@oxyhq/core 5.5.0 → 7.0.0

package/dist/types/utils/ssoBounce.d.ts

@@ -1,287 +1,21 @@
 /**
- * Central cross-domain SSO bounce — per-origin sessionStorage keys, the bounce
- * URL builder, and the small pure predicates shared by every consumer's
- * cold-boot `sso-return` / `sso-bounce` steps and bfcache `pageshow`
- * re-evaluation.
+ * SSO callback path constant.
  *
- * This is the single source of truth for the SSO bounce wire/storage contract.
- * `@oxyhq/auth` (`WebOxyProvider`) and `@oxyhq/services` (`OxyContext`) both
- * consume these helpers so the two providers behave identically.
+ * The client SSO-bounce machinery (per-origin sessionStorage keys, the bounce
+ * URL builder, the `guardActive` / `allowSsoBounce` / `getSsoCallbackBootstrapScript`
+ * predicates, …) was removed in the device-first cutover — RP apps no longer
+ * bounce through `auth.oxy.so`. The one survivor is this path constant, still
+ * referenced by the api SSO controller and the IdP (both lista B, gated on the
+ * ecosystem bump). `@oxyhq/core/server` re-exports it for the api.
  *
- * TRUE central SSO (Google/Meta/Clerk style) works like this for a Relying
- * Party (mention.earth, homiio.com, alia.onl, …) with no local session:
- *
- *   1. `sso-bounce` (terminal, once): a TOP-LEVEL navigation to
- *      `auth.oxy.so/sso?prompt=none&client_id=<origin>&return_to=<origin>{@link SSO_CALLBACK_PATH}&state=<s>`.
- *      Before navigating it records, in this origin's `sessionStorage`, the
- *      CSRF `state` ({@link ssoStateKey}), a guard timestamp ({@link ssoGuardKey},
- *      the loop breaker), and the real destination URL ({@link ssoDestKey}) to
- *      restore after the callback.
- *   2. The central IdP worker reads its first-party `fedcm_session`, mints a
- *      session, stores it under an opaque single-use `code`, and 303-redirects
- *      back to `<origin>{@link SSO_CALLBACK_PATH}#oxy_sso=ok&code=<code>&state=<s>`
- *      (or `#oxy_sso=none` / `#oxy_sso=error`).
- *   3. `sso-return` parses the fragment (`parseSsoReturnFragment`), validates
- *      `state`, exchanges the `code` via `oxyServices.exchangeSsoCode`, commits
- *      the session, then restores the original destination.
- *
- * Loop proof (logged-out): first load all steps skip → `sso-bounce` sets
- * guard/state/dest + the outcome-independent attempted-flag
- * ({@link ssoAttemptedKey}) and navigates; the IdP (no central session) returns
- * `#oxy_sso=none`; the callback load's `sso-return` sees `none`, sets the
- * NO_SESSION flag ({@link ssoNoSessionKey}), and `sso-bounce` is then disabled.
- * Exactly ONE bounce, no loop. An interrupted bounce (user hit back
- * mid-redirect) self-heals once the {@link SSO_GUARD_TTL_MS} guard TTL lapses.
- * The attempted-flag is the definitive, outcome-INDEPENDENT loop breaker: it is
- * set pre-bounce so even if the return-side NO_SESSION write never lands, the
- * bounce can never re-fire this tab after the self-heal TTL lapses.
- *
- * All state lives in `sessionStorage` (per tab, cleared on tab close) and is
- * keyed per-origin so two RPs hosted in the same browser never collide. The
- * key strings and the 30s TTL are a wire/storage contract — they MUST match
- * the values the IdP and every consumer expect and must not change lightly.
+ * LEGACY(old-sdk): `SSO_CALLBACK_PATH` survives ONLY for the lista-B api/IdP SSO
+ * surface. Deletable once Homiio/Allo/Alia/Syra are bumped off the old SDK AND
+ * CloudWatch `/oxy/ecs` shows the `/sso*` + `/fedcm/*` routes quiet — the
+ * F-final sweep should remove this file then.
  */
 /**
- * The RP callback path the central IdP redirects back to after a bounce. The
- * SSO result is delivered in the fragment of this URL; the `sso-return` step
- * consumes it and then restores the user's real destination (stored under
- * {@link ssoDestKey}), so the user never lingers on this internal path.
+ * The RP callback path the central IdP redirects back to after a legacy SSO
+ * bounce. Kept as the single source of truth so the api/IdP never hardcode the
+ * literal.
  */
 export declare const SSO_CALLBACK_PATH = "/__oxy/sso-callback";
-/**
- * Self-healing TTL (ms) for the bounce guard. An in-flight bounce sets a
