@oxyhq/core 6.0.0 → 7.1.0

package/dist/types/session/accountProjection.d.ts

@@ -0,0 +1,142 @@
+/**
+ * Unified account-list projection — THE single source of truth.
+ *
+ * Produces the flat `SwitchableAccount[]` every account chooser renders, by
+ * merging the device's server-authoritative session set (`DeviceSessionState`
+ * from {@link SessionClient}) with the caller's account graph (`AccountNode[]`
+ * from `oxyServices.listAccounts()`), deduped by `accountId`. This lives in
+ * `@oxyhq/core` so `@oxyhq/services` (RN) and `@oxyhq/auth` (web) — and
+ * `auth.oxy.so` — all render the SAME list from the SAME logic and cannot
+ * diverge.
+ *
+ * Pure and I/O-free: the caller resolves per-account profiles via
+ * `oxyServices.getUsersByIds(...)` and passes them in as `profilesById`, and
+ * binds `resolveAvatarUrl` to `oxyServices.getFileDownloadUrl`. This is the same
+ * split the former `@oxyhq/services` `buildSwitchableAccounts` used — hoisted
+ * into core, keyed directly on `DeviceSessionState` (whose `activeAccountId` is
+ * atomic, so no cross-call current-row reconciliation is needed).
+ */
+import type { DeviceSessionState } from '@oxyhq/contracts';
+import type { User } from '../models/interfaces';
+import type { AccountNode, AccountRelationship, AccountKind, AccountMember } from '../mixins/OxyServices.accounts';
+/**
+ * The per-account user shape carried by a {@link SwitchableAccount}. The SDK's
+ * canonical {@link User} document — either a profile resolved via
+ * `oxyServices.getUsersByIds()` (device rows), the caller-supplied
+ * `activeUser` override (the freshest copy of the active row), or the `account`
+ * document embedded in an account-graph node (graph-only rows).
+ */
+export type SwitchableAccountUser = User;
+/**
+ * One account the signed-in user can switch INTO, in the uniform switch model.
+ *
+ * A switchable account is either a device sign-in, an account-graph node (owned
+ * org / shared-with-you), or BOTH (an account that has been switched into
+ * becomes a device session while still being a graph node — the two are deduped
+ * into a single row). Every row carries a canonical `accountId` (the uniform
+ * switch key); `sessionId` is present IFF the account is currently signed in on
+ * THIS device.
+ */
+export interface SwitchableAccount {
+    /**
+     * Canonical account id (the underlying `User._id`). The single key EVERY
+     * switch uses — `controller.switchTo(accountId)`. Always present.
+     */
+    accountId: string;
+    /**
+     * Device session id, present IFF this account is signed in on THIS device.
+     * Absent for a graph account not yet switched into. Used only for
+     * device-scoped actions (per-account sign-out); switching ALWAYS goes through
+     * `switchTo(accountId)`.
+     */
+    sessionId?: string;
+    /**
+     * Device-local account slot index (0..N-1) carried on the underlying
+     * `SessionAccount`. Absent for graph-only rows.
+     */
+    authuser?: number;
+    /** Whether this account is the currently-active one (`accountId === activeAccountId`). */
+    isCurrent: boolean;
+    /** Whether this account is signed in on THIS device (has a `sessionId`). */
+    onDevice: boolean;
+    /**
+     * The caller's relationship to this account when it appears in the account
+     * graph: `self` (the caller's own personal account), `owner` (an org/project/
+     * bot the caller owns), or `member` (shared with the caller). Absent for an
+     * independent device sign-in that is NOT in the active account's graph.
+     */
+    relationship?: AccountRelationship;
+    /** Account classification (personal/organization/…). Cosmetic badge only. */
+    kind?: AccountKind;
+    /** Parent account id for 2-level tree grouping, or `null` for a root. */
+    parentAccountId?: string | null;
+    /**
+     * The caller's effective membership (role + permissions) in this account when
+     * it appears in the graph, or `null`/absent otherwise. Use `permissions` to
+     * gate per-account settings UI.
