@oxyhq/core 5.5.0 → 7.0.0

package/dist/types/mixins/OxyServices.auth.d.ts

@@ -3,7 +3,8 @@
  *
  * Supports password-based login (email/username) and public key challenge-response.
  */
-import type { User, RefreshAllResponse, RefreshCookieResponse } from '../models/interfaces';
+import type { User } from '../models/interfaces';
+import type { LoginResult, LoginSessionResult } from '@oxyhq/contracts';
 import type { SessionLoginResponse } from '../models/session';
 import type { OxyServicesBase } from '../OxyServices.base';
 import type { PublicApplication } from './OxyServices.connectedApps';
@@ -11,25 +12,6 @@ export interface ChallengeResponse {
     challenge: string;
     expiresAt: string;
 }
-/**
- * Options for {@link refreshAllSessions}.
- */
-export interface RefreshAllOptions {
-    /**
-     * Abort the `POST /auth/refresh-all` request after this many milliseconds and
-     * resolve as "no signed-in accounts" (`{ accounts: [] }`) rather than hanging.
-     *
-     * Why: on a cross-domain RP (e.g. `mention.earth`) the `Domain=oxy.so` refresh
-     * cookie never reaches `api.<apex>`, so this request can stall behind a slow
-     * or unreachable endpoint with no useful answer coming back. As one step of
-     * the ordered cold-boot sequence, a stalled refresh is dead latency in front
-     * of the steps that actually hold the answer. A bounded abort lets cold boot
-     * fall through quickly. Omit (or pass `0`/negative) to wait indefinitely.
-     * The abort is treated identically to a 401 — the
-     * "not signed in on this device" path — never an error.
-     */
-    timeout?: number;
-}
 export interface RegistrationRequest {
     publicKey: string;
     username: string;
@@ -419,61 +401,6 @@ export declare function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(B
          * @param authorizeCode - The public code being denied.
          */
         denyCommonsSignIn(authorizeCode: string): Promise<CommonsSignInActionResult>;
-        /**
-         * Refresh every device-local refresh-cookie slot in a single round trip
-         * (Google-style multi-account rebuild).
-         *
-         * Calls `POST {sessionBaseUrl}/auth/refresh-all` with `credentials: 'include'`
-         * and NO bearer. The browser attaches every indexed `oxy_rt_${authuser}`
-         * cookie it has; the server rotates each in parallel and returns one entry
-         * per VALID account.
-         *
-         * Failure handling:
-         * - 401 → no signed-in accounts on this device → returns `{ accounts: [] }`
-         *   (NOT an error; this is the cold-boot "not signed in" path).
-         * - 404 → endpoint not deployed → returns `{ accounts: [] }`.
-         * - Any other non-2xx → throws via `handleError`.
-         *
-         * The refresh cookie itself never enters JS — only the rotated access
-         * tokens do. Each access token still needs to be planted via
-         * `setTokens(...)` (or per-account in-memory storage) at the consumer.
-         */
-        refreshAllSessions(options?: RefreshAllOptions): Promise<RefreshAllResponse>;
-        /**
-         * Rotate a single refresh-cookie slot and return the fresh access token.
-         *
-         * When `authuser` is provided, the server rotates ONLY that slot
-         * (`oxy_rt_${authuser}`) — sibling accounts on the same device stay
-         * untouched. When omitted, the server picks the lowest indexed slot present.
-         * The refresh cookie itself never enters JS.
-         *
-         * Returns `null` on 401 (no cookie / expired / reused) so the caller can
-         * fall through cleanly to the unauthenticated path.
-         */
-        refreshTokenViaCookie(opts?: {
-            authuser?: number;
