@oxyhq/core 5.5.0 → 7.0.0

package/dist/cjs/crypto/keyManager.js

@@ -57,6 +57,11 @@ const STORAGE_KEYS = {
     SHARED_PUBLIC_KEY: 'oxy_shared_identity_public_key',
     SHARED_SESSION_TOKEN: 'oxy_shared_session_token',
     SHARED_SESSION_ID: 'oxy_shared_session_id',
+    // Opaque device-attribution token, shared across all Oxy apps on one device
+    // so they all resolve to a SINGLE server-side DeviceSession (device-first
+    // session model). Add-only: it never carries session state, only attributes
+    // a newly-credentialed session to the shared device set.
+    SHARED_DEVICE_TOKEN: 'oxy_shared_device_token',
 };
 /**
  * iOS Keychain Access Group for sharing identities across Oxy apps
@@ -544,6 +549,96 @@ class KeyManager {
             return false;
         }
     }
+    /**
+     * Store the opaque device-attribution token in the SHARED keychain so every
+     * Oxy app on this device reads the SAME token and therefore resolves to one
+     * server-side DeviceSession.
+     *
+     * Mirrors the shared-session storage options exactly (iOS keychain access
+     * group `group.so.oxy.shared`; Android shared secure store). Native-only —
+     * a no-op on web (the shared keychain does not exist there; web persists its
+     * deviceToken in the per-origin {@link AuthStateStore} instead).
+     */
+    static async setSharedDeviceToken(deviceToken) {
+        if (isWebPlatform()) {
+            return; // Not supported on web
+        }
+        try {
+            const store = await initSecureStore();
+            if ((0, platform_1.isIOS)()) {
+                const opts = {
+                    keychainAccessible: store.WHEN_UNLOCKED,
+                    keychainAccessGroup: IOS_KEYCHAIN_GROUP,
+                };
+                await store.setItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN, deviceToken, opts);
+            }
+            else if ((0, platform_1.isAndroid)()) {
+                await store.setItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN, deviceToken);
+            }
+            if ((0, debugUtils_1.isDev)()) {
+                loggerUtils_1.logger.debug('Shared device token stored successfully', { component: 'KeyManager' });
+            }
+        }
+        catch (error) {
+            if ((0, debugUtils_1.isDev)()) {
+                loggerUtils_1.logger.error('Failed to store shared device token', error, { component: 'KeyManager' });
+            }
+            throw error;
+        }
+    }
+    /**
+     * Read the shared device-attribution token, or `null` when none is set (or
+     * on web). Mirrors {@link getSharedSession}'s keychain-access-group read.
+     */
+    static async getSharedDeviceToken() {
+        if (isWebPlatform()) {
+            return null;
+        }
+        try {
+            const store = await initSecureStore();
+            if ((0, platform_1.isIOS)()) {
+                const opts = { keychainAccessGroup: IOS_KEYCHAIN_GROUP };
+                return await store.getItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN, opts);
+            }
+            if ((0, platform_1.isAndroid)()) {
+                return await store.getItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN);
+            }
+            return null;
+        }
+        catch (error) {
+            if ((0, debugUtils_1.isDev)()) {
+                loggerUtils_1.logger.warn('Failed to get shared device token', { component: 'KeyManager' }, error);
+            }
+            return null;
+        }
+    }
+    /**
+     * Delete the shared device-attribution token (device signout-all). Best-effort:
+     * a keychain failure is logged, not thrown, so it cannot block a sign-out.
+     */
+    static async clearSharedDeviceToken() {
+        if (isWebPlatform()) {
+            return;
+        }
+        try {
+            const store = await initSecureStore();
+            if ((0, platform_1.isIOS)()) {
+                const opts = { keychainAccessGroup: IOS_KEYCHAIN_GROUP };
+                await store.deleteItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN, opts);
+            }
+            else if ((0, platform_1.isAndroid)()) {
+                await store.deleteItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN);
+            }
+            if ((0, debugUtils_1.isDev)()) {
+                loggerUtils_1.logger.debug('Shared device token cleared successfully', { component: 'KeyManager' });
+            }
+        }
+        catch (error) {
+            if ((0, debugUtils_1.isDev)()) {
+                loggerUtils_1.logger.error('Failed to clear shared device token', error, { component: 'KeyManager' });
+            }
+        }
+    }
     // ==================== END SHARED IDENTITY METHODS ====================
     /**
      * Atomically persist a key pair to secure storage with verification + backup.

