@oxyhq/core 5.5.0 → 7.0.0

package/dist/types/HttpService.d.ts

@@ -26,6 +26,19 @@ export interface RequestOptions {
     signal?: AbortSignal;
     headers?: Record<string, string>;
     responseType?: 'blob';
+    /**
+     * Skip BOTH the bearer auth header (and its near-expiry preflight refresh)
+     * AND the 401-driven auto-refresh/retry for this request.
+     *
+     * Required for the body-authenticated refresh endpoint (`POST
+     * /auth/refresh-token`): it does not need a bearer, and — critically — it is
+     * itself invoked from inside the registered `AuthRefreshHandler`. If it went
+     * through the normal preflight, `getAuthHeader` would call
+     * `refreshAccessToken` while the handler-owning `tokenRefreshPromise` is
+     * still in flight and await ITSELF (deadlock). Skipping auth makes the
+     * refresh call fully independent of the current (near-expired) bearer.
+     */
+    skipAuth?: boolean;
 }
 interface RequestConfig extends RequestOptions {
     method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
@@ -144,7 +157,7 @@ export declare class HttpService {
      * `clearCacheByPrefix` sweeps and `clearCacheEntry` base-key matching.
      * The `clearCacheEntry` callsites all pass fixed, dataless logical keys
      * (`GET:/users/<id>`, `GET:/session/user/<sessionId>`,
-     * `GET:/fedcm/me/authorized-apps`), so this readable suffix can never be
+     * `GET:/auth/grants`), so this readable suffix can never be
      * ambiguous with a serialized request body.
      */
     private static readonly CACHE_IDENTITY_DELIM;

package/dist/types/OxyServices.base.d.ts

@@ -25,20 +25,6 @@ export declare class OxyServicesBase {
      * Get the configured Oxy API base URL
      */
     getBaseURL(): string;
-    /**
-     * Get the base URL the SDK's first-party session/refresh calls should target.
-     *
-     * Returns the configured `sessionBaseUrl` when provided, otherwise falls back
-     * to the API `baseURL` (`getBaseURL()`). Per the 2026 session architecture
-     * (docs/SESSION-ARCHITECTURE.md), non-`oxy.so` apps point this at their own
-     * same-site backend (e.g. `https://api.mention.earth`) whose session bridge
-     * forwards the user's refresh credential to `api.oxy.so`; `*.oxy.so` apps
-     * leave it unset so it resolves to `https://api.oxy.so` and nothing changes.
-     *
-     * This is additive: it only exposes configuration for `@oxyhq/services` to
-     * consume in a later phase. No refresh/auth logic in core reads it yet.
-     */
-    getSessionBaseUrl(): string;
     /**
      * Get the HTTP service instance
      * Useful for advanced use cases where direct access to the HTTP service is needed
@@ -142,44 +128,6 @@ export declare class OxyServicesBase {
      * Get the raw access token (for constructing anchor URLs when needed)
      */
     getAccessToken(): string | null;
-    /**
-     * Register the CURRENTLY-ACTIVE session in the device's first-party
-     * multi-account refresh-cookie set by calling `POST /auth/session`.
-     *
-     * This is the single, shared primitive every web primary-session commit and the
-     * account switch use to plant their `oxy_rt_<authuser>` slot. It MUST be a
-     * dedicated call to `/auth/session` rather than relying on whichever endpoint
-     * established the session: that endpoint is frequently OUTSIDE the cookie's
-     * `Path=/auth` scope (`/accounts/:id/switch`) or is a cross-origin/credential-
-     * less restore (`/sso/exchange`, the IdP `/auth/silent` postMessage) that cannot
-     * set an `api.oxy.so` cookie at all. `/auth/session` runs where the device's
-     * existing slots ARE visible, so the server resolves this user's slot (reusing an
-     * existing one or allocating a new one) without clobbering a sibling account,
-     * mints a fresh access token bound to the same session, and returns the resolved
-     * `authuser`.
-     *
-     * Behaviour:
-     * - Requires a planted bearer (the caller must have already installed the
-     *   session's access token); `/auth/session` derives the session from it.
-     * - On success re-plants the rotated access token (so the active token matches
-     *   the freshly-rotated cookie) and returns the device `authuser` slot.
-     * - WEB-ONLY: on native there are no first-party refresh cookies → returns
-     *   `null`.
-     * - FIRST-PARTY-ONLY: the cookie is host-only on the API host with
-     *   `SameSite=Lax`, so it only sticks when the page is SAME-SITE (same
-     *   registrable apex) as the API. On a cross-apex RP (`mention.earth` calling
-     *   `api.oxy.so`) the browser rejects the `Set-Cookie` as a third-party cookie,
-     *   so a returned slot would be a phantom never enumerated by `refresh-all`.
-     *   Those RPs durably restore via the per-apex `/auth/silent` iframe + `/sso`
-     *   bounce, NOT this device set → returns `null` without calling the API.
-     * - BEST-EFFORT: a failure (e.g. transient network) never throws — the session
-     *   stays active in-memory; only its reload durability via the device set is at
-     *   risk. The caller treats `null` as "not registered in the device set".
-     *
-     * @returns The resolved device `authuser` slot, or `null` on native / cross-apex
-     *   / failure.
-     */
-    establishDeviceRefreshSlot(): Promise<number | null>;
     /**
      * Decode the current access token and return its `exp` claim in SECONDS since
      * the Unix epoch (the raw JWT `exp` unit), or `null` when there is no token,