-        }): Promise<RefreshCookieResponse | null>;
-        /**
-         * Sign out a single device-local account by its authuser slot index.
-         *
-         * Revokes that slot's refresh-token family and deactivates its session;
-         * sibling indexed slots stay signed in. The browser-side `oxy_rt_${n}`
-         * cookie is cleared by the server's `Set-Cookie` response header.
-         */
-        logoutSessionByAuthuser(authuser: number): Promise<void>;
-        /**
-         * Sign out EVERY device-local account on this device by clearing every
-         * presented refresh-cookie slot at once. Revokes every family + clears
-         * every slot. Always succeeds (idempotent on unknown/garbage tokens).
-         */
-        logoutAllSessionsViaCookie(): Promise<void>;
-        /**
-         * Internal: raw `POST /auth/refresh[?authuser=N]` call returning the
-         * minted access token. Returns `null` on 401 / non-2xx.
-         *
-         * @internal
-         */
-        _refreshCookieRaw(authuser?: number): Promise<RefreshCookieResponse | null>;
         /**
          * Internal: decode (without verifying) the `sessionId` claim from a
          * server-signed access token. The server already verified the signature;
@@ -534,13 +461,45 @@ export declare function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(B
          * Convenience helper for email sign-in
          */
         signInWithEmail(email: string, password: string, deviceName?: string, deviceFingerprint?: any): Promise<SessionLoginResponse>;
+        /**
+         * Device-first password sign-in. Unlike the legacy {@link signIn} (which
+         * assumes a one-step session and is kept intact for existing callers until
+         * the F4 cutover), this returns the FULL `POST /auth/login` contract — the
+         * discriminated {@link LoginResult}: either a 2FA challenge
+         * (`{ twoFactorRequired, loginToken }`) to complete via
+         * {@link completeTwoFactorSignIn}, or a session arm.
+         *
+         * `options.deviceToken` attributes the new session to the caller's existing
+         * device set (so an in-app login from a cross-apex, cookie-less web app
+         * still joins the same DeviceSession). On the session arm, a returned access
+         * token is planted immediately (mirroring {@link verifyChallenge}), so the
+         * caller has an authenticated client without a second round-trip.
+         */
+        passwordSignIn(identifier: string, password: string, options?: {
+            deviceToken?: string;
+            deviceName?: string;
+            deviceFingerprint?: string;
+        }): Promise<LoginResult>;
+        /**
+         * Complete a 2FA-gated sign-in started by {@link passwordSignIn}. Presents
+         * the short-lived `loginToken` with either a TOTP `token` or a `backupCode`
+         * to `POST /security/2fa/verify-login`, which must resolve to the session
+         * arm of {@link LoginResult} (a second 2FA challenge here is a protocol
+         * error). A returned access token is planted immediately.
+         */
+        completeTwoFactorSignIn(params: {
+            loginToken: string;
+            token?: string;
+            backupCode?: string;
+            deviceToken?: string;
+            deviceName?: string;
+        }): Promise<LoginSessionResult>;
         httpService: import("../HttpService").HttpService;
         cloudURL: string;
         config: import("../OxyServices.base").OxyConfig;
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -569,7 +528,6 @@ export declare function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(B
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.civic.d.ts

