@oxyhq/core 6.0.0 → 7.0.0

package/dist/esm/HttpService.js

@@ -1020,7 +1020,7 @@ export class HttpService {
  * `clearCacheByPrefix` sweeps and `clearCacheEntry` base-key matching.
  * The `clearCacheEntry` callsites all pass fixed, dataless logical keys
  * (`GET:/users/<id>`, `GET:/session/user/<sessionId>`,
- * `GET:/fedcm/me/authorized-apps`), so this readable suffix can never be
+ * `GET:/auth/grants`), so this readable suffix can never be
  * ambiguous with a serialized request body.
  */
 HttpService.CACHE_IDENTITY_DELIM = ' id=';

package/dist/esm/index.js

@@ -23,6 +23,9 @@ import './crypto/polyfill.js';
 // ---------------------------------------------------------------------------
 export { OxyServices, OxyAuthenticationError, OxyAuthenticationTimeoutError } from './OxyServices.js';
 export { OXY_CLOUD_URL, oxyClient } from './OxyServices.js';
+// ---------------------------------------------------------------------------
+// Authentication
+// ---------------------------------------------------------------------------
 export { ServiceCredentialMismatchError } from './mixins/OxyServices.auth.js';
 export { OxyAppDataIdentifierError } from './mixins/OxyServices.appData.js';
 // ---------------------------------------------------------------------------
@@ -117,14 +120,18 @@ export { buildAccountsArray, createQuickAccount, getAccountDisplayName, getAccou
 // Registrable-domain + central-IdP-apex helpers.
 //
 // The client SSO-bounce / silent-iframe / FedCM machinery was removed in the
-// device-first cutover. These three symbols survive because the api SSO surface
-// and the IdP (both lista B, gated on the ecosystem bump) still import them:
-// `registrableApex` (eTLD+1), `CENTRAL_IDP_APEX`, and the `SSO_CALLBACK_PATH`
-// constant. `@oxyhq/core/server` re-exports `registrableApex` + `SSO_CALLBACK_PATH`
-// for the api; the IdP imports all three from here.
-// ---------------------------------------------------------------------------
-export { registrableApex } from './utils/fapiAutoDetect.js';
-export { CENTRAL_AUTH_URL, CENTRAL_IDP_APEX } from './utils/authWebUrl.js';
+// device-first cutover (wave 2, ecosystem-wide bump complete). `registrableApex`
+// (eTLD+1) and `CENTRAL_IDP_APEX` are still genuinely used: `registrableApex`
+// via the `@oxyhq/core/server` re-export consumed by
+// `packages/api/src/utils/sameSite.ts` for same-site origin checks, and
+// `CENTRAL_IDP_APEX` by `server/cors.ts`'s `createOxyCors` (auto-allows
+// `*.oxy.so`). `SSO_CALLBACK_PATH` has no remaining importer outside this
+// module as of wave 2 — kept exported for now rather than removed here (an
+// export deletion is a logic change, out of scope for a comment sweep); flag
+// for a follow-up dead-export cleanup pass.
+// ---------------------------------------------------------------------------
+export { registrableApex } from './utils/registrableApex.js';
+export { CENTRAL_IDP_APEX } from './utils/authWebUrl.js';
 export { SSO_CALLBACK_PATH } from './utils/ssoBounce.js';
 export { runColdBoot } from './utils/coldBoot.js';
 // ---------------------------------------------------------------------------

package/dist/esm/mixins/OxyServices.accounts.js

@@ -49,24 +49,18 @@ export function OxyServicesAccountsMixin(Base) {
          * target, directly or inherited — else 403; 404 if missing/archived; 403 if
          * the target is a personal account), then mints a REAL session for the
          * target account and returns it in the canonical login / `claimSessionByToken`
-         * shape (`{ sessionId, deviceId, expiresAt, accessToken, user, authuser }`).
+         * shape (`{ sessionId, deviceId, expiresAt, accessToken, user }`).
          *
          * Unlike the removed `X-Acting-As` delegation header, the returned session
          * IS the new identity: this plants `accessToken` as the active token —
          * exactly like `claimSessionByToken` / `verifyChallenge` — so every
          * subsequent request authenticates as the target account.
          *
-         * Joining the device multi-account set (so the switch survives a reload and
-         * propagates cross-domain via `/auth/refresh-all`) requires a SECOND call, to
-         * `POST /auth/session`, made here after the token is planted. The switch route
-         * lives at `/accounts/*`, OUTSIDE the `oxy_rt_<authuser>` cookie's `Path=/auth`
-         * scope, so the server never sees the device's existing slots from it and
-         * would clobber slot 0 (destroying the operator's own session). `/auth/session`
-         * runs where those cookies ARE visible, so the server allocates a NEW slot that
-         * coexists with the operator's and returns its `authuser`. This step is
-         * web-only (native multi-account uses stored sessions, not cookies) and
-         * best-effort — a failure leaves the in-session switch intact; the switched
-         * account simply won't survive a reload until the cookie is next established.
+         * A single call is all that's needed: the server registers the switched
+         * session into the operator's `DeviceSession` set directly, inheriting the
+         * operator's central `deviceId` so the switch survives a reload and syncs
+         * cross-domain via the same device-first session model as a normal login —
+         * there is no separate client-side cookie/slot step to make it stick.
          *
          * After planting, the SDK's identity-scoped GET cache is fully cleared so
          * every cached read re-fetches as the new account. (The consuming
@@ -76,7 +70,7 @@ export function OxyServicesAccountsMixin(Base) {
          * same-user silent refreshes, so the sweep here is explicit.)
          *
          * @param accountId - The target account's Mongo `_id`.
-         * @returns The minted session (planted) plus the device `authuser` slot.
+         * @returns The minted session, already planted as the active session.
          */
         async switchToAccount(accountId) {
             try {

