@oxyhq/core 5.5.0 → 7.0.0

package/dist/esm/crypto/keyManager.js

@@ -53,6 +53,11 @@ const STORAGE_KEYS = {
     SHARED_PUBLIC_KEY: 'oxy_shared_identity_public_key',
     SHARED_SESSION_TOKEN: 'oxy_shared_session_token',
     SHARED_SESSION_ID: 'oxy_shared_session_id',
+    // Opaque device-attribution token, shared across all Oxy apps on one device
+    // so they all resolve to a SINGLE server-side DeviceSession (device-first
+    // session model). Add-only: it never carries session state, only attributes
+    // a newly-credentialed session to the shared device set.
+    SHARED_DEVICE_TOKEN: 'oxy_shared_device_token',
 };
 /**
  * iOS Keychain Access Group for sharing identities across Oxy apps
@@ -540,6 +545,96 @@ export class KeyManager {
             return false;
         }
     }
+    /**
+     * Store the opaque device-attribution token in the SHARED keychain so every
+     * Oxy app on this device reads the SAME token and therefore resolves to one
+     * server-side DeviceSession.
+     *
+     * Mirrors the shared-session storage options exactly (iOS keychain access
+     * group `group.so.oxy.shared`; Android shared secure store). Native-only —
+     * a no-op on web (the shared keychain does not exist there; web persists its
+     * deviceToken in the per-origin {@link AuthStateStore} instead).
+     */
+    static async setSharedDeviceToken(deviceToken) {
+        if (isWebPlatform()) {
+            return; // Not supported on web
+        }
+        try {
+            const store = await initSecureStore();
+            if (isIOS()) {
+                const opts = {
+                    keychainAccessible: store.WHEN_UNLOCKED,
+                    keychainAccessGroup: IOS_KEYCHAIN_GROUP,
+                };
+                await store.setItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN, deviceToken, opts);
+            }
+            else if (isAndroid()) {
+                await store.setItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN, deviceToken);
+            }
+            if (isDev()) {
+                logger.debug('Shared device token stored successfully', { component: 'KeyManager' });
+            }
+        }
+        catch (error) {
+            if (isDev()) {
+                logger.error('Failed to store shared device token', error, { component: 'KeyManager' });
+            }
+            throw error;
+        }
+    }
+    /**
+     * Read the shared device-attribution token, or `null` when none is set (or
+     * on web). Mirrors {@link getSharedSession}'s keychain-access-group read.
+     */
+    static async getSharedDeviceToken() {
+        if (isWebPlatform()) {
+            return null;
+        }
+        try {
+            const store = await initSecureStore();
+            if (isIOS()) {
+                const opts = { keychainAccessGroup: IOS_KEYCHAIN_GROUP };
+                return await store.getItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN, opts);
+            }
+            if (isAndroid()) {
+                return await store.getItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN);
+            }
+            return null;
+        }
+        catch (error) {
+            if (isDev()) {
+                logger.warn('Failed to get shared device token', { component: 'KeyManager' }, error);
+            }
+            return null;
+        }
+    }
+    /**
+     * Delete the shared device-attribution token (device signout-all). Best-effort:
+     * a keychain failure is logged, not thrown, so it cannot block a sign-out.
+     */
+    static async clearSharedDeviceToken() {
+        if (isWebPlatform()) {
+            return;
+        }
+        try {
+            const store = await initSecureStore();
+            if (isIOS()) {
+                const opts = { keychainAccessGroup: IOS_KEYCHAIN_GROUP };
+                await store.deleteItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN, opts);
+            }
+            else if (isAndroid()) {
+                await store.deleteItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN);
+            }
+            if (isDev()) {
+                logger.debug('Shared device token cleared successfully', { component: 'KeyManager' });
+            }
+        }
+        catch (error) {
+            if (isDev()) {
+                logger.error('Failed to clear shared device token', error, { component: 'KeyManager' });
+            }
+        }
+    }
     // ==================== END SHARED IDENTITY METHODS ====================
     /**
      * Atomically persist a key pair to secure storage with verification + backup.

