@oxyhq/core 5.4.3 → 6.0.0

package/dist/types/HttpService.d.ts

@@ -26,6 +26,19 @@ export interface RequestOptions {
     signal?: AbortSignal;
     headers?: Record<string, string>;
     responseType?: 'blob';
+    /**
+     * Skip BOTH the bearer auth header (and its near-expiry preflight refresh)
+     * AND the 401-driven auto-refresh/retry for this request.
+     *
+     * Required for the body-authenticated refresh endpoint (`POST
+     * /auth/refresh-token`): it does not need a bearer, and — critically — it is
+     * itself invoked from inside the registered `AuthRefreshHandler`. If it went
+     * through the normal preflight, `getAuthHeader` would call
+     * `refreshAccessToken` while the handler-owning `tokenRefreshPromise` is
+     * still in flight and await ITSELF (deadlock). Skipping auth makes the
+     * refresh call fully independent of the current (near-expired) bearer.
+     */
+    skipAuth?: boolean;
 }
 interface RequestConfig extends RequestOptions {
     method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';

package/dist/types/OxyServices.base.d.ts

@@ -25,20 +25,6 @@ export declare class OxyServicesBase {
      * Get the configured Oxy API base URL
      */
     getBaseURL(): string;
-    /**
-     * Get the base URL the SDK's first-party session/refresh calls should target.
-     *
-     * Returns the configured `sessionBaseUrl` when provided, otherwise falls back
-     * to the API `baseURL` (`getBaseURL()`). Per the 2026 session architecture
-     * (docs/SESSION-ARCHITECTURE.md), non-`oxy.so` apps point this at their own
-     * same-site backend (e.g. `https://api.mention.earth`) whose session bridge
-     * forwards the user's refresh credential to `api.oxy.so`; `*.oxy.so` apps
-     * leave it unset so it resolves to `https://api.oxy.so` and nothing changes.
-     *
-     * This is additive: it only exposes configuration for `@oxyhq/services` to
-     * consume in a later phase. No refresh/auth logic in core reads it yet.
-     */
-    getSessionBaseUrl(): string;
     /**
      * Get the HTTP service instance
      * Useful for advanced use cases where direct access to the HTTP service is needed
@@ -142,44 +128,6 @@ export declare class OxyServicesBase {
      * Get the raw access token (for constructing anchor URLs when needed)
      */
     getAccessToken(): string | null;
-    /**
-     * Register the CURRENTLY-ACTIVE session in the device's first-party
-     * multi-account refresh-cookie set by calling `POST /auth/session`.
-     *
-     * This is the single, shared primitive every web primary-session commit and the
-     * account switch use to plant their `oxy_rt_<authuser>` slot. It MUST be a
-     * dedicated call to `/auth/session` rather than relying on whichever endpoint
-     * established the session: that endpoint is frequently OUTSIDE the cookie's
-     * `Path=/auth` scope (`/accounts/:id/switch`) or is a cross-origin/credential-
-     * less restore (`/sso/exchange`, the IdP `/auth/silent` postMessage) that cannot
-     * set an `api.oxy.so` cookie at all. `/auth/session` runs where the device's
-     * existing slots ARE visible, so the server resolves this user's slot (reusing an
-     * existing one or allocating a new one) without clobbering a sibling account,
-     * mints a fresh access token bound to the same session, and returns the resolved
-     * `authuser`.
-     *
-     * Behaviour:
-     * - Requires a planted bearer (the caller must have already installed the
-     *   session's access token); `/auth/session` derives the session from it.
-     * - On success re-plants the rotated access token (so the active token matches
-     *   the freshly-rotated cookie) and returns the device `authuser` slot.
-     * - WEB-ONLY: on native there are no first-party refresh cookies → returns
-     *   `null`.
-     * - FIRST-PARTY-ONLY: the cookie is host-only on the API host with
-     *   `SameSite=Lax`, so it only sticks when the page is SAME-SITE (same
-     *   registrable apex) as the API. On a cross-apex RP (`mention.earth` calling
-     *   `api.oxy.so`) the browser rejects the `Set-Cookie` as a third-party cookie,
-     *   so a returned slot would be a phantom never enumerated by `refresh-all`.
-     *   Those RPs durably restore via the per-apex `/auth/silent` iframe + `/sso`
-     *   bounce, NOT this device set → returns `null` without calling the API.
-     * - BEST-EFFORT: a failure (e.g. transient network) never throws — the session
-     *   stays active in-memory; only its reload durability via the device set is at
-     *   risk. The caller treats `null` as "not registered in the device set".
-     *
-     * @returns The resolved device `authuser` slot, or `null` on native / cross-apex
-     *   / failure.
-     */
-    establishDeviceRefreshSlot(): Promise<number | null>;
     /**
      * Decode the current access token and return its `exp` claim in SECONDS since
      * the Unix epoch (the raw JWT `exp` unit), or `null` when there is no token,