package/dist/esm/mixins/index.js

@@ -6,7 +6,6 @@
  */
 import { OxyServicesBase } from '../OxyServices.base.js';
 import { OxyServicesAuthMixin } from './OxyServices.auth.js';
-import { OxyServicesAuthorizedAppsMixin } from './OxyServices.authorizedApps.js';
 import { OxyServicesUserMixin } from './OxyServices.user.js';
 import { OxyServicesIdentityMixin } from './OxyServices.identity.js';
 import { OxyServicesPrivacyMixin } from './OxyServices.privacy.js';
@@ -43,10 +42,6 @@ import { OxyServicesDeviceBootMixin } from './OxyServices.deviceBoot.js';
 const MIXIN_PIPELINE = [
     // Base authentication
     OxyServicesAuthMixin,
-    // Legacy FedCM "Connected apps" management (list/revoke authorized RP grants).
-    // The FedCM sign-in surface was removed in the device-first cutover; only
-    // this management pair survives until the AppGrant migration.
-    OxyServicesAuthorizedAppsMixin,
     // User management (requires auth)
     OxyServicesUserMixin,
     // Self-sovereign identity (DID, signed records, auth-method ↔ VM mapping)

package/dist/esm/server/index.js

@@ -26,7 +26,7 @@ export { verifySecret } from './verifySecret.js';
 // SOURCE OF TRUTH shared with the IdP worker and the client FAPI auto-detect.
 // Pure host handling (no browser deps), so it is safe on the server subpath and
 // lets `@oxyhq/api` derive `auth.<apex>` without duplicating PSL logic.
-export { registrableApex } from '../utils/fapiAutoDetect.js';
+export { registrableApex } from '../utils/registrableApex.js';
 // The single RP callback path the IdP redirects back to. A pure wire-contract
 // constant (no browser deps at module top level), re-used server-side so the
 // `/sso/establish-token` `return_to` cannot drift from what `/sso/establish`

package/dist/esm/shared/utils/debugUtils.js

@@ -21,7 +21,7 @@ export const isDev = () => {
 };
 /**
  * Log a debug message (only in development)
- * @param prefix - Log prefix (e.g., '[FedCM]')
+ * @param prefix - Log prefix (e.g., '[ColdBoot]')
  * @param args - Arguments to log
  */
 export const debugLog = (prefix, ...args) => {
@@ -51,12 +51,12 @@ export const debugError = (prefix, ...args) => {
 };
 /**
  * Create a namespaced debug logger
- * @param namespace - Logger namespace (e.g., 'FedCM', 'SilentAuth')
+ * @param namespace - Logger namespace (e.g., 'ColdBoot', 'DeviceAuth')
  * @returns Object with log, warn, error methods
  *
  * @example
  * ```ts
- * const debug = createDebugLogger('FedCM');
+ * const debug = createDebugLogger('ColdBoot');
  * debug.log('Starting authentication');
  * debug.warn('Token expires soon');
  * debug.error('Authentication failed', error);

package/dist/esm/utils/authWebUrl.js

@@ -1,36 +1,16 @@
 /**
- * Central IdP (auth web) URL resolution for cross-domain SSO.
+ * Central IdP apex constant.
  *
- * The Oxy ecosystem runs a single, central Identity Provider at
- * `auth.oxy.so`. For TRUE central cross-domain SSO (Google/Meta/Clerk style),
- * FedCM and the opaque-code SSO bounce always target this one origin — it owns
- * the host-only `fedcm_session` cookie and the central session store reachable
- * via `api.oxy.so`. Relying Parties (mention.earth, homiio.com, alia.onl, …)
- * delegate to it rather than standing up a per-apex IdP.
- *
- * This module is intentionally pure: it performs no DOM access, reads no
- * `window`/`location`, and has no side effects. It is the single source of
- * truth for the central IdP origin so call sites never hardcode the literal.
- *
- * LEGACY(old-sdk): the client resolver (`resolveCentralAuthUrl`) was removed in
- * the device-first cutover; `CENTRAL_IDP_APEX` / `CENTRAL_AUTH_URL` survive ONLY
- * because the lista-B IdP worker imports them to brand assertions. Deletable
- * once Homiio/Allo/Alia/Syra are bumped off the old SDK AND CloudWatch
- * `/oxy/ecs` shows the `/sso*` + `/fedcm/*` routes quiet — F-final sweep.
+ * The client SSO/FedCM resolvers (`resolveCentralAuthUrl`, `CENTRAL_AUTH_URL`)
+ * were removed in the device-first / legacy-final cutovers. The lone survivor is
+ * `CENTRAL_IDP_APEX`, kept because it has a LIVE consumer —
+ * `@oxyhq/core/server`'s CORS helper (`server/cors.ts`'s `createOxyCors`)
+ * auto-allows `*.oxy.so` from it. That CORS use is permanent, so this stays
+ * past the SSO/FedCM teardown.
  */
 /**
  * The registrable apex (eTLD+1) of the Oxy ecosystem's central Identity
- * Provider. The central IdP is reachable at `auth.${CENTRAL_IDP_APEX}` and the
- * ID-token assertion issuer is always `https://auth.${CENTRAL_IDP_APEX}`
- * regardless of which per-apex `auth.<rp>` host served a given request.
- *
- * Kept as a standalone constant so the IdP worker and the SDK derive the same
- * literal from one source of truth (the worker imports it to brand assertions).
+ * Provider, reachable at `auth.${CENTRAL_IDP_APEX}`. Single source of truth so
+ * the CORS helper (and anything else that needs the central apex) never drifts.
  */
 export const CENTRAL_IDP_APEX = 'oxy.so';
-/**
- * The canonical central Identity Provider origin for the Oxy ecosystem.
- * No trailing slash. Derived from {@link CENTRAL_IDP_APEX} so the apex and the
- * full origin never drift apart. The IdP worker imports it to brand assertions.
- */
-export const CENTRAL_AUTH_URL = `https://auth.${CENTRAL_IDP_APEX}`;

package/dist/esm/utils/coldBoot.js

@@ -3,19 +3,21 @@
  * authentication resolution.
  *
  * On a fresh page load / app launch the SDK may have several ways to recover an
- * existing session (silent FedCM, a persisted refresh token, a cross-domain
- * claim, a redirect SSO return, ...). They must be attempted in a deterministic
- * order*, and the FIRST one that yields a session wins — every later step is
- * skipped. This module encodes exactly that contract and nothing else.
+ * existing session (a persisted refresh-token family, a shared-keychain
+ * identity, a cross-domain boot-fragment return, ...). They must be attempted
+ * in a deterministic order, and the FIRST one that yields a session wins —
+ * every later step is skipped. This module encodes exactly that contract and
+ * nothing else.
  *
  * Design constraints (all enforced):
  *   - PURE: no DOM, no `navigator`, no `window`, no React, no platform globals.
  *   - NO module-level mutable state. Every call to {@link runColdBoot} is fully
  *     self-contained, so it is safe under bundler re-evaluation (e.g. the Metro
- *     web bundle, which is precisely why the FedCM silent-SSO guard had to live
- *     in consumers rather than a core singleton).
- *   - Architecture-agnostic: both candidate cross-domain SSO designs consume
- *     this same primitive; it knows nothing about HOW a step resolves a session.
+ *     web bundle — the reason any run-once guard for a step must live in the
+ *     calling consumer, never in a core module-level singleton).
+ *   - Architecture-agnostic: it knows nothing about HOW a step resolves a
+ *     session; `runSessionColdBoot` (`boot/coldBootV2.ts`) is the current
+ *     device-first consumer.
  *
  * A step is skipped (without running) when its `enabled` predicate returns
  * false. Any thrown error — from either `enabled` or `run` — is reported via

package/dist/esm/utils/{fapiAutoDetect.js → registrableApex.js}

@@ -1,17 +1,15 @@
 /**
  * Registrable-apex (eTLD+1) host kernel.
  *
- * The client FAPI auto-detection helper (`autoDetectAuthWebUrl`) was removed in
- * the device-first cutover — the SDK no longer derives a per-apex `auth.<rp>`
- * IdP host. What survives is the pure registrable-domain kernel, still used by
- * the api SSO surface, `fedcm.service`, `deviceAuth` (same-apex trust checks),
- * and the IdP worker (all lista B / server-side). `@oxyhq/core/server`
- * re-exports it for the api.
+ * The client FAPI auto-detection helper was removed in the device-first cutover
+ * (which is why this file is now named for what it actually is, not the old
+ * `fapiAutoDetect`). What survives is the pure registrable-domain kernel, still
+ * used server-side by the api's device-first same-apex trust checks
+ * (`deviceAuth.ts`'s `POST /auth/device/web-session`, via `sameSite.ts`'s
+ * `isSameSiteTrustedRequest`) and the `@oxyhq/core/server` CORS/re-export layer.
  *
- * LEGACY(old-sdk): `registrableApex` survives ONLY for the lista-B server/IdP
- * SSO surface. Deletable once Homiio/Allo/Alia/Syra are bumped off the old SDK
- * AND CloudWatch `/oxy/ecs` shows the `/sso*` + `/fedcm/*` routes quiet — the
- * F-final sweep should remove this file then.
+ * `registrableApex` is NOT legacy — the device-first same-apex check is a live
+ * consumer, so this kernel stays regardless of the SSO/FedCM removal.
  */
 import { getDomain } from 'tldts';
 /**