@oxyhq/core 5.5.0 → 7.0.0

package/dist/esm/session/authStateStore.js

@@ -0,0 +1,278 @@
+/**
+ * Persisted auth state — ONE shape, web + native.
+ *
+ * The device-first session model (auth-centralization wave 1) persists the
+ * rotating refresh-token family head per ORIGIN so a reload restores the
+ * session locally without a redirect. This module is the storage seam: a tiny
+ * `load / save / clear` interface plus platform factories, so the cold boot
+ * (`coldBootV2`) and the unified refresh handler (`refresh.ts`) never touch a
+ * platform storage API directly.
+ *
+ * Platform-agnostic — the native factory takes an INJECTED key/value store
+ * (`@oxyhq/services` passes a SecureStore-backed adapter) so `@oxyhq/core`
+ * never imports `expo-secure-store`. The web factory is self-contained
+ * (`localStorage`) and degrades to in-memory when storage is unavailable
+ * (sandboxed iframe `SecurityError`, private-mode quota, SSR).
+ *
+ * ESM-safe (no `require()`).
+ */
+/**
+ * Versioned storage key. The `.v1` suffix lets a future shape change ship a
+ * `.v2` key without reading a stale/incompatible `.v1` blob. Distinct from the
+ * `oxy_shared_*` keychain keys in `KeyManager`, so it never collides.
+ */
+export const AUTH_STATE_STORAGE_KEY = 'oxy.auth.v1';
+/**
+ * Storage key for the long-lived device-attribution token. Separate from
+ * {@link AUTH_STATE_STORAGE_KEY} because it must OUTLIVE a session `clear()`
+ * (sign-out) — the device is unchanged across sign-ins.
+ */
+export const DEVICE_TOKEN_STORAGE_KEY = 'oxy.device.v1';
+/**
+ * Parse + shape-validate a stored blob. Returns `null` for anything that is
+ * not a well-formed {@link PersistedAuthState} (absent, malformed JSON, wrong
+ * types) so a corrupt entry degrades to "signed out" rather than throwing.
+ */
+function deserialize(raw) {
+    if (!raw) {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== 'object') {
+        return null;
+    }
+    const candidate = parsed;
+    if (typeof candidate.sessionId !== 'string' ||
+        typeof candidate.refreshToken !== 'string' ||
+        typeof candidate.userId !== 'string' ||
+        candidate.sessionId.length === 0 ||
+        candidate.refreshToken.length === 0 ||
+        candidate.userId.length === 0) {
+        return null;
+    }
+    const state = {
+        sessionId: candidate.sessionId,
+        refreshToken: candidate.refreshToken,
+        userId: candidate.userId,
+    };
+    if (typeof candidate.deviceToken === 'string' && candidate.deviceToken.length > 0) {
+        state.deviceToken = candidate.deviceToken;
+    }
+    if (typeof candidate.accessToken === 'string' && candidate.accessToken.length > 0) {
+        state.accessToken = candidate.accessToken;
+    }
+    if (typeof candidate.expiresAt === 'string' && candidate.expiresAt.length > 0) {
+        state.expiresAt = candidate.expiresAt;
+    }
+    return state;
+}
+/**
+ * A process-lifetime, in-memory {@link AuthStateStore}. Used directly for
+ * tests/SSR and as the degraded fallback of the web store when `localStorage`
+ * is unreachable. Not durable across reloads — that is acceptable for the
+ * fallback because the alternative (throwing) would break cold boot entirely.
+ */
+export function createMemoryAuthStateStore() {
+    let current = null;
+    let deviceToken = null;
+    return {
+        load: async () => current,
+        save: async (state) => {
+            current = state;
+        },
+        clear: async () => {
+            current = null;
+        },
+        loadDeviceToken: async () => deviceToken,
+        saveDeviceToken: async (token) => {
+            deviceToken = token;
+        },
+        clearDeviceToken: async () => {
+            deviceToken = null;
+        },
+    };
+}
+/**
+ * Read the ambient `localStorage`, tolerating the case where merely ACCESSING
+ * `window.localStorage` throws. In a sandboxed / cross-origin iframe the getter
+ * itself raises `SecurityError` (not the method calls), so the access must be
+ * inside the try. Returns `null` when storage is unavailable.
