@oxyhq/core 6.0.0 → 7.0.0

package/src/utils/__tests__/authWebUrl.test.ts

@@ -1,26 +1,15 @@
 /**
- * Central IdP apex/origin constants.
+ * Central IdP apex constant.
  *
- * `resolveCentralAuthUrl` was removed in the device-first cutover (the SDK no
- * longer resolves an IdP host). The `CENTRAL_IDP_APEX` / `CENTRAL_AUTH_URL`
- * constants survive because the IdP worker imports them to brand assertions.
+ * `resolveCentralAuthUrl` + `CENTRAL_AUTH_URL` were removed in the device-first /
+ * legacy-final cutovers. `CENTRAL_IDP_APEX` survives because live server-side
+ * callers (the `@oxyhq/core/server` CORS helper + the IdP worker) import it.
  */
 
-import { CENTRAL_AUTH_URL, CENTRAL_IDP_APEX } from '../authWebUrl';
+import { CENTRAL_IDP_APEX } from '../authWebUrl';
 
 describe('CENTRAL_IDP_APEX', () => {
   it('is the central IdP registrable apex', () => {
     expect(CENTRAL_IDP_APEX).toBe('oxy.so');
   });
 });
-
-describe('CENTRAL_AUTH_URL', () => {
-  it('is the central IdP origin with no trailing slash', () => {
-    expect(CENTRAL_AUTH_URL).toBe('https://auth.oxy.so');
-    expect(CENTRAL_AUTH_URL.endsWith('/')).toBe(false);
-  });
-
-  it('is derived from CENTRAL_IDP_APEX (apex and origin never drift)', () => {
-    expect(CENTRAL_AUTH_URL).toBe(`https://auth.${CENTRAL_IDP_APEX}`);
-  });
-});

package/src/utils/__tests__/{fapiAutoDetect.test.ts → registrableApex.test.ts}

@@ -6,7 +6,7 @@
  * surface + the IdP). These cases lock its Public-Suffix-List behaviour.
  */
 
-import { registrableApex } from '../fapiAutoDetect';
+import { registrableApex } from '../registrableApex';
 
 describe('registrableApex', () => {
   it('returns the eTLD+1 for a normal two-label host', () => {

package/src/utils/accountUtils.ts

@@ -14,9 +14,8 @@ export interface QuickAccount {
     avatarUrl?: string;
     /**
      * Device-local account slot index, 0..N-1 (Google-style multi-account).
-     * Mirrors the server's `oxy_rt_${authuser}` cookie slot. Optional so that
-     * pre-multi-account QuickAccounts (sessionId-only, non-cookie auth on RN)
-     * remain valid; web flows always populate it after `refreshAllSessions`.
+     * Optional so that pre-multi-account QuickAccounts (sessionId-only) remain
+     * valid; the device session set populates it where available.
      */
     authuser?: number;
     /**

package/src/utils/authWebUrl.ts

@@ -1,38 +1,17 @@
 /**
- * Central IdP (auth web) URL resolution for cross-domain SSO.
+ * Central IdP apex constant.
  *
- * The Oxy ecosystem runs a single, central Identity Provider at
- * `auth.oxy.so`. For TRUE central cross-domain SSO (Google/Meta/Clerk style),
- * FedCM and the opaque-code SSO bounce always target this one origin — it owns
- * the host-only `fedcm_session` cookie and the central session store reachable
- * via `api.oxy.so`. Relying Parties (mention.earth, homiio.com, alia.onl, …)
- * delegate to it rather than standing up a per-apex IdP.
- *
- * This module is intentionally pure: it performs no DOM access, reads no
- * `window`/`location`, and has no side effects. It is the single source of
- * truth for the central IdP origin so call sites never hardcode the literal.
- *
- * LEGACY(old-sdk): the client resolver (`resolveCentralAuthUrl`) was removed in
- * the device-first cutover; `CENTRAL_IDP_APEX` / `CENTRAL_AUTH_URL` survive ONLY
- * because the lista-B IdP worker imports them to brand assertions. Deletable
- * once Homiio/Allo/Alia/Syra are bumped off the old SDK AND CloudWatch
- * `/oxy/ecs` shows the `/sso*` + `/fedcm/*` routes quiet — F-final sweep.
+ * The client SSO/FedCM resolvers (`resolveCentralAuthUrl`, `CENTRAL_AUTH_URL`)
+ * were removed in the device-first / legacy-final cutovers. The lone survivor is
+ * `CENTRAL_IDP_APEX`, kept because it has a LIVE consumer —
+ * `@oxyhq/core/server`'s CORS helper (`server/cors.ts`'s `createOxyCors`)
+ * auto-allows `*.oxy.so` from it. That CORS use is permanent, so this stays
+ * past the SSO/FedCM teardown.
  */
 
