@oxyhq/core 5.5.0 → 7.0.0

package/src/crypto/keyManager.ts

@@ -91,6 +91,11 @@ const STORAGE_KEYS = {
   SHARED_PUBLIC_KEY: 'oxy_shared_identity_public_key',
   SHARED_SESSION_TOKEN: 'oxy_shared_session_token',
   SHARED_SESSION_ID: 'oxy_shared_session_id',
+  // Opaque device-attribution token, shared across all Oxy apps on one device
+  // so they all resolve to a SINGLE server-side DeviceSession (device-first
+  // session model). Add-only: it never carries session state, only attributes
+  // a newly-credentialed session to the shared device set.
+  SHARED_DEVICE_TOKEN: 'oxy_shared_device_token',
 } as const;
 
 /**
@@ -643,6 +648,102 @@ export class KeyManager {
     }
   }
 
+  /**
+   * Store the opaque device-attribution token in the SHARED keychain so every
+   * Oxy app on this device reads the SAME token and therefore resolves to one
+   * server-side DeviceSession.
+   *
+   * Mirrors the shared-session storage options exactly (iOS keychain access
+   * group `group.so.oxy.shared`; Android shared secure store). Native-only —
+   * a no-op on web (the shared keychain does not exist there; web persists its
+   * deviceToken in the per-origin {@link AuthStateStore} instead).
+   */
+  static async setSharedDeviceToken(deviceToken: string): Promise<void> {
+    if (isWebPlatform()) {
+      return; // Not supported on web
+    }
+
+    try {
+      const store = await initSecureStore();
+
+      if (isIOS()) {
+        const opts: OxySecureStoreOptions = {
+          keychainAccessible: store.WHEN_UNLOCKED,
+          keychainAccessGroup: IOS_KEYCHAIN_GROUP,
+        };
+        await store.setItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN, deviceToken, opts);
+      } else if (isAndroid()) {
+        await store.setItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN, deviceToken);
+      }
+
+      if (isDev()) {
+        logger.debug('Shared device token stored successfully', { component: 'KeyManager' });
+      }
+    } catch (error) {
+      if (isDev()) {
+        logger.error('Failed to store shared device token', error, { component: 'KeyManager' });
+      }
+      throw error;
+    }
+  }
+
+  /**
+   * Read the shared device-attribution token, or `null` when none is set (or
+   * on web). Mirrors {@link getSharedSession}'s keychain-access-group read.
+   */
+  static async getSharedDeviceToken(): Promise<string | null> {
+    if (isWebPlatform()) {
+      return null;
+    }
+
+    try {
+      const store = await initSecureStore();
+
+      if (isIOS()) {
+        const opts: OxySecureStoreOptions = { keychainAccessGroup: IOS_KEYCHAIN_GROUP };
+        return await store.getItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN, opts);
+      }
+      if (isAndroid()) {
+        return await store.getItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN);
+      }
+      return null;
+    } catch (error) {
+      if (isDev()) {
+        logger.warn('Failed to get shared device token', { component: 'KeyManager' }, error);
+      }
+      return null;
+    }
+  }
+
+  /**
+   * Delete the shared device-attribution token (device signout-all). Best-effort:
+   * a keychain failure is logged, not thrown, so it cannot block a sign-out.
+   */
+  static async clearSharedDeviceToken(): Promise<void> {
+    if (isWebPlatform()) {
+      return;
+    }
+
+    try {
+      const store = await initSecureStore();
+
+      if (isIOS()) {
+        const opts: OxySecureStoreOptions = { keychainAccessGroup: IOS_KEYCHAIN_GROUP };
+        await store.deleteItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN, opts);
+      } else if (isAndroid()) {
+        await store.deleteItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN);
+      }
+
+      if (isDev()) {
+        logger.debug('Shared device token cleared successfully', { component: 'KeyManager' });
+      }
+    } catch (error) {
+      if (isDev()) {
+        logger.error('Failed to clear shared device token', error, { component: 'KeyManager' });
+      }
+    }
+  }
+
   // ==================== END SHARED IDENTITY METHODS ====================
 