package/dist/types/OxyServices.d.ts

@@ -58,10 +58,6 @@
  */
 import { type LinkedHttpClient, type OxyConfig } from './OxyServices.base';
 import { OxyAuthenticationError, OxyAuthenticationTimeoutError } from './OxyServices.errors';
-import type { SessionLoginResponse } from './models/session';
-import type { FedCMAuthOptions, FedCMConfig } from './mixins/OxyServices.fedcm';
-import type { SilentAuthOptions } from './mixins/OxyServices.silent';
-import type { RedirectAuthOptions } from './mixins/OxyServices.redirect';
 import { composeOxyServices } from './mixins';
 /**
  * OxyServices - Unified client library for interacting with the Oxy API
@@ -100,31 +96,10 @@ import { composeOxyServices } from './mixins';
  */
 declare const OxyServicesComposed: import("./mixins").ComposedOxyServicesConstructor;
 export declare class OxyServices extends OxyServicesComposed {
-    /**
-     * FedCM credential-request timeouts (ms). The runtime values are defined on
-     * the FedCM mixin and inherited here via `extends`; these `declare` members
-     * surface their types to TypeScript without re-emitting (or duplicating) the
-     * literals, so consumers/tests can reference `OxyServices.FEDCM_SILENT_TIMEOUT`
-     * with full typing.
-     */
-    static readonly FEDCM_TIMEOUT: number;
-    static readonly FEDCM_SILENT_TIMEOUT: number;
     constructor(config: OxyConfig);
 }
 export interface OxyServices extends InstanceType<ReturnType<typeof composeOxyServices>> {
     createLinkedClient(config: OxyConfig): LinkedHttpClient;
-    isFedCMSupported(): boolean;
-    signInWithFedCM(options?: FedCMAuthOptions): Promise<SessionLoginResponse>;
-    silentSignInWithFedCM(): Promise<SessionLoginResponse | null>;
-    revokeFedCMCredential(): Promise<void>;
-    getFedCMConfig(): FedCMConfig;
-    resolveAuthUrl(): string;
-    silentSignIn(options?: SilentAuthOptions): Promise<SessionLoginResponse | null>;
-    waitForIframeAuth(iframe: HTMLIFrameElement, timeout: number, expectedOrigin: string): Promise<SessionLoginResponse | null>;
-    signInWithRedirect(options?: RedirectAuthOptions): void;
-    signUpWithRedirect(options?: RedirectAuthOptions): void;
-    exchangeSsoCode(code: string, state?: string): Promise<SessionLoginResponse>;
-    generateSsoState(): string;
     auth(options?: {
         debug?: boolean;
         onError?: (error: unknown) => unknown;