 /**
  * The registrable apex (eTLD+1) of the Oxy ecosystem's central Identity
- * Provider. The central IdP is reachable at `auth.${CENTRAL_IDP_APEX}` and the
- * ID-token assertion issuer is always `https://auth.${CENTRAL_IDP_APEX}`
- * regardless of which per-apex `auth.<rp>` host served a given request.
- *
- * Kept as a standalone constant so the IdP worker and the SDK derive the same
- * literal from one source of truth (the worker imports it to brand assertions).
+ * Provider, reachable at `auth.${CENTRAL_IDP_APEX}`. Single source of truth so
+ * the CORS helper (and anything else that needs the central apex) never drifts.
  */
 export const CENTRAL_IDP_APEX = 'oxy.so';
-
-/**
- * The canonical central Identity Provider origin for the Oxy ecosystem.
- * No trailing slash. Derived from {@link CENTRAL_IDP_APEX} so the apex and the
- * full origin never drift apart. The IdP worker imports it to brand assertions.
- */
-export const CENTRAL_AUTH_URL = `https://auth.${CENTRAL_IDP_APEX}`;

package/src/utils/coldBoot.ts

@@ -3,19 +3,21 @@
  * authentication resolution.
  *
  * On a fresh page load / app launch the SDK may have several ways to recover an
- * existing session (silent FedCM, a persisted refresh token, a cross-domain
- * claim, a redirect SSO return, ...). They must be attempted in a deterministic
- * order*, and the FIRST one that yields a session wins — every later step is
- * skipped. This module encodes exactly that contract and nothing else.
+ * existing session (a persisted refresh-token family, a shared-keychain
+ * identity, a cross-domain boot-fragment return, ...). They must be attempted
+ * in a deterministic order, and the FIRST one that yields a session wins —
+ * every later step is skipped. This module encodes exactly that contract and
+ * nothing else.
  *
  * Design constraints (all enforced):
  *   - PURE: no DOM, no `navigator`, no `window`, no React, no platform globals.
  *   - NO module-level mutable state. Every call to {@link runColdBoot} is fully
  *     self-contained, so it is safe under bundler re-evaluation (e.g. the Metro
- *     web bundle, which is precisely why the FedCM silent-SSO guard had to live
- *     in consumers rather than a core singleton).
- *   - Architecture-agnostic: both candidate cross-domain SSO designs consume
- *     this same primitive; it knows nothing about HOW a step resolves a session.
+ *     web bundle — the reason any run-once guard for a step must live in the
+ *     calling consumer, never in a core module-level singleton).
+ *   - Architecture-agnostic: it knows nothing about HOW a step resolves a
+ *     session; `runSessionColdBoot` (`boot/coldBootV2.ts`) is the current
+ *     device-first consumer.
  *
  * A step is skipped (without running) when its `enabled` predicate returns
  * false. Any thrown error — from either `enabled` or `run` — is reported via
@@ -104,15 +106,16 @@ export interface RunColdBootOptions<S> {
    * fails to settle before the deadline, the runner abandons the await for that
    * step (reporting it via `onStepDeadline`) and CONTINUES to the next step,
    * each now racing against an already-expired deadline. This is deliberate:
-   * the runner keeps iterating so the TERMINAL step (e.g. the `/sso` bounce,
-   * whose `run()` performs its side effect synchronously before its first
-   * `await`) still gets to fire. A step that has nothing to contribute after
-   * the deadline simply doesn't settle and is skipped in turn.
+   * the runner keeps iterating so the TERMINAL step (e.g. `coldBootV2`'s
+   * `bootstrap-hop`, whose `run()` performs its navigation side effect
+   * synchronously before its first `await`) still gets to fire. A step that
+   * has nothing to contribute after the deadline simply doesn't settle and is
+   * skipped in turn.
    *
    * Per-step timeouts inside `run()` remain the first line of defense and
    * should keep every step well under this budget on a healthy load; this only
-   * trips when one of them regresses (the production FedCM-silent hang). When
-   * omitted there is no overall deadline.
+   * trips when one of them regresses (a step hanging past its own timeout).
+   * When omitted there is no overall deadline.
    */
   readonly overallDeadlineMs?: number;
   /**