package/dist/esm/i18n/locales/en-US.json

@@ -2,6 +2,13 @@
     "signin": {
         "title": "Sign In",
         "subtitle": "Sign in to continue your journey",
+        "chooser": {
+            "title": "Choose an account",
+            "subtitle": "Continue as an account below, or use another.",
+            "signedIn": "Signed in",
+            "useAnother": "Use another account",
+            "continueAs": "Continue as {{name}}"
+        },
         "addAccountTitle": "Add Another Account",
         "addAccountSubtitle": "Sign in with another account",
         "username": {
@@ -602,6 +609,7 @@
     "editProfile": {
         "title": "Edit Profile",
         "subtitle": "Manage your profile and preferences",
+        "notSet": "Not set",
         "sections": {
             "profilePicture": "Profile Picture",
             "basicInfo": "Basic Information",
@@ -610,6 +618,9 @@
             "security": "Security"
         },
         "items": {
+            "avatar": {
+                "subtitle": "Update your profile photo"
+            },
             "displayName": {
                 "title": "Display Name",
                 "subtitle": "This is how your name will appear to others",
@@ -617,7 +628,8 @@
                 "firstName": "First Name",
                 "firstNamePlaceholder": "Enter first name",
                 "lastName": "Last Name",
-                "lastNamePlaceholder": "Enter last name (optional)"
+                "lastNamePlaceholder": "Enter last name (optional)",
+                "invalidChars": "Use letters and spaces only"
             },
             "username": {
                 "title": "Username",

package/dist/esm/i18n/locales/es-ES.json

@@ -2,6 +2,13 @@
     "signin": {
         "title": "Iniciar sesión",
         "subtitle": "Inicia sesión para continuar",
+        "chooser": {
+            "title": "Elige una cuenta",
+            "subtitle": "Continúa con una de tus cuentas o usa otra.",
+            "signedIn": "Sesión activa",
+            "useAnother": "Usar otra cuenta",
+            "continueAs": "Continuar como {{name}}"
+        },
         "addAccountTitle": "Agregar otra cuenta",
         "addAccountSubtitle": "Inicia sesión con otra cuenta",
         "username": {
@@ -152,6 +159,7 @@
     "editProfile": {
         "title": "Editar perfil",
         "subtitle": "Gestiona tu perfil y preferencias",
+        "notSet": "Sin definir",
         "sections": {
             "profilePicture": "Foto de perfil",
             "basicInfo": "Información básica",
@@ -160,6 +168,9 @@
             "security": "Seguridad"
         },
         "items": {
+            "avatar": {
+                "subtitle": "Actualiza tu foto de perfil"
+            },
             "displayName": {
                 "title": "Nombre para mostrar",
                 "subtitle": "Así aparecerá tu nombre para los demás",
@@ -167,7 +178,8 @@
                 "firstName": "Nombre",
                 "firstNamePlaceholder": "Introduce tu nombre",
                 "lastName": "Apellido",
-                "lastNamePlaceholder": "Introduce tu apellido (opcional)"
+                "lastNamePlaceholder": "Introduce tu apellido (opcional)",
+                "invalidChars": "Usa solo letras y espacios"
             },
             "username": {
                 "title": "Usuario",

package/dist/esm/i18n/locales/locales/en-US.json

@@ -2,6 +2,13 @@
   "signin": {
     "title": "Sign In",
     "subtitle": "Sign in to continue your journey",
+    "chooser": {
+      "title": "Choose an account",
+      "subtitle": "Continue as an account below, or use another.",
+      "signedIn": "Signed in",
+      "useAnother": "Use another account",
+      "continueAs": "Continue as {{name}}"
+    },
     "addAccountTitle": "Add Another Account",
     "addAccountSubtitle": "Sign in with another account",
     "username": {
@@ -602,6 +609,7 @@
   "editProfile": {
     "title": "Edit Profile",
     "subtitle": "Manage your profile and preferences",
+    "notSet": "Not set",
     "sections": {
       "profilePicture": "Profile Picture",
       "basicInfo": "Basic Information",
@@ -610,6 +618,9 @@
       "security": "Security"
     },
     "items": {
+      "avatar": {
+        "subtitle": "Update your profile photo"
+      },
       "displayName": {
         "title": "Display Name",
         "subtitle": "This is how your name will appear to others",
@@ -617,7 +628,8 @@
         "firstName": "First Name",
         "firstNamePlaceholder": "Enter first name",
         "lastName": "Last Name",
-        "lastNamePlaceholder": "Enter last name (optional)"
+        "lastNamePlaceholder": "Enter last name (optional)",
+        "invalidChars": "Use letters and spaces only"
       },
       "username": {
         "title": "Username",