+ */
+function safeGetLocalStorage() {
+    try {
+        if (typeof globalThis === 'undefined') {
+            return null;
+        }
+        const store = globalThis.localStorage;
+        return store ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * A `localStorage`-backed {@link AuthStateStore} under the versioned
+ * {@link AUTH_STATE_STORAGE_KEY}.
+ *
+ * Resilience:
+ *  - If `localStorage` is unreachable (sandboxed-iframe `SecurityError`, SSR),
+ *    the whole store degrades to an in-memory {@link createMemoryAuthStateStore}
+ *    for this page's lifetime — never throws on construction.
+ *  - Individual `getItem`/`setItem`/`removeItem` are each wrapped: a read that
+ *    throws yields `null`; a write that throws (quota, private mode) is
+ *    swallowed. The persisted-refresh lane treats a failed persist as "no
+ *    durable state" (falls back to the bootstrap hop) rather than crashing.
+ */
+export function createWebAuthStateStore() {
+    const storage = safeGetLocalStorage();
+    if (!storage) {
+        return createMemoryAuthStateStore();
+    }
+    // In-memory mirror so a FAILED persist (quota / private mode / locked store)
+    // does not silently lose the session for this page's lifetime. `undefined`
+    // means "never written this session" → fall back to storage; any set value
+    // (including `null` after clear) is authoritative and preferred over storage.
+    let sessionMirror;
+    let deviceTokenMirror;
+    return {
+        load: async () => {
+            if (sessionMirror !== undefined) {
+                return sessionMirror;
+            }
+            try {
+                return deserialize(storage.getItem(AUTH_STATE_STORAGE_KEY));
+            }
+            catch {
+                return null;
+            }
+        },
+        save: async (state) => {
+            sessionMirror = state; // mirror FIRST — authoritative even if persist fails
+            try {
+                storage.setItem(AUTH_STATE_STORAGE_KEY, JSON.stringify(state));
+            }
+            catch {
+                // Quota / private-mode / disabled storage — non-fatal. The session
+                // stays live via the in-memory mirror; only reload durability is lost.
+            }
+        },
+        clear: async () => {
+            sessionMirror = null;
+            try {
+                storage.removeItem(AUTH_STATE_STORAGE_KEY);
+            }
+            catch {
+                // Non-fatal — see save().
+            }
+        },
+        loadDeviceToken: async () => {
+            if (deviceTokenMirror !== undefined) {
+                return deviceTokenMirror;
+            }
+            try {
+                return storage.getItem(DEVICE_TOKEN_STORAGE_KEY);
+            }
+            catch {
+                return null;
+            }
+        },
+        saveDeviceToken: async (token) => {
+            deviceTokenMirror = token;
+            try {
+                storage.setItem(DEVICE_TOKEN_STORAGE_KEY, token);
+            }
+            catch {
+                // Non-fatal — see save().
+            }
+        },
+        clearDeviceToken: async () => {
+            deviceTokenMirror = null;
+            try {
+                storage.removeItem(DEVICE_TOKEN_STORAGE_KEY);
+            }
+            catch {
+                // Non-fatal — see save().
+            }
+        },
+    };
+}
+/**
+ * A native {@link AuthStateStore} over an injected async key/value store.
+ *
+ * `@oxyhq/core` never imports `expo-secure-store`; `@oxyhq/services` constructs
+ * the SecureStore-backed adapter and passes it here. Every operation is wrapped
+ * so a storage exception degrades gracefully (read → `null`, write → swallowed)
+ * exactly like the web store.