- * timestamp guard; if the bounce is interrupted before the callback lands
- * (e.g. the user navigates back mid-redirect), the guard would otherwise pin
- * the RP signed-out forever. After this window the guard is treated as stale
- * and a fresh single bounce is permitted. 30s comfortably exceeds a real
- * redirect round-trip while keeping a crash short-lived.
- */
-export declare const SSO_GUARD_TTL_MS = 30000;
-/** Per-origin CSRF state key (matched on return to defeat fragment forgery). */
-export declare function ssoStateKey(origin: string): string;
-/** Per-origin bounce guard key (a timestamp; loop breaker + self-heal TTL). */
-export declare function ssoGuardKey(origin: string): string;
-/** Per-origin destination key (the real URL to restore after the callback). */
-export declare function ssoDestKey(origin: string): string;
-/**
- * Per-origin "the central IdP has no session for me" key. Set after a
- * `none`/`error` return (or a failed/forged exchange) so `sso-bounce` does not
- * fire again this tab — the definitive loop breaker.
- */
-export declare function ssoNoSessionKey(origin: string): string;
-/**
- * Per-origin, OUTCOME-INDEPENDENT once-guard. Set in `sessionStorage` BEFORE
- * the terminal SSO bounce navigates. Gates the bounce so the silent
- * cross-domain probe fires AT MOST ONCE per tab session — independent of
- * whether the return-side NO_SESSION flag ever lands. The definitive loop
- * breaker; survives the 30s self-heal `ssoGuardKey` TTL. Cleared only on an
- * explicit sign-out/clear so a later cold boot (after the user signs in
- * centrally) can probe again.
- */
-export declare function ssoAttemptedKey(origin: string): string;
-/**
- * Per-origin DURABLE "this device/origin has had a signed-in Oxy session
- * before" hint.
- *
- * Unlike every other key in this module — which lives in per-tab
- * `sessionStorage` — this hint is written to DURABLE storage (web
- * `localStorage`; the services provider uses its own `storageKeyPrefix`-scoped
- * key in `@oxyhq/services`). It is set whenever a session is established or
- * restored and survives a session expiring; it is cleared ONLY on an explicit
- * full sign-out. It exists purely to drive {@link allowSsoBounce}: a returning
- * visitor (hint present) whose local session has lapsed still gets ONE terminal
- * `/sso` establish bounce to recover a session that lives only at the central
- * IdP, while a truly first-time anonymous visitor is never force-bounced.
- */
-export declare function ssoPriorSessionKey(origin: string): string;
-/**
- * Per-origin DURABLE "the user DELIBERATELY signed out on this device/origin"
- * flag.
- *
- * Like {@link ssoPriorSessionKey} this lives in DURABLE storage (web
- * `localStorage`; services uses its own `storageKeyPrefix`-scoped key), NOT the
- * per-tab `sessionStorage` the loop-breaker keys use — it must survive a reload.
- *
- * It exists purely to suppress AUTOMATIC silent restore after a deliberate
- * sign-out: a still-live IdP session (the central `fedcm_session`) would
- * otherwise let the per-apex `/auth/silent` iframe re-mint a session on the
- * very next cold boot, so a user who pressed "Sign out" gets silently signed
- * back in on reload. With this flag set, that silent cold-boot step is
- * skipped while the Gmail-style returning-account fast-path is otherwise
- * preserved.
- *
- * Lifecycle (mirrors the existing gate machinery — set on a definitive event,
- * cleared on its inverse):
- *   - SET on EXPLICIT full sign-out (alongside clearing the prior-session hint
- *     and the SSO bounce state).
- *   - CLEARED on ANY deliberate sign-in (password, account switch, device
- *     claim) so a real sign-in fully re-enables silent restore — there is no
- *     "stuck signed out" state.
- *
- * NOTE: this gates only AUTOMATIC/silent restore. An INTERACTIVE sign-in always
- * clears it first, so the user can always sign back in.
- */
-export declare function ssoSignedOutKey(origin: string): string;
-/**
- * Per-origin key holding the LAST consumed SSO-return outcome (`ok` | `none` |
- * `error`, plus an optional machine-readable `reason` on the non-`ok` outcomes).
- *
- * Lives in per-tab `sessionStorage` like the other loop-breaker keys, and for