package/dist/esm/i18n/locales/locales/es-ES.json

@@ -2,6 +2,13 @@
   "signin": {
     "title": "Iniciar sesión",
     "subtitle": "Inicia sesión para continuar",
+    "chooser": {
+      "title": "Elige una cuenta",
+      "subtitle": "Continúa con una de tus cuentas o usa otra.",
+      "signedIn": "Sesión activa",
+      "useAnother": "Usar otra cuenta",
+      "continueAs": "Continuar como {{name}}"
+    },
     "addAccountTitle": "Agregar otra cuenta",
     "addAccountSubtitle": "Inicia sesión con otra cuenta",
     "username": {
@@ -152,6 +159,7 @@
   "editProfile": {
     "title": "Editar perfil",
     "subtitle": "Gestiona tu perfil y preferencias",
+    "notSet": "Sin definir",
     "sections": {
       "profilePicture": "Foto de perfil",
       "basicInfo": "Información básica",
@@ -160,6 +168,9 @@
       "security": "Seguridad"
     },
     "items": {
+      "avatar": {
+        "subtitle": "Actualiza tu foto de perfil"
+      },
       "displayName": {
         "title": "Nombre para mostrar",
         "subtitle": "Así aparecerá tu nombre para los demás",
@@ -167,7 +178,8 @@
         "firstName": "Nombre",
         "firstNamePlaceholder": "Introduce tu nombre",
         "lastName": "Apellido",
-        "lastNamePlaceholder": "Introduce tu apellido (opcional)"
+        "lastNamePlaceholder": "Introduce tu apellido (opcional)",
+        "invalidChars": "Usa solo letras y espacios"
       },
       "username": {
         "title": "Usuario",

