@oxyhq/core 6.0.0 → 7.1.0

package/dist/cjs/HttpService.js

@@ -1024,7 +1024,7 @@ exports.HttpService = HttpService;
  * `clearCacheByPrefix` sweeps and `clearCacheEntry` base-key matching.
  * The `clearCacheEntry` callsites all pass fixed, dataless logical keys
  * (`GET:/users/<id>`, `GET:/session/user/<sessionId>`,
- * `GET:/fedcm/me/authorized-apps`), so this readable suffix can never be
+ * `GET:/auth/grants`), so this readable suffix can never be
  * ambiguous with a serialized request body.
  */
 HttpService.CACHE_IDENTITY_DELIM = ' id=';

package/dist/cjs/index.js

@@ -20,8 +20,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.isRTLLocale = exports.normalizeLanguageCode = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.RecoveryPhraseService = exports.SignatureService = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.verifyPublicCardAttestation = exports.parseAttestPayload = exports.parseIdPayload = exports.buildUserDid = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.ServiceCredentialMismatchError = exports.oxyClient = exports.OXY_CLOUD_URL = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.OxyServices = void 0;
 exports.isValidPassword = exports.isValidUsername = exports.isValidEmail = exports.PASSWORD_REGEX = exports.USERNAME_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.translate = exports.createDebugLogger = exports.debugError = exports.debugWarn = exports.debugLog = exports.isDev = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = void 0;
-exports.createAuthRefreshHandler = exports.refreshPersistedSession = exports.DEVICE_TOKEN_STORAGE_KEY = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.runColdBoot = exports.SSO_CALLBACK_PATH = exports.CENTRAL_IDP_APEX = exports.CENTRAL_AUTH_URL = exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.logPerformance = exports.logPayment = exports.logDevice = exports.logUser = exports.logSession = exports.logApi = exports.logAuth = exports.LogLevel = exports.logger = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.isValidDisplayName = void 0;
-exports.packageInfo = exports.BOOT_STATE_SESSION_KEY = exports.BOOT_FRAGMENT_PARAM = exports.hashHasBootFragment = exports.parseDeviceBootFragment = exports.consumeDeviceBootReturn = exports.BOOT_ATTEMPTED_KEY = exports.isSameApex = exports.createBrowserColdBootDom = exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = void 0;
+exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.switchableAccountIds = exports.projectSwitchableAccounts = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.runColdBoot = exports.SSO_CALLBACK_PATH = exports.CENTRAL_IDP_APEX = exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.logPerformance = exports.logPayment = exports.logDevice = exports.logUser = exports.logSession = exports.logApi = exports.logAuth = exports.LogLevel = exports.logger = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.isValidDisplayName = void 0;
+exports.packageInfo = exports.BOOT_STATE_SESSION_KEY = exports.BOOT_FRAGMENT_PARAM = exports.hashHasBootFragment = exports.parseDeviceBootFragment = exports.consumeDeviceBootReturn = exports.BOOT_ATTEMPTED_KEY = exports.isSameApex = exports.createBrowserColdBootDom = exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshPersistedSession = exports.DEVICE_TOKEN_STORAGE_KEY = void 0;
 // Ensure crypto polyfills are loaded before anything else
 require("./crypto/polyfill");
 // ---------------------------------------------------------------------------
@@ -34,6 +34,9 @@ Object.defineProperty(exports, "OxyAuthenticationTimeoutError", { enumerable: tr
 var OxyServices_2 = require("./OxyServices");
 Object.defineProperty(exports, "OXY_CLOUD_URL", { enumerable: true, get: function () { return OxyServices_2.OXY_CLOUD_URL; } });
 Object.defineProperty(exports, "oxyClient", { enumerable: true, get: function () { return OxyServices_2.oxyClient; } });
+// ---------------------------------------------------------------------------
+// Authentication
+// ---------------------------------------------------------------------------
 var OxyServices_auth_1 = require("./mixins/OxyServices.auth");
 Object.defineProperty(exports, "ServiceCredentialMismatchError", { enumerable: true, get: function () { return OxyServices_auth_1.ServiceCredentialMismatchError; } });
 var OxyServices_appData_1 = require("./mixins/OxyServices.appData");
@@ -254,16 +257,19 @@ Object.defineProperty(exports, "getAccountColor", { enumerable: true, get: funct