+     */
+    callerMembership?: AccountMember | null;
+    /** Friendly display name (never blank — falls back to a handle/sentinel). */
+    displayName: string;
+    /**
+     * Real account email, or `null` when the account genuinely has none. NEVER a
+     * synthesized `username@oxy.so` — a missing email falls back to the `@handle`
+     * secondary line.
+     */
+    email: string | null;
+    /** Resolved avatar thumbnail URL, or `undefined` when the account has no avatar. */
+    avatarUrl?: string;
+    /** Account's preferred Bloom color preset, or `null` when unset. */
+    color: string | null;
+    /** The underlying per-account user payload. */
+    user: SwitchableAccountUser;
+}
+/** Input to {@link projectSwitchableAccounts}. */
+export interface ProjectSwitchableAccountsInput {
+    /**
+     * The device-scoped session state from `SessionClient.getState()`. `null`
+     * (or an empty account set) contributes no device rows.
+     */
+    state: DeviceSessionState | null;
+    /** The caller's account graph (`oxyServices.listAccounts()`). `[]` when none. */
+    graph: AccountNode[];
+    /**
+     * Per-account profiles resolved via `oxyServices.getUsersByIds()`, keyed by
+     * account id (`User.id`). Device accounts whose profile is absent here are
+     * omitted until a subsequent fetch resolves them (unless they are the active
+     * account and `activeUser` is supplied).
+     */
+    profilesById: Map<string, User>;
+    /**
+     * The freshest copy of the ACTIVE account's user (e.g. `useOxy().user`),
+     * preferred over `profilesById` for the active row so a just-committed profile
+     * edit is reflected immediately. Optional — the controller relies on
+     * `profilesById` alone when omitted.
+     */
+    activeUser?: User | null;
+    /** Locale for display-name resolution (passed to `getAccountDisplayName`). */
+    locale?: string;
+    /**
+     * Resolves an avatar file id to a thumbnail URL — bind to
+     * `(id) => id ? oxyServices.getFileDownloadUrl(id, 'thumb') : undefined`.
+     */
+    resolveAvatarUrl: (avatar: string | null | undefined) => string | undefined;
+}
+/**
+ * Pure union of device sign-ins and account-graph nodes into the flat
+ * {@link SwitchableAccount}[] every switcher renders.
+ *
+ * Order: device rows first (in `state.accounts` order, active flagged), then
+ * graph-only rows (in graph order). An account present as BOTH a device session
+ * and a graph node is deduped into ONE device row enriched with the graph
+ * metadata (relationship / kind / parent / membership).
+ */
+export declare function projectSwitchableAccounts(input: ProjectSwitchableAccountsInput): SwitchableAccount[];
+/**
+ * Every distinct account id referenced by a device session set AND an account
+ * graph, sorted for a stable profile-fetch key. Feed to
+ * `oxyServices.getUsersByIds(...)`; graph nodes already embed their `account`
+ * document, but including their ids lets the caller pass one id set and lets the
+ * projection prefer freshly-fetched profiles uniformly.
+ */
+export declare function switchableAccountIds(state: DeviceSessionState | null, graph: AccountNode[]): string[];

package/dist/types/session/createSessionClient.d.ts

@@ -1,5 +1,5 @@
 import type { OxyServices } from '../OxyServices';
-import { SessionClient, type TokenTransport } from './SessionClient';
+import { SessionClient, type SessionClientOptions, type TokenTransport } from './SessionClient';
 import type { SocketIOFactory } from './socketLoader';
 import { createSessionClientHost } from './sessionClientHost';
 /**
@@ -24,7 +24,14 @@ import { createSessionClientHost } from './sessionClientHost';
  * specifier (bundler-fragile in Metro/Expo-web and Vite against the published
  * dist). When omitted, the client falls back to the lazy loader.