+ */
+export function createNativeAuthStateStore(storage) {
+    // Same in-memory mirror as the web store — a locked/failed SecureStore write
+    // must not silently lose the session for the app's lifetime.
+    let sessionMirror;
+    let deviceTokenMirror;
+    return {
+        load: async () => {
+            if (sessionMirror !== undefined) {
+                return sessionMirror;
+            }
+            try {
+                return deserialize(await storage.getItem(AUTH_STATE_STORAGE_KEY));
+            }
+            catch {
+                return null;
+            }
+        },
+        save: async (state) => {
+            sessionMirror = state;
+            try {
+                await storage.setItem(AUTH_STATE_STORAGE_KEY, JSON.stringify(state));
+            }
+            catch {
+                // Non-fatal — session stays live via the in-memory mirror.
+            }
+        },
+        clear: async () => {
+            sessionMirror = null;
+            try {
+                await storage.removeItem(AUTH_STATE_STORAGE_KEY);
+            }
+            catch {
+                // Non-fatal.
+            }
+        },
+        loadDeviceToken: async () => {
+            if (deviceTokenMirror !== undefined) {
+                return deviceTokenMirror;
+            }
+            try {
+                return await storage.getItem(DEVICE_TOKEN_STORAGE_KEY);
+            }
+            catch {
+                return null;
+            }
+        },
+        saveDeviceToken: async (token) => {
+            deviceTokenMirror = token;
+            try {
+                await storage.setItem(DEVICE_TOKEN_STORAGE_KEY, token);
+            }
+            catch {
+                // Non-fatal.
+            }
+        },
+        clearDeviceToken: async () => {
+            deviceTokenMirror = null;
+            try {
+                await storage.removeItem(DEVICE_TOKEN_STORAGE_KEY);
+            }
+            catch {
+                // Non-fatal.
+            }
+        },
+    };
+}

package/dist/esm/session/refresh.js

@@ -0,0 +1,257 @@
+import { isNative } from '../utils/platform.js';
+import { logger } from '../utils/loggerUtils.js';
+/**
+ * Lead time (ms) before access-token expiry at which the proactive scheduler
+ * refreshes. Mirrors `HttpService`'s per-request `TOKEN_REFRESH_LEAD_SECONDS`
+ * (60s) so the scheduled refresh and the request-time preflight refresh use
+ * the same window — the scheduler just fires it during idle/background.
+ */
+export const TOKEN_REFRESH_LEAD_MS = 60000;
+/**
+ * Max `setTimeout` delay (2^31 − 1 ms, ~24.8 days). A larger delay overflows
+ * the int32 timer field and fires IMMEDIATELY — with a long-TTL token that
+ * turns the reschedule-on-finish loop into a tight busy refresh. Clamp to it.
+ */
+const MAX_TIMEOUT_DELAY_MS = 2147483647;
+/**
+ * Floor (ms) on ANY scheduled delay. An already-expired / in-lead-window token
+ * computes a non-positive `exp − now − lead`; without this floor that becomes
+ * `setTimeout(…, 0)`, and a FAILING refresh (offline / server error) would
+ * re-arm at 0 in the finally block → a tight 100%-CPU busy loop. The floor
+ * guarantees every re-arm yields the event loop.
+ */
+const MIN_SCHEDULE_DELAY_MS = 1000;
+/**
+ * Backoff schedule (ms) applied when a scheduled refresh FAILS: first retry
+ * after {@link MIN_FAILURE_BACKOFF_MS}, doubling up to {@link MAX_FAILURE_BACKOFF_MS}.
+ * Reset to 0 on any success or token change. This is what converts the former
+ * zero-delay failure loop into a bounded, backing-off retry.