 // Registrable-domain + central-IdP-apex helpers.
 //
 // The client SSO-bounce / silent-iframe / FedCM machinery was removed in the
-// device-first cutover. These three symbols survive because the api SSO surface
-// and the IdP (both lista B, gated on the ecosystem bump) still import them:
-// `registrableApex` (eTLD+1), `CENTRAL_IDP_APEX`, and the `SSO_CALLBACK_PATH`
-// constant. `@oxyhq/core/server` re-exports `registrableApex` + `SSO_CALLBACK_PATH`
-// for the api; the IdP imports all three from here.
-// ---------------------------------------------------------------------------
-var fapiAutoDetect_1 = require("./utils/fapiAutoDetect");
-Object.defineProperty(exports, "registrableApex", { enumerable: true, get: function () { return fapiAutoDetect_1.registrableApex; } });
+// device-first cutover (wave 2, ecosystem-wide bump complete). `registrableApex`
+// (eTLD+1) and `CENTRAL_IDP_APEX` are still genuinely used: `registrableApex`
+// via the `@oxyhq/core/server` re-export consumed by
+// `packages/api/src/utils/sameSite.ts` for same-site origin checks, and
+// `CENTRAL_IDP_APEX` by `server/cors.ts`'s `createOxyCors` (auto-allows
+// `*.oxy.so`). `SSO_CALLBACK_PATH` has no remaining importer outside this
+// module as of wave 2 — kept exported for now rather than removed here (an
+// export deletion is a logic change, out of scope for a comment sweep); flag
+// for a follow-up dead-export cleanup pass.
+// ---------------------------------------------------------------------------
+var registrableApex_1 = require("./utils/registrableApex");
+Object.defineProperty(exports, "registrableApex", { enumerable: true, get: function () { return registrableApex_1.registrableApex; } });
 var authWebUrl_1 = require("./utils/authWebUrl");
-Object.defineProperty(exports, "CENTRAL_AUTH_URL", { enumerable: true, get: function () { return authWebUrl_1.CENTRAL_AUTH_URL; } });
 Object.defineProperty(exports, "CENTRAL_IDP_APEX", { enumerable: true, get: function () { return authWebUrl_1.CENTRAL_IDP_APEX; } });
 var ssoBounce_1 = require("./utils/ssoBounce");
 Object.defineProperty(exports, "SSO_CALLBACK_PATH", { enumerable: true, get: function () { return ssoBounce_1.SSO_CALLBACK_PATH; } });
@@ -288,6 +294,21 @@ Object.defineProperty(exports, "deviceStateToClientSessions", { enumerable: true
 Object.defineProperty(exports, "activeSessionIdOf", { enumerable: true, get: function () { return projectSessionState_1.activeSessionIdOf; } });
 Object.defineProperty(exports, "activeUserOf", { enumerable: true, get: function () { return projectSessionState_1.activeUserOf; } });
 Object.defineProperty(exports, "accountIdsOf", { enumerable: true, get: function () { return projectSessionState_1.accountIdsOf; } });
+// Unified account-list projection (THE single source of truth for the account
+// chooser: device sign-ins ∪ account graph, deduped by accountId). Pure +
+// I/O-free — the caller hydrates profiles via `getUsersByIds`. Shared by
+// `@oxyhq/services`, `@oxyhq/auth`, and auth.oxy.so so the list can't diverge.
+var accountProjection_1 = require("./session/accountProjection");
+Object.defineProperty(exports, "projectSwitchableAccounts", { enumerable: true, get: function () { return accountProjection_1.projectSwitchableAccounts; } });
+Object.defineProperty(exports, "switchableAccountIds", { enumerable: true, get: function () { return accountProjection_1.switchableAccountIds; } });
+// Headless controller for the unified account dialog. Framework-agnostic
+// state machine + subscribe/getSnapshot store (bind via `useSyncExternalStore`)
+// — no password/2FA logic (that lives at the IdP; `openPasswordAtOxyAuth` only
+// hands off). Reuses `SessionClient.switchAccount` / `oxyServices.switchToAccount`
+// for the uniform switch and the existing device-flow methods for sign-in.
+var accountDialogController_1 = require("./session/accountDialogController");
+Object.defineProperty(exports, "AccountDialogController", { enumerable: true, get: function () { return accountDialogController_1.AccountDialogController; } });
+Object.defineProperty(exports, "createAccountDialogController", { enumerable: true, get: function () { return accountDialogController_1.createAccountDialogController; } });
 // ---------------------------------------------------------------------------
 // Device-first session machinery (auth centralization, wave 1) — additive.
 // Persisted auth-state store, the unified refresh handler + scheduler, the