  */
-export declare function createSessionClient(oxyServices: OxyServices, transport: TokenTransport, socketFactory?: SocketIOFactory): {
+export declare function createSessionClient(oxyServices: OxyServices, transport: TokenTransport, socketFactory?: SocketIOFactory, 
+/**
+ * Optional signed-out realtime wiring: `signedOutSocketAuth` (open the socket
+ * while signed out so an idle tab receives its device pushes) and
+ * `onSessionAppeared` (self-acquire when a sibling signs in). See
+ * {@link SessionClientOptions}.
+ */
+extra?: Pick<SessionClientOptions, 'signedOutSocketAuth' | 'onSessionAppeared'>): {
     client: SessionClient;
     host: ReturnType<typeof createSessionClientHost>;
 };

package/dist/types/shared/utils/debugUtils.d.ts

@@ -12,7 +12,7 @@
 export declare const isDev: () => boolean;
 /**
  * Log a debug message (only in development)
- * @param prefix - Log prefix (e.g., '[FedCM]')
+ * @param prefix - Log prefix (e.g., '[ColdBoot]')
  * @param args - Arguments to log
  */
 export declare const debugLog: (prefix: string, ...args: unknown[]) => void;
@@ -30,12 +30,12 @@ export declare const debugWarn: (prefix: string, ...args: unknown[]) => void;
 export declare const debugError: (prefix: string, ...args: unknown[]) => void;
 /**
  * Create a namespaced debug logger
- * @param namespace - Logger namespace (e.g., 'FedCM', 'SilentAuth')
+ * @param namespace - Logger namespace (e.g., 'ColdBoot', 'DeviceAuth')
  * @returns Object with log, warn, error methods
  *
  * @example
  * ```ts
- * const debug = createDebugLogger('FedCM');
+ * const debug = createDebugLogger('ColdBoot');
  * debug.log('Starting authentication');
  * debug.warn('Token expires soon');
  * debug.error('Authentication failed', error);

package/dist/types/utils/accountUtils.d.ts

@@ -11,9 +11,8 @@ export interface QuickAccount {
     avatarUrl?: string;
     /**
      * Device-local account slot index, 0..N-1 (Google-style multi-account).
-     * Mirrors the server's `oxy_rt_${authuser}` cookie slot. Optional so that
-     * pre-multi-account QuickAccounts (sessionId-only, non-cookie auth on RN)
-     * remain valid; web flows always populate it after `refreshAllSessions`.
+     * Optional so that pre-multi-account QuickAccounts (sessionId-only) remain
+     * valid; the device session set populates it where available.
      */
     authuser?: number;
     /**

package/dist/types/utils/authWebUrl.d.ts

@@ -1,36 +1,16 @@
 /**
- * Central IdP (auth web) URL resolution for cross-domain SSO.
+ * Central IdP apex constant.
  *
- * The Oxy ecosystem runs a single, central Identity Provider at
- * `auth.oxy.so`. For TRUE central cross-domain SSO (Google/Meta/Clerk style),
- * FedCM and the opaque-code SSO bounce always target this one origin — it owns
- * the host-only `fedcm_session` cookie and the central session store reachable
- * via `api.oxy.so`. Relying Parties (mention.earth, homiio.com, alia.onl, …)
- * delegate to it rather than standing up a per-apex IdP.
- *
- * This module is intentionally pure: it performs no DOM access, reads no
- * `window`/`location`, and has no side effects. It is the single source of
- * truth for the central IdP origin so call sites never hardcode the literal.
- *
- * LEGACY(old-sdk): the client resolver (`resolveCentralAuthUrl`) was removed in
- * the device-first cutover; `CENTRAL_IDP_APEX` / `CENTRAL_AUTH_URL` survive ONLY
- * because the lista-B IdP worker imports them to brand assertions. Deletable
- * once Homiio/Allo/Alia/Syra are bumped off the old SDK AND CloudWatch
- * `/oxy/ecs` shows the `/sso*` + `/fedcm/*` routes quiet — F-final sweep.