   /**

package/src/i18n/locales/en-US.json

@@ -2,6 +2,13 @@
   "signin": {
     "title": "Sign In",
     "subtitle": "Sign in to continue your journey",
+    "chooser": {
+      "title": "Choose an account",
+      "subtitle": "Continue as an account below, or use another.",
+      "signedIn": "Signed in",
+      "useAnother": "Use another account",
+      "continueAs": "Continue as {{name}}"
+    },
     "addAccountTitle": "Add Another Account",
     "addAccountSubtitle": "Sign in with another account",
     "username": {
@@ -602,6 +609,7 @@
   "editProfile": {
     "title": "Edit Profile",
     "subtitle": "Manage your profile and preferences",
+    "notSet": "Not set",
     "sections": {
       "profilePicture": "Profile Picture",
       "basicInfo": "Basic Information",
@@ -610,6 +618,9 @@
       "security": "Security"
     },
     "items": {
+      "avatar": {
+        "subtitle": "Update your profile photo"
+      },
       "displayName": {
         "title": "Display Name",
         "subtitle": "This is how your name will appear to others",
@@ -617,7 +628,8 @@
         "firstName": "First Name",
         "firstNamePlaceholder": "Enter first name",
         "lastName": "Last Name",
-        "lastNamePlaceholder": "Enter last name (optional)"
+        "lastNamePlaceholder": "Enter last name (optional)",
+        "invalidChars": "Use letters and spaces only"
       },
       "username": {
         "title": "Username",

package/src/i18n/locales/es-ES.json

@@ -2,6 +2,13 @@
   "signin": {
     "title": "Iniciar sesión",
     "subtitle": "Inicia sesión para continuar",
+    "chooser": {
+      "title": "Elige una cuenta",
+      "subtitle": "Continúa con una de tus cuentas o usa otra.",
+      "signedIn": "Sesión activa",
+      "useAnother": "Usar otra cuenta",
+      "continueAs": "Continuar como {{name}}"
+    },
     "addAccountTitle": "Agregar otra cuenta",
     "addAccountSubtitle": "Inicia sesión con otra cuenta",
     "username": {
@@ -152,6 +159,7 @@
   "editProfile": {
     "title": "Editar perfil",
     "subtitle": "Gestiona tu perfil y preferencias",
+    "notSet": "Sin definir",
     "sections": {
       "profilePicture": "Foto de perfil",
       "basicInfo": "Información básica",
@@ -160,6 +168,9 @@
       "security": "Seguridad"
     },
     "items": {
+      "avatar": {
+        "subtitle": "Actualiza tu foto de perfil"
+      },
       "displayName": {
         "title": "Nombre para mostrar",
         "subtitle": "Así aparecerá tu nombre para los demás",
@@ -167,7 +178,8 @@
         "firstName": "Nombre",
         "firstNamePlaceholder": "Introduce tu nombre",
         "lastName": "Apellido",
-        "lastNamePlaceholder": "Introduce tu apellido (opcional)"
+        "lastNamePlaceholder": "Introduce tu apellido (opcional)",
+        "invalidChars": "Usa solo letras y espacios"
       },
       "username": {
         "title": "Usuario",

package/src/index.ts

@@ -34,25 +34,6 @@ export type { AuthRefreshReason, AuthRefreshHandler } from './HttpService';
 // ---------------------------------------------------------------------------
 // Authentication
 // ---------------------------------------------------------------------------
-export { AuthManager, createAuthManager } from './AuthManager';
-export type {
-    StorageAdapter,
-    AuthStateChangeCallback,
-    AuthMethod,
-    AuthManagerConfig,
-} from './AuthManager';
-export type {
-    AuthManagerAccount,
-    RestoreFromCookiesResult,
-    RestoreFromCookiesOptions,
-    SwitchAuthuserResult,
-} from './AuthManagerTypes';
-
-export { CrossDomainAuth, createCrossDomainAuth } from './CrossDomainAuth';
-export type { CrossDomainAuthOptions } from './CrossDomainAuth';
-export type { FedCMAuthOptions, FedCMConfig, AuthorizedApp } from './mixins/OxyServices.fedcm';
-export type { SilentAuthOptions } from './mixins/OxyServices.silent';
-export type { RedirectAuthOptions } from './mixins/OxyServices.redirect';
 export { ServiceCredentialMismatchError } from './mixins/OxyServices.auth';
 export type { ServiceTokenResponse } from './mixins/OxyServices.auth';
 // "Sign in with Oxy" — handoff (Workstream C)
@@ -245,16 +226,6 @@ export type {
     SessionLoginResponse,
 } from './models/session';
 