package/src/utils/{fapiAutoDetect.ts → registrableApex.ts}

@@ -1,17 +1,15 @@
 /**
  * Registrable-apex (eTLD+1) host kernel.
  *
- * The client FAPI auto-detection helper (`autoDetectAuthWebUrl`) was removed in
- * the device-first cutover — the SDK no longer derives a per-apex `auth.<rp>`
- * IdP host. What survives is the pure registrable-domain kernel, still used by
- * the api SSO surface, `fedcm.service`, `deviceAuth` (same-apex trust checks),
- * and the IdP worker (all lista B / server-side). `@oxyhq/core/server`
- * re-exports it for the api.
+ * The client FAPI auto-detection helper was removed in the device-first cutover
+ * (which is why this file is now named for what it actually is, not the old
+ * `fapiAutoDetect`). What survives is the pure registrable-domain kernel, still
+ * used server-side by the api's device-first same-apex trust checks
+ * (`deviceAuth.ts`'s `POST /auth/device/web-session`, via `sameSite.ts`'s
+ * `isSameSiteTrustedRequest`) and the `@oxyhq/core/server` CORS/re-export layer.
  *
- * LEGACY(old-sdk): `registrableApex` survives ONLY for the lista-B server/IdP
- * SSO surface. Deletable once Homiio/Allo/Alia/Syra are bumped off the old SDK
- * AND CloudWatch `/oxy/ecs` shows the `/sso*` + `/fedcm/*` routes quiet — the
- * F-final sweep should remove this file then.
+ * `registrableApex` is NOT legacy — the device-first same-apex check is a live
+ * consumer, so this kernel stays regardless of the SSO/FedCM removal.
  */
 
 import { getDomain } from 'tldts';

package/dist/cjs/mixins/OxyServices.authorizedApps.js

@@ -1,38 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OxyServicesAuthorizedAppsMixin = OxyServicesAuthorizedAppsMixin;
-function OxyServicesAuthorizedAppsMixin(Base) {
-    return class extends Base {
-        /**
-         * List the authenticated user's authorized RP apps — the intersection of the
-         * user's FedCM grants and the currently-approved RP catalog. Powers the
-         * "Connected apps" management UI. Requires a real user session.
-         */
-        async listAuthorizedApps() {
-            try {
-                const response = await this.makeRequest('GET', '/fedcm/me/authorized-apps', undefined, {
-                    cache: true,
-                    cacheTTL: 30 * 1000, // 30 second cache — short, this drives a manageable UI
-                });
-                return response?.apps ?? [];
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Revoke the authenticated user's authorization for a specific RP origin.
-         * The corresponding cache entry is invalidated so a subsequent
-         * `listAuthorizedApps()` sees fresh data.
-         */
-        async revokeAuthorizedApp(origin) {
-            try {
-                await this.makeRequest('DELETE', `/fedcm/me/authorized-apps/${encodeURIComponent(origin)}`, undefined, { cache: false });
-                this.clearCacheEntry('GET:/fedcm/me/authorized-apps');
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-    };
-}

package/dist/esm/mixins/OxyServices.authorizedApps.js

@@ -1,35 +0,0 @@
-export function OxyServicesAuthorizedAppsMixin(Base) {
-    return class extends Base {
-        /**
-         * List the authenticated user's authorized RP apps — the intersection of the
-         * user's FedCM grants and the currently-approved RP catalog. Powers the
-         * "Connected apps" management UI. Requires a real user session.
-         */
-        async listAuthorizedApps() {
-            try {
-                const response = await this.makeRequest('GET', '/fedcm/me/authorized-apps', undefined, {
-                    cache: true,
-                    cacheTTL: 30 * 1000, // 30 second cache — short, this drives a manageable UI
-                });
-                return response?.apps ?? [];
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Revoke the authenticated user's authorization for a specific RP origin.
-         * The corresponding cache entry is invalidated so a subsequent
-         * `listAuthorizedApps()` sees fresh data.
-         */
-        async revokeAuthorizedApp(origin) {
-            try {
-                await this.makeRequest('DELETE', `/fedcm/me/authorized-apps/${encodeURIComponent(origin)}`, undefined, { cache: false });
-                this.clearCacheEntry('GET:/fedcm/me/authorized-apps');
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-    };
-}