+ * The client SSO/FedCM resolvers (`resolveCentralAuthUrl`, `CENTRAL_AUTH_URL`)
+ * were removed in the device-first / legacy-final cutovers. The lone survivor is
+ * `CENTRAL_IDP_APEX`, kept because it has a LIVE consumer —
+ * `@oxyhq/core/server`'s CORS helper (`server/cors.ts`'s `createOxyCors`)
+ * auto-allows `*.oxy.so` from it. That CORS use is permanent, so this stays
+ * past the SSO/FedCM teardown.
  */
 /**
  * The registrable apex (eTLD+1) of the Oxy ecosystem's central Identity
- * Provider. The central IdP is reachable at `auth.${CENTRAL_IDP_APEX}` and the
- * ID-token assertion issuer is always `https://auth.${CENTRAL_IDP_APEX}`
- * regardless of which per-apex `auth.<rp>` host served a given request.
- *
- * Kept as a standalone constant so the IdP worker and the SDK derive the same
- * literal from one source of truth (the worker imports it to brand assertions).
+ * Provider, reachable at `auth.${CENTRAL_IDP_APEX}`. Single source of truth so
+ * the CORS helper (and anything else that needs the central apex) never drifts.
  */
 export declare const CENTRAL_IDP_APEX = "oxy.so";
-/**
- * The canonical central Identity Provider origin for the Oxy ecosystem.
- * No trailing slash. Derived from {@link CENTRAL_IDP_APEX} so the apex and the
- * full origin never drift apart. The IdP worker imports it to brand assertions.
- */
-export declare const CENTRAL_AUTH_URL = "https://auth.oxy.so";

package/dist/types/utils/coldBoot.d.ts

@@ -3,19 +3,21 @@
  * authentication resolution.
  *
  * On a fresh page load / app launch the SDK may have several ways to recover an
- * existing session (silent FedCM, a persisted refresh token, a cross-domain
- * claim, a redirect SSO return, ...). They must be attempted in a deterministic
- * order*, and the FIRST one that yields a session wins — every later step is
- * skipped. This module encodes exactly that contract and nothing else.
+ * existing session (a persisted refresh-token family, a shared-keychain
+ * identity, a cross-domain boot-fragment return, ...). They must be attempted
+ * in a deterministic order, and the FIRST one that yields a session wins —
+ * every later step is skipped. This module encodes exactly that contract and
+ * nothing else.
  *
  * Design constraints (all enforced):
  *   - PURE: no DOM, no `navigator`, no `window`, no React, no platform globals.
  *   - NO module-level mutable state. Every call to {@link runColdBoot} is fully
  *     self-contained, so it is safe under bundler re-evaluation (e.g. the Metro
- *     web bundle, which is precisely why the FedCM silent-SSO guard had to live
- *     in consumers rather than a core singleton).
- *   - Architecture-agnostic: both candidate cross-domain SSO designs consume
- *     this same primitive; it knows nothing about HOW a step resolves a session.
+ *     web bundle — the reason any run-once guard for a step must live in the
+ *     calling consumer, never in a core module-level singleton).
+ *   - Architecture-agnostic: it knows nothing about HOW a step resolves a
+ *     session; `runSessionColdBoot` (`boot/coldBootV2.ts`) is the current
+ *     device-first consumer.
  *
  * A step is skipped (without running) when its `enabled` predicate returns
  * false. Any thrown error — from either `enabled` or `run` — is reported via
@@ -92,15 +94,16 @@ export interface RunColdBootOptions<S> {
      * fails to settle before the deadline, the runner abandons the await for that
      * step (reporting it via `onStepDeadline`) and CONTINUES to the next step,
      * each now racing against an already-expired deadline. This is deliberate:
-     * the runner keeps iterating so the TERMINAL step (e.g. the `/sso` bounce,
-     * whose `run()` performs its side effect synchronously before its first
-     * `await`) still gets to fire. A step that has nothing to contribute after
-     * the deadline simply doesn't settle and is skipped in turn.