@@ -463,7 +463,6 @@ export declare function OxyServicesCivicMixin<T extends typeof OxyServicesBase>(
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -492,7 +491,6 @@ export declare function OxyServicesCivicMixin<T extends typeof OxyServicesBase>(
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.connectedApps.d.ts

@@ -118,7 +118,6 @@ export declare function OxyServicesConnectedAppsMixin<T extends typeof OxyServic
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -147,7 +146,6 @@ export declare function OxyServicesConnectedAppsMixin<T extends typeof OxyServic
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.contacts.d.ts

@@ -53,7 +53,6 @@ export declare function OxyServicesContactsMixin<T extends typeof OxyServicesBas
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -82,7 +81,6 @@ export declare function OxyServicesContactsMixin<T extends typeof OxyServicesBas
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.deviceBoot.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Device-first bootstrap mixin (auth centralization, wave 1).
+ *
+ * The client half of the new device-first session bootstrap: the four network
+ * calls the cold boot (`coldBootV2`) and the unified refresh handler
+ * (`refresh.ts`) make, plus the URL builder for the cross-apex bootstrap hop.
+ * Every response is validated against the `@oxyhq/contracts` `deviceBoot`
+ * schemas via `safeParseContract`, so producer (oxy-api) and consumer cannot
+ * drift — an unexpected shape throws here rather than silently corrupting the
+ * persisted store.
+ *
+ * These methods are ADDITIVE and carry NO persistence or token-planting side
+ * effects of their own (except the bearer-authenticated calls that naturally
+ * flow through `HttpService`). The cold boot / refresh handler own persistence
+ * and `setTokens`, so the same network primitive can be reused from either
+ * without double-planting.
+ */
+import { type AuthTokenBundle, type TokenRefreshResponse, type WebSessionResult } from '@oxyhq/contracts';
+import type { OxyServicesBase } from '../OxyServices.base';
+export declare function OxyServicesDeviceBootMixin<T extends typeof OxyServicesBase>(Base: T): {
+    new (...args: any[]): {
+        /**
+         * Exchange a single-use boot `code` (from the `#oxy_boot` return fragment)
+         * for a token bundle. Origin-bound + GETDEL-burned server-side.
+         *
+         * @throws if the response does not match {@link authTokenBundleSchema}.
+         */
+        exchangeBootCode(code: string): Promise<AuthTokenBundle>;
+        /**
+         * Same-site fast path (`*.oxy.so` apps). Reads the first-party `oxy_device`
+         * cookie via a credentialed same-origin fetch and either resolves a full
+         * session bundle or reports the device is known-but-signed-out. Never
+         * redirects.
+         *
+         * @throws if the response matches neither arm of {@link webSessionResultSchema}.
+         */
+        requestWebSession(): Promise<WebSessionResult>;
+        /**
+         * Rotate the persisted refresh-token family (web + native, one call). The
+         * caller (refresh handler / cold boot) plants + persists the rotated pair.
+         *
+         * @throws if the response does not match {@link tokenRefreshResponseSchema}.
+         */
+        refreshWithToken(refreshToken: string): Promise<TokenRefreshResponse>;
+        /**
+         * Issue (or rotate) the native channel's opaque device token. Bearer-gated —
+         * the server derives the deviceId from the JWT. Native apps mirror the
+         * returned token into the shared keychain via
+         * `KeyManager.setSharedDeviceToken`.
+         *
+         * @throws if the response does not match {@link deviceTokenIssueResponseSchema}.
+         */
+        issueNativeDeviceToken(): Promise<string>;
+        /**
+         * Build the top-level `GET /auth/device/bootstrap` URL for the cross-apex
+         * hop. The server validates `return_to` against the trusted-origin lane and
+         * echoes `state` back in the return fragment for CSRF verification.
+         */
+        buildBootstrapUrl(returnTo: string, state: string): string;
+        httpService: import("../HttpService").HttpService;
+        cloudURL: string;
+        config: import("../OxyServices.base").OxyConfig;
+        __resetTokensForTests(): void;
+        makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
+        getBaseURL(): string;
+        getClient(): import("../HttpService").HttpService;
+        createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
+        getMetrics(): {
+            totalRequests: number;
+            successfulRequests: number;
+            failedRequests: number;
+            cacheHits: number;
+            cacheMisses: number;
+            averageResponseTime: number;
+        };
+        clearCache(): void;
+        clearCacheEntry(key: string): void;
+        clearCacheByPrefix(prefix: string): number;
+        getCacheStats(): {
+            size: number;
+            hits: number;
+            misses: number;
+            hitRate: number;
+        };
+        getCloudURL(): string;
+        setTokens(accessToken: string): void;
+        clearTokens(): void;
+        onTokensChanged(listener: (accessToken: string | null) => void): () => void;
+        _cachedUserId: string | null | undefined;
+        _cachedAccessToken: string | null;
+        getCurrentUserId(): string | null;
+        hasValidToken(): boolean;
+        getAccessToken(): string | null;
+        getAccessTokenExpiry(): number | null;
+        waitForAuth(timeoutMs?: number): Promise<boolean>;
+        withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
+            maxRetries?: number;
+            retryDelay?: number;
+            authTimeoutMs?: number;
+        }): Promise<T_1>;
+        validate(): Promise<boolean>;
+        handleError(error: unknown): Error;
+        healthCheck(): Promise<{
+            status: string;
+            users?: number;
+            timestamp?: string;
+            [key: string]: any;
+        }>;
+    };
+} & T;