package/dist/types/boot/coldBootV2.d.ts

@@ -0,0 +1,76 @@
+import { type ColdBootOutcome } from '../utils/coldBoot';
+import type { OxyServices } from '../OxyServices';
+import type { AuthStateStore } from '../session/authStateStore';
+import { type DeviceBootSession } from './deviceBootReturn';
+/**
+ * localStorage flag marking that the cross-apex bootstrap navigation has fired
+ * once for this origin. Persistent (not session) so the visible redirect
+ * happens AT MOST ONCE EVER per browser+origin — a signed-out user is never
+ * bounced again; they sign in explicitly.
+ */
+export declare const BOOT_ATTEMPTED_KEY = "oxy.boot.attempted";
+/** Why a cold boot ended without a session. */
+export type SignedOutReason = 'no_session' | 'new_device' | 'state-mismatch' | 'error';
+/**
+ * The DOM/storage seam. All access is injected so the boot is unit-testable
+ * under the jest `node` environment; {@link createBrowserColdBootDom} provides
+ * the guarded real-globals implementation used in production.
+ */
+export interface ColdBootDom {
+    getHash(): string;
+    stripFragment(): void;
+    getSessionItem(key: string): string | null;
+    setSessionItem(key: string, value: string): void;
+    removeSessionItem(key: string): void;
+    getLocalItem(key: string): string | null;
+    setLocalItem(key: string, value: string): void;
+    getLocationHostname(): string | null;
+    /** Current href WITHOUT its hash fragment (the bootstrap `return_to`). */
+    getReturnToHref(): string | null;
+    navigate(url: string): void;
+    /** A fresh high-entropy CSRF state token. */
+    randomState(): string;
+}
+export interface RunSessionColdBootOptions {
+    oxy: OxyServices;
+    store: AuthStateStore;
+    /** Platform hints; default derived from `@oxyhq/core`'s platform detection. */
+    platform?: {
+        isWeb?: boolean;
+        isNative?: boolean;
+    };
+    /**
+     * The RP return URL for the cross-apex hop. Defaults to the current href
+     * (sans fragment) via the DOM seam.
+     */
+    returnTo?: string;
+    /** Invoked with the winning session (token already planted). */
+    onSession?: (session: DeviceBootSession & {
+        via: string;
+    }) => void | Promise<void>;
+    /** Invoked when the boot ended signed out (not while navigating away). */
+    onSignedOut?: (reason: SignedOutReason) => void | Promise<void>;
+    onStepError?: (id: string, error: unknown) => void;
+    /** DOM/storage seam; defaults to the guarded browser implementation. */
+    dom?: ColdBootDom;
+}
+/**
+ * The guarded real-globals {@link ColdBootDom}. Every accessor tolerates a
+ * missing/throwing global (SSR, sandboxed iframe) by returning a neutral value
+ * or no-op, so the boot degrades to signed-out rather than crashing.
+ */
+export declare function createBrowserColdBootDom(): ColdBootDom;
+/**
+ * True when both hosts are same-site / same-apex. For a normal multi-label host
+ * pair, that means sharing a registrable domain. For an IP literal or a
+ * single-label host (no registrable domain), same-apex requires the two hosts
+ * to be EXACTLY equal — never grouped by a spurious trailing-label match.
+ */
+export declare function isSameApex(pageHost: string, apiHost: string): boolean;
+/**
+ * Run the device-first cold boot. Resolves to the `runColdBoot` outcome and, as
+ * a side effect, invokes `onSession` (winning session, token already planted)
+ * or `onSignedOut` (no session — unless the boot is navigating away for the
+ * cross-apex hop, in which case neither fires).
+ */
+export declare function runSessionColdBoot(opts: RunSessionColdBootOptions): Promise<ColdBootOutcome<DeviceBootSession>>;