- * the same reason: a `none`/`error` return HARD-navigates the RP off the
- * internal callback path back to its real destination (a fresh document load),
- * so the outcome an RP wants to render ("the central IdP had no session — show a
- * branded sign-in screen instead of bouncing again") must survive that
- * round-trip. The RP reads it on the destination load to decide whether an
- * AUTOMATIC (guard-driven) sign-in should re-bounce or defer to a user gesture.
- *
- * Written as a small JSON blob (`{kind, reason?}`). Set whenever a return is
- * consumed; cleared on a successful session commit and on an explicit
- * user-gesture sign-in / full sign-out (so a deliberate retry is never
- * suppressed by a prior automatic none/error).
- */
-export declare function ssoOutcomeKey(origin: string): string;
-/**
- * Per-origin marker written by the pre-hydration callback bootstrap.
- *
- * Static Expo exports render unknown paths as `+not-found`; on
- * `/__oxy/sso-callback` that can fail hydration before the React provider has a
- * chance to run `consumeSsoReturn`. The bootstrap runs in the HTML head, moves
- * the URL to a hydratable route while preserving the SSO fragment, and writes
- * this marker so `consumeSsoReturn` still restores the original destination as
- * if the page were physically on the callback path.
- */
-export declare function ssoCallbackBootstrapKey(origin: string): string;
-/**
- * Inline script for Expo/static web apps.
- *
- * Must run before the app bundle hydrates. It is intentionally tiny and
- * dependency-free: if the browser lands on the internal callback route with an
- * Oxy SSO fragment, it marks the handoff and rewrites the path to `/` while
- * preserving `#oxy_sso=...`. The normal SDK cold-boot `sso-return` step then
- * consumes the fragment from a route that can hydrate. If the internal route is
- * reached without a valid SSO fragment, it leaves the route via a hard root
- * navigation because there is no session material to preserve.
- */
-export declare function getSsoCallbackBootstrapScript(): string;
-/**
- * Perform the terminal top-level SSO bounce navigation.
- *
- * A thin wrapper over `window.location.assign(url)` so the single navigation
- * seam lives in one place (and stays mockable in tests, where jsdom's
- * `Location.assign` is a non-configurable native method). In production this is
- * exactly `window.location.assign` — the document is torn down and replaced by
- * the central IdP page. Off-browser (SSR / native) it is a no-op: native never
- * bounces.
- */
-export declare function ssoNavigate(url: string): void;
-/**
- * Build the central IdP `/sso` bounce URL for an RP.
- *
- * Pure (no DOM access) so it is unit-testable and shared by every consumer's
- * terminal `sso-bounce` step. The IdP reads `client_id` (the RP origin) and
- * `return_to` to mint an origin-bound opaque code and 303-redirect back.
- *
- * The IdP base is resolved via {@link resolveCentralAuthUrl} so an explicit
- * `authWebUrl` override (e.g. a staging IdP) drives the SSO bounce exactly the
- * way it drives FedCM. When omitted, the central default {@link CENTRAL_AUTH_URL}
- * is used.
- *
- * @param origin - The RP origin (`window.location.origin`).
- * @param state - The CSRF state minted for this bounce.
- * @param authWebUrl - Optional explicit IdP base URL override. Falls back to
- *   the central default when `undefined`/empty.
- * @returns The absolute `<idp-origin>/sso?...` URL string.
- */
-export declare function buildSsoBounceUrl(origin: string, state: string, authWebUrl?: string): string;
-/**
- * Whether `origin` IS the central IdP origin. The RP must NEVER bounce while
- * sitting on `auth.oxy.so` itself — doing so would loop the IdP against itself.
- *
- * Both sides are normalised via `new URL(...).origin` so a trailing-slash or
- * path difference never defeats the guard. Returns `false` on any parse
- * failure (an unparseable candidate is, by definition, not the central IdP).
- */
-export declare function isCentralIdPOrigin(origin: string): boolean;
-/**
- * Read the bounce guard and decide whether it is still ACTIVE.
- *
- * Active means: a guard value is present AND it parses to a finite timestamp