package/dist/types/OxyServices.d.ts

@@ -58,10 +58,6 @@
  */
 import { type LinkedHttpClient, type OxyConfig } from './OxyServices.base';
 import { OxyAuthenticationError, OxyAuthenticationTimeoutError } from './OxyServices.errors';
-import type { SessionLoginResponse } from './models/session';
-import type { FedCMAuthOptions, FedCMConfig } from './mixins/OxyServices.fedcm';
-import type { SilentAuthOptions } from './mixins/OxyServices.silent';
-import type { RedirectAuthOptions } from './mixins/OxyServices.redirect';
 import { composeOxyServices } from './mixins';
 /**
  * OxyServices - Unified client library for interacting with the Oxy API
@@ -100,31 +96,10 @@ import { composeOxyServices } from './mixins';
  */
 declare const OxyServicesComposed: import("./mixins").ComposedOxyServicesConstructor;
 export declare class OxyServices extends OxyServicesComposed {
-    /**
-     * FedCM credential-request timeouts (ms). The runtime values are defined on
-     * the FedCM mixin and inherited here via `extends`; these `declare` members
-     * surface their types to TypeScript without re-emitting (or duplicating) the
-     * literals, so consumers/tests can reference `OxyServices.FEDCM_SILENT_TIMEOUT`
-     * with full typing.
-     */
-    static readonly FEDCM_TIMEOUT: number;
-    static readonly FEDCM_SILENT_TIMEOUT: number;
     constructor(config: OxyConfig);
 }
 export interface OxyServices extends InstanceType<ReturnType<typeof composeOxyServices>> {
     createLinkedClient(config: OxyConfig): LinkedHttpClient;
-    isFedCMSupported(): boolean;
-    signInWithFedCM(options?: FedCMAuthOptions): Promise<SessionLoginResponse>;
-    silentSignInWithFedCM(): Promise<SessionLoginResponse | null>;
-    revokeFedCMCredential(): Promise<void>;
-    getFedCMConfig(): FedCMConfig;
-    resolveAuthUrl(): string;
-    silentSignIn(options?: SilentAuthOptions): Promise<SessionLoginResponse | null>;
-    waitForIframeAuth(iframe: HTMLIFrameElement, timeout: number, expectedOrigin: string): Promise<SessionLoginResponse | null>;
-    signInWithRedirect(options?: RedirectAuthOptions): void;
-    signUpWithRedirect(options?: RedirectAuthOptions): void;
-    exchangeSsoCode(code: string, state?: string): Promise<SessionLoginResponse>;
-    generateSsoState(): string;
     auth(options?: {
         debug?: boolean;
         onError?: (error: unknown) => unknown;