package/dist/types/boot/deviceBootReturn.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Device-boot return-fragment consumption (web cross-apex hop).
+ *
+ * After the top-level `GET /auth/device/bootstrap` hop, the API 303s back to the
+ * RP with a `#oxy_boot=<base64url(JSON)>` fragment. This module parses and
+ * consumes it: it strips the fragment from the URL FIRST (so the opaque
+ * deviceToken / code never linger in history or a `Referer`), verifies the
+ * echoed CSRF `state` against the value the initiator stashed in
+ * `sessionStorage`, persists the deviceToken, and — when a session resolved —
+ * exchanges the single-use `code` for a token bundle.
+ *
+ * Pure/injectable: all DOM access (hash, `history.replaceState`,
+ * `sessionStorage`) is passed in as callbacks so the logic is unit-testable
+ * under the jest `node` environment and reusable by `coldBootV2`.
+ *
+ * ESM-safe (no `require()`).
+ */
+import { type AuthTokenBundle, type DeviceBootFragment, type DeviceBootReason } from '@oxyhq/contracts';
+import type { AuthStateStore } from '../session/authStateStore';
+/** The `#oxy_boot=` fragment parameter name the API appends on the return hop. */
+export declare const BOOT_FRAGMENT_PARAM = "oxy_boot";
+/**
+ * `sessionStorage` key under which the bootstrap-hop initiator stashes the
+ * 128-bit CSRF `state` before navigating, and which the return step reads back
+ * (single-use).
+ */
+export declare const BOOT_STATE_SESSION_KEY = "oxy.boot.state";
+/** True when a location hash carries the `oxy_boot` return fragment. */
+export declare function hashHasBootFragment(hash: string): boolean;
+/**
+ * Extract + decode + validate the `oxy_boot` fragment from a location hash.
+ * Returns the parsed {@link DeviceBootFragment}, or `null` when the parameter
+ * is absent, not valid base64url, not JSON, or fails the contract schema.
+ */
+export declare function parseDeviceBootFragment(hash: string): DeviceBootFragment | null;
+/** The winning session shape a cold-boot step reports. */
+export interface DeviceBootSession {
+    sessionId: string;
+    userId: string;
+    accessToken: string;
+}
+/** Outcome of {@link consumeDeviceBootReturn}. */
+export type DeviceBootReturnOutcome = {
+    kind: 'none';
+} | {
+    kind: 'state-mismatch';
+} | {
+    kind: 'session';
+    session: DeviceBootSession;
+} | {
+    kind: 'no-session';
+    reason: DeviceBootReason;
+};
+export interface ConsumeDeviceBootReturnDeps {
+    /** The current location hash (e.g. `window.location.hash`). */
+    hash: string;
+    /** Strip the fragment from the URL (e.g. `history.replaceState`). */
+    stripFragment: () => void;
+    /** Read the expected CSRF state (e.g. `sessionStorage.getItem(BOOT_STATE_SESSION_KEY)`). */
+    readExpectedState: () => string | null;
+    /** Clear the expected CSRF state (single-use). */
+    clearExpectedState: () => void;
+    store: AuthStateStore;
+    /** Exchange the single-use boot code for a token bundle (`oxy.exchangeBootCode`). */
+    exchangeBootCode: (code: string) => Promise<AuthTokenBundle>;
+    /** Plant the freshly-minted access token on the owner client (`oxy.setTokens`). */
+    plantAccessToken: (accessToken: string) => void;
+}
+/**
+ * Consume the device-boot return fragment.
+ *
+ * Order is load-bearing:
+ *   1. If no fragment is present, return `none` (no URL mutation).
+ *   2. STRIP the fragment from the URL immediately — before validation or any
+ *      network — so the deviceToken/code never persist in history/referrer.
+ *   3. Verify the echoed `state` against the stashed (single-use) value; a
+ *      mismatch returns `state-mismatch` without persisting or exchanging.
+ *   4. Persist the deviceToken (survives sign-out).
+ *   5. If a session resolved (`reason:'session'` + `code`), exchange the code,
+ *      persist the rotated session, plant the token, and return `session`.
+ *      Otherwise return `no-session` with the reason.
+ */
+export declare function consumeDeviceBootReturn(deps: ConsumeDeviceBootReturnDeps): Promise<DeviceBootReturnOutcome>;