-// ---------------------------------------------------------------------------
-// Multi-account refresh-all (Google-style)
-// ---------------------------------------------------------------------------
-export type {
-    RefreshAllResponse,
-    RefreshAllAccount,
-    RefreshAllAccountUser,
-    RefreshCookieResponse,
-} from './models/interfaces';
-
 // ---------------------------------------------------------------------------
 // Crypto / identity
 // ---------------------------------------------------------------------------
@@ -367,6 +338,7 @@ export {
     isNative,
     isIOS,
     isAndroid,
+    isWebBrowser,
 } from './utils/platform';
 export type { PlatformOS } from './utils/platform';
 
@@ -468,6 +440,7 @@ export {
     isValidEmail,
     isValidUsername,
     isValidPassword,
+    isValidDisplayName,
     isRequiredString,
     isRequiredNumber,
     isRequiredBoolean,
@@ -514,48 +487,27 @@ export {
     getAccountDisplayName,
     getAccountFallbackHandle,
     formatPublicKeyHandle,
-    mergeAccountsFromRefreshAll,
     getAccountColor,
 } from './utils/accountUtils';
 export type { QuickAccount, DisplayNameUserShape } from './utils/accountUtils';
 
 // ---------------------------------------------------------------------------
-// Cross-domain SSO infrastructure
+// Registrable-domain + central-IdP-apex helpers.
+//
+// The client SSO-bounce / silent-iframe / FedCM machinery was removed in the
+// device-first cutover (wave 2, ecosystem-wide bump complete). `registrableApex`
+// (eTLD+1) and `CENTRAL_IDP_APEX` are still genuinely used: `registrableApex`
+// via the `@oxyhq/core/server` re-export consumed by
+// `packages/api/src/utils/sameSite.ts` for same-site origin checks, and
+// `CENTRAL_IDP_APEX` by `server/cors.ts`'s `createOxyCors` (auto-allows
+// `*.oxy.so`). `SSO_CALLBACK_PATH` has no remaining importer outside this
+// module as of wave 2 — kept exported for now rather than removed here (an
+// export deletion is a logic change, out of scope for a comment sweep); flag
+// for a follow-up dead-export cleanup pass.
 // ---------------------------------------------------------------------------
-export { autoDetectAuthWebUrl, registrableApex } from './utils/fapiAutoDetect';
-
-// Central cross-domain SSO (opaque single-use code bounce via auth.oxy.so)
-export { CENTRAL_AUTH_URL, CENTRAL_IDP_APEX, resolveCentralAuthUrl } from './utils/authWebUrl';
-export { parseSsoReturnFragment, consumeSsoReturn } from './utils/ssoReturn';
-export type { SsoReturnKind, SsoReturnResult, ConsumeSsoReturnDeps } from './utils/ssoReturn';
-export { generateSsoState } from './mixins/OxyServices.sso';
-
-// Post-claim durable-session establish hop (web device-flow / QR sign-in).
-export { establishIdpSessionAfterClaim } from './utils/ssoEstablish';
-export type { SsoEstablishClient, EstablishAfterClaimDeps } from './utils/ssoEstablish';
-
-// SSO bounce — per-origin sessionStorage keys, bounce URL builder, predicates
-export {
-    SSO_CALLBACK_PATH,
-    SSO_GUARD_TTL_MS,
-    ssoStateKey,
-    ssoGuardKey,
-    ssoDestKey,
-    ssoNoSessionKey,
-    ssoAttemptedKey,
-    ssoPriorSessionKey,
-    ssoSignedOutKey,
-    ssoOutcomeKey,
-    ssoCallbackBootstrapKey,
-    ssoNavigate,
-    getSsoCallbackBootstrapScript,
-    buildSsoBounceUrl,
-    isCentralIdPOrigin,
-    guardActive,
-    silentRestoreSuppressed,
-    allowSsoBounce,
-} from './utils/ssoBounce';
-export type { SsoBounceGate } from './utils/ssoBounce';
+export { registrableApex } from './utils/registrableApex';
+export { CENTRAL_IDP_APEX } from './utils/authWebUrl';
+export { SSO_CALLBACK_PATH } from './utils/ssoBounce';
 
 export { runColdBoot } from './utils/coldBoot';
 export type {
@@ -591,6 +543,64 @@ export {
     accountIdsOf,
 } from './session/projectSessionState';
 