package/dist/types/mixins/OxyServices.devices.d.ts

@@ -55,7 +55,6 @@ export declare function OxyServicesDevicesMixin<T extends typeof OxyServicesBase
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -84,7 +83,6 @@ export declare function OxyServicesDevicesMixin<T extends typeof OxyServicesBase
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.features.d.ts

@@ -203,7 +203,6 @@ export declare function OxyServicesFeaturesMixin<T extends typeof OxyServicesBas
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -232,7 +231,6 @@ export declare function OxyServicesFeaturesMixin<T extends typeof OxyServicesBas
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.identity.d.ts

@@ -205,7 +205,6 @@ export declare function OxyServicesIdentityMixin<T extends typeof OxyServicesBas
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -234,7 +233,6 @@ export declare function OxyServicesIdentityMixin<T extends typeof OxyServicesBas
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.language.d.ts

@@ -40,7 +40,6 @@ export declare function OxyServicesLanguageMixin<T extends typeof OxyServicesBas
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -69,7 +68,6 @@ export declare function OxyServicesLanguageMixin<T extends typeof OxyServicesBas
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.links.d.ts

@@ -57,7 +57,6 @@ export declare function OxyServicesLinksMixin<T extends typeof OxyServicesBase>(
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -86,7 +85,6 @@ export declare function OxyServicesLinksMixin<T extends typeof OxyServicesBase>(
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.location.d.ts

@@ -23,7 +23,6 @@ export declare function OxyServicesLocationMixin<T extends typeof OxyServicesBas
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -52,7 +51,6 @@ export declare function OxyServicesLocationMixin<T extends typeof OxyServicesBas
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.nodes.d.ts

@@ -151,7 +151,6 @@ export declare function OxyServicesNodesMixin<T extends typeof OxyServicesBase>(
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -180,7 +179,6 @@ export declare function OxyServicesNodesMixin<T extends typeof OxyServicesBase>(
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.payment.d.ts

@@ -70,7 +70,6 @@ export declare function OxyServicesPaymentMixin<T extends typeof OxyServicesBase
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -99,7 +98,6 @@ export declare function OxyServicesPaymentMixin<T extends typeof OxyServicesBase
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.privacy.d.ts

@@ -99,7 +99,6 @@ export declare function OxyServicesPrivacyMixin<T extends typeof OxyServicesBase
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -128,7 +127,6 @@ export declare function OxyServicesPrivacyMixin<T extends typeof OxyServicesBase
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.reputation.d.ts

@@ -388,7 +388,6 @@ export declare function OxyServicesReputationMixin<T extends typeof OxyServicesB
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -417,7 +416,6 @@ export declare function OxyServicesReputationMixin<T extends typeof OxyServicesB
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.security.d.ts

@@ -37,7 +37,6 @@ export declare function OxyServicesSecurityMixin<T extends typeof OxyServicesBas
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -66,7 +65,6 @@ export declare function OxyServicesSecurityMixin<T extends typeof OxyServicesBas
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.topics.d.ts

@@ -63,7 +63,6 @@ export declare function OxyServicesTopicsMixin<T extends typeof OxyServicesBase>
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -92,7 +91,6 @@ export declare function OxyServicesTopicsMixin<T extends typeof OxyServicesBase>
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.user.d.ts