package/dist/types/boot/coldBootV2.d.ts

@@ -0,0 +1,76 @@
+import { type ColdBootOutcome } from '../utils/coldBoot';
+import type { OxyServices } from '../OxyServices';
+import type { AuthStateStore } from '../session/authStateStore';
+import { type DeviceBootSession } from './deviceBootReturn';
+/**
+ * localStorage flag marking that the cross-apex bootstrap navigation has fired
+ * once for this origin. Persistent (not session) so the visible redirect
+ * happens AT MOST ONCE EVER per browser+origin — a signed-out user is never
+ * bounced again; they sign in explicitly.
+ */
+export declare const BOOT_ATTEMPTED_KEY = "oxy.boot.attempted";
+/** Why a cold boot ended without a session. */
+export type SignedOutReason = 'no_session' | 'new_device' | 'state-mismatch' | 'error';
+/**
+ * The DOM/storage seam. All access is injected so the boot is unit-testable
+ * under the jest `node` environment; {@link createBrowserColdBootDom} provides
+ * the guarded real-globals implementation used in production.
+ */
+export interface ColdBootDom {
+    getHash(): string;
+    stripFragment(): void;
+    getSessionItem(key: string): string | null;
+    setSessionItem(key: string, value: string): void;
+    removeSessionItem(key: string): void;
+    getLocalItem(key: string): string | null;
+    setLocalItem(key: string, value: string): void;
+    getLocationHostname(): string | null;
+    /** Current href WITHOUT its hash fragment (the bootstrap `return_to`). */
+    getReturnToHref(): string | null;
+    navigate(url: string): void;
+    /** A fresh high-entropy CSRF state token. */
+    randomState(): string;
+}
+export interface RunSessionColdBootOptions {
+    oxy: OxyServices;
+    store: AuthStateStore;
+    /** Platform hints; default derived from `@oxyhq/core`'s platform detection. */
+    platform?: {
+        isWeb?: boolean;
+        isNative?: boolean;
+    };
+    /**
+     * The RP return URL for the cross-apex hop. Defaults to the current href
+     * (sans fragment) via the DOM seam.
+     */
+    returnTo?: string;
+    /** Invoked with the winning session (token already planted). */
+    onSession?: (session: DeviceBootSession & {
+        via: string;
+    }) => void | Promise<void>;
+    /** Invoked when the boot ended signed out (not while navigating away). */
+    onSignedOut?: (reason: SignedOutReason) => void | Promise<void>;
+    onStepError?: (id: string, error: unknown) => void;
+    /** DOM/storage seam; defaults to the guarded browser implementation. */
+    dom?: ColdBootDom;
+}
+/**
+ * The guarded real-globals {@link ColdBootDom}. Every accessor tolerates a
+ * missing/throwing global (SSR, sandboxed iframe) by returning a neutral value
+ * or no-op, so the boot degrades to signed-out rather than crashing.
+ */
+export declare function createBrowserColdBootDom(): ColdBootDom;
+/**
+ * True when both hosts are same-site / same-apex. For a normal multi-label host
+ * pair, that means sharing a registrable domain. For an IP literal or a
+ * single-label host (no registrable domain), same-apex requires the two hosts
+ * to be EXACTLY equal — never grouped by a spurious trailing-label match.
+ */
+export declare function isSameApex(pageHost: string, apiHost: string): boolean;
+/**
+ * Run the device-first cold boot. Resolves to the `runColdBoot` outcome and, as
+ * a side effect, invokes `onSession` (winning session, token already planted)
+ * or `onSignedOut` (no session — unless the boot is navigating away for the
+ * cross-apex hop, in which case neither fires).
+ */
+export declare function runSessionColdBoot(opts: RunSessionColdBootOptions): Promise<ColdBootOutcome<DeviceBootSession>>;