+// ---------------------------------------------------------------------------
+// Device-first session machinery (auth centralization, wave 1) — additive.
+// Persisted auth-state store, the unified refresh handler + scheduler, the
+// cold-boot v2 runner, and the device-boot return-fragment consumer. Built ON
+// the existing `runColdBoot` primitive + `SessionClient`; the legacy
+// FedCM/SSO/CrossDomainAuth surface is untouched (cutover happens in F4).
+// ---------------------------------------------------------------------------
+export {
+    createWebAuthStateStore,
+    createNativeAuthStateStore,
+    createMemoryAuthStateStore,
+    AUTH_STATE_STORAGE_KEY,
+    DEVICE_TOKEN_STORAGE_KEY,
+} from './session/authStateStore';
+export type {
+    PersistedAuthState,
+    AuthStateStore,
+    NativeKeyValueStorage,
+} from './session/authStateStore';
+
+export {
+    refreshPersistedSession,
+    createAuthRefreshHandler,
+    installAuthRefreshHandler,
+    startTokenRefreshScheduler,
+    TOKEN_REFRESH_LEAD_MS,
+} from './session/refresh';
+export type { RefreshDeps, TokenRefreshSchedulerHandle } from './session/refresh';
+
+export {
+    runSessionColdBoot,
+    createBrowserColdBootDom,
+    isSameApex,
+    BOOT_ATTEMPTED_KEY,
+} from './boot/coldBootV2';
+export type {
+    RunSessionColdBootOptions,
+    ColdBootDom,
+    SignedOutReason,
+} from './boot/coldBootV2';
+
+export {
+    consumeDeviceBootReturn,
+    parseDeviceBootFragment,
+    hashHasBootFragment,
+    BOOT_FRAGMENT_PARAM,
+    BOOT_STATE_SESSION_KEY,
+} from './boot/deviceBootReturn';
+export type {
+    DeviceBootSession,
+    DeviceBootReturnOutcome,
+    ConsumeDeviceBootReturnDeps,
+} from './boot/deviceBootReturn';
+
+// The web-session result contract (`WebSessionResult`) is owned by
+// `@oxyhq/contracts` — import it directly from there; `@oxyhq/core` does not
+// re-export contract types.
+
 // API response contracts (request/response Zod schemas + inferred types) live in
 // `@oxyhq/contracts` — the single source of truth shared by the backend and every
 // client SDK. Import them directly from `@oxyhq/contracts`; `@oxyhq/core` does NOT