package/dist/types/mixins/OxyServices.authorizedApps.d.ts

@@ -1,94 +0,0 @@
-/**
- * Authorized-apps mixin — the "Connected apps" management surface that survived
- * the FedCM removal.
- *
- * These two methods read/revoke the user's LEGACY FedCM authorization grants
- * (`GET`/`DELETE /fedcm/me/authorized-apps`). They are the last live consumers
- * of that endpoint (services' `ConnectedAppsScreen` via `useAccountQueries` /
- * `useAccountMutations`) and stay until the AppGrant migration retires the
- * FedCM grant store. All FedCM SIGN-IN machinery was deleted with
- * `OxyServices.fedcm.ts`; this is management-only, so it has no dependency on
- * the credential/nonce pipeline.
- */
-import type { OxyServicesBase } from '../OxyServices.base';
-/**
- * Public summary of an RP application the user has authorized — mirrors the
- * `AuthorizedAppSummary` shape returned by `GET /fedcm/me/authorized-apps`.
- */
-export interface AuthorizedApp {
-    /** Normalised RP origin. */
-    origin: string;
-    /** Friendly display name. */
-    name: string;
-    /** Optional human-readable description. */
-    description?: string;
-    /** ISO-8601 timestamp of when the user first authorized this RP. */
-    firstGrantedAt: string;
-    /** ISO-8601 timestamp of the most recent FedCM exchange for this user+RP. */
-    lastUsedAt: string;
-}
-export declare function OxyServicesAuthorizedAppsMixin<T extends typeof OxyServicesBase>(Base: T): {
-    new (...args: any[]): {
-        /**
-         * List the authenticated user's authorized RP apps — the intersection of the
-         * user's FedCM grants and the currently-approved RP catalog. Powers the
-         * "Connected apps" management UI. Requires a real user session.
-         */
-        listAuthorizedApps(): Promise<AuthorizedApp[]>;
-        /**
-         * Revoke the authenticated user's authorization for a specific RP origin.
-         * The corresponding cache entry is invalidated so a subsequent
-         * `listAuthorizedApps()` sees fresh data.
-         */
-        revokeAuthorizedApp(origin: string): Promise<void>;
-        httpService: import("../HttpService").HttpService;
-        cloudURL: string;
-        config: import("../OxyServices.base").OxyConfig;
-        __resetTokensForTests(): void;
-        makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
-        getBaseURL(): string;
-        getClient(): import("../HttpService").HttpService;
-        createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
-        getMetrics(): {
-            totalRequests: number;
-            successfulRequests: number;
-            failedRequests: number;
-            cacheHits: number;
-            cacheMisses: number;
-            averageResponseTime: number;
-        };
-        clearCache(): void;
-        clearCacheEntry(key: string): void;
-        clearCacheByPrefix(prefix: string): number;
-        getCacheStats(): {
-            size: number;
-            hits: number;
-            misses: number;
-            hitRate: number;
-        };
-        getCloudURL(): string;
-        setTokens(accessToken: string): void;
-        clearTokens(): void;
-        onTokensChanged(listener: (accessToken: string | null) => void): () => void;
-        _cachedUserId: string | null | undefined;
-        _cachedAccessToken: string | null;
-        getCurrentUserId(): string | null;
-        hasValidToken(): boolean;
-        getAccessToken(): string | null;
-        getAccessTokenExpiry(): number | null;
-        waitForAuth(timeoutMs?: number): Promise<boolean>;
-        withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
-            maxRetries?: number;
-            retryDelay?: number;
-            authTimeoutMs?: number;
-        }): Promise<T_1>;
-        validate(): Promise<boolean>;
-        handleError(error: unknown): Error;
-        healthCheck(): Promise<{
-            status: string;
-            users?: number;
-            timestamp?: string;
-            [key: string]: any;
-        }>;
-    };
-} & T;