- * AND less than {@link SSO_GUARD_TTL_MS} has elapsed since it was set. An active
- * guard disables `sso-bounce` (a bounce is already in flight this tab). A
- * missing, malformed, or expired guard is NOT active, so a fresh bounce may
- * proceed (this is the 30s self-heal for an interrupted bounce).
- *
- * Defensive: a `getItem` that throws (e.g. a locked/disabled storage) is
- * treated as "not active" so the guard never wedges the flow.
- *
- * @param storage - The session storage to read (injected for testability).
- * @param origin - The page origin whose guard to evaluate.
- * @param now - Current epoch ms (injected for deterministic tests). Defaults to
- *   `Date.now()`.
- */
-export declare function guardActive(storage: Pick<Storage, 'getItem'>, origin: string, now?: number): boolean;
-/**
- * Whether AUTOMATIC silent restore is SUPPRESSED for this origin because the
- * user deliberately signed out (the durable {@link ssoSignedOutKey} flag).
- *
- * When `true`, the silent cold-boot step that can re-mint a session from a
- * still-live IdP session WITHOUT user intent — the per-apex
- * `/auth/silent` iframe — MUST be skipped, so a user who pressed "Sign out" is
- * not silently signed back in on the next reload. Interactive sign-in clears the
- * flag, so this never blocks a deliberate re-sign-in.
- *
- * Defensive: a `getItem` that throws (locked/disabled storage) is treated as NOT
- * suppressed, so the gate fails toward the normal restore behaviour rather than
- * wedging the user out.
- *
- * @param storage - The DURABLE storage to read (web `localStorage`; injected for
- *   testability).
- * @param origin - The page origin whose signed-out flag to evaluate.
- */
-export declare function silentRestoreSuppressed(storage: Pick<Storage, 'getItem'>, origin: string): boolean;
-/**
- * Inputs to the smart {@link allowSsoBounce} gate.
- */
-export interface SsoBounceGate {
-    /**
-     * Whether this device/origin has had a signed-in Oxy session before (the
-     * durable {@link ssoPriorSessionKey} hint). Set whenever a session is
-     * established or restored; survives session expiry; cleared only on explicit
-     * full sign-out. `true` ⇒ a returning visitor.
-     */
-    readonly hasPriorSession: boolean;
-    /**
-     * Whether a local/stored session was recovered earlier this cold boot. At the
-     * terminal bounce gate this is effectively always `false` (an earlier step
-     * would have won and short-circuited), but it is part of the contract — "no
-     * prior hint AND no local session" — so it is passed explicitly for fidelity
-     * and robustness.
-     */
-    readonly hasLocalSession: boolean;
-}
-/**
- * Decide whether the terminal `/sso` establish-bounce is ALLOWED for this
- * visitor (the smart `enabled` gate for the `sso-bounce` cold-boot step).
- *
- * The terminal bounce is the ONLY cold-boot step that can recover a session
- * that lives SOLELY at the central IdP — the cross-apex Relying-Party case
- * (e.g. `mention.earth`, a different apex from `oxy.so`) whose device-local
- * session has expired and whose `Domain=oxy.so` refresh cookie never reaches
- * `api.<apex>`. It is also what plants the first-party per-apex `fedcm_session`
- * cookie that the EARLIER `silent-iframe` step later relies on. So it must fire
- * for a RETURNING user, yet it must NOT force a truly first-time anonymous
- * visitor off to the IdP.
- *
- *   - ALLOW when there is a prior-signed-in hint OR a local session was
- *     recovered this boot (a returning user) — so a central-only cross-domain
- *     session recovers via ONE bounce, after which the per-apex cookie is
- *     planted and subsequent loads restore silently with no bounce.
- *   - else (no hint, no local session) SUPPRESS — a first-time anonymous
- *     visitor browses without a forced redirect.
- *
- * This is the smart DEFAULT and the ONLY behaviour: apps never configure it.
- * It is also the GATE DECISION ONLY — callers still apply the per-tab loop
- * guards (`ssoAttemptedKey`, `ssoNoSessionKey`, {@link guardActive}) so an
- * allowed bounce still fires at most once per cold boot.
- */
-export declare function allowSsoBounce(gate: SsoBounceGate): boolean;