package/dist/cjs/i18n/locales/en-US.json

@@ -2,6 +2,13 @@
     "signin": {
         "title": "Sign In",
         "subtitle": "Sign in to continue your journey",
+        "chooser": {
+            "title": "Choose an account",
+            "subtitle": "Continue as an account below, or use another.",
+            "signedIn": "Signed in",
+            "useAnother": "Use another account",
+            "continueAs": "Continue as {{name}}"
+        },
         "addAccountTitle": "Add Another Account",
         "addAccountSubtitle": "Sign in with another account",
         "username": {
@@ -602,6 +609,7 @@
     "editProfile": {
         "title": "Edit Profile",
         "subtitle": "Manage your profile and preferences",
+        "notSet": "Not set",
         "sections": {
             "profilePicture": "Profile Picture",
             "basicInfo": "Basic Information",
@@ -610,6 +618,9 @@
             "security": "Security"
         },
         "items": {
+            "avatar": {
+                "subtitle": "Update your profile photo"
+            },
             "displayName": {
                 "title": "Display Name",
                 "subtitle": "This is how your name will appear to others",
@@ -617,7 +628,8 @@
                 "firstName": "First Name",
                 "firstNamePlaceholder": "Enter first name",
                 "lastName": "Last Name",
-                "lastNamePlaceholder": "Enter last name (optional)"
+                "lastNamePlaceholder": "Enter last name (optional)",
+                "invalidChars": "Use letters and spaces only"
             },
             "username": {
                 "title": "Username",

package/dist/cjs/i18n/locales/es-ES.json

@@ -2,6 +2,13 @@
     "signin": {
         "title": "Iniciar sesión",
         "subtitle": "Inicia sesión para continuar",
+        "chooser": {
+            "title": "Elige una cuenta",
+            "subtitle": "Continúa con una de tus cuentas o usa otra.",
+            "signedIn": "Sesión activa",
+            "useAnother": "Usar otra cuenta",
+            "continueAs": "Continuar como {{name}}"
+        },
         "addAccountTitle": "Agregar otra cuenta",
         "addAccountSubtitle": "Inicia sesión con otra cuenta",
         "username": {
@@ -152,6 +159,7 @@
     "editProfile": {
         "title": "Editar perfil",
         "subtitle": "Gestiona tu perfil y preferencias",
+        "notSet": "Sin definir",
         "sections": {
             "profilePicture": "Foto de perfil",
             "basicInfo": "Información básica",
@@ -160,6 +168,9 @@
             "security": "Seguridad"
         },
         "items": {
+            "avatar": {
+                "subtitle": "Actualiza tu foto de perfil"
+            },
             "displayName": {
                 "title": "Nombre para mostrar",
                 "subtitle": "Así aparecerá tu nombre para los demás",
@@ -167,7 +178,8 @@
                 "firstName": "Nombre",
                 "firstNamePlaceholder": "Introduce tu nombre",
                 "lastName": "Apellido",
-                "lastNamePlaceholder": "Introduce tu apellido (opcional)"
+                "lastNamePlaceholder": "Introduce tu apellido (opcional)",
+                "invalidChars": "Usa solo letras y espacios"
             },
             "username": {
                 "title": "Usuario",

package/dist/cjs/i18n/locales/locales/en-US.json

@@ -2,6 +2,13 @@
   "signin": {
     "title": "Sign In",
     "subtitle": "Sign in to continue your journey",
+    "chooser": {
+      "title": "Choose an account",
+      "subtitle": "Continue as an account below, or use another.",
+      "signedIn": "Signed in",
+      "useAnother": "Use another account",
+      "continueAs": "Continue as {{name}}"
+    },
     "addAccountTitle": "Add Another Account",
     "addAccountSubtitle": "Sign in with another account",
     "username": {
@@ -602,6 +609,7 @@
   "editProfile": {
     "title": "Edit Profile",
     "subtitle": "Manage your profile and preferences",
+    "notSet": "Not set",
     "sections": {
       "profilePicture": "Profile Picture",
       "basicInfo": "Basic Information",
@@ -610,6 +618,9 @@
       "security": "Security"
     },
     "items": {
+      "avatar": {
+        "subtitle": "Update your profile photo"
+      },
       "displayName": {