+     * the runner keeps iterating so the TERMINAL step (e.g. `coldBootV2`'s
+     * `bootstrap-hop`, whose `run()` performs its navigation side effect
+     * synchronously before its first `await`) still gets to fire. A step that
+     * has nothing to contribute after the deadline simply doesn't settle and is
+     * skipped in turn.
      *
      * Per-step timeouts inside `run()` remain the first line of defense and
      * should keep every step well under this budget on a healthy load; this only
-     * trips when one of them regresses (the production FedCM-silent hang). When
-     * omitted there is no overall deadline.
+     * trips when one of them regresses (a step hanging past its own timeout).
+     * When omitted there is no overall deadline.
      */
     readonly overallDeadlineMs?: number;
     /**

package/dist/types/utils/{fapiAutoDetect.d.ts → registrableApex.d.ts}

@@ -1,17 +1,15 @@
 /**
  * Registrable-apex (eTLD+1) host kernel.
  *
- * The client FAPI auto-detection helper (`autoDetectAuthWebUrl`) was removed in
- * the device-first cutover — the SDK no longer derives a per-apex `auth.<rp>`
- * IdP host. What survives is the pure registrable-domain kernel, still used by
- * the api SSO surface, `fedcm.service`, `deviceAuth` (same-apex trust checks),
- * and the IdP worker (all lista B / server-side). `@oxyhq/core/server`
- * re-exports it for the api.
+ * The client FAPI auto-detection helper was removed in the device-first cutover
+ * (which is why this file is now named for what it actually is, not the old
+ * `fapiAutoDetect`). What survives is the pure registrable-domain kernel, still
+ * used server-side by the api's device-first same-apex trust checks
+ * (`deviceAuth.ts`'s `POST /auth/device/web-session`, via `sameSite.ts`'s
+ * `isSameSiteTrustedRequest`) and the `@oxyhq/core/server` CORS/re-export layer.
  *
- * LEGACY(old-sdk): `registrableApex` survives ONLY for the lista-B server/IdP
- * SSO surface. Deletable once Homiio/Allo/Alia/Syra are bumped off the old SDK
- * AND CloudWatch `/oxy/ecs` shows the `/sso*` + `/fedcm/*` routes quiet — the
- * F-final sweep should remove this file then.
+ * `registrableApex` is NOT legacy — the device-first same-apex check is a live
+ * consumer, so this kernel stays regardless of the SSO/FedCM removal.
  */
 /**
  * Compute the bare registrable apex (eTLD+1) of a hostname using the Public

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "6.0.0",
+  "version": "7.1.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -94,7 +94,7 @@
     }
   },
   "dependencies": {
-    "@oxyhq/contracts": "^0.9.1",
+    "@oxyhq/contracts": "^0.10.0",
     "@oxyhq/protocol": "^0.1.1",
     "bip39": "^3.1.0",
     "buffer": "^6.0.3",

package/src/HttpService.ts

@@ -820,7 +820,7 @@ export class HttpService {
    * `clearCacheByPrefix` sweeps and `clearCacheEntry` base-key matching.
    * The `clearCacheEntry` callsites all pass fixed, dataless logical keys
    * (`GET:/users/<id>`, `GET:/session/user/<sessionId>`,
-   * `GET:/fedcm/me/authorized-apps`), so this readable suffix can never be
+   * `GET:/auth/grants`), so this readable suffix can never be
    * ambiguous with a serialized request body.
    */
   private static readonly CACHE_IDENTITY_DELIM = ' id=';

package/src/index.ts

@@ -34,9 +34,6 @@ export type { AuthRefreshReason, AuthRefreshHandler } from './HttpService';
 // ---------------------------------------------------------------------------
 // Authentication
 // ---------------------------------------------------------------------------
-// Legacy "Connected apps" management surface (list/revoke FedCM authorization
-// grants). The FedCM sign-in machinery was removed in the device-first cutover.
-export type { AuthorizedApp } from './mixins/OxyServices.authorizedApps';
 export { ServiceCredentialMismatchError } from './mixins/OxyServices.auth';
 export type { ServiceTokenResponse } from './mixins/OxyServices.auth';
 // "Sign in with Oxy" — handoff (Workstream C)
@@ -498,14 +495,18 @@ export type { QuickAccount, DisplayNameUserShape } from './utils/accountUtils';
 // Registrable-domain + central-IdP-apex helpers.