package/dist/cjs/mixins/OxyServices.accounts.js

@@ -52,24 +52,18 @@ function OxyServicesAccountsMixin(Base) {
          * target, directly or inherited — else 403; 404 if missing/archived; 403 if
          * the target is a personal account), then mints a REAL session for the
          * target account and returns it in the canonical login / `claimSessionByToken`
-         * shape (`{ sessionId, deviceId, expiresAt, accessToken, user, authuser }`).
+         * shape (`{ sessionId, deviceId, expiresAt, accessToken, user }`).
          *
          * Unlike the removed `X-Acting-As` delegation header, the returned session
          * IS the new identity: this plants `accessToken` as the active token —
          * exactly like `claimSessionByToken` / `verifyChallenge` — so every
          * subsequent request authenticates as the target account.
          *
-         * Joining the device multi-account set (so the switch survives a reload and
-         * propagates cross-domain via `/auth/refresh-all`) requires a SECOND call, to
-         * `POST /auth/session`, made here after the token is planted. The switch route
-         * lives at `/accounts/*`, OUTSIDE the `oxy_rt_<authuser>` cookie's `Path=/auth`
-         * scope, so the server never sees the device's existing slots from it and
-         * would clobber slot 0 (destroying the operator's own session). `/auth/session`
-         * runs where those cookies ARE visible, so the server allocates a NEW slot that
-         * coexists with the operator's and returns its `authuser`. This step is
-         * web-only (native multi-account uses stored sessions, not cookies) and
-         * best-effort — a failure leaves the in-session switch intact; the switched
-         * account simply won't survive a reload until the cookie is next established.
+         * A single call is all that's needed: the server registers the switched
+         * session into the operator's `DeviceSession` set directly, inheriting the
+         * operator's central `deviceId` so the switch survives a reload and syncs
+         * cross-domain via the same device-first session model as a normal login —
+         * there is no separate client-side cookie/slot step to make it stick.
          *
          * After planting, the SDK's identity-scoped GET cache is fully cleared so
          * every cached read re-fetches as the new account. (The consuming
@@ -79,7 +73,7 @@ function OxyServicesAccountsMixin(Base) {
          * same-user silent refreshes, so the sweep here is explicit.)
          *
          * @param accountId - The target account's Mongo `_id`.
-         * @returns The minted session (planted) plus the device `authuser` slot.
+         * @returns The minted session, already planted as the active session.
          */
         async switchToAccount(accountId) {
             try {

package/dist/cjs/mixins/index.js

@@ -10,7 +10,6 @@ exports.MIXIN_PIPELINE = void 0;
 exports.composeOxyServices = composeOxyServices;
 const OxyServices_base_1 = require("../OxyServices.base");
 const OxyServices_auth_1 = require("./OxyServices.auth");
-const OxyServices_authorizedApps_1 = require("./OxyServices.authorizedApps");
 const OxyServices_user_1 = require("./OxyServices.user");
 const OxyServices_identity_1 = require("./OxyServices.identity");
 const OxyServices_privacy_1 = require("./OxyServices.privacy");
@@ -47,10 +46,6 @@ const OxyServices_deviceBoot_1 = require("./OxyServices.deviceBoot");
 const MIXIN_PIPELINE = [
     // Base authentication
     OxyServices_auth_1.OxyServicesAuthMixin,
-    // Legacy FedCM "Connected apps" management (list/revoke authorized RP grants).
-    // The FedCM sign-in surface was removed in the device-first cutover; only
-    // this management pair survives until the AppGrant migration.
-    OxyServices_authorizedApps_1.OxyServicesAuthorizedAppsMixin,
     // User management (requires auth)
     OxyServices_user_1.OxyServicesUserMixin,
     // Self-sovereign identity (DID, signed records, auth-method ↔ VM mapping)