         "title": "Display Name",
         "subtitle": "This is how your name will appear to others",
@@ -617,7 +628,8 @@
         "firstName": "First Name",
         "firstNamePlaceholder": "Enter first name",
         "lastName": "Last Name",
-        "lastNamePlaceholder": "Enter last name (optional)"
+        "lastNamePlaceholder": "Enter last name (optional)",
+        "invalidChars": "Use letters and spaces only"
       },
       "username": {
         "title": "Username",

package/dist/cjs/i18n/locales/locales/es-ES.json

@@ -2,6 +2,13 @@
   "signin": {
     "title": "Iniciar sesión",
     "subtitle": "Inicia sesión para continuar",
+    "chooser": {
+      "title": "Elige una cuenta",
+      "subtitle": "Continúa con una de tus cuentas o usa otra.",
+      "signedIn": "Sesión activa",
+      "useAnother": "Usar otra cuenta",
+      "continueAs": "Continuar como {{name}}"
+    },
     "addAccountTitle": "Agregar otra cuenta",
     "addAccountSubtitle": "Inicia sesión con otra cuenta",
     "username": {
@@ -152,6 +159,7 @@
   "editProfile": {
     "title": "Editar perfil",
     "subtitle": "Gestiona tu perfil y preferencias",
+    "notSet": "Sin definir",
     "sections": {
       "profilePicture": "Foto de perfil",
       "basicInfo": "Información básica",
@@ -160,6 +168,9 @@
       "security": "Seguridad"
     },
     "items": {
+      "avatar": {
+        "subtitle": "Actualiza tu foto de perfil"
+      },
       "displayName": {
         "title": "Nombre para mostrar",
         "subtitle": "Así aparecerá tu nombre para los demás",
@@ -167,7 +178,8 @@
         "firstName": "Nombre",
         "firstNamePlaceholder": "Introduce tu nombre",
         "lastName": "Apellido",
-        "lastNamePlaceholder": "Introduce tu apellido (opcional)"
+        "lastNamePlaceholder": "Introduce tu apellido (opcional)",
+        "invalidChars": "Usa solo letras y espacios"
       },
       "username": {
         "title": "Usuario",

package/dist/cjs/index.js

@@ -18,10 +18,10 @@
  * If a symbol does not appear here, it is NOT part of the public API.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.isRTLLocale = exports.normalizeLanguageCode = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.RecoveryPhraseService = exports.SignatureService = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.verifyPublicCardAttestation = exports.parseAttestPayload = exports.parseIdPayload = exports.buildUserDid = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.ServiceCredentialMismatchError = exports.createCrossDomainAuth = exports.CrossDomainAuth = exports.createAuthManager = exports.AuthManager = exports.oxyClient = exports.OXY_CLOUD_URL = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.OxyServices = void 0;
-exports.PASSWORD_REGEX = exports.USERNAME_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.translate = exports.createDebugLogger = exports.debugError = exports.debugWarn = exports.debugLog = exports.isDev = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isAndroid = void 0;
-exports.ssoAttemptedKey = exports.ssoNoSessionKey = exports.ssoDestKey = exports.ssoGuardKey = exports.ssoStateKey = exports.SSO_GUARD_TTL_MS = exports.SSO_CALLBACK_PATH = exports.establishIdpSessionAfterClaim = exports.generateSsoState = exports.consumeSsoReturn = exports.parseSsoReturnFragment = exports.resolveCentralAuthUrl = exports.CENTRAL_IDP_APEX = exports.CENTRAL_AUTH_URL = exports.registrableApex = exports.autoDetectAuthWebUrl = exports.getAccountColor = exports.mergeAccountsFromRefreshAll = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.logPerformance = exports.logPayment = exports.logDevice = exports.logUser = exports.logSession = exports.logApi = exports.logAuth = exports.LogLevel = exports.logger = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.isValidPassword = exports.isValidUsername = exports.isValidEmail = void 0;
-exports.packageInfo = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.runColdBoot = exports.allowSsoBounce = exports.silentRestoreSuppressed = exports.guardActive = exports.isCentralIdPOrigin = exports.buildSsoBounceUrl = exports.getSsoCallbackBootstrapScript = exports.ssoNavigate = exports.ssoCallbackBootstrapKey = exports.ssoOutcomeKey = exports.ssoSignedOutKey = exports.ssoPriorSessionKey = void 0;
+exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.isRTLLocale = exports.normalizeLanguageCode = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.RecoveryPhraseService = exports.SignatureService = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.verifyPublicCardAttestation = exports.parseAttestPayload = exports.parseIdPayload = exports.buildUserDid = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.ServiceCredentialMismatchError = exports.oxyClient = exports.OXY_CLOUD_URL = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.OxyServices = void 0;
+exports.isValidPassword = exports.isValidUsername = exports.isValidEmail = exports.PASSWORD_REGEX = exports.USERNAME_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.translate = exports.createDebugLogger = exports.debugError = exports.debugWarn = exports.debugLog = exports.isDev = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = void 0;
+exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshPersistedSession = exports.DEVICE_TOKEN_STORAGE_KEY = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.runColdBoot = exports.SSO_CALLBACK_PATH = exports.CENTRAL_IDP_APEX = exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.logPerformance = exports.logPayment = exports.logDevice = exports.logUser = exports.logSession = exports.logApi = exports.logAuth = exports.LogLevel = exports.logger = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.isValidDisplayName = void 0;
+exports.packageInfo = exports.BOOT_STATE_SESSION_KEY = exports.BOOT_FRAGMENT_PARAM = exports.hashHasBootFragment = exports.parseDeviceBootFragment = exports.consumeDeviceBootReturn = exports.BOOT_ATTEMPTED_KEY = exports.isSameApex = exports.createBrowserColdBootDom = exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = void 0;
 // Ensure crypto polyfills are loaded before anything else
 require("./crypto/polyfill");
 // ---------------------------------------------------------------------------
@@ -37,12 +37,6 @@ Object.defineProperty(exports, "oxyClient", { enumerable: true, get: function ()
 // ---------------------------------------------------------------------------
 // Authentication
 // ---------------------------------------------------------------------------
-var AuthManager_1 = require("./AuthManager");
-Object.defineProperty(exports, "AuthManager", { enumerable: true, get: function () { return AuthManager_1.AuthManager; } });
-Object.defineProperty(exports, "createAuthManager", { enumerable: true, get: function () { return AuthManager_1.createAuthManager; } });
-var CrossDomainAuth_1 = require("./CrossDomainAuth");
-Object.defineProperty(exports, "CrossDomainAuth", { enumerable: true, get: function () { return CrossDomainAuth_1.CrossDomainAuth; } });
-Object.defineProperty(exports, "createCrossDomainAuth", { enumerable: true, get: function () { return CrossDomainAuth_1.createCrossDomainAuth; } });
 var OxyServices_auth_1 = require("./mixins/OxyServices.auth");
 Object.defineProperty(exports, "ServiceCredentialMismatchError", { enumerable: true, get: function () { return OxyServices_auth_1.ServiceCredentialMismatchError; } });
 var OxyServices_appData_1 = require("./mixins/OxyServices.appData");
@@ -138,6 +132,7 @@ Object.defineProperty(exports, "isWeb", { enumerable: true, get: function () { r
 Object.defineProperty(exports, "isNative", { enumerable: true, get: function () { return platform_1.isNative; } });
 Object.defineProperty(exports, "isIOS", { enumerable: true, get: function () { return platform_1.isIOS; } });
 Object.defineProperty(exports, "isAndroid", { enumerable: true, get: function () { return platform_1.isAndroid; } });
+Object.defineProperty(exports, "isWebBrowser", { enumerable: true, get: function () { return platform_1.isWebBrowser; } });
 // ---------------------------------------------------------------------------
 // Colour / theme utilities
 // ---------------------------------------------------------------------------
@@ -215,6 +210,7 @@ Object.defineProperty(exports, "PASSWORD_REGEX", { enumerable: true, get: functi
 Object.defineProperty(exports, "isValidEmail", { enumerable: true, get: function () { return validationUtils_1.isValidEmail; } });
 Object.defineProperty(exports, "isValidUsername", { enumerable: true, get: function () { return validationUtils_1.isValidUsername; } });