package/dist/types/crypto/keyManager.d.ts

@@ -157,6 +157,27 @@ export declare class KeyManager {
      * @returns True if migration was successful, false if no local identity exists
      */
     static migrateToSharedIdentity(): Promise<boolean>;
+    /**
+     * Store the opaque device-attribution token in the SHARED keychain so every
+     * Oxy app on this device reads the SAME token and therefore resolves to one
+     * server-side DeviceSession.
+     *
+     * Mirrors the shared-session storage options exactly (iOS keychain access
+     * group `group.so.oxy.shared`; Android shared secure store). Native-only —
+     * a no-op on web (the shared keychain does not exist there; web persists its
+     * deviceToken in the per-origin {@link AuthStateStore} instead).
+     */
+    static setSharedDeviceToken(deviceToken: string): Promise<void>;
+    /**
+     * Read the shared device-attribution token, or `null` when none is set (or
+     * on web). Mirrors {@link getSharedSession}'s keychain-access-group read.
+     */
+    static getSharedDeviceToken(): Promise<string | null>;
+    /**
+     * Delete the shared device-attribution token (device signout-all). Best-effort:
+     * a keychain failure is logged, not thrown, so it cannot block a sign-out.
+     */
+    static clearSharedDeviceToken(): Promise<void>;
     /**
      * Atomically persist a key pair to secure storage with verification + backup.
      *