package/dist/esm/index.js

@@ -26,8 +26,6 @@ export { OXY_CLOUD_URL, oxyClient } from './OxyServices.js';
 // ---------------------------------------------------------------------------
 // Authentication
 // ---------------------------------------------------------------------------
-export { AuthManager, createAuthManager } from './AuthManager.js';
-export { CrossDomainAuth, createCrossDomainAuth } from './CrossDomainAuth.js';
 export { ServiceCredentialMismatchError } from './mixins/OxyServices.auth.js';
 export { OxyAppDataIdentifierError } from './mixins/OxyServices.appData.js';
 // ---------------------------------------------------------------------------
@@ -80,7 +78,7 @@ export { SUPPORTED_LANGUAGES, getLanguageMetadata, getLanguageName, getNativeLan
 // ---------------------------------------------------------------------------
 // Platform detection
 // ---------------------------------------------------------------------------
-export { getPlatformOS, setPlatformOS, isWeb, isNative, isIOS, isAndroid, } from './utils/platform.js';
+export { getPlatformOS, setPlatformOS, isWeb, isNative, isIOS, isAndroid, isWebBrowser, } from './utils/platform.js';
 // ---------------------------------------------------------------------------
 // Colour / theme utilities
 // ---------------------------------------------------------------------------
@@ -105,7 +103,7 @@ export { retryAsync } from './utils/asyncUtils.js';
 // ---------------------------------------------------------------------------
 // Validation
 // ---------------------------------------------------------------------------
-export { EMAIL_REGEX, USERNAME_REGEX, PASSWORD_REGEX, isValidEmail, isValidUsername, isValidPassword, isRequiredString, isRequiredNumber, isRequiredBoolean, isValidArray, isValidObject, isValidUUID, isValidURL, isValidDate, isValidFileSize, isValidFileType, sanitizeString, sanitizeHTML, isValidObjectId, validateAndSanitizeUserInput, } from './utils/validationUtils.js';
+export { EMAIL_REGEX, USERNAME_REGEX, PASSWORD_REGEX, isValidEmail, isValidUsername, isValidPassword, isValidDisplayName, isRequiredString, isRequiredNumber, isRequiredBoolean, isValidArray, isValidObject, isValidUUID, isValidURL, isValidDate, isValidFileSize, isValidFileType, sanitizeString, sanitizeHTML, isValidObjectId, validateAndSanitizeUserInput, } from './utils/validationUtils.js';
 // ---------------------------------------------------------------------------
 // Logging
 // ---------------------------------------------------------------------------
@@ -117,19 +115,24 @@ export { updateAvatarVisibility } from './utils/avatarUtils.js';
 // ---------------------------------------------------------------------------
 // Accounts
 // ---------------------------------------------------------------------------
-export { buildAccountsArray, createQuickAccount, getAccountDisplayName, getAccountFallbackHandle, formatPublicKeyHandle, mergeAccountsFromRefreshAll, getAccountColor, } from './utils/accountUtils.js';
-// ---------------------------------------------------------------------------
-// Cross-domain SSO infrastructure
-// ---------------------------------------------------------------------------
-export { autoDetectAuthWebUrl, registrableApex } from './utils/fapiAutoDetect.js';
-// Central cross-domain SSO (opaque single-use code bounce via auth.oxy.so)
-export { CENTRAL_AUTH_URL, CENTRAL_IDP_APEX, resolveCentralAuthUrl } from './utils/authWebUrl.js';
-export { parseSsoReturnFragment, consumeSsoReturn } from './utils/ssoReturn.js';
-export { generateSsoState } from './mixins/OxyServices.sso.js';
-// Post-claim durable-session establish hop (web device-flow / QR sign-in).
-export { establishIdpSessionAfterClaim } from './utils/ssoEstablish.js';
-// SSO bounce — per-origin sessionStorage keys, bounce URL builder, predicates
-export { SSO_CALLBACK_PATH, SSO_GUARD_TTL_MS, ssoStateKey, ssoGuardKey, ssoDestKey, ssoNoSessionKey, ssoAttemptedKey, ssoPriorSessionKey, ssoSignedOutKey, ssoOutcomeKey, ssoCallbackBootstrapKey, ssoNavigate, getSsoCallbackBootstrapScript, buildSsoBounceUrl, isCentralIdPOrigin, guardActive, silentRestoreSuppressed, allowSsoBounce, } from './utils/ssoBounce.js';
+export { buildAccountsArray, createQuickAccount, getAccountDisplayName, getAccountFallbackHandle, formatPublicKeyHandle, getAccountColor, } from './utils/accountUtils.js';
+// ---------------------------------------------------------------------------
+// Registrable-domain + central-IdP-apex helpers.
+//
+// The client SSO-bounce / silent-iframe / FedCM machinery was removed in the
+// device-first cutover (wave 2, ecosystem-wide bump complete). `registrableApex`
+// (eTLD+1) and `CENTRAL_IDP_APEX` are still genuinely used: `registrableApex`
+// via the `@oxyhq/core/server` re-export consumed by
+// `packages/api/src/utils/sameSite.ts` for same-site origin checks, and
+// `CENTRAL_IDP_APEX` by `server/cors.ts`'s `createOxyCors` (auto-allows
+// `*.oxy.so`). `SSO_CALLBACK_PATH` has no remaining importer outside this
+// module as of wave 2 — kept exported for now rather than removed here (an
+// export deletion is a logic change, out of scope for a comment sweep); flag
+// for a follow-up dead-export cleanup pass.
+// ---------------------------------------------------------------------------
+export { registrableApex } from './utils/registrableApex.js';
+export { CENTRAL_IDP_APEX } from './utils/authWebUrl.js';
+export { SSO_CALLBACK_PATH } from './utils/ssoBounce.js';
 export { runColdBoot } from './utils/coldBoot.js';
 // ---------------------------------------------------------------------------
 // Session sync (device-scoped multi-account session client)
@@ -143,6 +146,20 @@ export { SessionClient } from './session/SessionClient.js';
 export { createSessionClientHost } from './session/sessionClientHost.js';
 export { createSessionClient } from './session/createSessionClient.js';
 export { deviceStateToClientSessions, activeSessionIdOf, activeUserOf, accountIdsOf, } from './session/projectSessionState.js';
+// ---------------------------------------------------------------------------
+// Device-first session machinery (auth centralization, wave 1) — additive.
+// Persisted auth-state store, the unified refresh handler + scheduler, the
+// cold-boot v2 runner, and the device-boot return-fragment consumer. Built ON
+// the existing `runColdBoot` primitive + `SessionClient`; the legacy
+// FedCM/SSO/CrossDomainAuth surface is untouched (cutover happens in F4).
+// ---------------------------------------------------------------------------
+export { createWebAuthStateStore, createNativeAuthStateStore, createMemoryAuthStateStore, AUTH_STATE_STORAGE_KEY, DEVICE_TOKEN_STORAGE_KEY, } from './session/authStateStore.js';
+export { refreshPersistedSession, createAuthRefreshHandler, installAuthRefreshHandler, startTokenRefreshScheduler, TOKEN_REFRESH_LEAD_MS, } from './session/refresh.js';
+export { runSessionColdBoot, createBrowserColdBootDom, isSameApex, BOOT_ATTEMPTED_KEY, } from './boot/coldBootV2.js';
+export { consumeDeviceBootReturn, parseDeviceBootFragment, hashHasBootFragment, BOOT_FRAGMENT_PARAM, BOOT_STATE_SESSION_KEY, } from './boot/deviceBootReturn.js';
+// The web-session result contract (`WebSessionResult`) is owned by
+// `@oxyhq/contracts` — import it directly from there; `@oxyhq/core` does not
+// re-export contract types.
 // API response contracts (request/response Zod schemas + inferred types) live in
 // `@oxyhq/contracts` — the single source of truth shared by the backend and every
 // client SDK. Import them directly from `@oxyhq/contracts`; `@oxyhq/core` does NOT