+ */
+const MIN_FAILURE_BACKOFF_MS = 5000;
+const MAX_FAILURE_BACKOFF_MS = 5 * 60000;
+/**
+ * Error codes (in addition to HTTP 401/403) that mean the stored refresh token
+ * is permanently unusable — the family was revoked or a reuse was detected. On
+ * any of these the persisted store is CLEARED (the session is truly over);
+ * transient failures (network, 5xx) leave the store intact so a later attempt
+ * can still succeed.
+ */
+const REVOKED_REFRESH_CODES = new Set([
+    'invalid_grant',
+    'refresh_token_revoked',
+    'refresh_token_reuse',
+    'token_reuse',
+    'invalid_token',
+]);
+/** Does this error mean the refresh token is permanently dead (vs. transient)? */
+function isRevokedRefreshError(error) {
+    if (!error || typeof error !== 'object') {
+        return false;
+    }
+    const e = error;
+    if (e.status === 401 || e.status === 403) {
+        return true;
+    }
+    return typeof e.code === 'string' && REVOKED_REFRESH_CODES.has(e.code);
+}
+/**
+ * Rotate the persisted session and return the fresh access token, or `null`
+ * when no arm could produce one.
+ *
+ * Arm 1 (`POST /auth/refresh-token`): if the store holds a refresh token, rotate
+ * it — on success plant + persist the rotated pair; on a REVOKED error clear the
+ * store; on a transient error leave the store and return `null`.
+ *
+ * Arm 2 (native shared-keychain): when there is no refresh token or arm 1 was
+ * revoked, re-mint via `signInWithSharedIdentity` (which plants tokens). The
+ * shared keychain — not the per-origin store — is the durable native credential,
+ * so this arm does not write the store.
+ */
+export async function refreshPersistedSession(deps) {
+    const { oxy, store } = deps;
+    const allowSharedKeyFallback = deps.allowSharedKeyFallback ?? isNative();
+    const persisted = await store.load();
+    if (persisted?.refreshToken) {
+        try {
+            const rotated = await oxy.refreshWithToken(persisted.refreshToken);
+            oxy.setTokens(rotated.accessToken);
+            const next = {
+                sessionId: rotated.sessionId,
+                refreshToken: rotated.refreshToken,
+                userId: persisted.userId,
+                accessToken: rotated.accessToken,
+                expiresAt: rotated.expiresAt,
+            };
+            if (persisted.deviceToken) {
+                next.deviceToken = persisted.deviceToken;
+            }
+            await store.save(next);
+            return rotated.accessToken;
+        }
+        catch (error) {
+            if (isRevokedRefreshError(error)) {
+                await store.clear();
+                // Fall through to the native shared-key arm below — on a shared-key
+                // device the refresh family being revoked does not end the session.
+            }
+            else {
+                logger.debug('Persisted refresh failed (transient) — keeping store', { component: 'refresh', method: 'refreshPersistedSession' }, error);
+                return null;
+            }
+        }
+    }
+    if (allowSharedKeyFallback) {
+        try {
+            const session = await oxy.signInWithSharedIdentity();
+            if (session?.accessToken) {
+                return session.accessToken;
+            }
+        }
+        catch (error) {
+            logger.debug('Shared-key refresh fallback failed', { component: 'refresh', method: 'refreshPersistedSession' }, error);
+        }
+    }
+    return null;
+}
+/**
+ * Build the reactive `AuthRefreshHandler` (arm 1 + arm 2). Install it via
+ * {@link installAuthRefreshHandler} or directly on
+ * `oxy.httpService.setAuthRefreshHandler`. `HttpService` owns single-flight
+ * dedup + cooldown, so the timer, the request-time preflight, and a 401 all
+ * collapse to one network attempt.
+ */
+export function createAuthRefreshHandler(deps) {
+    return async (_reason) => {
+        return refreshPersistedSession(deps);
+    };
+}
+/**
+ * Install the unified refresh handler on the owner client's `HttpService`.
+ * Returns a disposer that removes it.