package/dist/types/boot/deviceBootReturn.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Device-boot return-fragment consumption (web cross-apex hop).
+ *
+ * After the top-level `GET /auth/device/bootstrap` hop, the API 303s back to the
+ * RP with a `#oxy_boot=<base64url(JSON)>` fragment. This module parses and
+ * consumes it: it strips the fragment from the URL FIRST (so the opaque
+ * deviceToken / code never linger in history or a `Referer`), verifies the
+ * echoed CSRF `state` against the value the initiator stashed in
+ * `sessionStorage`, persists the deviceToken, and — when a session resolved —
+ * exchanges the single-use `code` for a token bundle.
+ *
+ * Pure/injectable: all DOM access (hash, `history.replaceState`,
+ * `sessionStorage`) is passed in as callbacks so the logic is unit-testable
+ * under the jest `node` environment and reusable by `coldBootV2`.
+ *
+ * ESM-safe (no `require()`).
+ */
+import { type AuthTokenBundle, type DeviceBootFragment, type DeviceBootReason } from '@oxyhq/contracts';
+import type { AuthStateStore } from '../session/authStateStore';
+/** The `#oxy_boot=` fragment parameter name the API appends on the return hop. */
+export declare const BOOT_FRAGMENT_PARAM = "oxy_boot";
+/**
+ * `sessionStorage` key under which the bootstrap-hop initiator stashes the
+ * 128-bit CSRF `state` before navigating, and which the return step reads back
+ * (single-use).
+ */
+export declare const BOOT_STATE_SESSION_KEY = "oxy.boot.state";
+/** True when a location hash carries the `oxy_boot` return fragment. */
+export declare function hashHasBootFragment(hash: string): boolean;
+/**
+ * Extract + decode + validate the `oxy_boot` fragment from a location hash.
+ * Returns the parsed {@link DeviceBootFragment}, or `null` when the parameter
+ * is absent, not valid base64url, not JSON, or fails the contract schema.
+ */
+export declare function parseDeviceBootFragment(hash: string): DeviceBootFragment | null;
+/** The winning session shape a cold-boot step reports. */
+export interface DeviceBootSession {
+    sessionId: string;
+    userId: string;
+    accessToken: string;
+}
+/** Outcome of {@link consumeDeviceBootReturn}. */
+export type DeviceBootReturnOutcome = {
+    kind: 'none';
+} | {
+    kind: 'state-mismatch';
+} | {
+    kind: 'session';
+    session: DeviceBootSession;
+} | {
+    kind: 'no-session';
+    reason: DeviceBootReason;
+};
+export interface ConsumeDeviceBootReturnDeps {
+    /** The current location hash (e.g. `window.location.hash`). */
+    hash: string;
+    /** Strip the fragment from the URL (e.g. `history.replaceState`). */
+    stripFragment: () => void;
+    /** Read the expected CSRF state (e.g. `sessionStorage.getItem(BOOT_STATE_SESSION_KEY)`). */
+    readExpectedState: () => string | null;
+    /** Clear the expected CSRF state (single-use). */
+    clearExpectedState: () => void;
+    store: AuthStateStore;
+    /** Exchange the single-use boot code for a token bundle (`oxy.exchangeBootCode`). */
+    exchangeBootCode: (code: string) => Promise<AuthTokenBundle>;
+    /** Plant the freshly-minted access token on the owner client (`oxy.setTokens`). */
+    plantAccessToken: (accessToken: string) => void;
+}
+/**
+ * Consume the device-boot return fragment.
+ *
+ * Order is load-bearing:
+ *   1. If no fragment is present, return `none` (no URL mutation).
+ *   2. STRIP the fragment from the URL immediately — before validation or any
+ *      network — so the deviceToken/code never persist in history/referrer.
+ *   3. Verify the echoed `state` against the stashed (single-use) value; a
+ *      mismatch returns `state-mismatch` without persisting or exchanging.
+ *   4. Persist the deviceToken (survives sign-out).
+ *   5. If a session resolved (`reason:'session'` + `code`), exchange the code,
+ *      persist the rotated session, plant the token, and return `session`.
+ *      Otherwise return `no-session` with the reason.
+ */
+export declare function consumeDeviceBootReturn(deps: ConsumeDeviceBootReturnDeps): Promise<DeviceBootReturnOutcome>;

package/dist/types/crypto/keyManager.d.ts

@@ -157,6 +157,27 @@ export declare class KeyManager {
      * @returns True if migration was successful, false if no local identity exists
      */
     static migrateToSharedIdentity(): Promise<boolean>;
+    /**
+     * Store the opaque device-attribution token in the SHARED keychain so every
+     * Oxy app on this device reads the SAME token and therefore resolves to one
+     * server-side DeviceSession.
+     *
+     * Mirrors the shared-session storage options exactly (iOS keychain access
+     * group `group.so.oxy.shared`; Android shared secure store). Native-only —
+     * a no-op on web (the shared keychain does not exist there; web persists its
+     * deviceToken in the per-origin {@link AuthStateStore} instead).
+     */
+    static setSharedDeviceToken(deviceToken: string): Promise<void>;
+    /**
+     * Read the shared device-attribution token, or `null` when none is set (or
+     * on web). Mirrors {@link getSharedSession}'s keychain-access-group read.
+     */
+    static getSharedDeviceToken(): Promise<string | null>;
+    /**
+     * Delete the shared device-attribution token (device signout-all). Best-effort:
+     * a keychain failure is logged, not thrown, so it cannot block a sign-out.
+     */
+    static clearSharedDeviceToken(): Promise<void>;
     /**
      * Atomically persist a key pair to secure storage with verification + backup.
      *