 //
 // The client SSO-bounce / silent-iframe / FedCM machinery was removed in the
-// device-first cutover. These three symbols survive because the api SSO surface
-// and the IdP (both lista B, gated on the ecosystem bump) still import them:
-// `registrableApex` (eTLD+1), `CENTRAL_IDP_APEX`, and the `SSO_CALLBACK_PATH`
-// constant. `@oxyhq/core/server` re-exports `registrableApex` + `SSO_CALLBACK_PATH`
-// for the api; the IdP imports all three from here.
-// ---------------------------------------------------------------------------
-export { registrableApex } from './utils/fapiAutoDetect';
-export { CENTRAL_AUTH_URL, CENTRAL_IDP_APEX } from './utils/authWebUrl';
+// device-first cutover (wave 2, ecosystem-wide bump complete). `registrableApex`
+// (eTLD+1) and `CENTRAL_IDP_APEX` are still genuinely used: `registrableApex`
+// via the `@oxyhq/core/server` re-export consumed by
+// `packages/api/src/utils/sameSite.ts` for same-site origin checks, and
+// `CENTRAL_IDP_APEX` by `server/cors.ts`'s `createOxyCors` (auto-allows
+// `*.oxy.so`). `SSO_CALLBACK_PATH` has no remaining importer outside this
+// module as of wave 2 — kept exported for now rather than removed here (an
+// export deletion is a logic change, out of scope for a comment sweep); flag
+// for a follow-up dead-export cleanup pass.
+// ---------------------------------------------------------------------------
+export { registrableApex } from './utils/registrableApex';
+export { CENTRAL_IDP_APEX } from './utils/authWebUrl';
 export { SSO_CALLBACK_PATH } from './utils/ssoBounce';
 
 export { runColdBoot } from './utils/coldBoot';
@@ -542,6 +543,37 @@ export {
     accountIdsOf,
 } from './session/projectSessionState';
 
+// Unified account-list projection (THE single source of truth for the account
+// chooser: device sign-ins ∪ account graph, deduped by accountId). Pure +
+// I/O-free — the caller hydrates profiles via `getUsersByIds`. Shared by
+// `@oxyhq/services`, `@oxyhq/auth`, and auth.oxy.so so the list can't diverge.
+export {
+    projectSwitchableAccounts,
+    switchableAccountIds,
+} from './session/accountProjection';
+export type {
+    SwitchableAccount,
+    SwitchableAccountUser,
+    ProjectSwitchableAccountsInput,
+} from './session/accountProjection';
+
+// Headless controller for the unified account dialog. Framework-agnostic
+// state machine + subscribe/getSnapshot store (bind via `useSyncExternalStore`)
+// — no password/2FA logic (that lives at the IdP; `openPasswordAtOxyAuth` only
+// hands off). Reuses `SessionClient.switchAccount` / `oxyServices.switchToAccount`
+// for the uniform switch and the existing device-flow methods for sign-in.
+export {
+    AccountDialogController,
+    createAccountDialogController,
+} from './session/accountDialogController';
+export type {
+    AccountDialogControllerOptions,
+    AccountDialogSnapshot,
+    AccountDialogView,
+    SignInFlowPhase,
+    SignInFlowState,
+} from './session/accountDialogController';
+
 // ---------------------------------------------------------------------------
 // Device-first session machinery (auth centralization, wave 1) — additive.
 // Persisted auth-state store, the unified refresh handler + scheduler, the

package/src/mixins/OxyServices.accounts.ts

@@ -28,8 +28,9 @@
  * SWITCHING INTO AN ACCOUNT: `switchToAccount(accountId)` mints a REAL session
  * for the target account and plants it as the active session — there is no
  * per-request "acting-as" header. Identity is carried by the session/token, not
- * a delegation header, so a switch propagates through reload and `refresh-all`
- * exactly like a login.