@@ -413,7 +413,6 @@ export declare function OxyServicesUserMixin<T extends typeof OxyServicesBase>(B
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -442,7 +441,6 @@ export declare function OxyServicesUserMixin<T extends typeof OxyServicesBase>(B
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.utility.d.ts

@@ -228,7 +228,6 @@ export declare function OxyServicesUtilityMixin<T extends typeof OxyServicesBase
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -257,7 +256,6 @@ export declare function OxyServicesUtilityMixin<T extends typeof OxyServicesBase
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/index.d.ts

@@ -6,10 +6,6 @@
  */
 import { OxyServicesBase } from '../OxyServices.base';
 import { OxyServicesAuthMixin } from './OxyServices.auth';
-import { OxyServicesFedCMMixin } from './OxyServices.fedcm';
-import { OxyServicesSilentAuthMixin } from './OxyServices.silent';
-import { OxyServicesRedirectAuthMixin } from './OxyServices.redirect';
-import { OxyServicesSsoMixin } from './OxyServices.sso';
 import { OxyServicesUserMixin } from './OxyServices.user';
 import { OxyServicesIdentityMixin } from './OxyServices.identity';
 import { OxyServicesPrivacyMixin } from './OxyServices.privacy';
@@ -31,6 +27,7 @@ import { OxyServicesAppDataMixin } from './OxyServices.appData';
 import { OxyServicesCivicMixin } from './OxyServices.civic';
 import { OxyServicesNodesMixin } from './OxyServices.nodes';
 import { OxyServicesLinksMixin } from './OxyServices.links';
+import { OxyServicesDeviceBootMixin } from './OxyServices.deviceBoot';
 /**
  * Instance shape of every mixin in the pipeline, intersected. The runtime
  * `composeOxyServices()` produces a class whose instances expose all of
@@ -40,7 +37,7 @@ import { OxyServicesLinksMixin } from './OxyServices.links';
  * If you add a new mixin to `MIXIN_PIPELINE`, add it here too so its methods
  * are visible without a cast.
  */
-type AllMixinInstances = InstanceType<ReturnType<typeof OxyServicesAuthMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesFedCMMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesSilentAuthMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesRedirectAuthMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesSsoMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesUserMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesIdentityMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesPrivacyMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLanguageMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesPaymentMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesReputationMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAssetsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAccountsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesConnectedAppsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLocationMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAnalyticsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesDevicesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesSecurityMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesFeaturesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesTopicsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesContactsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAppDataMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesCivicMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesNodesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLinksMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesUtilityMixin<typeof OxyServicesBase>>>;
+type AllMixinInstances = InstanceType<ReturnType<typeof OxyServicesAuthMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesUserMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesIdentityMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesPrivacyMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLanguageMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesPaymentMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesReputationMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAssetsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAccountsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesConnectedAppsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLocationMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAnalyticsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesDevicesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesSecurityMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesFeaturesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesTopicsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesContactsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAppDataMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesCivicMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesNodesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLinksMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesDeviceBootMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesUtilityMixin<typeof OxyServicesBase>>>;
 /**
  * Constructor type for the fully composed mixin pipeline. Each mixin returns
  * a new constructor that augments its input; reducing across the pipeline
@@ -59,10 +56,9 @@ type MixinFunction = (Base: new (...args: unknown[]) => OxyServicesBase) => new
  *
  * Order matters for dependencies:
  * 1. Base auth mixin first (required by all others)
- * 2. Cross-domain auth mixins (FedCM, silent iframe, Redirect)
- * 3. User mixin (requires auth)
- * 4. Feature mixins (can depend on user)
- * 5. Utility mixin last (augments all)
+ * 2. User mixin (requires auth)
+ * 3. Feature mixins (can depend on user)
+ * 4. Utility mixin last (augments all)
  *
  * To add a new mixin: insert it at the appropriate position in this array.
  */