package/dist/types/index.d.ts

@@ -21,14 +21,7 @@ export { OxyServices, OxyAuthenticationError, OxyAuthenticationTimeoutError } fr
 export { OXY_CLOUD_URL, oxyClient } from './OxyServices';
 export type { LinkedHttpClient } from './OxyServices.base';
 export type { AuthRefreshReason, AuthRefreshHandler } from './HttpService';
-export { AuthManager, createAuthManager } from './AuthManager';
-export type { StorageAdapter, AuthStateChangeCallback, AuthMethod, AuthManagerConfig, } from './AuthManager';
-export type { AuthManagerAccount, RestoreFromCookiesResult, RestoreFromCookiesOptions, SwitchAuthuserResult, } from './AuthManagerTypes';
-export { CrossDomainAuth, createCrossDomainAuth } from './CrossDomainAuth';
-export type { CrossDomainAuthOptions } from './CrossDomainAuth';
-export type { FedCMAuthOptions, FedCMConfig, AuthorizedApp } from './mixins/OxyServices.fedcm';
-export type { SilentAuthOptions } from './mixins/OxyServices.silent';
-export type { RedirectAuthOptions } from './mixins/OxyServices.redirect';
+export type { AuthorizedApp } from './mixins/OxyServices.authorizedApps';
 export { ServiceCredentialMismatchError } from './mixins/OxyServices.auth';
 export type { ServiceTokenResponse } from './mixins/OxyServices.auth';
 export type { CommonsSignInHandle, CommonsSignInStatus, CommonsApprovalInfo, CommonsSignInActionResult, } from './mixins/OxyServices.auth';
@@ -53,7 +46,6 @@ export { SessionSyncRequiredError, AuthenticationFailedError, ensureValidToken,
 export type { HandleApiErrorOptions } from './utils/authHelpers';
 export { mergeSessions, normalizeAndSortSessions, sessionsArraysEqual, } from './utils/sessionUtils';
 export type { ClientSession, StorageKeys, MinimalUserData, SessionLoginResponse, } from './models/session';
-export type { RefreshAllResponse, RefreshAllAccount, RefreshAllAccountUser, RefreshCookieResponse, } from './models/interfaces';
 export { KeyManager, IdentityAlreadyExistsError, IdentityPersistError, } from './crypto/keyManager';
 export type { KeyPair } from './crypto/keyManager';
 export { SignatureService } from './crypto/signatureService';
@@ -68,7 +60,7 @@ export { TopicType, TopicSource } from './models/Topic';
 export type { TopicData, TopicTranslation } from './models/Topic';
 export { SUPPORTED_LANGUAGES, getLanguageMetadata, getLanguageName, getNativeLanguageName, normalizeLanguageCode, isRTLLocale, } from './utils/languageUtils';
 export type { LanguageMetadata } from './utils/languageUtils';
-export { getPlatformOS, setPlatformOS, isWeb, isNative, isIOS, isAndroid, } from './utils/platform';
+export { getPlatformOS, setPlatformOS, isWeb, isNative, isIOS, isAndroid, isWebBrowser, } from './utils/platform';
 export type { PlatformOS } from './utils/platform';
 export { darkenColor, lightenColor, hexToRgb, rgbToHex, withOpacity, isLightColor, getContrastTextColor, } from './shared/utils/colorUtils';
 export { normalizeTheme, normalizeColorScheme, getOppositeTheme, systemPrefersDarkMode, getSystemColorScheme, } from './shared/utils/themeUtils';
@@ -82,28 +74,31 @@ export { buildSearchParams, buildUrl, buildPaginationParams, safeJsonParse, } fr
 export type { PaginationParams, ApiResponse, ErrorResponse, } from './utils/apiUtils';
 export { ErrorCodes, createApiError, handleHttpError, validateRequiredFields, } from './utils/errorUtils';
 export { retryAsync } from './utils/asyncUtils';
-export { EMAIL_REGEX, USERNAME_REGEX, PASSWORD_REGEX, isValidEmail, isValidUsername, isValidPassword, isRequiredString, isRequiredNumber, isRequiredBoolean, isValidArray, isValidObject, isValidUUID, isValidURL, isValidDate, isValidFileSize, isValidFileType, sanitizeString, sanitizeHTML, isValidObjectId, validateAndSanitizeUserInput, } from './utils/validationUtils';