package/dist/types/index.d.ts

@@ -21,14 +21,6 @@ export { OxyServices, OxyAuthenticationError, OxyAuthenticationTimeoutError } fr
 export { OXY_CLOUD_URL, oxyClient } from './OxyServices';
 export type { LinkedHttpClient } from './OxyServices.base';
 export type { AuthRefreshReason, AuthRefreshHandler } from './HttpService';
-export { AuthManager, createAuthManager } from './AuthManager';
-export type { StorageAdapter, AuthStateChangeCallback, AuthMethod, AuthManagerConfig, } from './AuthManager';
-export type { AuthManagerAccount, RestoreFromCookiesResult, RestoreFromCookiesOptions, SwitchAuthuserResult, } from './AuthManagerTypes';
-export { CrossDomainAuth, createCrossDomainAuth } from './CrossDomainAuth';
-export type { CrossDomainAuthOptions } from './CrossDomainAuth';
-export type { FedCMAuthOptions, FedCMConfig, AuthorizedApp } from './mixins/OxyServices.fedcm';
-export type { SilentAuthOptions } from './mixins/OxyServices.silent';
-export type { RedirectAuthOptions } from './mixins/OxyServices.redirect';
 export { ServiceCredentialMismatchError } from './mixins/OxyServices.auth';
 export type { ServiceTokenResponse } from './mixins/OxyServices.auth';
 export type { CommonsSignInHandle, CommonsSignInStatus, CommonsApprovalInfo, CommonsSignInActionResult, } from './mixins/OxyServices.auth';
@@ -53,7 +45,6 @@ export { SessionSyncRequiredError, AuthenticationFailedError, ensureValidToken,
 export type { HandleApiErrorOptions } from './utils/authHelpers';
 export { mergeSessions, normalizeAndSortSessions, sessionsArraysEqual, } from './utils/sessionUtils';
 export type { ClientSession, StorageKeys, MinimalUserData, SessionLoginResponse, } from './models/session';
-export type { RefreshAllResponse, RefreshAllAccount, RefreshAllAccountUser, RefreshCookieResponse, } from './models/interfaces';
 export { KeyManager, IdentityAlreadyExistsError, IdentityPersistError, } from './crypto/keyManager';
 export type { KeyPair } from './crypto/keyManager';
 export { SignatureService } from './crypto/signatureService';
@@ -68,7 +59,7 @@ export { TopicType, TopicSource } from './models/Topic';
 export type { TopicData, TopicTranslation } from './models/Topic';
 export { SUPPORTED_LANGUAGES, getLanguageMetadata, getLanguageName, getNativeLanguageName, normalizeLanguageCode, isRTLLocale, } from './utils/languageUtils';
 export type { LanguageMetadata } from './utils/languageUtils';
-export { getPlatformOS, setPlatformOS, isWeb, isNative, isIOS, isAndroid, } from './utils/platform';
+export { getPlatformOS, setPlatformOS, isWeb, isNative, isIOS, isAndroid, isWebBrowser, } from './utils/platform';
 export type { PlatformOS } from './utils/platform';
 export { darkenColor, lightenColor, hexToRgb, rgbToHex, withOpacity, isLightColor, getContrastTextColor, } from './shared/utils/colorUtils';
 export { normalizeTheme, normalizeColorScheme, getOppositeTheme, systemPrefersDarkMode, getSystemColorScheme, } from './shared/utils/themeUtils';
@@ -82,21 +73,15 @@ export { buildSearchParams, buildUrl, buildPaginationParams, safeJsonParse, } fr
 export type { PaginationParams, ApiResponse, ErrorResponse, } from './utils/apiUtils';
 export { ErrorCodes, createApiError, handleHttpError, validateRequiredFields, } from './utils/errorUtils';
 export { retryAsync } from './utils/asyncUtils';
-export { EMAIL_REGEX, USERNAME_REGEX, PASSWORD_REGEX, isValidEmail, isValidUsername, isValidPassword, isRequiredString, isRequiredNumber, isRequiredBoolean, isValidArray, isValidObject, isValidUUID, isValidURL, isValidDate, isValidFileSize, isValidFileType, sanitizeString, sanitizeHTML, isValidObjectId, validateAndSanitizeUserInput, } from './utils/validationUtils';