+ */
+export function installAuthRefreshHandler(deps) {
+    deps.oxy.httpService.setAuthRefreshHandler(createAuthRefreshHandler(deps));
+    return () => {
+        deps.oxy.httpService.setAuthRefreshHandler(null);
+    };
+}
+/**
+ * Start the proactive refresh scheduler against `oxy`.
+ *
+ * Schedules a single timer to fire {@link TOKEN_REFRESH_LEAD_MS} before the
+ * current access token's `exp`, calling
+ * `oxy.httpService.refreshAccessToken('preflight')` (which runs the installed
+ * handler; deduped + cooldown-guarded). After every attempt it reschedules
+ * from the possibly-rotated token. It also reschedules whenever the token
+ * changes (a sign-out that clears the token cancels the timer) and, on web
+ * tab-focus, refreshes immediately if already inside the lead window (a
+ * long-hidden tab throttles timers, so the token can be expired on return).
+ *
+ * No-ops cleanly when there is no token or an opaque/no-`exp` token — the
+ * reactive 401 path stays the only refresh trigger in that case. The timer is
+ * `.unref?.()`-ed so it never keeps a Node/Jest event loop alive.
+ */
+export function startTokenRefreshScheduler(oxy) {
+    let disposed = false;
+    let timer = null;
+    // 0 = no active backoff; grows on consecutive failures, resets on success /
+    // token change. Keeps a failing refresh from re-arming at zero delay.
+    let failureBackoffMs = 0;
+    const clearTimer = () => {
+        if (timer !== null) {
+            clearTimeout(timer);
+            timer = null;
+        }
+    };
+    /** Arm the timer for `delayMs`, flooring at {@link MIN_SCHEDULE_DELAY_MS} and capping at the int32 max. */
+    const armTimer = (delayMs) => {
+        clearTimer();
+        const clamped = Math.min(Math.max(delayMs, MIN_SCHEDULE_DELAY_MS), MAX_TIMEOUT_DELAY_MS);
+        timer = setTimeout(runRefresh, clamped);
+        // Never keep a Node/Jest event loop alive for a background refresh timer.
+        timer.unref?.();
+    };
+    /** Schedule the next refresh from the current token's expiry (the healthy path). */
+    const scheduleFromExpiry = () => {
+        clearTimer();
+        if (disposed || !oxy.getAccessToken()) {
+            return;
+        }
+        const expSeconds = oxy.getAccessTokenExpiry();
+        if (expSeconds === null) {
+            return;
+        }
+        armTimer(expSeconds * 1000 - Date.now() - TOKEN_REFRESH_LEAD_MS);
+    };
+    const runRefresh = () => {
+        // Clear any pending timer up front so an out-of-band trigger (focus) plus
+        // a fired timer can never double-run.
+        clearTimer();
+        void oxy.httpService.refreshAccessToken('preflight')
+            .then((token) => Boolean(token))
+            .catch(() => false)
+            .then((ok) => {
+            if (disposed) {
+                return;
+            }
+            if (ok) {
+                // Success — drop any backoff and re-arm from the rotated token's exp.
+                failureBackoffMs = 0;
+                scheduleFromExpiry();
+                return;
+            }
+            // Failure — back off (never re-arm at zero) and retry.
+            failureBackoffMs =
+                failureBackoffMs === 0
+                    ? MIN_FAILURE_BACKOFF_MS
+                    : Math.min(failureBackoffMs * 2, MAX_FAILURE_BACKOFF_MS);
+            armTimer(failureBackoffMs);
+        });
+    };
+    /** Public (re)schedule entry: a fresh token / focus signal — drop backoff and arm from expiry. */
+    const schedule = () => {
+        failureBackoffMs = 0;
+        scheduleFromExpiry();
+    };
+    const onFocus = () => {
+        if (disposed || !oxy.getAccessToken()) {
+            return;
+        }
+        const expSeconds = oxy.getAccessTokenExpiry();
+        if (expSeconds === null) {
+            return;
+        }
+        const remainingMs = expSeconds * 1000 - Date.now();
+        if (remainingMs <= TOKEN_REFRESH_LEAD_MS) {
+            runRefresh();
+        }
+        else {
+            schedule();
+        }
+    };
+    const unsubscribeTokens = oxy.onTokensChanged(() => {
+        if (!disposed) {
+            schedule();
+        }
+    });
+    let removeFocusListener = null;
+    if (typeof document !== 'undefined') {
+        const handler = () => {
+            if (document.visibilityState === 'visible') {
+                onFocus();
+            }
+        };
+        document.addEventListener('visibilitychange', handler);
+        removeFocusListener = () => document.removeEventListener('visibilitychange', handler);
+    }
+    schedule();
+    return {
+        dispose() {
+            disposed = true;
+            clearTimer();
+            unsubscribeTokens();
+            removeFocusListener?.();
+            removeFocusListener = null;
+        },
+    };
+}

package/dist/esm/shared/utils/debugUtils.js

@@ -21,7 +21,7 @@ export const isDev = () => {
 };
 /**
  * Log a debug message (only in development)
- * @param prefix - Log prefix (e.g., '[FedCM]')
+ * @param prefix - Log prefix (e.g., '[ColdBoot]')
  * @param args - Arguments to log
  */
 export const debugLog = (prefix, ...args) => {
@@ -51,12 +51,12 @@ export const debugError = (prefix, ...args) => {
 };
 /**
  * Create a namespaced debug logger
- * @param namespace - Logger namespace (e.g., 'FedCM', 'SilentAuth')
+ * @param namespace - Logger namespace (e.g., 'ColdBoot', 'DeviceAuth')
  * @returns Object with log, warn, error methods
  *
  * @example
  * ```ts
- * const debug = createDebugLogger('FedCM');
+ * const debug = createDebugLogger('ColdBoot');
  * debug.log('Starting authentication');
  * debug.warn('Token expires soon');
  * debug.error('Authentication failed', error);

package/dist/esm/utils/accountUtils.js

@@ -116,59 +116,6 @@ export const createQuickAccount = (sessionId, userData, existingAccount, getFile
         avatarUrl,
     };
 };
-/**
- * Merge a fresh `/auth/refresh-all` snapshot into an existing QuickAccount
- * list, preserving any cached fields (`avatarUrl`) for slots that didn't
- * change. The fresh response is canonical: the resulting list contains EXACTLY
- * the slots present in `fresh`, sorted by `authuser` ascending. Stale stored
- * accounts that no longer appear in `fresh` are dropped (the server already
- * authoritatively cleared the corresponding cookie).
- *
- * @param stored Previously persisted QuickAccount list (any order).
- * @param fresh Server's authoritative refresh-all response.
- * @returns Canonical merged list, sorted by `authuser` asc.
- */
-export const mergeAccountsFromRefreshAll = (stored, fresh) => {
-    const storedByAuthuser = new Map();
-    if (stored) {
-        for (const account of stored) {
-            if (typeof account.authuser === 'number') {
-                storedByAuthuser.set(account.authuser, account);
-            }
-        }
-    }
-    const merged = fresh.map((entry) => {
-        const previous = storedByAuthuser.get(entry.authuser);
-        // Preserve any previously cached identity for a slot that arrives
-        // without a user shape rather than overwriting it with blanks, and let
-        // AuthManager's getCurrentUser() hydration refresh it on the next
-        // snapshot.
-        const wireUser = entry.user;
-        const username = wireUser?.username ?? previous?.username ?? '';
-        const displayName = getAccountDisplayName({
-            name: wireUser?.name,
-            username,
-        });
-        const avatar = wireUser?.avatar ?? previous?.avatar ?? undefined;
-        const avatarUrl = previous && previous.avatar === avatar ? previous.avatarUrl : undefined;
-        return {
-            sessionId: entry.sessionId,
-            userId: wireUser?.id ?? previous?.userId,
-            username,
-            displayName,
-            avatar,
-            avatarUrl,
-            authuser: entry.authuser,
-            color: wireUser?.color ?? previous?.color ?? null,
-        };
-    });
-    merged.sort((a, b) => {
-        const aIdx = a.authuser ?? Number.POSITIVE_INFINITY;
-        const bIdx = b.authuser ?? Number.POSITIVE_INFINITY;
-        return aIdx - bIdx;
-    });
-    return merged;
-};
 /**
  * Return the account's preferred Bloom color preset, or `null` if it has no
  * preference. Centralises the `color ?? null` normalisation so consumers can

package/dist/esm/utils/authWebUrl.js

@@ -1,44 +1,16 @@
 /**
- * Central IdP (auth web) URL resolution for cross-domain SSO.
+ * Central IdP apex constant.
  *
- * The Oxy ecosystem runs a single, central Identity Provider at
- * `auth.oxy.so`. For TRUE central cross-domain SSO (Google/Meta/Clerk style),
- * FedCM and the opaque-code SSO bounce always target this one origin — it owns
- * the host-only `fedcm_session` cookie and the central session store reachable
- * via `api.oxy.so`. Relying Parties (mention.earth, homiio.com, alia.onl, …)
- * delegate to it rather than standing up a per-apex IdP.
- *
- * This module is intentionally pure: it performs no DOM access, reads no
- * `window`/`location`, and has no side effects. It is the single source of
- * truth for the central IdP origin so call sites never hardcode the literal.
- *
- * Note: this is distinct from `autoDetectAuthWebUrl` (per-apex `auth.<rp-apex>`
- * derivation). The central-SSO path deliberately does NOT auto-detect per-apex
- * IdPs — it is central only. An explicitly-configured `authWebUrl` still wins.
+ * The client SSO/FedCM resolvers (`resolveCentralAuthUrl`, `CENTRAL_AUTH_URL`)
+ * were removed in the device-first / legacy-final cutovers. The lone survivor is
+ * `CENTRAL_IDP_APEX`, kept because it has a LIVE consumer —
+ * `@oxyhq/core/server`'s CORS helper (`server/cors.ts`'s `createOxyCors`)
+ * auto-allows `*.oxy.so` from it. That CORS use is permanent, so this stays
+ * past the SSO/FedCM teardown.
  */
 /**
  * The registrable apex (eTLD+1) of the Oxy ecosystem's central Identity
- * Provider. The central IdP is reachable at `auth.${CENTRAL_IDP_APEX}` and the
- * ID-token assertion issuer is always `https://auth.${CENTRAL_IDP_APEX}`
- * regardless of which per-apex `auth.<rp>` host served a given request.
- *
- * Kept as a standalone constant so the IdP worker and the SDK derive the same
- * literal from one source of truth (the worker imports it to brand assertions).
+ * Provider, reachable at `auth.${CENTRAL_IDP_APEX}`. Single source of truth so
+ * the CORS helper (and anything else that needs the central apex) never drifts.
  */
 export const CENTRAL_IDP_APEX = 'oxy.so';
-/**
- * The canonical central Identity Provider origin for the Oxy ecosystem.
- * No trailing slash. Derived from {@link CENTRAL_IDP_APEX} so the apex and the
- * full origin never drift apart.
- */
-export const CENTRAL_AUTH_URL = `https://auth.${CENTRAL_IDP_APEX}`;
-/**
- * Resolve the central IdP origin, honouring an explicit override.
- *
- * @param explicit - A caller-supplied auth web URL, or `undefined`/empty to use
- *   the central default. An explicit non-empty value always wins.
- * @returns The explicit value when provided, otherwise {@link CENTRAL_AUTH_URL}.
- */
-export function resolveCentralAuthUrl(explicit) {
-    return explicit ?? CENTRAL_AUTH_URL;
-}