+export { EMAIL_REGEX, USERNAME_REGEX, PASSWORD_REGEX, isValidEmail, isValidUsername, isValidPassword, isValidDisplayName, isRequiredString, isRequiredNumber, isRequiredBoolean, isValidArray, isValidObject, isValidUUID, isValidURL, isValidDate, isValidFileSize, isValidFileType, sanitizeString, sanitizeHTML, isValidObjectId, validateAndSanitizeUserInput, } from './utils/validationUtils';
 export { logger, LogLevel, logAuth, logApi, logSession, logUser, logDevice, logPayment, logPerformance, } from './utils/loggerUtils';
 export type { LogContext } from './utils/loggerUtils';
 export { updateAvatarVisibility } from './utils/avatarUtils';
-export { buildAccountsArray, createQuickAccount, getAccountDisplayName, getAccountFallbackHandle, formatPublicKeyHandle, mergeAccountsFromRefreshAll, getAccountColor, } from './utils/accountUtils';
+export { buildAccountsArray, createQuickAccount, getAccountDisplayName, getAccountFallbackHandle, formatPublicKeyHandle, getAccountColor, } from './utils/accountUtils';
 export type { QuickAccount, DisplayNameUserShape } from './utils/accountUtils';
-export { autoDetectAuthWebUrl, registrableApex } from './utils/fapiAutoDetect';
-export { CENTRAL_AUTH_URL, CENTRAL_IDP_APEX, resolveCentralAuthUrl } from './utils/authWebUrl';
-export { parseSsoReturnFragment, consumeSsoReturn } from './utils/ssoReturn';
-export type { SsoReturnKind, SsoReturnResult, ConsumeSsoReturnDeps } from './utils/ssoReturn';
-export { generateSsoState } from './mixins/OxyServices.sso';
-export { establishIdpSessionAfterClaim } from './utils/ssoEstablish';
-export type { SsoEstablishClient, EstablishAfterClaimDeps } from './utils/ssoEstablish';
-export { SSO_CALLBACK_PATH, SSO_GUARD_TTL_MS, ssoStateKey, ssoGuardKey, ssoDestKey, ssoNoSessionKey, ssoAttemptedKey, ssoPriorSessionKey, ssoSignedOutKey, ssoCallbackBootstrapKey, ssoNavigate, getSsoCallbackBootstrapScript, buildSsoBounceUrl, isCentralIdPOrigin, guardActive, silentRestoreSuppressed, allowSsoBounce, } from './utils/ssoBounce';
-export type { SsoBounceGate } from './utils/ssoBounce';
+export { registrableApex } from './utils/fapiAutoDetect';
+export { CENTRAL_AUTH_URL, CENTRAL_IDP_APEX } from './utils/authWebUrl';
+export { SSO_CALLBACK_PATH } from './utils/ssoBounce';
 export { runColdBoot } from './utils/coldBoot';
 export type { ColdBootStep, ColdBootStepResult, ColdBootSession, ColdBootSkip, ColdBootOutcome, RunColdBootOptions, } from './utils/coldBoot';
 export { SessionClient } from './session/SessionClient';
 export type { TokenTransport, SessionClientHost, SessionClientOptions } from './session/SessionClient';
+export type { SocketIOFactory, MinimalSocket } from './session/socketLoader';
 export { createSessionClientHost } from './session/sessionClientHost';
 export { createSessionClient } from './session/createSessionClient';
 export { deviceStateToClientSessions, activeSessionIdOf, activeUserOf, accountIdsOf, } from './session/projectSessionState';
+export { createWebAuthStateStore, createNativeAuthStateStore, createMemoryAuthStateStore, AUTH_STATE_STORAGE_KEY, DEVICE_TOKEN_STORAGE_KEY, } from './session/authStateStore';
+export type { PersistedAuthState, AuthStateStore, NativeKeyValueStorage, } from './session/authStateStore';
+export { refreshPersistedSession, createAuthRefreshHandler, installAuthRefreshHandler, startTokenRefreshScheduler, TOKEN_REFRESH_LEAD_MS, } from './session/refresh';
+export type { RefreshDeps, TokenRefreshSchedulerHandle } from './session/refresh';
+export { runSessionColdBoot, createBrowserColdBootDom, isSameApex, BOOT_ATTEMPTED_KEY, } from './boot/coldBootV2';
+export type { RunSessionColdBootOptions, ColdBootDom, SignedOutReason, } from './boot/coldBootV2';
+export { consumeDeviceBootReturn, parseDeviceBootFragment, hashHasBootFragment, BOOT_FRAGMENT_PARAM, BOOT_STATE_SESSION_KEY, } from './boot/deviceBootReturn';
+export type { DeviceBootSession, DeviceBootReturnOutcome, ConsumeDeviceBootReturnDeps, } from './boot/deviceBootReturn';
 export { packageInfo } from './constants/version';
 import { OxyServices } from './OxyServices';
 export default OxyServices;

package/dist/types/mixins/OxyServices.accounts.d.ts

@@ -655,7 +655,6 @@ export declare function OxyServicesAccountsMixin<T extends typeof OxyServicesBas
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -684,7 +683,6 @@ export declare function OxyServicesAccountsMixin<T extends typeof OxyServicesBas
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.analytics.d.ts

@@ -25,7 +25,6 @@ export declare function OxyServicesAnalyticsMixin<T extends typeof OxyServicesBa
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -54,7 +53,6 @@ export declare function OxyServicesAnalyticsMixin<T extends typeof OxyServicesBa
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.appData.d.ts

@@ -61,7 +61,6 @@ export declare function OxyServicesAppDataMixin<T extends typeof OxyServicesBase
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -90,7 +89,6 @@ export declare function OxyServicesAppDataMixin<T extends typeof OxyServicesBase
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.assets.d.ts

@@ -180,7 +180,6 @@ export declare function OxyServicesAssetsMixin<T extends typeof OxyServicesBase>
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -209,7 +208,6 @@ export declare function OxyServicesAssetsMixin<T extends typeof OxyServicesBase>
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.auth.d.ts

@@ -3,7 +3,8 @@
  *
  * Supports password-based login (email/username) and public key challenge-response.
  */
-import type { User, RefreshAllResponse, RefreshCookieResponse } from '../models/interfaces';
+import type { User } from '../models/interfaces';
+import type { LoginResult, LoginSessionResult } from '@oxyhq/contracts';
 import type { SessionLoginResponse } from '../models/session';
 import type { OxyServicesBase } from '../OxyServices.base';
 import type { PublicApplication } from './OxyServices.connectedApps';
@@ -11,25 +12,6 @@ export interface ChallengeResponse {
     challenge: string;
     expiresAt: string;
 }
-/**
- * Options for {@link refreshAllSessions}.
- */
-export interface RefreshAllOptions {
-    /**
-     * Abort the `POST /auth/refresh-all` request after this many milliseconds and
-     * resolve as "no signed-in accounts" (`{ accounts: [] }`) rather than hanging.
-     *
-     * Why: on a cross-domain RP (e.g. `mention.earth`) the `Domain=oxy.so` refresh
-     * cookie never reaches `api.<apex>`, so this request can stall behind a slow
-     * or unreachable endpoint with no useful answer coming back. As one step of
-     * the ordered cold-boot sequence, a stalled refresh is dead latency in front
-     * of the steps that actually hold the answer. A bounded abort lets cold boot
-     * fall through quickly. Omit (or pass `0`/negative) to wait indefinitely.
-     * The abort is treated identically to a 401 — the
-     * "not signed in on this device" path — never an error.
-     */
-    timeout?: number;
-}
 export interface RegistrationRequest {
     publicKey: string;
     username: string;
@@ -419,61 +401,6 @@ export declare function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(B
          * @param authorizeCode - The public code being denied.
          */
         denyCommonsSignIn(authorizeCode: string): Promise<CommonsSignInActionResult>;
-        /**
-         * Refresh every device-local refresh-cookie slot in a single round trip
-         * (Google-style multi-account rebuild).
-         *
-         * Calls `POST {sessionBaseUrl}/auth/refresh-all` with `credentials: 'include'`
-         * and NO bearer. The browser attaches every indexed `oxy_rt_${authuser}`
-         * cookie it has; the server rotates each in parallel and returns one entry
-         * per VALID account.
-         *
-         * Failure handling:
-         * - 401 → no signed-in accounts on this device → returns `{ accounts: [] }`
-         *   (NOT an error; this is the cold-boot "not signed in" path).
-         * - 404 → endpoint not deployed → returns `{ accounts: [] }`.
-         * - Any other non-2xx → throws via `handleError`.
-         *
-         * The refresh cookie itself never enters JS — only the rotated access
-         * tokens do. Each access token still needs to be planted via
-         * `setTokens(...)` (or per-account in-memory storage) at the consumer.
-         */
-        refreshAllSessions(options?: RefreshAllOptions): Promise<RefreshAllResponse>;