 Object.defineProperty(exports, "isValidPassword", { enumerable: true, get: function () { return validationUtils_1.isValidPassword; } });
+Object.defineProperty(exports, "isValidDisplayName", { enumerable: true, get: function () { return validationUtils_1.isValidDisplayName; } });
 Object.defineProperty(exports, "isRequiredString", { enumerable: true, get: function () { return validationUtils_1.isRequiredString; } });
 Object.defineProperty(exports, "isRequiredNumber", { enumerable: true, get: function () { return validationUtils_1.isRequiredNumber; } });
 Object.defineProperty(exports, "isRequiredBoolean", { enumerable: true, get: function () { return validationUtils_1.isRequiredBoolean; } });
@@ -256,47 +252,27 @@ Object.defineProperty(exports, "createQuickAccount", { enumerable: true, get: fu
 Object.defineProperty(exports, "getAccountDisplayName", { enumerable: true, get: function () { return accountUtils_1.getAccountDisplayName; } });
 Object.defineProperty(exports, "getAccountFallbackHandle", { enumerable: true, get: function () { return accountUtils_1.getAccountFallbackHandle; } });
 Object.defineProperty(exports, "formatPublicKeyHandle", { enumerable: true, get: function () { return accountUtils_1.formatPublicKeyHandle; } });
-Object.defineProperty(exports, "mergeAccountsFromRefreshAll", { enumerable: true, get: function () { return accountUtils_1.mergeAccountsFromRefreshAll; } });
 Object.defineProperty(exports, "getAccountColor", { enumerable: true, get: function () { return accountUtils_1.getAccountColor; } });
 // ---------------------------------------------------------------------------
-// Cross-domain SSO infrastructure
-// ---------------------------------------------------------------------------
-var fapiAutoDetect_1 = require("./utils/fapiAutoDetect");
-Object.defineProperty(exports, "autoDetectAuthWebUrl", { enumerable: true, get: function () { return fapiAutoDetect_1.autoDetectAuthWebUrl; } });
-Object.defineProperty(exports, "registrableApex", { enumerable: true, get: function () { return fapiAutoDetect_1.registrableApex; } });
-// Central cross-domain SSO (opaque single-use code bounce via auth.oxy.so)
+// Registrable-domain + central-IdP-apex helpers.
+//
+// The client SSO-bounce / silent-iframe / FedCM machinery was removed in the
+// device-first cutover (wave 2, ecosystem-wide bump complete). `registrableApex`
+// (eTLD+1) and `CENTRAL_IDP_APEX` are still genuinely used: `registrableApex`
+// via the `@oxyhq/core/server` re-export consumed by
+// `packages/api/src/utils/sameSite.ts` for same-site origin checks, and
+// `CENTRAL_IDP_APEX` by `server/cors.ts`'s `createOxyCors` (auto-allows
+// `*.oxy.so`). `SSO_CALLBACK_PATH` has no remaining importer outside this
+// module as of wave 2 — kept exported for now rather than removed here (an
+// export deletion is a logic change, out of scope for a comment sweep); flag
+// for a follow-up dead-export cleanup pass.
+// ---------------------------------------------------------------------------
+var registrableApex_1 = require("./utils/registrableApex");
+Object.defineProperty(exports, "registrableApex", { enumerable: true, get: function () { return registrableApex_1.registrableApex; } });
 var authWebUrl_1 = require("./utils/authWebUrl");
-Object.defineProperty(exports, "CENTRAL_AUTH_URL", { enumerable: true, get: function () { return authWebUrl_1.CENTRAL_AUTH_URL; } });
 Object.defineProperty(exports, "CENTRAL_IDP_APEX", { enumerable: true, get: function () { return authWebUrl_1.CENTRAL_IDP_APEX; } });
-Object.defineProperty(exports, "resolveCentralAuthUrl", { enumerable: true, get: function () { return authWebUrl_1.resolveCentralAuthUrl; } });
-var ssoReturn_1 = require("./utils/ssoReturn");
-Object.defineProperty(exports, "parseSsoReturnFragment", { enumerable: true, get: function () { return ssoReturn_1.parseSsoReturnFragment; } });
-Object.defineProperty(exports, "consumeSsoReturn", { enumerable: true, get: function () { return ssoReturn_1.consumeSsoReturn; } });
-var OxyServices_sso_1 = require("./mixins/OxyServices.sso");
-Object.defineProperty(exports, "generateSsoState", { enumerable: true, get: function () { return OxyServices_sso_1.generateSsoState; } });
-// Post-claim durable-session establish hop (web device-flow / QR sign-in).