package/dist/types/utils/validationUtils.d.ts

@@ -25,6 +25,21 @@ export declare function isValidUsername(username: string): boolean;
  * Validate password strength
  */
 export declare function isValidPassword(password: string): boolean;
+/**
+ * Whether `raw` already satisfies the display-name policy, i.e. it contains no
+ * disallowed characters AND no orphaned combining marks. Used to REJECT native
+ * (signup / profile edit) names with a 400 rather than silently stripping them,
+ * and to validate inline in the client editor.
+ *
+ * The orphaned-mark probe runs on the NFC-normalized form so a legitimate
+ * decomposed accent (`e`+◌́) — which normalization recomposes into `é` — is NOT
+ * rejected, while a lone, base-less mark (e.g. `"༘"`) IS.
+ *
+ * The function only checks the character set; an empty or whitespace-only string
+ * is considered valid (`true`). Call sites that require a non-empty name enforce
+ * that separately.
+ */
+export declare function isValidDisplayName(raw: string): boolean;
 /**
  * Validate required string
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "5.5.0",
+  "version": "7.0.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -94,7 +94,7 @@
     }
   },
   "dependencies": {
-    "@oxyhq/contracts": "^0.8.0",
+    "@oxyhq/contracts": "^0.10.0",
     "@oxyhq/protocol": "^0.1.1",
     "bip39": "^3.1.0",
     "buffer": "^6.0.3",

package/src/HttpService.ts

@@ -70,6 +70,19 @@ export interface RequestOptions {
   signal?: AbortSignal;
   headers?: Record<string, string>;
   responseType?: 'blob';
+  /**
+   * Skip BOTH the bearer auth header (and its near-expiry preflight refresh)
+   * AND the 401-driven auto-refresh/retry for this request.
+   *
+   * Required for the body-authenticated refresh endpoint (`POST
+   * /auth/refresh-token`): it does not need a bearer, and — critically — it is
+   * itself invoked from inside the registered `AuthRefreshHandler`. If it went
+   * through the normal preflight, `getAuthHeader` would call
+   * `refreshAccessToken` while the handler-owning `tokenRefreshPromise` is
+   * still in flight and await ITSELF (deadlock). Skipping auth makes the
+   * refresh call fully independent of the current (near-expired) bearer.
+   */
+  skipAuth?: boolean;
 }
 
 interface RequestConfig extends RequestOptions {
@@ -403,8 +416,11 @@ export class HttpService {
         // Build URL with params
         const fullUrl = this.buildURL(url, params);
         
-        // Get auth token (with auto-refresh)
-        const authHeader = await this.getAuthHeader();
+        // Get auth token (with auto-refresh). `skipAuth` requests (the
+        // body-authenticated refresh endpoint) send NO bearer and skip the
+        // near-expiry preflight — see RequestOptions.skipAuth for the deadlock
+        // this avoids.
+        const authHeader = config.skipAuth ? null : await this.getAuthHeader();
 