package/dist/cjs/server/index.js

@@ -50,8 +50,8 @@ Object.defineProperty(exports, "verifySecret", { enumerable: true, get: function
 // SOURCE OF TRUTH shared with the IdP worker and the client FAPI auto-detect.
 // Pure host handling (no browser deps), so it is safe on the server subpath and
 // lets `@oxyhq/api` derive `auth.<apex>` without duplicating PSL logic.
-var fapiAutoDetect_1 = require("../utils/fapiAutoDetect");
-Object.defineProperty(exports, "registrableApex", { enumerable: true, get: function () { return fapiAutoDetect_1.registrableApex; } });
+var registrableApex_1 = require("../utils/registrableApex");
+Object.defineProperty(exports, "registrableApex", { enumerable: true, get: function () { return registrableApex_1.registrableApex; } });
 // The single RP callback path the IdP redirects back to. A pure wire-contract
 // constant (no browser deps at module top level), re-used server-side so the
 // `/sso/establish-token` `return_to` cannot drift from what `/sso/establish`

package/dist/cjs/session/SessionClient.js

@@ -4,6 +4,14 @@ exports.SessionClient = void 0;
 const contracts_1 = require("@oxyhq/contracts");
 const loggerUtils_1 = require("../utils/loggerUtils");
 const socketLoader_1 = require("./socketLoader");
+/**
+ * Same-origin `BroadcastChannel` name for instant, network-free session wake
+ * across tabs of the SAME origin (e.g. two `accounts.oxy.so` tabs). Complements
+ * the cookie-authed device socket, which covers same-apex cross-origin
+ * (`accounts` ↔ `console` ↔ `inbox`, all `*.oxy.so`). Cross-APEX (mention.earth)
+ * is covered by neither and relies on a reload — the documented limitation.
+ */
+const SESSION_BROADCAST_CHANNEL = 'oxy.session';
 class SessionClient {
     constructor(host, options = {}) {
         this.host = host;
@@ -13,6 +21,12 @@ class SessionClient {
         this.socket = null;
         this.tokenUnsub = null;
         this.started = false;
+        /** In-flight guard so a burst of pushes triggers at most ONE acquisition. */
+        this.acquiring = false;
+        /** True while the live socket is an anonymous (signed-out) device connection. */
+        this.socketAnonymous = false;
+        /** Same-origin cross-tab wake channel; null on platforms without BroadcastChannel. */
+        this.channel = null;
     }
     getState() {
         return this.state;
@@ -105,14 +119,17 @@ class SessionClient {
     async switchAccount(accountId) {
         const res = await this.host.makeRequest('POST', '/session/device/switch', { accountId }, { cache: false });
         this.applySync(res);
+        this.postCommitPing();
     }
     async signOut(target) {
         const res = await this.host.makeRequest('POST', '/session/device/signout', target, { cache: false });
         this.applySync(res);
+        this.postCommitPing();
     }
     async addCurrentAccount() {
         const res = await this.host.makeRequest('POST', '/session/device/add', undefined, { cache: false });
         this.applySync(res);
+        this.postCommitPing();
     }
     /**
      * Register the just-signed-in account into the device set AND make it the
@@ -140,19 +157,58 @@ class SessionClient {
             return;
         this.started = true;
         this.tokenUnsub = this.host.onTokensChanged((token) => {
-            if (token && this.socket && !this.socket.connected) {
+            if (!token)
+                return;
+            // A bearer just landed: an in-flight acquisition (if any) succeeded — clear
+            // the guard so a later sign-out can re-acquire.
+            this.acquiring = false;
+            if (!this.socket)
+                return;
+            if (this.socketAnonymous) {
+                // The live socket was an anonymous (device-room-only) connection. Force a
+                // reconnect so the handshake re-runs authenticated and also joins the
+                // `user:<id>` notification room.
+                this.socketAnonymous = false;
+                this.socket.disconnect();
+                this.socket.connect();
+            }
+            else if (!this.socket.connected) {
                 this.socket.connect();
             }
         });
-        await this.bootstrap();
+        this.openBroadcastChannel();