+ * a delegation header, so a switch propagates through reload and cross-domain
+ * exactly like a login, via the device-first session model (the server
+ * registers the switched session into the operator's device-set directly).
  */
 import type { User } from '../models/interfaces';
 import type { SessionLoginResponse } from '../models/session';
@@ -434,22 +435,22 @@ export interface AccountSuccessResult {
 /**
  * Result of {@link OxyServicesAccountsMixin.switchToAccount} — the freshly
  * minted session for the target account, in the SAME shape the canonical login
- * / `claimSessionByToken` responses use (`SessionLoginResponse`), plus the
- * device-local refresh-cookie slot index.
+ * / `claimSessionByToken` responses use (`SessionLoginResponse`).
  *
  * `accessToken` is the first access token for the new session (already planted
- * as the active token by `switchToAccount`). The refresh token is NOT in the
- * body — the server sets it as the httpOnly `oxy_rt_<authuser>` cookie, which
- * joins the device multi-account set so the switched session survives reload and
- * propagates cross-domain via `/auth/refresh-all`. `user` is the target account.
+ * as the active token by `switchToAccount`). The switched session's survival
+ * across reload and cross-domain sync is device-first: the server registers
+ * it into the operator's `DeviceSession` set directly
+ * (`deviceSessionService.addAccount`, broadcast to the device room) — there is
+ * no client-side refresh-cookie slot to establish. `user` is the target
+ * account.
  */
 export interface SwitchAccountResult extends SessionLoginResponse {
   /**
-   * The device-local refresh-cookie slot index (`oxy_rt_<authuser>`) the server
-   * assigned to the minted session. Surfaced so the consumer can register the
-   * new session in its device multi-account set exactly like a login response.
-   * Absent only when the server could not set the cookie (best-effort — the
-   * switch itself still succeeds).
+   * Legacy device-local refresh-cookie slot index. The current server switch
+   * response never sets this field (device-set registration replaced the
+   * cookie-slot model) — kept optional for backward type-compatibility with
+   * any caller still reading it, but always `undefined` in practice.
    */
   authuser?: number;
 }
@@ -515,24 +516,18 @@ export function OxyServicesAccountsMixin<T extends typeof OxyServicesBase>(Base:
      * target, directly or inherited — else 403; 404 if missing/archived; 403 if
      * the target is a personal account), then mints a REAL session for the
      * target account and returns it in the canonical login / `claimSessionByToken`
-     * shape (`{ sessionId, deviceId, expiresAt, accessToken, user, authuser }`).
+     * shape (`{ sessionId, deviceId, expiresAt, accessToken, user }`).
      *
      * Unlike the removed `X-Acting-As` delegation header, the returned session
      * IS the new identity: this plants `accessToken` as the active token —
      * exactly like `claimSessionByToken` / `verifyChallenge` — so every
      * subsequent request authenticates as the target account.
      *
-     * Joining the device multi-account set (so the switch survives a reload and
-     * propagates cross-domain via `/auth/refresh-all`) requires a SECOND call, to
-     * `POST /auth/session`, made here after the token is planted. The switch route
-     * lives at `/accounts/*`, OUTSIDE the `oxy_rt_<authuser>` cookie's `Path=/auth`
-     * scope, so the server never sees the device's existing slots from it and
-     * would clobber slot 0 (destroying the operator's own session). `/auth/session`
-     * runs where those cookies ARE visible, so the server allocates a NEW slot that
-     * coexists with the operator's and returns its `authuser`. This step is
-     * web-only (native multi-account uses stored sessions, not cookies) and
-     * best-effort — a failure leaves the in-session switch intact; the switched
-     * account simply won't survive a reload until the cookie is next established.
+     * A single call is all that's needed: the server registers the switched
+     * session into the operator's `DeviceSession` set directly, inheriting the
+     * operator's central `deviceId` so the switch survives a reload and syncs
+     * cross-domain via the same device-first session model as a normal login —
+     * there is no separate client-side cookie/slot step to make it stick.
      *
      * After planting, the SDK's identity-scoped GET cache is fully cleared so
      * every cached read re-fetches as the new account. (The consuming
@@ -542,7 +537,7 @@ export function OxyServicesAccountsMixin<T extends typeof OxyServicesBase>(Base:
      * same-user silent refreshes, so the sweep here is explicit.)
      *
      * @param accountId - The target account's Mongo `_id`.
-     * @returns The minted session (planted) plus the device `authuser` slot.
+     * @returns The minted session, already planted as the active session.
      */
     async switchToAccount(accountId: string): Promise<SwitchAccountResult> {
       try {

package/src/mixins/index.ts

@@ -7,7 +7,6 @@
 
 import { OxyServicesBase } from '../OxyServices.base';
 import { OxyServicesAuthMixin } from './OxyServices.auth';
-import { OxyServicesAuthorizedAppsMixin } from './OxyServices.authorizedApps';
 import { OxyServicesUserMixin } from './OxyServices.user';
 import { OxyServicesIdentityMixin } from './OxyServices.identity';
 import { OxyServicesPrivacyMixin } from './OxyServices.privacy';
@@ -42,7 +41,6 @@ import { OxyServicesDeviceBootMixin } from './OxyServices.deviceBoot';
  */
 type AllMixinInstances =
   & InstanceType<ReturnType<typeof OxyServicesAuthMixin<typeof OxyServicesBase>>>
-  & InstanceType<ReturnType<typeof OxyServicesAuthorizedAppsMixin<typeof OxyServicesBase>>>
   & InstanceType<ReturnType<typeof OxyServicesUserMixin<typeof OxyServicesBase>>>
   & InstanceType<ReturnType<typeof OxyServicesIdentityMixin<typeof OxyServicesBase>>>
   & InstanceType<ReturnType<typeof OxyServicesPrivacyMixin<typeof OxyServicesBase>>>
@@ -96,11 +94,6 @@ const MIXIN_PIPELINE: MixinFunction[] = [
     // Base authentication
     OxyServicesAuthMixin,
 
-    // Legacy FedCM "Connected apps" management (list/revoke authorized RP grants).
-    // The FedCM sign-in surface was removed in the device-first cutover; only
-    // this management pair survives until the AppGrant migration.
-    OxyServicesAuthorizedAppsMixin,
-
     // User management (requires auth)
     OxyServicesUserMixin,
     // Self-sovereign identity (DID, signed records, auth-method ↔ VM mapping)

package/src/models/session.ts

@@ -8,11 +8,10 @@ export interface ClientSession {
   userId?: string;
   isCurrent?: boolean;
   /**
-   * Web-only: the device-local refresh-cookie slot index (0..N) that backs
-   * this session. Populated from `POST /auth/refresh-all` and from login /
-   * signup / fedcm-exchange responses. Required for per-session web token
-   * refresh via `refreshTokenViaCookie({ authuser })` without a bearer token.
-   * Absent on native (RN uses the bearer-protected session id directly).
+   * The account's ordinal slot (0..N) within the device's account set
+   * (`SessionAccount.authuser` in `@oxyhq/contracts`), projected from the
+   * device-first `DeviceSessionState` — used purely for stable Google-style
+   * account-chooser ordering, not for any token-refresh mechanism.
    */
   authuser?: number;
 }

package/src/server/index.ts

@@ -68,7 +68,7 @@ export { verifySecret } from './verifySecret';
 // SOURCE OF TRUTH shared with the IdP worker and the client FAPI auto-detect.
 // Pure host handling (no browser deps), so it is safe on the server subpath and
 // lets `@oxyhq/api` derive `auth.<apex>` without duplicating PSL logic.
-export { registrableApex } from '../utils/fapiAutoDetect';
+export { registrableApex } from '../utils/registrableApex';
 
 // The single RP callback path the IdP redirects back to. A pure wire-contract
 // constant (no browser deps at module top level), re-used server-side so the