         // CSRF protects cookie-authenticated browser writes. Bearer-authenticated
         // SDK clients are not vulnerable to ambient-cookie CSRF, and linked app
@@ -514,7 +530,7 @@ export class HttpService {
           // On 401, delegate refresh to AuthManager and retry once before
           // giving up. HttpService deliberately does not know any session
           // routes; the AuthManager is the single session authority.
-          if (response.status === 401 && !config._isAuthRetry) {
+          if (response.status === 401 && !config._isAuthRetry && !config.skipAuth) {
             const refreshed = await this.refreshAccessToken('response-401');
             if (refreshed) {
               // `deduplicate: false` is REQUIRED on the retry (mirrors the 403
@@ -804,7 +820,7 @@ export class HttpService {
    * `clearCacheByPrefix` sweeps and `clearCacheEntry` base-key matching.
    * The `clearCacheEntry` callsites all pass fixed, dataless logical keys
    * (`GET:/users/<id>`, `GET:/session/user/<sessionId>`,
-   * `GET:/fedcm/me/authorized-apps`), so this readable suffix can never be
+   * `GET:/auth/grants`), so this readable suffix can never be
    * ambiguous with a serialized request body.
    */
   private static readonly CACHE_IDENTITY_DELIM = ' id=';

package/src/OxyServices.base.ts

@@ -8,10 +8,6 @@ import type { OxyConfig as OxyConfigBase, ApiError, User } from './models/interf
 import { handleHttpError } from './utils/errorUtils';
 import { HttpService, type AuthRefreshReason, type RequestOptions } from './HttpService';
 import { OxyAuthenticationError, OxyAuthenticationTimeoutError } from './OxyServices.errors';
-import { resolveCentralAuthUrl } from './utils/authWebUrl';
-import { isWeb } from './utils/platform';
-import { registrableApex } from './utils/fapiAutoDetect';
-import { logger } from './utils/loggerUtils';
 
 export interface OxyConfig extends OxyConfigBase {
   cloudURL?: string;
@@ -44,23 +40,15 @@ export class OxyServicesBase {
       throw new Error('OxyConfig is required');
     }
 
-    // Default `authWebUrl` to the CENTRAL IdP (`auth.oxy.so`) when the caller
-    // did not pin it explicitly. TRUE central cross-domain SSO (Google/Meta/
-    // Clerk style) routes every RP through the one central IdP — it owns the
-    // host-only `fedcm_session` cookie and the central session store — so the
-    // SDK no longer derives a per-apex `auth.<rp-apex>` IdP by default.
-    // `autoDetectAuthWebUrl` is still exported for any call site that opts into
-    // per-apex resolution, but it is NOT the constructor default anymore.
-    // An explicit `authWebUrl` always wins (we only fill it when absent).
-    const resolvedConfig: OxyConfig = config.authWebUrl
-      ? config
-      : { ...config, authWebUrl: resolveCentralAuthUrl(config.authWebUrl) };
-
-    this.config = resolvedConfig;
-    this.cloudURL = resolvedConfig.cloudURL || 'https://cloud.oxy.so';
+    // `authWebUrl` is a plain optional config value now (used only for building
+    // third-party "Sign in with Oxy" OAuth links). The SDK no longer derives or
+    // defaults an IdP host — the device-first cold boot restores sessions from
+    // the persisted refresh store, not an `auth.<apex>` bounce.
+    this.config = config;
+    this.cloudURL = config.cloudURL || 'https://cloud.oxy.so';
 
     // Initialize unified HTTP service (handles auth, caching, deduplication, queuing, retry)
-    this.httpService = new HttpService(resolvedConfig);
+    this.httpService = new HttpService(config);
   }
 
   // Test-only utility to reset tokens on this instance between jest tests
@@ -99,23 +87,6 @@ export class OxyServicesBase {
     return this.httpService.getBaseURL();
   }
 