+        // `bootstrap` (`GET /session/device/state`) is bearer-authenticated: skip it
+        // when signed out (the signed-out socket below still joins the device room to
+        // receive pushes). A bootstrap failure is non-fatal — the socket must still
+        // connect so realtime sync survives a transient state-fetch error.
+        if (this.host.getAccessToken()) {
+            try {
+                await this.bootstrap();
+            }
+            catch (error) {
+                loggerUtils_1.logger.warn('[SessionClient] bootstrap during start failed (non-fatal)', { component: 'SessionClient' }, error);
+            }
+        }
         await this.connectSocket();
     }
     stop() {
         this.started = false;
+        this.acquiring = false;
+        this.socketAnonymous = false;
         if (this.tokenUnsub) {
             this.tokenUnsub();
             this.tokenUnsub = null;
         }
+        if (this.channel) {
+            this.channel.onmessage = null;
+            try {
+                this.channel.close();
+            }
+            catch (error) {
+                loggerUtils_1.logger.debug('[SessionClient] BroadcastChannel close failed', { component: 'SessionClient' }, error);
+            }
+            this.channel = null;
+        }
         if (this.socket) {
             this.socket.disconnect();
             this.socket = null;
@@ -170,25 +226,140 @@ class SessionClient {
         if (!this.started)
             return; // stopped while the dynamic import was in flight
         const hasToken = Boolean(this.host.getAccessToken());
+        // Signed-out connect gate: when there is no bearer, only open the socket if
+        // the consumer supplies a device anchor (web cookie → `true`; native token →
+        // string). This lets an idle tab receive its device's `session_state` pushes
+        // and self-acquire when a sibling signs in.
+        let signedOutAuth = false;
+        if (!hasToken && this.options.signedOutSocketAuth) {
+            try {
+                signedOutAuth = await this.options.signedOutSocketAuth();
+            }
+            catch (error) {
+                loggerUtils_1.logger.warn('[SessionClient] signedOutSocketAuth failed', { component: 'SessionClient' }, error);
+                signedOutAuth = false;
+            }
+            if (!this.started)
+                return; // stopped while the async gate was in flight
+        }
+        const signedOutConnect = signedOutAuth !== false && signedOutAuth != null;
+        const signedOutDeviceToken = typeof signedOutAuth === 'string' ? signedOutAuth : undefined;
+        this.socketAnonymous = !hasToken && signedOutConnect;
         const socket = io(this.host.getBaseURL(), {
             transports: ['websocket'],
-            autoConnect: hasToken,
+            // Send the first-party `oxy_device` cookie on the same-site handshake so a
+            // signed-out browser tab can be resolved to its device room server-side.
+            withCredentials: true,
+            autoConnect: hasToken || signedOutConnect,
             auth: (cb) => {
-                cb({ token: this.host.getAccessToken() ?? '' });
+                const token = this.host.getAccessToken() ?? '';
+                // Present the native device token only while signed out (no bearer). Once
+                // a token is held the bearer path wins and the deviceToken is redundant.
+                cb(token || !signedOutDeviceToken ? { token } : { token, deviceToken: signedOutDeviceToken });
             },
         });
         socket.on('session_state', (payload) => {
             const applied = this.applyState(payload);
-            if (applied) {
-                const active = this.state?.activeAccountId ?? null;
-                if (active && active !== this.host.getCurrentAccountId()) {
-                    void this.bootstrap().catch((error) => {
-                        loggerUtils_1.logger.warn('[SessionClient] post-push token fetch failed', { component: 'SessionClient' }, error);
-                    });
+            if (!applied)
+                return;
+            // Signed-out tab: a session appeared on this device (a sibling signed in).