package/src/mixins/OxyServices.accounts.ts

@@ -28,8 +28,9 @@
  * SWITCHING INTO AN ACCOUNT: `switchToAccount(accountId)` mints a REAL session
  * for the target account and plants it as the active session — there is no
  * per-request "acting-as" header. Identity is carried by the session/token, not
- * a delegation header, so a switch propagates through reload and `refresh-all`
- * exactly like a login.
+ * a delegation header, so a switch propagates through reload and cross-domain
+ * exactly like a login, via the device-first session model (the server
+ * registers the switched session into the operator's device-set directly).
  */
 import type { User } from '../models/interfaces';
 import type { SessionLoginResponse } from '../models/session';
@@ -434,22 +435,22 @@ export interface AccountSuccessResult {
 /**
  * Result of {@link OxyServicesAccountsMixin.switchToAccount} — the freshly
  * minted session for the target account, in the SAME shape the canonical login
- * / `claimSessionByToken` responses use (`SessionLoginResponse`), plus the
- * device-local refresh-cookie slot index.
+ * / `claimSessionByToken` responses use (`SessionLoginResponse`).
  *
  * `accessToken` is the first access token for the new session (already planted
- * as the active token by `switchToAccount`). The refresh token is NOT in the
- * body — the server sets it as the httpOnly `oxy_rt_<authuser>` cookie, which
- * joins the device multi-account set so the switched session survives reload and
- * propagates cross-domain via `/auth/refresh-all`. `user` is the target account.
+ * as the active token by `switchToAccount`). The switched session's survival
+ * across reload and cross-domain sync is device-first: the server registers
+ * it into the operator's `DeviceSession` set directly
+ * (`deviceSessionService.addAccount`, broadcast to the device room) — there is
+ * no client-side refresh-cookie slot to establish. `user` is the target
+ * account.
  */
 export interface SwitchAccountResult extends SessionLoginResponse {
   /**
-   * The device-local refresh-cookie slot index (`oxy_rt_<authuser>`) the server
-   * assigned to the minted session. Surfaced so the consumer can register the
-   * new session in its device multi-account set exactly like a login response.
-   * Absent only when the server could not set the cookie (best-effort — the
-   * switch itself still succeeds).
+   * Legacy device-local refresh-cookie slot index. The current server switch
+   * response never sets this field (device-set registration replaced the
+   * cookie-slot model) — kept optional for backward type-compatibility with
+   * any caller still reading it, but always `undefined` in practice.
    */
   authuser?: number;
 }
@@ -515,24 +516,18 @@ export function OxyServicesAccountsMixin<T extends typeof OxyServicesBase>(Base:
      * target, directly or inherited — else 403; 404 if missing/archived; 403 if
      * the target is a personal account), then mints a REAL session for the
      * target account and returns it in the canonical login / `claimSessionByToken`
-     * shape (`{ sessionId, deviceId, expiresAt, accessToken, user, authuser }`).
+     * shape (`{ sessionId, deviceId, expiresAt, accessToken, user }`).
      *
      * Unlike the removed `X-Acting-As` delegation header, the returned session
      * IS the new identity: this plants `accessToken` as the active token —
      * exactly like `claimSessionByToken` / `verifyChallenge` — so every
      * subsequent request authenticates as the target account.
      *
-     * Joining the device multi-account set (so the switch survives a reload and
-     * propagates cross-domain via `/auth/refresh-all`) requires a SECOND call, to
-     * `POST /auth/session`, made here after the token is planted. The switch route
-     * lives at `/accounts/*`, OUTSIDE the `oxy_rt_<authuser>` cookie's `Path=/auth`
-     * scope, so the server never sees the device's existing slots from it and
-     * would clobber slot 0 (destroying the operator's own session). `/auth/session`
-     * runs where those cookies ARE visible, so the server allocates a NEW slot that
-     * coexists with the operator's and returns its `authuser`. This step is
-     * web-only (native multi-account uses stored sessions, not cookies) and
-     * best-effort — a failure leaves the in-session switch intact; the switched
-     * account simply won't survive a reload until the cookie is next established.
+     * A single call is all that's needed: the server registers the switched
+     * session into the operator's `DeviceSession` set directly, inheriting the
+     * operator's central `deviceId` so the switch survives a reload and syncs
+     * cross-domain via the same device-first session model as a normal login —
+     * there is no separate client-side cookie/slot step to make it stick.
      *
      * After planting, the SDK's identity-scoped GET cache is fully cleared so
      * every cached read re-fetches as the new account. (The consuming
@@ -542,7 +537,7 @@ export function OxyServicesAccountsMixin<T extends typeof OxyServicesBase>(Base:
      * same-user silent refreshes, so the sweep here is explicit.)
      *
      * @param accountId - The target account's Mongo `_id`.
-     * @returns The minted session (planted) plus the device `authuser` slot.
+     * @returns The minted session, already planted as the active session.
      */
     async switchToAccount(accountId: string): Promise<SwitchAccountResult> {
       try {
@@ -555,23 +550,16 @@ export function OxyServicesAccountsMixin<T extends typeof OxyServicesBase>(Base:
 
         // Plant the freshly minted session as the ACTIVE session, mirroring
         // `claimSessionByToken` / `verifyChallenge`: the response body carries
-        // the first access token. The device refresh cookie is established below.
+        // the first access token.
         if (res?.accessToken) {
           this.setTokens(res.accessToken);
         }
 
-        // Register the switched session in the device's multi-account set by
-        // establishing its first-party refresh cookie. This MUST be a separate
-        // call to `POST /auth/session` (the shared `establishDeviceRefreshSlot`
-        // primitive): the switch route is at `/accounts/*`, outside the
-        // `oxy_rt_<authuser>` cookie's `Path=/auth` scope, so it can never read
-        // the device's existing slots and would overwrite slot 0 (destroying the
-        // operator's own session). `/auth/session` runs where the cookies ARE
-        // visible, so the server allocates a NEW slot that coexists with the
-        // operator's and returns its `authuser`. Web-only; best-effort (the helper
-        // re-plants the rotated access token and returns `null` on native/failure).
-        const establishedAuthuser = await this.establishDeviceRefreshSlot();
-        const authuser = establishedAuthuser ?? res.authuser;
+        // The switch route now registers the switched session in the device's
+        // server-side DeviceSession set directly (device-first), so there is no
+        // client-side refresh-cookie slot to establish — the `authuser` comes
+        // from the switch response (optional-chained to match `res?.accessToken`).
+        const authuser = res?.authuser;
 
         // Identity changed → drop the entire GET response cache so no entry
         // personalised for the previous identity is reused. Cache keys are