-  /**
-   * Get the base URL the SDK's first-party session/refresh calls should target.
-   *
-   * Returns the configured `sessionBaseUrl` when provided, otherwise falls back
-   * to the API `baseURL` (`getBaseURL()`). Per the 2026 session architecture
-   * (docs/SESSION-ARCHITECTURE.md), non-`oxy.so` apps point this at their own
-   * same-site backend (e.g. `https://api.mention.earth`) whose session bridge
-   * forwards the user's refresh credential to `api.oxy.so`; `*.oxy.so` apps
-   * leave it unset so it resolves to `https://api.oxy.so` and nothing changes.
-   *
-   * This is additive: it only exposes configuration for `@oxyhq/services` to
-   * consume in a later phase. No refresh/auth logic in core reads it yet.
-   */
-  public getSessionBaseUrl(): string {
-    return this.config.sessionBaseUrl ?? this.getBaseURL();
-  }
-
   /**
    * Get the HTTP service instance
    * Useful for advanced use cases where direct access to the HTTP service is needed
@@ -313,82 +284,6 @@ export class OxyServicesBase {
     return this.httpService.getAccessToken();
   }
 
-  /**
-   * Register the CURRENTLY-ACTIVE session in the device's first-party
-   * multi-account refresh-cookie set by calling `POST /auth/session`.
-   *
-   * This is the single, shared primitive every web primary-session commit and the
-   * account switch use to plant their `oxy_rt_<authuser>` slot. It MUST be a
-   * dedicated call to `/auth/session` rather than relying on whichever endpoint
-   * established the session: that endpoint is frequently OUTSIDE the cookie's
-   * `Path=/auth` scope (`/accounts/:id/switch`) or is a cross-origin/credential-
-   * less restore (`/sso/exchange`, the IdP `/auth/silent` postMessage) that cannot
-   * set an `api.oxy.so` cookie at all. `/auth/session` runs where the device's
-   * existing slots ARE visible, so the server resolves this user's slot (reusing an
-   * existing one or allocating a new one) without clobbering a sibling account,
-   * mints a fresh access token bound to the same session, and returns the resolved
-   * `authuser`.
-   *
-   * Behaviour:
-   * - Requires a planted bearer (the caller must have already installed the
-   *   session's access token); `/auth/session` derives the session from it.
-   * - On success re-plants the rotated access token (so the active token matches
-   *   the freshly-rotated cookie) and returns the device `authuser` slot.
-   * - WEB-ONLY: on native there are no first-party refresh cookies → returns
-   *   `null`.
-   * - FIRST-PARTY-ONLY: the cookie is host-only on the API host with
-   *   `SameSite=Lax`, so it only sticks when the page is SAME-SITE (same
-   *   registrable apex) as the API. On a cross-apex RP (`mention.earth` calling
-   *   `api.oxy.so`) the browser rejects the `Set-Cookie` as a third-party cookie,
-   *   so a returned slot would be a phantom never enumerated by `refresh-all`.
-   *   Those RPs durably restore via the per-apex `/auth/silent` iframe + `/sso`
-   *   bounce, NOT this device set → returns `null` without calling the API.
-   * - BEST-EFFORT: a failure (e.g. transient network) never throws — the session
-   *   stays active in-memory; only its reload durability via the device set is at
-   *   risk. The caller treats `null` as "not registered in the device set".
-   *
-   * @returns The resolved device `authuser` slot, or `null` on native / cross-apex
-   *   / failure.
-   */
-  public async establishDeviceRefreshSlot(): Promise<number | null> {
-    if (!isWeb()) {
-      return null;
-    }
-    if (typeof window !== 'undefined' && window.location?.hostname) {
-      const pageApex = registrableApex(window.location.hostname);
-      let apiApex: string | null = null;
-      try {
-        apiApex = registrableApex(new URL(this.getBaseURL()).hostname);
-      } catch {
-        apiApex = null;
-      }
-      if (!pageApex || !apiApex || pageApex !== apiApex) {
-        return null;
-      }
-    }
-    try {
-      const established = await this.makeRequest<{ accessToken?: string; authuser?: number }>(
-        'POST',
-        '/auth/session',
-        undefined,
-        { cache: false },
-      );
-      // `/auth/session` mints a fresh access token off the same session; re-plant
-      // it so the active token matches the rotated cookie.
-      if (established?.accessToken) {
-        this.setTokens(established.accessToken);
-      }
-      return typeof established?.authuser === 'number' ? established.authuser : null;
-    } catch (error) {
-      logger.warn(
-        '[OxyServices] Failed to establish device refresh cookie via POST /auth/session; the session is active in-session but may not survive a reload as part of the device account set',
-        { component: 'OxyServices', method: 'establishDeviceRefreshSlot' },
-        error,
-      );
-      return null;
-    }
-  }
-
   /**
    * Decode the current access token and return its `exp` claim in SECONDS since
    * the Unix epoch (the raw JWT `exp` unit), or `null` when there is no token,