+            // Acquire it so this tab flips to signed-in; the planted token then
+            // reconnects the socket on the authenticated path.
+            if (!this.host.getAccessToken()) {
+                if ((this.state?.accounts.length ?? 0) > 0) {
+                    this.requestAcquisition();
                 }
+                return;
+            }
+            const active = this.state?.activeAccountId ?? null;
+            if (active && active !== this.host.getCurrentAccountId()) {
+                void this.bootstrap().catch((error) => {
+                    loggerUtils_1.logger.warn('[SessionClient] post-push token fetch failed', { component: 'SessionClient' }, error);
+                });
             }
         });
         this.socket = socket;
     }
+    /**
+     * Run the consumer's session acquisition at most once at a time. A returned
+     * promise gates the next attempt (reset on settle), so a failed acquisition
+     * can retry on the NEXT push while a burst of identical pushes cannot pile up.
+     */
+    requestAcquisition() {
+        if (this.acquiring || !this.options.onSessionAppeared)
+            return;
+        this.acquiring = true;
+        let result;
+        try {
+            result = this.options.onSessionAppeared();
+        }
+        catch (error) {
+            this.acquiring = false;
+            loggerUtils_1.logger.error('[SessionClient] onSessionAppeared threw', error);
+            return;
+        }
+        void Promise.resolve(result).catch((error) => {
+            loggerUtils_1.logger.warn('[SessionClient] onSessionAppeared rejected', { component: 'SessionClient' }, error);
+        }).finally(() => {
+            this.acquiring = false;
+        });
+    }
+    /**
+     * Open the same-origin `BroadcastChannel` (web only). A sibling tab that
+     * commits a session posts a wake ping; on receipt a signed-in tab re-syncs its
+     * device state and a signed-out tab self-acquires — instant + network-free for
+     * the common "two tabs of the same origin" case, with no state (and no tokens)
+     * ever crossing the channel. No-op on native (no BroadcastChannel).
+     */
+    openBroadcastChannel() {
+        if (this.channel)
+            return;
+        const Ctor = globalThis.BroadcastChannel;
+        if (typeof Ctor !== 'function')
+            return; // native RN / SSR — feature absent
+        let channel;
+        try {
+            channel = new Ctor(SESSION_BROADCAST_CHANNEL);
+        }
+        catch (error) {
+            loggerUtils_1.logger.debug('[SessionClient] BroadcastChannel unavailable', { component: 'SessionClient' }, error);
+            return;
+        }
+        channel.onmessage = (event) => {
+            if (!event || typeof event.data !== 'object' || event.data === null)
+                return;
+            if (event.data.type !== 'commit')
+                return;
+            // BroadcastChannel never echoes to the posting context, so this is a
+            // sibling's commit. Re-sync (signed-in) or acquire (signed-out). Neither
+            // path re-posts, so there is no cross-tab ping loop.
+            if (this.host.getAccessToken()) {
+                void this.bootstrap().catch((error) => {
+                    loggerUtils_1.logger.warn('[SessionClient] broadcast re-sync failed', { component: 'SessionClient' }, error);
+                });
+            }
+            else {
+                this.requestAcquisition();
+            }
+        };
+        this.channel = channel;
+    }
+    /**
+     * Wake same-origin sibling tabs after a locally-initiated session mutation.
+     * Opens the channel lazily: a sign-in registers the account (`addCurrentAccount`
+     * / `switchAccount`) BEFORE `start()` runs, so the ping must not depend on
+     * `start()` having opened the channel first.
+     */
+    postCommitPing() {
+        this.openBroadcastChannel();
+        if (!this.channel)
+            return;
+        try {
+            this.channel.postMessage({ type: 'commit', at: Date.now() });
+        }
+        catch (error) {
+            loggerUtils_1.logger.debug('[SessionClient] BroadcastChannel post failed', { component: 'SessionClient' }, error);
+        }
+    }
 }
 exports.SessionClient = SessionClient;