+export { EMAIL_REGEX, USERNAME_REGEX, PASSWORD_REGEX, isValidEmail, isValidUsername, isValidPassword, isValidDisplayName, isRequiredString, isRequiredNumber, isRequiredBoolean, isValidArray, isValidObject, isValidUUID, isValidURL, isValidDate, isValidFileSize, isValidFileType, sanitizeString, sanitizeHTML, isValidObjectId, validateAndSanitizeUserInput, } from './utils/validationUtils';
 export { logger, LogLevel, logAuth, logApi, logSession, logUser, logDevice, logPayment, logPerformance, } from './utils/loggerUtils';
 export type { LogContext } from './utils/loggerUtils';
 export { updateAvatarVisibility } from './utils/avatarUtils';
-export { buildAccountsArray, createQuickAccount, getAccountDisplayName, getAccountFallbackHandle, formatPublicKeyHandle, mergeAccountsFromRefreshAll, getAccountColor, } from './utils/accountUtils';
+export { buildAccountsArray, createQuickAccount, getAccountDisplayName, getAccountFallbackHandle, formatPublicKeyHandle, getAccountColor, } from './utils/accountUtils';
 export type { QuickAccount, DisplayNameUserShape } from './utils/accountUtils';
-export { autoDetectAuthWebUrl, registrableApex } from './utils/fapiAutoDetect';
-export { CENTRAL_AUTH_URL, CENTRAL_IDP_APEX, resolveCentralAuthUrl } from './utils/authWebUrl';
-export { parseSsoReturnFragment, consumeSsoReturn } from './utils/ssoReturn';
-export type { SsoReturnKind, SsoReturnResult, ConsumeSsoReturnDeps } from './utils/ssoReturn';
-export { generateSsoState } from './mixins/OxyServices.sso';
-export { establishIdpSessionAfterClaim } from './utils/ssoEstablish';
-export type { SsoEstablishClient, EstablishAfterClaimDeps } from './utils/ssoEstablish';
-export { SSO_CALLBACK_PATH, SSO_GUARD_TTL_MS, ssoStateKey, ssoGuardKey, ssoDestKey, ssoNoSessionKey, ssoAttemptedKey, ssoPriorSessionKey, ssoSignedOutKey, ssoOutcomeKey, ssoCallbackBootstrapKey, ssoNavigate, getSsoCallbackBootstrapScript, buildSsoBounceUrl, isCentralIdPOrigin, guardActive, silentRestoreSuppressed, allowSsoBounce, } from './utils/ssoBounce';
-export type { SsoBounceGate } from './utils/ssoBounce';
+export { registrableApex } from './utils/registrableApex';
+export { CENTRAL_IDP_APEX } from './utils/authWebUrl';
+export { SSO_CALLBACK_PATH } from './utils/ssoBounce';
 export { runColdBoot } from './utils/coldBoot';
 export type { ColdBootStep, ColdBootStepResult, ColdBootSession, ColdBootSkip, ColdBootOutcome, RunColdBootOptions, } from './utils/coldBoot';
 export { SessionClient } from './session/SessionClient';
@@ -105,6 +90,14 @@ export type { SocketIOFactory, MinimalSocket } from './session/socketLoader';
 export { createSessionClientHost } from './session/sessionClientHost';
 export { createSessionClient } from './session/createSessionClient';
 export { deviceStateToClientSessions, activeSessionIdOf, activeUserOf, accountIdsOf, } from './session/projectSessionState';
+export { createWebAuthStateStore, createNativeAuthStateStore, createMemoryAuthStateStore, AUTH_STATE_STORAGE_KEY, DEVICE_TOKEN_STORAGE_KEY, } from './session/authStateStore';
+export type { PersistedAuthState, AuthStateStore, NativeKeyValueStorage, } from './session/authStateStore';
+export { refreshPersistedSession, createAuthRefreshHandler, installAuthRefreshHandler, startTokenRefreshScheduler, TOKEN_REFRESH_LEAD_MS, } from './session/refresh';
+export type { RefreshDeps, TokenRefreshSchedulerHandle } from './session/refresh';
+export { runSessionColdBoot, createBrowserColdBootDom, isSameApex, BOOT_ATTEMPTED_KEY, } from './boot/coldBootV2';
+export type { RunSessionColdBootOptions, ColdBootDom, SignedOutReason, } from './boot/coldBootV2';
+export { consumeDeviceBootReturn, parseDeviceBootFragment, hashHasBootFragment, BOOT_FRAGMENT_PARAM, BOOT_STATE_SESSION_KEY, } from './boot/deviceBootReturn';
+export type { DeviceBootSession, DeviceBootReturnOutcome, ConsumeDeviceBootReturnDeps, } from './boot/deviceBootReturn';
 export { packageInfo } from './constants/version';
 import { OxyServices } from './OxyServices';
 export default OxyServices;