package/src/OxyServices.ts

@@ -58,10 +58,6 @@
  */
 import { OxyServicesBase, type LinkedHttpClient, type OxyConfig } from './OxyServices.base';
 import { OxyAuthenticationError, OxyAuthenticationTimeoutError } from './OxyServices.errors';
-import type { SessionLoginResponse } from './models/session';
-import type { FedCMAuthOptions, FedCMConfig } from './mixins/OxyServices.fedcm';
-import type { SilentAuthOptions } from './mixins/OxyServices.silent';
-import type { RedirectAuthOptions } from './mixins/OxyServices.redirect';
 
 // Import mixin composition helper
 import { composeOxyServices } from './mixins';
@@ -111,16 +107,6 @@ const OxyServicesComposed = composeOxyServices();
 // We extend the composed constructor directly — its public surface is broadened
 // to the full mixin set via the interface declaration that follows.
 export class OxyServices extends OxyServicesComposed {
-  /**
-   * FedCM credential-request timeouts (ms). The runtime values are defined on
-   * the FedCM mixin and inherited here via `extends`; these `declare` members
-   * surface their types to TypeScript without re-emitting (or duplicating) the
-   * literals, so consumers/tests can reference `OxyServices.FEDCM_SILENT_TIMEOUT`
-   * with full typing.
-   */
-  declare static readonly FEDCM_TIMEOUT: number;
-  declare static readonly FEDCM_SILENT_TIMEOUT: number;
-
   constructor(config: OxyConfig) {
     super(config);
   }
@@ -133,30 +119,6 @@ export class OxyServices extends OxyServicesComposed {
 export interface OxyServices extends InstanceType<ReturnType<typeof composeOxyServices>> {
   createLinkedClient(config: OxyConfig): LinkedHttpClient;
 
-  // FedCM authentication
-  isFedCMSupported(): boolean;
-  signInWithFedCM(options?: FedCMAuthOptions): Promise<SessionLoginResponse>;
-  silentSignInWithFedCM(): Promise<SessionLoginResponse | null>;
-  revokeFedCMCredential(): Promise<void>;
-  getFedCMConfig(): FedCMConfig;
-
-  // Silent iframe SSO
-  resolveAuthUrl(): string;
-  silentSignIn(options?: SilentAuthOptions): Promise<SessionLoginResponse | null>;
-  waitForIframeAuth(
-    iframe: HTMLIFrameElement,
-    timeout: number,
-    expectedOrigin: string,
-  ): Promise<SessionLoginResponse | null>;
-
-  // Redirect authentication
-  signInWithRedirect(options?: RedirectAuthOptions): void;
-  signUpWithRedirect(options?: RedirectAuthOptions): void;
-
-  // Central cross-domain SSO (opaque single-use code exchange)
-  exchangeSsoCode(code: string, state?: string): Promise<SessionLoginResponse>;
-  generateSsoState(): string;
-
   // Express.js middleware
   auth(options?: {
     debug?: boolean;