@oxyhq/core 5.5.0 → 6.0.0

package/src/crypto/keyManager.ts

@@ -91,6 +91,11 @@ const STORAGE_KEYS = {
   SHARED_PUBLIC_KEY: 'oxy_shared_identity_public_key',
   SHARED_SESSION_TOKEN: 'oxy_shared_session_token',
   SHARED_SESSION_ID: 'oxy_shared_session_id',
+  // Opaque device-attribution token, shared across all Oxy apps on one device
+  // so they all resolve to a SINGLE server-side DeviceSession (device-first
+  // session model). Add-only: it never carries session state, only attributes
+  // a newly-credentialed session to the shared device set.
+  SHARED_DEVICE_TOKEN: 'oxy_shared_device_token',
 } as const;
 
 /**
@@ -643,6 +648,102 @@ export class KeyManager {
     }
   }
 
+  /**
+   * Store the opaque device-attribution token in the SHARED keychain so every
+   * Oxy app on this device reads the SAME token and therefore resolves to one
+   * server-side DeviceSession.
+   *
+   * Mirrors the shared-session storage options exactly (iOS keychain access
+   * group `group.so.oxy.shared`; Android shared secure store). Native-only —
+   * a no-op on web (the shared keychain does not exist there; web persists its
+   * deviceToken in the per-origin {@link AuthStateStore} instead).
+   */
+  static async setSharedDeviceToken(deviceToken: string): Promise<void> {
+    if (isWebPlatform()) {
+      return; // Not supported on web
+    }
+
+    try {
+      const store = await initSecureStore();
+
+      if (isIOS()) {
+        const opts: OxySecureStoreOptions = {
+          keychainAccessible: store.WHEN_UNLOCKED,
+          keychainAccessGroup: IOS_KEYCHAIN_GROUP,
+        };
+        await store.setItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN, deviceToken, opts);
+      } else if (isAndroid()) {
+        await store.setItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN, deviceToken);
+      }
+
+      if (isDev()) {
+        logger.debug('Shared device token stored successfully', { component: 'KeyManager' });
+      }
+    } catch (error) {
+      if (isDev()) {
+        logger.error('Failed to store shared device token', error, { component: 'KeyManager' });
+      }
+      throw error;
+    }
+  }
+
+  /**
+   * Read the shared device-attribution token, or `null` when none is set (or
+   * on web). Mirrors {@link getSharedSession}'s keychain-access-group read.
+   */
+  static async getSharedDeviceToken(): Promise<string | null> {
+    if (isWebPlatform()) {
+      return null;
+    }
+
+    try {
+      const store = await initSecureStore();
+
+      if (isIOS()) {
+        const opts: OxySecureStoreOptions = { keychainAccessGroup: IOS_KEYCHAIN_GROUP };
+        return await store.getItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN, opts);
+      }
+      if (isAndroid()) {
+        return await store.getItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN);
+      }
+      return null;
+    } catch (error) {
+      if (isDev()) {
+        logger.warn('Failed to get shared device token', { component: 'KeyManager' }, error);
+      }
+      return null;
+    }
+  }
+
+  /**
+   * Delete the shared device-attribution token (device signout-all). Best-effort:
+   * a keychain failure is logged, not thrown, so it cannot block a sign-out.
+   */
+  static async clearSharedDeviceToken(): Promise<void> {
+    if (isWebPlatform()) {
+      return;
+    }
+
+    try {
+      const store = await initSecureStore();
+
+      if (isIOS()) {
+        const opts: OxySecureStoreOptions = { keychainAccessGroup: IOS_KEYCHAIN_GROUP };
+        await store.deleteItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN, opts);
+      } else if (isAndroid()) {
+        await store.deleteItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN);
+      }
+
+      if (isDev()) {
+        logger.debug('Shared device token cleared successfully', { component: 'KeyManager' });
+      }
+    } catch (error) {
+      if (isDev()) {
+        logger.error('Failed to clear shared device token', error, { component: 'KeyManager' });
+      }
+    }
+  }
+
   // ==================== END SHARED IDENTITY METHODS ====================
 
   /**

package/src/i18n/locales/en-US.json

@@ -2,6 +2,13 @@
   "signin": {
     "title": "Sign In",
     "subtitle": "Sign in to continue your journey",
+    "chooser": {
+      "title": "Choose an account",
+      "subtitle": "Continue as an account below, or use another.",
+      "signedIn": "Signed in",
+      "useAnother": "Use another account",
+      "continueAs": "Continue as {{name}}"
+    },
     "addAccountTitle": "Add Another Account",
     "addAccountSubtitle": "Sign in with another account",
     "username": {
@@ -602,6 +609,7 @@
   "editProfile": {
     "title": "Edit Profile",
     "subtitle": "Manage your profile and preferences",
+    "notSet": "Not set",
     "sections": {
       "profilePicture": "Profile Picture",
       "basicInfo": "Basic Information",
@@ -610,6 +618,9 @@
       "security": "Security"
     },
     "items": {
+      "avatar": {
+        "subtitle": "Update your profile photo"
+      },
       "displayName": {
         "title": "Display Name",
         "subtitle": "This is how your name will appear to others",
@@ -617,7 +628,8 @@
         "firstName": "First Name",
         "firstNamePlaceholder": "Enter first name",
         "lastName": "Last Name",
-        "lastNamePlaceholder": "Enter last name (optional)"
+        "lastNamePlaceholder": "Enter last name (optional)",
+        "invalidChars": "Use letters and spaces only"
       },
       "username": {
         "title": "Username",

package/src/i18n/locales/es-ES.json

@@ -2,6 +2,13 @@
   "signin": {
     "title": "Iniciar sesión",
     "subtitle": "Inicia sesión para continuar",
+    "chooser": {
+      "title": "Elige una cuenta",
+      "subtitle": "Continúa con una de tus cuentas o usa otra.",
+      "signedIn": "Sesión activa",
+      "useAnother": "Usar otra cuenta",
+      "continueAs": "Continuar como {{name}}"
+    },
     "addAccountTitle": "Agregar otra cuenta",
     "addAccountSubtitle": "Inicia sesión con otra cuenta",
     "username": {
@@ -152,6 +159,7 @@
   "editProfile": {
     "title": "Editar perfil",
     "subtitle": "Gestiona tu perfil y preferencias",
+    "notSet": "Sin definir",
     "sections": {
       "profilePicture": "Foto de perfil",
       "basicInfo": "Información básica",
@@ -160,6 +168,9 @@
       "security": "Seguridad"
     },
     "items": {
+      "avatar": {
+        "subtitle": "Actualiza tu foto de perfil"
+      },
       "displayName": {
         "title": "Nombre para mostrar",
         "subtitle": "Así aparecerá tu nombre para los demás",
@@ -167,7 +178,8 @@
         "firstName": "Nombre",
         "firstNamePlaceholder": "Introduce tu nombre",
         "lastName": "Apellido",
-        "lastNamePlaceholder": "Introduce tu apellido (opcional)"
+        "lastNamePlaceholder": "Introduce tu apellido (opcional)",
+        "invalidChars": "Usa solo letras y espacios"
       },
       "username": {
         "title": "Usuario",

package/src/index.ts

@@ -34,25 +34,9 @@ export type { AuthRefreshReason, AuthRefreshHandler } from './HttpService';
 // ---------------------------------------------------------------------------
 // Authentication
 // ---------------------------------------------------------------------------
-export { AuthManager, createAuthManager } from './AuthManager';
-export type {
-    StorageAdapter,
-    AuthStateChangeCallback,
-    AuthMethod,
-    AuthManagerConfig,
-} from './AuthManager';
-export type {
-    AuthManagerAccount,
-    RestoreFromCookiesResult,
-    RestoreFromCookiesOptions,
-    SwitchAuthuserResult,
-} from './AuthManagerTypes';
-
-export { CrossDomainAuth, createCrossDomainAuth } from './CrossDomainAuth';
-export type { CrossDomainAuthOptions } from './CrossDomainAuth';
-export type { FedCMAuthOptions, FedCMConfig, AuthorizedApp } from './mixins/OxyServices.fedcm';
-export type { SilentAuthOptions } from './mixins/OxyServices.silent';
-export type { RedirectAuthOptions } from './mixins/OxyServices.redirect';
+// Legacy "Connected apps" management surface (list/revoke FedCM authorization
+// grants). The FedCM sign-in machinery was removed in the device-first cutover.
+export type { AuthorizedApp } from './mixins/OxyServices.authorizedApps';
 export { ServiceCredentialMismatchError } from './mixins/OxyServices.auth';
 export type { ServiceTokenResponse } from './mixins/OxyServices.auth';
 // "Sign in with Oxy" — handoff (Workstream C)
@@ -245,16 +229,6 @@ export type {
     SessionLoginResponse,
 } from './models/session';
 
-// ---------------------------------------------------------------------------
-// Multi-account refresh-all (Google-style)
-// ---------------------------------------------------------------------------
-export type {
-    RefreshAllResponse,
-    RefreshAllAccount,
-    RefreshAllAccountUser,
-    RefreshCookieResponse,
-} from './models/interfaces';
-
 // ---------------------------------------------------------------------------
 // Crypto / identity
 // ---------------------------------------------------------------------------
@@ -367,6 +341,7 @@ export {
     isNative,
     isIOS,
     isAndroid,
+    isWebBrowser,
 } from './utils/platform';
 export type { PlatformOS } from './utils/platform';
 
@@ -468,6 +443,7 @@ export {
     isValidEmail,
     isValidUsername,
     isValidPassword,
+    isValidDisplayName,
     isRequiredString,
     isRequiredNumber,
     isRequiredBoolean,
@@ -514,48 +490,23 @@ export {
     getAccountDisplayName,
     getAccountFallbackHandle,
     formatPublicKeyHandle,
-    mergeAccountsFromRefreshAll,
     getAccountColor,
 } from './utils/accountUtils';
 export type { QuickAccount, DisplayNameUserShape } from './utils/accountUtils';
 
 // ---------------------------------------------------------------------------
-// Cross-domain SSO infrastructure
+// Registrable-domain + central-IdP-apex helpers.
+//
+// The client SSO-bounce / silent-iframe / FedCM machinery was removed in the
+// device-first cutover. These three symbols survive because the api SSO surface
+// and the IdP (both lista B, gated on the ecosystem bump) still import them:
+// `registrableApex` (eTLD+1), `CENTRAL_IDP_APEX`, and the `SSO_CALLBACK_PATH`
+// constant. `@oxyhq/core/server` re-exports `registrableApex` + `SSO_CALLBACK_PATH`
+// for the api; the IdP imports all three from here.
 // ---------------------------------------------------------------------------
-export { autoDetectAuthWebUrl, registrableApex } from './utils/fapiAutoDetect';
-
-// Central cross-domain SSO (opaque single-use code bounce via auth.oxy.so)
-export { CENTRAL_AUTH_URL, CENTRAL_IDP_APEX, resolveCentralAuthUrl } from './utils/authWebUrl';
-export { parseSsoReturnFragment, consumeSsoReturn } from './utils/ssoReturn';
-export type { SsoReturnKind, SsoReturnResult, ConsumeSsoReturnDeps } from './utils/ssoReturn';
-export { generateSsoState } from './mixins/OxyServices.sso';
-
-// Post-claim durable-session establish hop (web device-flow / QR sign-in).
-export { establishIdpSessionAfterClaim } from './utils/ssoEstablish';
-export type { SsoEstablishClient, EstablishAfterClaimDeps } from './utils/ssoEstablish';
-
-// SSO bounce — per-origin sessionStorage keys, bounce URL builder, predicates
-export {
-    SSO_CALLBACK_PATH,
-    SSO_GUARD_TTL_MS,
-    ssoStateKey,
-    ssoGuardKey,
-    ssoDestKey,
-    ssoNoSessionKey,
-    ssoAttemptedKey,
-    ssoPriorSessionKey,
-    ssoSignedOutKey,
-    ssoOutcomeKey,
-    ssoCallbackBootstrapKey,
-    ssoNavigate,
-    getSsoCallbackBootstrapScript,
-    buildSsoBounceUrl,
-    isCentralIdPOrigin,
-    guardActive,
-    silentRestoreSuppressed,
-    allowSsoBounce,
-} from './utils/ssoBounce';
-export type { SsoBounceGate } from './utils/ssoBounce';
+export { registrableApex } from './utils/fapiAutoDetect';
+export { CENTRAL_AUTH_URL, CENTRAL_IDP_APEX } from './utils/authWebUrl';
+export { SSO_CALLBACK_PATH } from './utils/ssoBounce';
 
 export { runColdBoot } from './utils/coldBoot';
 export type {
@@ -591,6 +542,64 @@ export {
     accountIdsOf,
 } from './session/projectSessionState';
 
+// ---------------------------------------------------------------------------
+// Device-first session machinery (auth centralization, wave 1) — additive.
+// Persisted auth-state store, the unified refresh handler + scheduler, the
+// cold-boot v2 runner, and the device-boot return-fragment consumer. Built ON
+// the existing `runColdBoot` primitive + `SessionClient`; the legacy
+// FedCM/SSO/CrossDomainAuth surface is untouched (cutover happens in F4).
+// ---------------------------------------------------------------------------
+export {
+    createWebAuthStateStore,
+    createNativeAuthStateStore,
+    createMemoryAuthStateStore,
+    AUTH_STATE_STORAGE_KEY,
+    DEVICE_TOKEN_STORAGE_KEY,
+} from './session/authStateStore';
+export type {
+    PersistedAuthState,
+    AuthStateStore,
+    NativeKeyValueStorage,
+} from './session/authStateStore';
+
+export {
+    refreshPersistedSession,
+    createAuthRefreshHandler,
+    installAuthRefreshHandler,
+    startTokenRefreshScheduler,
+    TOKEN_REFRESH_LEAD_MS,
+} from './session/refresh';
+export type { RefreshDeps, TokenRefreshSchedulerHandle } from './session/refresh';
+
+export {
+    runSessionColdBoot,
+    createBrowserColdBootDom,
+    isSameApex,
+    BOOT_ATTEMPTED_KEY,
+} from './boot/coldBootV2';
+export type {
+    RunSessionColdBootOptions,
+    ColdBootDom,
+    SignedOutReason,
+} from './boot/coldBootV2';
+
+export {
+    consumeDeviceBootReturn,
+    parseDeviceBootFragment,
+    hashHasBootFragment,
+    BOOT_FRAGMENT_PARAM,
+    BOOT_STATE_SESSION_KEY,
+} from './boot/deviceBootReturn';
+export type {
+    DeviceBootSession,
+    DeviceBootReturnOutcome,
+    ConsumeDeviceBootReturnDeps,
+} from './boot/deviceBootReturn';
+
+// The web-session result contract (`WebSessionResult`) is owned by
+// `@oxyhq/contracts` — import it directly from there; `@oxyhq/core` does not
+// re-export contract types.
+
 // API response contracts (request/response Zod schemas + inferred types) live in
 // `@oxyhq/contracts` — the single source of truth shared by the backend and every
 // client SDK. Import them directly from `@oxyhq/contracts`; `@oxyhq/core` does NOT

package/src/mixins/OxyServices.accounts.ts

@@ -555,23 +555,16 @@ export function OxyServicesAccountsMixin<T extends typeof OxyServicesBase>(Base:
 
         // Plant the freshly minted session as the ACTIVE session, mirroring
         // `claimSessionByToken` / `verifyChallenge`: the response body carries
-        // the first access token. The device refresh cookie is established below.
+        // the first access token.
         if (res?.accessToken) {
           this.setTokens(res.accessToken);
         }
 
-        // Register the switched session in the device's multi-account set by
-        // establishing its first-party refresh cookie. This MUST be a separate
-        // call to `POST /auth/session` (the shared `establishDeviceRefreshSlot`
-        // primitive): the switch route is at `/accounts/*`, outside the
-        // `oxy_rt_<authuser>` cookie's `Path=/auth` scope, so it can never read
-        // the device's existing slots and would overwrite slot 0 (destroying the
-        // operator's own session). `/auth/session` runs where the cookies ARE
-        // visible, so the server allocates a NEW slot that coexists with the
-        // operator's and returns its `authuser`. Web-only; best-effort (the helper
-        // re-plants the rotated access token and returns `null` on native/failure).
-        const establishedAuthuser = await this.establishDeviceRefreshSlot();
-        const authuser = establishedAuthuser ?? res.authuser;
+        // The switch route now registers the switched session in the device's
+        // server-side DeviceSession set directly (device-first), so there is no
+        // client-side refresh-cookie slot to establish — the `authuser` comes
+        // from the switch response (optional-chained to match `res?.accessToken`).
+        const authuser = res?.authuser;
 
         // Identity changed → drop the entire GET response cache so no entry
         // personalised for the previous identity is reused. Cache keys are