package/dist/types/mixins/OxyServices.accounts.d.ts

@@ -28,8 +28,9 @@
  * SWITCHING INTO AN ACCOUNT: `switchToAccount(accountId)` mints a REAL session
  * for the target account and plants it as the active session — there is no
  * per-request "acting-as" header. Identity is carried by the session/token, not
- * a delegation header, so a switch propagates through reload and `refresh-all`
- * exactly like a login.
+ * a delegation header, so a switch propagates through reload and cross-domain
+ * exactly like a login, via the device-first session model (the server
+ * registers the switched session into the operator's device-set directly).
  */
 import type { User } from '../models/interfaces';
 import type { SessionLoginResponse } from '../models/session';
@@ -387,22 +388,22 @@ export interface AccountSuccessResult {
 /**
  * Result of {@link OxyServicesAccountsMixin.switchToAccount} — the freshly
  * minted session for the target account, in the SAME shape the canonical login
- * / `claimSessionByToken` responses use (`SessionLoginResponse`), plus the
- * device-local refresh-cookie slot index.
+ * / `claimSessionByToken` responses use (`SessionLoginResponse`).
  *
  * `accessToken` is the first access token for the new session (already planted
- * as the active token by `switchToAccount`). The refresh token is NOT in the
- * body — the server sets it as the httpOnly `oxy_rt_<authuser>` cookie, which
- * joins the device multi-account set so the switched session survives reload and
- * propagates cross-domain via `/auth/refresh-all`. `user` is the target account.
+ * as the active token by `switchToAccount`). The switched session's survival
+ * across reload and cross-domain sync is device-first: the server registers
+ * it into the operator's `DeviceSession` set directly
+ * (`deviceSessionService.addAccount`, broadcast to the device room) — there is
+ * no client-side refresh-cookie slot to establish. `user` is the target
+ * account.
  */
 export interface SwitchAccountResult extends SessionLoginResponse {
     /**
-     * The device-local refresh-cookie slot index (`oxy_rt_<authuser>`) the server
-     * assigned to the minted session. Surfaced so the consumer can register the
-     * new session in its device multi-account set exactly like a login response.
-     * Absent only when the server could not set the cookie (best-effort — the
-     * switch itself still succeeds).
+     * Legacy device-local refresh-cookie slot index. The current server switch
+     * response never sets this field (device-set registration replaced the
+     * cookie-slot model) — kept optional for backward type-compatibility with
+     * any caller still reading it, but always `undefined` in practice.
      */
     authuser?: number;
 }
@@ -432,24 +433,18 @@ export declare function OxyServicesAccountsMixin<T extends typeof OxyServicesBas
          * target, directly or inherited — else 403; 404 if missing/archived; 403 if
          * the target is a personal account), then mints a REAL session for the
          * target account and returns it in the canonical login / `claimSessionByToken`
-         * shape (`{ sessionId, deviceId, expiresAt, accessToken, user, authuser }`).
+         * shape (`{ sessionId, deviceId, expiresAt, accessToken, user }`).
          *
          * Unlike the removed `X-Acting-As` delegation header, the returned session
          * IS the new identity: this plants `accessToken` as the active token —
          * exactly like `claimSessionByToken` / `verifyChallenge` — so every
          * subsequent request authenticates as the target account.
          *
-         * Joining the device multi-account set (so the switch survives a reload and
-         * propagates cross-domain via `/auth/refresh-all`) requires a SECOND call, to
-         * `POST /auth/session`, made here after the token is planted. The switch route
-         * lives at `/accounts/*`, OUTSIDE the `oxy_rt_<authuser>` cookie's `Path=/auth`
-         * scope, so the server never sees the device's existing slots from it and
-         * would clobber slot 0 (destroying the operator's own session). `/auth/session`
-         * runs where those cookies ARE visible, so the server allocates a NEW slot that
-         * coexists with the operator's and returns its `authuser`. This step is
-         * web-only (native multi-account uses stored sessions, not cookies) and
-         * best-effort — a failure leaves the in-session switch intact; the switched
-         * account simply won't survive a reload until the cookie is next established.
+         * A single call is all that's needed: the server registers the switched
+         * session into the operator's `DeviceSession` set directly, inheriting the
+         * operator's central `deviceId` so the switch survives a reload and syncs
+         * cross-domain via the same device-first session model as a normal login —
+         * there is no separate client-side cookie/slot step to make it stick.
          *
          * After planting, the SDK's identity-scoped GET cache is fully cleared so
          * every cached read re-fetches as the new account. (The consuming
@@ -459,7 +454,7 @@ export declare function OxyServicesAccountsMixin<T extends typeof OxyServicesBas
          * same-user silent refreshes, so the sweep here is explicit.)
          *
          * @param accountId - The target account's Mongo `_id`.
-         * @returns The minted session (planted) plus the device `authuser` slot.
+         * @returns The minted session, already planted as the active session.
          */
         switchToAccount(accountId: string): Promise<SwitchAccountResult>;
         /**
@@ -655,7 +650,6 @@ export declare function OxyServicesAccountsMixin<T extends typeof OxyServicesBas
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -684,7 +678,6 @@ export declare function OxyServicesAccountsMixin<T extends typeof OxyServicesBas
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
@@ -696,7 +689,9 @@ export declare function OxyServicesAccountsMixin<T extends typeof OxyServicesBas
         handleError(error: unknown): Error;
         healthCheck(): Promise<{
             status: string;
-            users?: number;
+            users
+            /** Aggregate totals for an application over the requested period. */
+            ? /** Aggregate totals for an application over the requested period. */: number;
             timestamp?: string;
             [key: string]: any;
         }>;

package/dist/types/mixins/OxyServices.analytics.d.ts

@@ -25,7 +25,6 @@ export declare function OxyServicesAnalyticsMixin<T extends typeof OxyServicesBa
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -54,7 +53,6 @@ export declare function OxyServicesAnalyticsMixin<T extends typeof OxyServicesBa
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.appData.d.ts

@@ -61,7 +61,6 @@ export declare function OxyServicesAppDataMixin<T extends typeof OxyServicesBase
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -90,7 +89,6 @@ export declare function OxyServicesAppDataMixin<T extends typeof OxyServicesBase
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.assets.d.ts

@@ -180,7 +180,6 @@ export declare function OxyServicesAssetsMixin<T extends typeof OxyServicesBase>
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -209,7 +208,6 @@ export declare function OxyServicesAssetsMixin<T extends typeof OxyServicesBase>
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {