@oxyhq/core 6.0.0 → 7.1.0

package/dist/esm/shared/utils/debugUtils.js

@@ -21,7 +21,7 @@ export const isDev = () => {
 };
 /**
  * Log a debug message (only in development)
- * @param prefix - Log prefix (e.g., '[FedCM]')
+ * @param prefix - Log prefix (e.g., '[ColdBoot]')
  * @param args - Arguments to log
  */
 export const debugLog = (prefix, ...args) => {
@@ -51,12 +51,12 @@ export const debugError = (prefix, ...args) => {
 };
 /**
  * Create a namespaced debug logger
- * @param namespace - Logger namespace (e.g., 'FedCM', 'SilentAuth')
+ * @param namespace - Logger namespace (e.g., 'ColdBoot', 'DeviceAuth')
  * @returns Object with log, warn, error methods
  *
  * @example
  * ```ts
- * const debug = createDebugLogger('FedCM');
+ * const debug = createDebugLogger('ColdBoot');
  * debug.log('Starting authentication');
  * debug.warn('Token expires soon');
  * debug.error('Authentication failed', error);

package/dist/esm/utils/authWebUrl.js

@@ -1,36 +1,16 @@
 /**
- * Central IdP (auth web) URL resolution for cross-domain SSO.
+ * Central IdP apex constant.
  *
- * The Oxy ecosystem runs a single, central Identity Provider at
- * `auth.oxy.so`. For TRUE central cross-domain SSO (Google/Meta/Clerk style),
- * FedCM and the opaque-code SSO bounce always target this one origin — it owns
- * the host-only `fedcm_session` cookie and the central session store reachable
- * via `api.oxy.so`. Relying Parties (mention.earth, homiio.com, alia.onl, …)
- * delegate to it rather than standing up a per-apex IdP.
- *
- * This module is intentionally pure: it performs no DOM access, reads no
- * `window`/`location`, and has no side effects. It is the single source of
- * truth for the central IdP origin so call sites never hardcode the literal.
- *
- * LEGACY(old-sdk): the client resolver (`resolveCentralAuthUrl`) was removed in
- * the device-first cutover; `CENTRAL_IDP_APEX` / `CENTRAL_AUTH_URL` survive ONLY
- * because the lista-B IdP worker imports them to brand assertions. Deletable
- * once Homiio/Allo/Alia/Syra are bumped off the old SDK AND CloudWatch
- * `/oxy/ecs` shows the `/sso*` + `/fedcm/*` routes quiet — F-final sweep.
+ * The client SSO/FedCM resolvers (`resolveCentralAuthUrl`, `CENTRAL_AUTH_URL`)
+ * were removed in the device-first / legacy-final cutovers. The lone survivor is
+ * `CENTRAL_IDP_APEX`, kept because it has a LIVE consumer —
+ * `@oxyhq/core/server`'s CORS helper (`server/cors.ts`'s `createOxyCors`)
+ * auto-allows `*.oxy.so` from it. That CORS use is permanent, so this stays
+ * past the SSO/FedCM teardown.
  */
 /**
  * The registrable apex (eTLD+1) of the Oxy ecosystem's central Identity
- * Provider. The central IdP is reachable at `auth.${CENTRAL_IDP_APEX}` and the
- * ID-token assertion issuer is always `https://auth.${CENTRAL_IDP_APEX}`
- * regardless of which per-apex `auth.<rp>` host served a given request.
- *
- * Kept as a standalone constant so the IdP worker and the SDK derive the same
- * literal from one source of truth (the worker imports it to brand assertions).
+ * Provider, reachable at `auth.${CENTRAL_IDP_APEX}`. Single source of truth so
+ * the CORS helper (and anything else that needs the central apex) never drifts.
  */
 export const CENTRAL_IDP_APEX = 'oxy.so';
-/**
- * The canonical central Identity Provider origin for the Oxy ecosystem.
- * No trailing slash. Derived from {@link CENTRAL_IDP_APEX} so the apex and the
- * full origin never drift apart. The IdP worker imports it to brand assertions.
- */
-export const CENTRAL_AUTH_URL = `https://auth.${CENTRAL_IDP_APEX}`;

package/dist/esm/utils/coldBoot.js

@@ -3,19 +3,21 @@
  * authentication resolution.
  *
  * On a fresh page load / app launch the SDK may have several ways to recover an
- * existing session (silent FedCM, a persisted refresh token, a cross-domain
- * claim, a redirect SSO return, ...). They must be attempted in a deterministic
- * order*, and the FIRST one that yields a session wins — every later step is
- * skipped. This module encodes exactly that contract and nothing else.
+ * existing session (a persisted refresh-token family, a shared-keychain
+ * identity, a cross-domain boot-fragment return, ...). They must be attempted
+ * in a deterministic order, and the FIRST one that yields a session wins —
+ * every later step is skipped. This module encodes exactly that contract and
+ * nothing else.
  *
  * Design constraints (all enforced):
  *   - PURE: no DOM, no `navigator`, no `window`, no React, no platform globals.
  *   - NO module-level mutable state. Every call to {@link runColdBoot} is fully
  *     self-contained, so it is safe under bundler re-evaluation (e.g. the Metro
- *     web bundle, which is precisely why the FedCM silent-SSO guard had to live
- *     in consumers rather than a core singleton).
- *   - Architecture-agnostic: both candidate cross-domain SSO designs consume
- *     this same primitive; it knows nothing about HOW a step resolves a session.
+ *     web bundle — the reason any run-once guard for a step must live in the
+ *     calling consumer, never in a core module-level singleton).
+ *   - Architecture-agnostic: it knows nothing about HOW a step resolves a
+ *     session; `runSessionColdBoot` (`boot/coldBootV2.ts`) is the current
+ *     device-first consumer.
  *
  * A step is skipped (without running) when its `enabled` predicate returns
  * false. Any thrown error — from either `enabled` or `run` — is reported via

package/dist/esm/utils/{fapiAutoDetect.js → registrableApex.js}

@@ -1,17 +1,15 @@
 /**
  * Registrable-apex (eTLD+1) host kernel.
  *
- * The client FAPI auto-detection helper (`autoDetectAuthWebUrl`) was removed in
- * the device-first cutover — the SDK no longer derives a per-apex `auth.<rp>`
- * IdP host. What survives is the pure registrable-domain kernel, still used by
- * the api SSO surface, `fedcm.service`, `deviceAuth` (same-apex trust checks),
- * and the IdP worker (all lista B / server-side). `@oxyhq/core/server`
- * re-exports it for the api.
+ * The client FAPI auto-detection helper was removed in the device-first cutover
+ * (which is why this file is now named for what it actually is, not the old
+ * `fapiAutoDetect`). What survives is the pure registrable-domain kernel, still
+ * used server-side by the api's device-first same-apex trust checks
+ * (`deviceAuth.ts`'s `POST /auth/device/web-session`, via `sameSite.ts`'s
+ * `isSameSiteTrustedRequest`) and the `@oxyhq/core/server` CORS/re-export layer.
  *
- * LEGACY(old-sdk): `registrableApex` survives ONLY for the lista-B server/IdP
- * SSO surface. Deletable once Homiio/Allo/Alia/Syra are bumped off the old SDK
- * AND CloudWatch `/oxy/ecs` shows the `/sso*` + `/fedcm/*` routes quiet — the
- * F-final sweep should remove this file then.
+ * `registrableApex` is NOT legacy — the device-first same-apex check is a live
+ * consumer, so this kernel stays regardless of the SSO/FedCM removal.
  */
 import { getDomain } from 'tldts';
 /**