package/src/mixins/OxyServices.authorizedApps.ts

@@ -1,75 +0,0 @@
-/**
- * Authorized-apps mixin — the "Connected apps" management surface that survived
- * the FedCM removal.
- *
- * These two methods read/revoke the user's LEGACY FedCM authorization grants
- * (`GET`/`DELETE /fedcm/me/authorized-apps`). They are the last live consumers
- * of that endpoint (services' `ConnectedAppsScreen` via `useAccountQueries` /
- * `useAccountMutations`) and stay until the AppGrant migration retires the
- * FedCM grant store. All FedCM SIGN-IN machinery was deleted with
- * `OxyServices.fedcm.ts`; this is management-only, so it has no dependency on
- * the credential/nonce pipeline.
- */
-import type { OxyServicesBase } from '../OxyServices.base';
-
-/**
- * Public summary of an RP application the user has authorized — mirrors the
- * `AuthorizedAppSummary` shape returned by `GET /fedcm/me/authorized-apps`.
- */
-export interface AuthorizedApp {
-  /** Normalised RP origin. */
-  origin: string;
-  /** Friendly display name. */
-  name: string;
-  /** Optional human-readable description. */
-  description?: string;
-  /** ISO-8601 timestamp of when the user first authorized this RP. */
-  firstGrantedAt: string;
-  /** ISO-8601 timestamp of the most recent FedCM exchange for this user+RP. */
-  lastUsedAt: string;
-}
-
-export function OxyServicesAuthorizedAppsMixin<T extends typeof OxyServicesBase>(Base: T) {
-  return class extends Base {
-    /**
-     * List the authenticated user's authorized RP apps — the intersection of the
-     * user's FedCM grants and the currently-approved RP catalog. Powers the
-     * "Connected apps" management UI. Requires a real user session.
-     */
-    async listAuthorizedApps(): Promise<AuthorizedApp[]> {
-      try {
-        const response = await this.makeRequest<{ apps: AuthorizedApp[] }>(
-          'GET',
-          '/fedcm/me/authorized-apps',
-          undefined,
-          {
-            cache: true,
-            cacheTTL: 30 * 1000, // 30 second cache — short, this drives a manageable UI
-          },
-        );
-        return response?.apps ?? [];
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * Revoke the authenticated user's authorization for a specific RP origin.
-     * The corresponding cache entry is invalidated so a subsequent
-     * `listAuthorizedApps()` sees fresh data.
-     */
-    async revokeAuthorizedApp(origin: string): Promise<void> {
-      try {
-        await this.makeRequest(
-          'DELETE',
-          `/fedcm/me/authorized-apps/${encodeURIComponent(origin)}`,
-          undefined,
-          { cache: false },
-        );
-        this.clearCacheEntry('GET:/fedcm/me/authorized-apps');
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-  };
-}

package/src/mixins/__tests__/authorizedApps.test.ts

@@ -1,63 +0,0 @@
-/**
- * Authorized-apps mixin tests — the "Connected apps" management pair that
- * survived the FedCM removal. Stubs `makeRequest` (no network).
- */
-import type { AuthorizedApp } from '../OxyServices.authorizedApps';
-import { OxyServices } from '../../OxyServices';
-
-const APP: AuthorizedApp = {
-  origin: 'https://mention.earth',
-  name: 'Mention',
-  firstGrantedAt: '2026-01-01T00:00:00.000Z',
-  lastUsedAt: '2026-06-01T00:00:00.000Z',
-};
-
-describe('OxyServices.authorizedApps', () => {
-  let oxy: OxyServices;
-  let makeRequest: jest.SpyInstance;
-
-  beforeEach(() => {
-    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
-    makeRequest = jest.spyOn(oxy, 'makeRequest');
-  });
-
-  afterEach(() => jest.restoreAllMocks());
-
-  describe('listAuthorizedApps', () => {
-    it('GETs the authorized-apps and returns the array', async () => {
-      makeRequest.mockResolvedValueOnce({ apps: [APP] });
-      expect(await oxy.listAuthorizedApps()).toEqual([APP]);
-      expect(makeRequest).toHaveBeenCalledWith(
-        'GET',
-        '/fedcm/me/authorized-apps',
-        undefined,
-        expect.objectContaining({ cache: true }),
-      );
-    });
-
-    it('defaults to [] when the response has no apps', async () => {
-      makeRequest.mockResolvedValueOnce({});
-      expect(await oxy.listAuthorizedApps()).toEqual([]);
-    });
-
-    it('defaults to [] when the response is null (no throw on null access)', async () => {
-      makeRequest.mockResolvedValueOnce(null);
-      expect(await oxy.listAuthorizedApps()).toEqual([]);
-    });
-  });
-
-  describe('revokeAuthorizedApp', () => {
-    it('DELETEs the encoded origin and sweeps the list cache', async () => {
-      const clearCacheEntry = jest.spyOn(oxy, 'clearCacheEntry');
-      makeRequest.mockResolvedValueOnce(undefined);
-      await oxy.revokeAuthorizedApp('https://mention.earth');
-      expect(makeRequest).toHaveBeenCalledWith(
-        'DELETE',
-        '/fedcm/me/authorized-apps/https%3A%2F%2Fmention.earth',
-        undefined,
-        { cache: false },
-      );
-      expect(clearCacheEntry).toHaveBeenCalledWith('GET:/fedcm/me/authorized-apps');
-    });
-  });
-});