-var ssoEstablish_1 = require("./utils/ssoEstablish");
-Object.defineProperty(exports, "establishIdpSessionAfterClaim", { enumerable: true, get: function () { return ssoEstablish_1.establishIdpSessionAfterClaim; } });
-// SSO bounce — per-origin sessionStorage keys, bounce URL builder, predicates
 var ssoBounce_1 = require("./utils/ssoBounce");
 Object.defineProperty(exports, "SSO_CALLBACK_PATH", { enumerable: true, get: function () { return ssoBounce_1.SSO_CALLBACK_PATH; } });
-Object.defineProperty(exports, "SSO_GUARD_TTL_MS", { enumerable: true, get: function () { return ssoBounce_1.SSO_GUARD_TTL_MS; } });
-Object.defineProperty(exports, "ssoStateKey", { enumerable: true, get: function () { return ssoBounce_1.ssoStateKey; } });
-Object.defineProperty(exports, "ssoGuardKey", { enumerable: true, get: function () { return ssoBounce_1.ssoGuardKey; } });
-Object.defineProperty(exports, "ssoDestKey", { enumerable: true, get: function () { return ssoBounce_1.ssoDestKey; } });
-Object.defineProperty(exports, "ssoNoSessionKey", { enumerable: true, get: function () { return ssoBounce_1.ssoNoSessionKey; } });
-Object.defineProperty(exports, "ssoAttemptedKey", { enumerable: true, get: function () { return ssoBounce_1.ssoAttemptedKey; } });
-Object.defineProperty(exports, "ssoPriorSessionKey", { enumerable: true, get: function () { return ssoBounce_1.ssoPriorSessionKey; } });
-Object.defineProperty(exports, "ssoSignedOutKey", { enumerable: true, get: function () { return ssoBounce_1.ssoSignedOutKey; } });
-Object.defineProperty(exports, "ssoOutcomeKey", { enumerable: true, get: function () { return ssoBounce_1.ssoOutcomeKey; } });
-Object.defineProperty(exports, "ssoCallbackBootstrapKey", { enumerable: true, get: function () { return ssoBounce_1.ssoCallbackBootstrapKey; } });
-Object.defineProperty(exports, "ssoNavigate", { enumerable: true, get: function () { return ssoBounce_1.ssoNavigate; } });
-Object.defineProperty(exports, "getSsoCallbackBootstrapScript", { enumerable: true, get: function () { return ssoBounce_1.getSsoCallbackBootstrapScript; } });
-Object.defineProperty(exports, "buildSsoBounceUrl", { enumerable: true, get: function () { return ssoBounce_1.buildSsoBounceUrl; } });
-Object.defineProperty(exports, "isCentralIdPOrigin", { enumerable: true, get: function () { return ssoBounce_1.isCentralIdPOrigin; } });
-Object.defineProperty(exports, "guardActive", { enumerable: true, get: function () { return ssoBounce_1.guardActive; } });
-Object.defineProperty(exports, "silentRestoreSuppressed", { enumerable: true, get: function () { return ssoBounce_1.silentRestoreSuppressed; } });
-Object.defineProperty(exports, "allowSsoBounce", { enumerable: true, get: function () { return ssoBounce_1.allowSsoBounce; } });
 var coldBoot_1 = require("./utils/coldBoot");
 Object.defineProperty(exports, "runColdBoot", { enumerable: true, get: function () { return coldBoot_1.runColdBoot; } });
 // ---------------------------------------------------------------------------
@@ -318,6 +294,39 @@ Object.defineProperty(exports, "deviceStateToClientSessions", { enumerable: true
 Object.defineProperty(exports, "activeSessionIdOf", { enumerable: true, get: function () { return projectSessionState_1.activeSessionIdOf; } });
 Object.defineProperty(exports, "activeUserOf", { enumerable: true, get: function () { return projectSessionState_1.activeUserOf; } });
 Object.defineProperty(exports, "accountIdsOf", { enumerable: true, get: function () { return projectSessionState_1.accountIdsOf; } });
+// ---------------------------------------------------------------------------
+// Device-first session machinery (auth centralization, wave 1) — additive.
+// Persisted auth-state store, the unified refresh handler + scheduler, the
+// cold-boot v2 runner, and the device-boot return-fragment consumer. Built ON
+// the existing `runColdBoot` primitive + `SessionClient`; the legacy
+// FedCM/SSO/CrossDomainAuth surface is untouched (cutover happens in F4).
+// ---------------------------------------------------------------------------
+var authStateStore_1 = require("./session/authStateStore");
+Object.defineProperty(exports, "createWebAuthStateStore", { enumerable: true, get: function () { return authStateStore_1.createWebAuthStateStore; } });
+Object.defineProperty(exports, "createNativeAuthStateStore", { enumerable: true, get: function () { return authStateStore_1.createNativeAuthStateStore; } });
+Object.defineProperty(exports, "createMemoryAuthStateStore", { enumerable: true, get: function () { return authStateStore_1.createMemoryAuthStateStore; } });
+Object.defineProperty(exports, "AUTH_STATE_STORAGE_KEY", { enumerable: true, get: function () { return authStateStore_1.AUTH_STATE_STORAGE_KEY; } });
+Object.defineProperty(exports, "DEVICE_TOKEN_STORAGE_KEY", { enumerable: true, get: function () { return authStateStore_1.DEVICE_TOKEN_STORAGE_KEY; } });
+var refresh_1 = require("./session/refresh");
+Object.defineProperty(exports, "refreshPersistedSession", { enumerable: true, get: function () { return refresh_1.refreshPersistedSession; } });
+Object.defineProperty(exports, "createAuthRefreshHandler", { enumerable: true, get: function () { return refresh_1.createAuthRefreshHandler; } });
+Object.defineProperty(exports, "installAuthRefreshHandler", { enumerable: true, get: function () { return refresh_1.installAuthRefreshHandler; } });
+Object.defineProperty(exports, "startTokenRefreshScheduler", { enumerable: true, get: function () { return refresh_1.startTokenRefreshScheduler; } });
+Object.defineProperty(exports, "TOKEN_REFRESH_LEAD_MS", { enumerable: true, get: function () { return refresh_1.TOKEN_REFRESH_LEAD_MS; } });
+var coldBootV2_1 = require("./boot/coldBootV2");
+Object.defineProperty(exports, "runSessionColdBoot", { enumerable: true, get: function () { return coldBootV2_1.runSessionColdBoot; } });
+Object.defineProperty(exports, "createBrowserColdBootDom", { enumerable: true, get: function () { return coldBootV2_1.createBrowserColdBootDom; } });
+Object.defineProperty(exports, "isSameApex", { enumerable: true, get: function () { return coldBootV2_1.isSameApex; } });
+Object.defineProperty(exports, "BOOT_ATTEMPTED_KEY", { enumerable: true, get: function () { return coldBootV2_1.BOOT_ATTEMPTED_KEY; } });
+var deviceBootReturn_1 = require("./boot/deviceBootReturn");
+Object.defineProperty(exports, "consumeDeviceBootReturn", { enumerable: true, get: function () { return deviceBootReturn_1.consumeDeviceBootReturn; } });
+Object.defineProperty(exports, "parseDeviceBootFragment", { enumerable: true, get: function () { return deviceBootReturn_1.parseDeviceBootFragment; } });
+Object.defineProperty(exports, "hashHasBootFragment", { enumerable: true, get: function () { return deviceBootReturn_1.hashHasBootFragment; } });
+Object.defineProperty(exports, "BOOT_FRAGMENT_PARAM", { enumerable: true, get: function () { return deviceBootReturn_1.BOOT_FRAGMENT_PARAM; } });
+Object.defineProperty(exports, "BOOT_STATE_SESSION_KEY", { enumerable: true, get: function () { return deviceBootReturn_1.BOOT_STATE_SESSION_KEY; } });
+// The web-session result contract (`WebSessionResult`) is owned by
+// `@oxyhq/contracts` — import it directly from there; `@oxyhq/core` does not
+// re-export contract types.
 // API response contracts (request/response Zod schemas + inferred types) live in
 // `@oxyhq/contracts` — the single source of truth shared by the backend and every
 // client SDK. Import them directly from `@oxyhq/contracts`; `@oxyhq/core` does NOT

package/dist/cjs/mixins/OxyServices.accounts.js

@@ -52,24 +52,18 @@ function OxyServicesAccountsMixin(Base) {
          * target, directly or inherited — else 403; 404 if missing/archived; 403 if
          * the target is a personal account), then mints a REAL session for the
          * target account and returns it in the canonical login / `claimSessionByToken`
-         * shape (`{ sessionId, deviceId, expiresAt, accessToken, user, authuser }`).
+         * shape (`{ sessionId, deviceId, expiresAt, accessToken, user }`).
          *
          * Unlike the removed `X-Acting-As` delegation header, the returned session
          * IS the new identity: this plants `accessToken` as the active token —
          * exactly like `claimSessionByToken` / `verifyChallenge` — so every
          * subsequent request authenticates as the target account.
          *
-         * Joining the device multi-account set (so the switch survives a reload and
-         * propagates cross-domain via `/auth/refresh-all`) requires a SECOND call, to
-         * `POST /auth/session`, made here after the token is planted. The switch route
-         * lives at `/accounts/*`, OUTSIDE the `oxy_rt_<authuser>` cookie's `Path=/auth`
-         * scope, so the server never sees the device's existing slots from it and
-         * would clobber slot 0 (destroying the operator's own session). `/auth/session`
-         * runs where those cookies ARE visible, so the server allocates a NEW slot that
-         * coexists with the operator's and returns its `authuser`. This step is
-         * web-only (native multi-account uses stored sessions, not cookies) and
-         * best-effort — a failure leaves the in-session switch intact; the switched
-         * account simply won't survive a reload until the cookie is next established.
+         * A single call is all that's needed: the server registers the switched
+         * session into the operator's `DeviceSession` set directly, inheriting the
+         * operator's central `deviceId` so the switch survives a reload and syncs
+         * cross-domain via the same device-first session model as a normal login —
+         * there is no separate client-side cookie/slot step to make it stick.
          *
          * After planting, the SDK's identity-scoped GET cache is fully cleared so
          * every cached read re-fetches as the new account. (The consuming
@@ -79,29 +73,22 @@ function OxyServicesAccountsMixin(Base) {
          * same-user silent refreshes, so the sweep here is explicit.)
          *
          * @param accountId - The target account's Mongo `_id`.
-         * @returns The minted session (planted) plus the device `authuser` slot.
+         * @returns The minted session, already planted as the active session.
          */
         async switchToAccount(accountId) {
             try {
                 const res = await this.makeRequest('POST', `/accounts/${encodeURIComponent(accountId)}/switch`, undefined, { cache: false });
                 // Plant the freshly minted session as the ACTIVE session, mirroring
                 // `claimSessionByToken` / `verifyChallenge`: the response body carries
-                // the first access token. The device refresh cookie is established below.
+                // the first access token.
                 if (res?.accessToken) {
                     this.setTokens(res.accessToken);
                 }
-                // Register the switched session in the device's multi-account set by
-                // establishing its first-party refresh cookie. This MUST be a separate
-                // call to `POST /auth/session` (the shared `establishDeviceRefreshSlot`
-                // primitive): the switch route is at `/accounts/*`, outside the
-                // `oxy_rt_<authuser>` cookie's `Path=/auth` scope, so it can never read
-                // the device's existing slots and would overwrite slot 0 (destroying the
-                // operator's own session). `/auth/session` runs where the cookies ARE
-                // visible, so the server allocates a NEW slot that coexists with the
-                // operator's and returns its `authuser`. Web-only; best-effort (the helper
-                // re-plants the rotated access token and returns `null` on native/failure).
-                const establishedAuthuser = await this.establishDeviceRefreshSlot();
-                const authuser = establishedAuthuser ?? res.authuser;
+                // The switch route now registers the switched session in the device's
+                // server-side DeviceSession set directly (device-first), so there is no
+                // client-side refresh-cookie slot to establish — the `authuser` comes
+                // from the switch response (optional-chained to match `res?.accessToken`).
+                const authuser = res?.authuser;
                 // Identity changed → drop the entire GET response cache so no entry
                 // personalised for the previous identity is reused. Cache keys are
                 // identity-scoped, so a different identity could not READ the old