package/dist/esm/mixins/OxyServices.accounts.js

@@ -49,24 +49,18 @@ export function OxyServicesAccountsMixin(Base) {
          * target, directly or inherited — else 403; 404 if missing/archived; 403 if
          * the target is a personal account), then mints a REAL session for the
          * target account and returns it in the canonical login / `claimSessionByToken`
-         * shape (`{ sessionId, deviceId, expiresAt, accessToken, user, authuser }`).
+         * shape (`{ sessionId, deviceId, expiresAt, accessToken, user }`).
          *
          * Unlike the removed `X-Acting-As` delegation header, the returned session
          * IS the new identity: this plants `accessToken` as the active token —
          * exactly like `claimSessionByToken` / `verifyChallenge` — so every
          * subsequent request authenticates as the target account.
          *
-         * Joining the device multi-account set (so the switch survives a reload and
-         * propagates cross-domain via `/auth/refresh-all`) requires a SECOND call, to
-         * `POST /auth/session`, made here after the token is planted. The switch route
-         * lives at `/accounts/*`, OUTSIDE the `oxy_rt_<authuser>` cookie's `Path=/auth`
-         * scope, so the server never sees the device's existing slots from it and
-         * would clobber slot 0 (destroying the operator's own session). `/auth/session`
-         * runs where those cookies ARE visible, so the server allocates a NEW slot that
-         * coexists with the operator's and returns its `authuser`. This step is
-         * web-only (native multi-account uses stored sessions, not cookies) and
-         * best-effort — a failure leaves the in-session switch intact; the switched
-         * account simply won't survive a reload until the cookie is next established.
+         * A single call is all that's needed: the server registers the switched
+         * session into the operator's `DeviceSession` set directly, inheriting the
+         * operator's central `deviceId` so the switch survives a reload and syncs
+         * cross-domain via the same device-first session model as a normal login —
+         * there is no separate client-side cookie/slot step to make it stick.
          *
          * After planting, the SDK's identity-scoped GET cache is fully cleared so
          * every cached read re-fetches as the new account. (The consuming
@@ -76,29 +70,22 @@ export function OxyServicesAccountsMixin(Base) {
          * same-user silent refreshes, so the sweep here is explicit.)
          *
          * @param accountId - The target account's Mongo `_id`.
-         * @returns The minted session (planted) plus the device `authuser` slot.
+         * @returns The minted session, already planted as the active session.
          */
         async switchToAccount(accountId) {
             try {
                 const res = await this.makeRequest('POST', `/accounts/${encodeURIComponent(accountId)}/switch`, undefined, { cache: false });
                 // Plant the freshly minted session as the ACTIVE session, mirroring
                 // `claimSessionByToken` / `verifyChallenge`: the response body carries
-                // the first access token. The device refresh cookie is established below.
+                // the first access token.
                 if (res?.accessToken) {
                     this.setTokens(res.accessToken);
                 }
-                // Register the switched session in the device's multi-account set by
-                // establishing its first-party refresh cookie. This MUST be a separate
-                // call to `POST /auth/session` (the shared `establishDeviceRefreshSlot`
-                // primitive): the switch route is at `/accounts/*`, outside the
-                // `oxy_rt_<authuser>` cookie's `Path=/auth` scope, so it can never read
-                // the device's existing slots and would overwrite slot 0 (destroying the
-                // operator's own session). `/auth/session` runs where the cookies ARE
-                // visible, so the server allocates a NEW slot that coexists with the
-                // operator's and returns its `authuser`. Web-only; best-effort (the helper
-                // re-plants the rotated access token and returns `null` on native/failure).
-                const establishedAuthuser = await this.establishDeviceRefreshSlot();
-                const authuser = establishedAuthuser ?? res.authuser;
+                // The switch route now registers the switched session in the device's
+                // server-side DeviceSession set directly (device-first), so there is no
+                // client-side refresh-cookie slot to establish — the `authuser` comes
+                // from the switch response (optional-chained to match `res?.accessToken`).
+                const authuser = res?.authuser;
                 // Identity changed → drop the entire GET response cache so no entry
                 // personalised for the previous identity is reused. Cache keys are
                 // identity-scoped, so a different identity could not READ the old