-        /**
-         * Rotate a single refresh-cookie slot and return the fresh access token.
-         *
-         * When `authuser` is provided, the server rotates ONLY that slot
-         * (`oxy_rt_${authuser}`) — sibling accounts on the same device stay
-         * untouched. When omitted, the server picks the lowest indexed slot present.
-         * The refresh cookie itself never enters JS.
-         *
-         * Returns `null` on 401 (no cookie / expired / reused) so the caller can
-         * fall through cleanly to the unauthenticated path.
-         */
-        refreshTokenViaCookie(opts?: {
-            authuser?: number;
-        }): Promise<RefreshCookieResponse | null>;
-        /**
-         * Sign out a single device-local account by its authuser slot index.
-         *
-         * Revokes that slot's refresh-token family and deactivates its session;
-         * sibling indexed slots stay signed in. The browser-side `oxy_rt_${n}`
-         * cookie is cleared by the server's `Set-Cookie` response header.
-         */
-        logoutSessionByAuthuser(authuser: number): Promise<void>;
-        /**
-         * Sign out EVERY device-local account on this device by clearing every
-         * presented refresh-cookie slot at once. Revokes every family + clears
-         * every slot. Always succeeds (idempotent on unknown/garbage tokens).
-         */
-        logoutAllSessionsViaCookie(): Promise<void>;
-        /**
-         * Internal: raw `POST /auth/refresh[?authuser=N]` call returning the
-         * minted access token. Returns `null` on 401 / non-2xx.
-         *
-         * @internal
-         */
-        _refreshCookieRaw(authuser?: number): Promise<RefreshCookieResponse | null>;
         /**
          * Internal: decode (without verifying) the `sessionId` claim from a
          * server-signed access token. The server already verified the signature;
@@ -534,13 +461,45 @@ export declare function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(B
          * Convenience helper for email sign-in
          */
         signInWithEmail(email: string, password: string, deviceName?: string, deviceFingerprint?: any): Promise<SessionLoginResponse>;
+        /**
+         * Device-first password sign-in. Unlike the legacy {@link signIn} (which
+         * assumes a one-step session and is kept intact for existing callers until
+         * the F4 cutover), this returns the FULL `POST /auth/login` contract — the
+         * discriminated {@link LoginResult}: either a 2FA challenge
+         * (`{ twoFactorRequired, loginToken }`) to complete via
+         * {@link completeTwoFactorSignIn}, or a session arm.
+         *
+         * `options.deviceToken` attributes the new session to the caller's existing
+         * device set (so an in-app login from a cross-apex, cookie-less web app
+         * still joins the same DeviceSession). On the session arm, a returned access
+         * token is planted immediately (mirroring {@link verifyChallenge}), so the
+         * caller has an authenticated client without a second round-trip.
+         */
+        passwordSignIn(identifier: string, password: string, options?: {
+            deviceToken?: string;
+            deviceName?: string;
+            deviceFingerprint?: string;
+        }): Promise<LoginResult>;
+        /**
+         * Complete a 2FA-gated sign-in started by {@link passwordSignIn}. Presents
+         * the short-lived `loginToken` with either a TOTP `token` or a `backupCode`
+         * to `POST /security/2fa/verify-login`, which must resolve to the session
+         * arm of {@link LoginResult} (a second 2FA challenge here is a protocol
+         * error). A returned access token is planted immediately.
+         */
+        completeTwoFactorSignIn(params: {
+            loginToken: string;
+            token?: string;
+            backupCode?: string;
+            deviceToken?: string;
+            deviceName?: string;
+        }): Promise<LoginSessionResult>;
         httpService: import("../HttpService").HttpService;
         cloudURL: string;
         config: import("../OxyServices.base").OxyConfig;
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -569,7 +528,6 @@ export declare function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(B
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {