@oxyhq/core 7.1.0 → 8.0.0

package/dist/cjs/HttpService.js

@@ -56,7 +56,7 @@ const CSRF_FETCH_RETRY_DELAY_MS = 500;
 /**
  * Cooldown (ms) applied after a failed access-token refresh before another
  * refresh is attempted. Prevents a refresh storm (and server hammering) when
- * the AuthManager's refresh handler is failing — every in-flight request that
+ * the auth refresh handler is failing — every in-flight request that
  * hits a 401 would otherwise trigger its own refresh.
  */
 const TOKEN_REFRESH_COOLDOWN_MS = 15000;
@@ -143,7 +143,7 @@ class HttpService {
         this.cacheSizeWarningSilentUntil = 0;
         /**
          * Fan-out listeners notified on EVERY access-token change on this instance:
-         * explicit `setTokens`, `clearTokens`, an AuthManager-owned refresh, and the
+         * explicit `setTokens`, `clearTokens`, a refresh-handler rotation, and the
          * internal 401-driven clear. This is a Set so multiple independent observers
          * can mirror token state without clobbering each other.
          *
@@ -361,9 +361,9 @@ class HttpService {
                     clearTimeout(timeoutId);
                 // Handle response
                 if (!response.ok) {
-                    // On 401, delegate refresh to AuthManager and retry once before
-                    // giving up. HttpService deliberately does not know any session
-                    // routes; the AuthManager is the single session authority.
+                    // On 401, delegate to the installed auth refresh handler and retry
+                    // once before giving up. HttpService deliberately does not know any
+                    // session routes; the refresh handler owns session rotation.
                     if (response.status === 401 && !config._isAuthRetry && !config.skipAuth) {
                         const refreshed = await this.refreshAccessToken('response-401');
                         if (refreshed) {
@@ -823,7 +823,7 @@ class HttpService {
                     this.tokenStore.setTokens(newToken);
                     this.notifyTokenChange();
                 }
-                this.logger.debug('Token refreshed via AuthManager');
+                this.logger.debug('Token refreshed via the auth refresh handler');
                 return newToken;
             })
                 .catch((error) => {

package/dist/cjs/i18n/locales/en-US.json

@@ -384,7 +384,11 @@
             "subtitle": "Add another account to switch between them quickly"
         },
         "label": "Account switcher",
-        "searchPlaceholder": "Search accounts"
+        "searchPlaceholder": "Search accounts",
+        "scanTitle": "Scan to sign in",
+        "scanSubtitle": "Open the Oxy app on your phone and scan this code",
+        "scanWithOxy": "Scan with the Oxy app to continue",
+        "scanQr": "Scan QR code"
     },
     "reputation": {
         "faq": {
@@ -1905,5 +1909,44 @@
             "earlyAdopter": "Early Adopter",
             "earlyAdopterDesc": "Been part of the community from the start"
         }
+    },
+    "consent": {
+        "title": "Continue to {{app}}",
+        "subtitle": "Use your Oxy account to sign in to {{app}}. Review what this connection means before you continue.",
+        "provenance": {
+            "title": "Who is requesting access",
+            "official": "Official Oxy application",
+            "developer": "Published by {{developer}}",
+            "thirdParty": "Third-party application"
+        },
+        "permissions": {
+            "title": "Permissions requested",
+            "basic": "Sign you in and read your basic profile"
+        },
+        "scopes": {
+            "openid": "Confirm your identity",
+            "profile": "Read your basic profile",
+            "email": "Read your email address",
+            "offlineAccess": "Keep you signed in when you're away",
+            "userRead": "Read your basic profile",
+            "filesRead": "Read your files",
+            "filesWrite": "Upload and modify your files",
+            "filesDelete": "Delete your files",
+            "webhooksReceive": "Receive webhooks",
+            "chatCompletions": "Use AI chat on your behalf",
+            "modelsRead": "List available AI models",
+            "federationWrite": "Act across federated services"
+        },
+        "account": {
+            "title": "Signing in as"
+        },
+        "links": {
+            "website": "Website",
+            "privacy": "Privacy Policy",
+            "terms": "Terms of Service"
+        },
+        "allow": "Continue to {{app}}",
+        "deny": "Cancel",
+        "disclaimer": "By continuing, {{app}} will be able to sign in with your Oxy account. You can manage connected apps anytime in your Oxy account settings."
     }
 }

package/dist/cjs/i18n/locales/es-ES.json

@@ -581,7 +581,11 @@
             "subtitle": "Añade otra cuenta para cambiar rápidamente entre ellas"
         },
         "label": "Selector de cuentas",
-        "searchPlaceholder": "Buscar cuentas"
+        "searchPlaceholder": "Buscar cuentas",
+        "scanTitle": "Escanea para iniciar sesión",
+        "scanSubtitle": "Abre la app de Oxy en tu móvil y escanea este código",
+        "scanWithOxy": "Escanea con la app de Oxy para continuar",
+        "scanQr": "Escanear código QR"
     },
     "feedback": {
         "type": {
@@ -1905,5 +1909,44 @@
             "earlyAdopter": "Pionero",
             "earlyAdopterDesc": "Has formado parte de la comunidad desde el principio"
         }
+    },
+    "consent": {
+        "title": "Continuar a {{app}}",
+        "subtitle": "Usa tu cuenta de Oxy para iniciar sesión en {{app}}. Revisa qué implica esta conexión antes de continuar.",
+        "provenance": {
+            "title": "Quién solicita acceso",
+            "official": "Aplicación oficial de Oxy",
+            "developer": "Publicada por {{developer}}",
+            "thirdParty": "Aplicación de terceros"
+        },
+        "permissions": {
+            "title": "Permisos solicitados",
+            "basic": "Iniciar sesión y leer tu perfil básico"
+        },
+        "scopes": {
+            "openid": "Confirmar tu identidad",
+            "profile": "Leer tu perfil básico",
+            "email": "Leer tu dirección de correo",
+            "offlineAccess": "Mantener tu sesión iniciada cuando no estés",
+            "userRead": "Leer tu perfil básico",
+            "filesRead": "Leer tus archivos",
+            "filesWrite": "Subir y modificar tus archivos",
+            "filesDelete": "Eliminar tus archivos",
+            "webhooksReceive": "Recibir webhooks",
+            "chatCompletions": "Usar el chat con IA en tu nombre",
+            "modelsRead": "Ver los modelos de IA disponibles",
+            "federationWrite": "Actuar en servicios federados"
+        },
+        "account": {
+            "title": "Iniciando sesión como"
+        },
+        "links": {
+            "website": "Sitio web",
+            "privacy": "Política de privacidad",
+            "terms": "Términos del servicio"
+        },
+        "allow": "Continuar a {{app}}",
+        "deny": "Cancelar",
+        "disclaimer": "Al continuar, {{app}} podrá iniciar sesión con tu cuenta de Oxy. Puedes gestionar las apps conectadas cuando quieras en los ajustes de tu cuenta de Oxy."
     }
 }

package/dist/cjs/i18n/locales/locales/en-US.json

@@ -384,7 +384,11 @@
       "subtitle": "Add another account to switch between them quickly"
     },
     "label": "Account switcher",
-    "searchPlaceholder": "Search accounts"
+    "searchPlaceholder": "Search accounts",
+    "scanTitle": "Scan to sign in",
+    "scanSubtitle": "Open the Oxy app on your phone and scan this code",
+    "scanWithOxy": "Scan with the Oxy app to continue",
+    "scanQr": "Scan QR code"
   },
   "reputation": {
     "faq": {
@@ -1905,5 +1909,44 @@
       "earlyAdopter": "Early Adopter",
       "earlyAdopterDesc": "Been part of the community from the start"
     }
+  },
+  "consent": {
+    "title": "Continue to {{app}}",
+    "subtitle": "Use your Oxy account to sign in to {{app}}. Review what this connection means before you continue.",
+    "provenance": {
+      "title": "Who is requesting access",
+      "official": "Official Oxy application",
+      "developer": "Published by {{developer}}",
+      "thirdParty": "Third-party application"
+    },
+    "permissions": {
+      "title": "Permissions requested",
+      "basic": "Sign you in and read your basic profile"
+    },
+    "scopes": {
+      "openid": "Confirm your identity",
+      "profile": "Read your basic profile",
+      "email": "Read your email address",
+      "offlineAccess": "Keep you signed in when you're away",
+      "userRead": "Read your basic profile",
+      "filesRead": "Read your files",
+      "filesWrite": "Upload and modify your files",
+      "filesDelete": "Delete your files",
+      "webhooksReceive": "Receive webhooks",
+      "chatCompletions": "Use AI chat on your behalf",
+      "modelsRead": "List available AI models",
+      "federationWrite": "Act across federated services"
+    },
+    "account": {
+      "title": "Signing in as"
+    },
+    "links": {
+      "website": "Website",
+      "privacy": "Privacy Policy",
+      "terms": "Terms of Service"
+    },
+    "allow": "Continue to {{app}}",
+    "deny": "Cancel",
+    "disclaimer": "By continuing, {{app}} will be able to sign in with your Oxy account. You can manage connected apps anytime in your Oxy account settings."
   }
-}
+}

package/dist/cjs/i18n/locales/locales/es-ES.json

@@ -581,7 +581,11 @@
       "subtitle": "Añade otra cuenta para cambiar rápidamente entre ellas"
     },
     "label": "Selector de cuentas",
-    "searchPlaceholder": "Buscar cuentas"
+    "searchPlaceholder": "Buscar cuentas",
+    "scanTitle": "Escanea para iniciar sesión",
+    "scanSubtitle": "Abre la app de Oxy en tu móvil y escanea este código",
+    "scanWithOxy": "Escanea con la app de Oxy para continuar",
+    "scanQr": "Escanear código QR"
   },
   "feedback": {
     "type": {
@@ -1905,5 +1909,44 @@
       "earlyAdopter": "Pionero",
       "earlyAdopterDesc": "Has formado parte de la comunidad desde el principio"
     }
+  },
+  "consent": {
+    "title": "Continuar a {{app}}",
+    "subtitle": "Usa tu cuenta de Oxy para iniciar sesión en {{app}}. Revisa qué implica esta conexión antes de continuar.",
+    "provenance": {
+      "title": "Quién solicita acceso",
+      "official": "Aplicación oficial de Oxy",
+      "developer": "Publicada por {{developer}}",
+      "thirdParty": "Aplicación de terceros"
+    },
+    "permissions": {
+      "title": "Permisos solicitados",
+      "basic": "Iniciar sesión y leer tu perfil básico"
+    },
+    "scopes": {
+      "openid": "Confirmar tu identidad",
+      "profile": "Leer tu perfil básico",
+      "email": "Leer tu dirección de correo",
+      "offlineAccess": "Mantener tu sesión iniciada cuando no estés",
+      "userRead": "Leer tu perfil básico",
+      "filesRead": "Leer tus archivos",
+      "filesWrite": "Subir y modificar tus archivos",
+      "filesDelete": "Eliminar tus archivos",
+      "webhooksReceive": "Recibir webhooks",
+      "chatCompletions": "Usar el chat con IA en tu nombre",
+      "modelsRead": "Ver los modelos de IA disponibles",
+      "federationWrite": "Actuar en servicios federados"
+    },
+    "account": {
+      "title": "Iniciando sesión como"
+    },
+    "links": {
+      "website": "Sitio web",
+      "privacy": "Política de privacidad",
+      "terms": "Términos del servicio"
+    },
+    "allow": "Continuar a {{app}}",
+    "deny": "Cancelar",
+    "disclaimer": "Al continuar, {{app}} podrá iniciar sesión con tu cuenta de Oxy. Puedes gestionar las apps conectadas cuando quieras en los ajustes de tu cuenta de Oxy."
   }
-}
+}

package/dist/cjs/index.js

@@ -20,8 +20,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.isRTLLocale = exports.normalizeLanguageCode = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.RecoveryPhraseService = exports.SignatureService = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.verifyPublicCardAttestation = exports.parseAttestPayload = exports.parseIdPayload = exports.buildUserDid = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.ServiceCredentialMismatchError = exports.oxyClient = exports.OXY_CLOUD_URL = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.OxyServices = void 0;
 exports.isValidPassword = exports.isValidUsername = exports.isValidEmail = exports.PASSWORD_REGEX = exports.USERNAME_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.translate = exports.createDebugLogger = exports.debugError = exports.debugWarn = exports.debugLog = exports.isDev = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = void 0;
-exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.switchableAccountIds = exports.projectSwitchableAccounts = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.runColdBoot = exports.SSO_CALLBACK_PATH = exports.CENTRAL_IDP_APEX = exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.logPerformance = exports.logPayment = exports.logDevice = exports.logUser = exports.logSession = exports.logApi = exports.logAuth = exports.LogLevel = exports.logger = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.isValidDisplayName = void 0;
-exports.packageInfo = exports.BOOT_STATE_SESSION_KEY = exports.BOOT_FRAGMENT_PARAM = exports.hashHasBootFragment = exports.parseDeviceBootFragment = exports.consumeDeviceBootReturn = exports.BOOT_ATTEMPTED_KEY = exports.isSameApex = exports.createBrowserColdBootDom = exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshPersistedSession = exports.DEVICE_TOKEN_STORAGE_KEY = void 0;
+exports.AccountDialogController = exports.switchableAccountIds = exports.projectSwitchableAccounts = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.runColdBoot = exports.CENTRAL_IDP_APEX = exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.logPerformance = exports.logPayment = exports.logDevice = exports.logUser = exports.logSession = exports.logApi = exports.logAuth = exports.LogLevel = exports.logger = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.isValidDisplayName = void 0;
+exports.packageInfo = exports.BOOT_STATE_SESSION_KEY = exports.BOOT_FRAGMENT_PARAM = exports.hashHasBootFragment = exports.parseDeviceBootFragment = exports.consumeDeviceBootReturn = exports.BOOT_ATTEMPTED_KEY = exports.isSameApex = exports.createBrowserColdBootDom = exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshPersistedSession = exports.DEVICE_TOKEN_STORAGE_KEY = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = void 0;
 // Ensure crypto polyfills are loaded before anything else
 require("./crypto/polyfill");
 // ---------------------------------------------------------------------------
@@ -256,33 +256,36 @@ Object.defineProperty(exports, "getAccountColor", { enumerable: true, get: funct
 // ---------------------------------------------------------------------------
 // Registrable-domain + central-IdP-apex helpers.
 //
-// The client SSO-bounce / silent-iframe / FedCM machinery was removed in the
-// device-first cutover (wave 2, ecosystem-wide bump complete). `registrableApex`
-// (eTLD+1) and `CENTRAL_IDP_APEX` are still genuinely used: `registrableApex`
-// via the `@oxyhq/core/server` re-export consumed by
-// `packages/api/src/utils/sameSite.ts` for same-site origin checks, and
-// `CENTRAL_IDP_APEX` by `server/cors.ts`'s `createOxyCors` (auto-allows
-// `*.oxy.so`). `SSO_CALLBACK_PATH` has no remaining importer outside this
-// module as of wave 2 — kept exported for now rather than removed here (an
-// export deletion is a logic change, out of scope for a comment sweep); flag
-// for a follow-up dead-export cleanup pass.
+// `registrableApex` (eTLD+1) is consumed via the `@oxyhq/core/server`
+// re-export by `packages/api/src/utils/sameSite.ts` for same-site origin
+// checks; `CENTRAL_IDP_APEX` by `server/cors.ts`'s `createOxyCors` (auto-allows
+// `*.oxy.so`).
 // ---------------------------------------------------------------------------
 var registrableApex_1 = require("./utils/registrableApex");
 Object.defineProperty(exports, "registrableApex", { enumerable: true, get: function () { return registrableApex_1.registrableApex; } });
 var authWebUrl_1 = require("./utils/authWebUrl");
 Object.defineProperty(exports, "CENTRAL_IDP_APEX", { enumerable: true, get: function () { return authWebUrl_1.CENTRAL_IDP_APEX; } });
-var ssoBounce_1 = require("./utils/ssoBounce");
-Object.defineProperty(exports, "SSO_CALLBACK_PATH", { enumerable: true, get: function () { return ssoBounce_1.SSO_CALLBACK_PATH; } });
 var coldBoot_1 = require("./utils/coldBoot");
 Object.defineProperty(exports, "runColdBoot", { enumerable: true, get: function () { return coldBoot_1.runColdBoot; } });
 // ---------------------------------------------------------------------------
+// OAuth 2.0 Authorization Code + PKCE helpers ("Sign in with Oxy" third party).
+// Standard OAuth against auth.oxy.so/authorize — no FedCM/cookies/SSO bounce.
+// ---------------------------------------------------------------------------
+var oauthPkce_1 = require("./utils/oauthPkce");
+Object.defineProperty(exports, "buildOAuthAuthorizeUrl", { enumerable: true, get: function () { return oauthPkce_1.buildOAuthAuthorizeUrl; } });
+Object.defineProperty(exports, "computeCodeChallenge", { enumerable: true, get: function () { return oauthPkce_1.computeCodeChallenge; } });
+Object.defineProperty(exports, "generateOAuthState", { enumerable: true, get: function () { return oauthPkce_1.generateOAuthState; } });
+Object.defineProperty(exports, "generatePkcePair", { enumerable: true, get: function () { return oauthPkce_1.generatePkcePair; } });
+Object.defineProperty(exports, "DEFAULT_OAUTH_SCOPE", { enumerable: true, get: function () { return oauthPkce_1.DEFAULT_OAUTH_SCOPE; } });
+Object.defineProperty(exports, "OXY_AUTHORIZE_URL", { enumerable: true, get: function () { return oauthPkce_1.OXY_AUTHORIZE_URL; } });
+// ---------------------------------------------------------------------------
 // Session sync (device-scoped multi-account session client)
 // ---------------------------------------------------------------------------
 var SessionClient_1 = require("./session/SessionClient");
 Object.defineProperty(exports, "SessionClient", { enumerable: true, get: function () { return SessionClient_1.SessionClient; } });
 // Shared SessionClient integration layer: the host adapter, the pure
 // DeviceSessionState projection helpers, and the client factory are defined
-// ONCE here so `@oxyhq/services` and `@oxyhq/auth` both reuse them instead of
+// ONCE here so every `@oxyhq/services` platform variant reuses them instead of
 // duplicating a local copy. Each consumer supplies its own `TokenTransport`
 // (native vs. web mint strategies differ) to `createSessionClient`.
 var sessionClientHost_1 = require("./session/sessionClientHost");
@@ -297,7 +300,7 @@ Object.defineProperty(exports, "accountIdsOf", { enumerable: true, get: function
 // Unified account-list projection (THE single source of truth for the account
 // chooser: device sign-ins ∪ account graph, deduped by accountId). Pure +
 // I/O-free — the caller hydrates profiles via `getUsersByIds`. Shared by
-// `@oxyhq/services`, `@oxyhq/auth`, and auth.oxy.so so the list can't diverge.
+// `@oxyhq/services` and auth.oxy.so so the list can't diverge.
 var accountProjection_1 = require("./session/accountProjection");
 Object.defineProperty(exports, "projectSwitchableAccounts", { enumerable: true, get: function () { return accountProjection_1.projectSwitchableAccounts; } });
 Object.defineProperty(exports, "switchableAccountIds", { enumerable: true, get: function () { return accountProjection_1.switchableAccountIds; } });

package/dist/cjs/server/index.js

@@ -16,7 +16,7 @@
  * ```
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SSO_CALLBACK_PATH = exports.registrableApex = exports.verifySecret = exports.createOxyCors = exports.UPSTREAM_HEADERS_TIMEOUT_MS = exports.MAX_URL_LENGTH = exports.MAX_REDIRECTS = exports.DEFAULT_USER_AGENT = exports.BLOCKED_HOSTNAMES = exports.ALLOWED_PROTOCOLS = exports.ALLOWED_PORTS = exports.UpstreamError = exports.SsrfRejection = exports.safeFetch = exports.isBlockedIp = exports.assertSafePublicUrl = exports.createOxyRateLimit = exports.requireOxyAuth = exports.isOxyAuthenticated = exports.getRequiredOxyUserId = exports.getOxyUserId = exports.createOxyAuthMiddleware = exports.createOptionalOxyAuth = void 0;
+exports.registrableApex = exports.verifySecret = exports.createOxyCors = exports.UPSTREAM_HEADERS_TIMEOUT_MS = exports.MAX_URL_LENGTH = exports.MAX_REDIRECTS = exports.DEFAULT_USER_AGENT = exports.BLOCKED_HOSTNAMES = exports.ALLOWED_PROTOCOLS = exports.ALLOWED_PORTS = exports.UpstreamError = exports.SsrfRejection = exports.safeFetch = exports.isBlockedIp = exports.assertSafePublicUrl = exports.createOxyRateLimit = exports.requireOxyAuth = exports.isOxyAuthenticated = exports.getRequiredOxyUserId = exports.getOxyUserId = exports.createOxyAuthMiddleware = exports.createOptionalOxyAuth = void 0;
 var auth_1 = require("./auth");
 Object.defineProperty(exports, "createOptionalOxyAuth", { enumerable: true, get: function () { return auth_1.createOptionalOxyAuth; } });
 Object.defineProperty(exports, "createOxyAuthMiddleware", { enumerable: true, get: function () { return auth_1.createOxyAuthMiddleware; } });
@@ -52,9 +52,3 @@ Object.defineProperty(exports, "verifySecret", { enumerable: true, get: function
 // lets `@oxyhq/api` derive `auth.<apex>` without duplicating PSL logic.
 var registrableApex_1 = require("../utils/registrableApex");
 Object.defineProperty(exports, "registrableApex", { enumerable: true, get: function () { return registrableApex_1.registrableApex; } });
-// The single RP callback path the IdP redirects back to. A pure wire-contract
-// constant (no browser deps at module top level), re-used server-side so the
-// `/sso/establish-token` `return_to` cannot drift from what `/sso/establish`
-// validates.
-var ssoBounce_1 = require("../utils/ssoBounce");
-Object.defineProperty(exports, "SSO_CALLBACK_PATH", { enumerable: true, get: function () { return ssoBounce_1.SSO_CALLBACK_PATH; } });

package/dist/cjs/session/accountDialogController.js

@@ -4,7 +4,7 @@
  *
  * A framework-agnostic state machine + subscribe/getSnapshot store (the same
  * pattern {@link SessionClient} uses — no React, no RN) that both
- * `@oxyhq/services` (RN `OxyProvider`) and `@oxyhq/auth` (web `WebOxyProvider`)
+ * every `OxyProvider` platform variant (Expo/RN and RN-Web)
  * bind to via `useSyncExternalStore`, so the account chooser is ONE
  * implementation across the ecosystem instead of the five drifting copies it
  * replaces.
@@ -60,6 +60,9 @@ class AccountDialogController {
         this.pollTimer = null;
         // --- Store plumbing ---
         this.unsubscribeSession = null;
+        this.unsubscribeTokens = null;
+        /** Last-observed SDK auth readiness (a planted bearer). Drives the fetch edge. */
+        this.authed = false;
         this.started = false;
         this.refreshSeq = 0;
         this.oxyServices = options.oxyServices;
@@ -99,13 +102,28 @@ class AccountDialogController {
         if (this.started)
             return;
         this.started = true;
+        this.authed = this.isAuthenticated();
         this.unsubscribeSession = this.sessionClient.subscribe(() => {
             // A device-state change (switch / sign-out / sibling sign-in) can add or
-            // remove accounts — re-project immediately, and refetch profiles when new
-            // account ids appeared.
+            // remove accounts — re-project immediately, refetch profiles when new
+            // account ids appeared, and reconcile the auth-readiness edge.
             this.emit();
             void this.ensureProfiles();
+            this.reconcileAuth();
         });
+        // The access token is planted AFTER `SessionClient.applyState` fires its
+        // subscription (`applySync` calls `setTokens` only once `applyState`/notify
+        // has returned; `ensureActiveToken` plants it async later), so the
+        // device-state subscription alone cannot observe the signed-out → signed-in
+        // edge. Observe the SDK-canonical readiness signal directly — a change to
+        // `oxyServices.getAccessToken()`, the `hasAccessToken` term of
+        // `OxyContext.canUsePrivateApi`.
+        this.unsubscribeTokens = this.oxyServices.onTokensChanged(() => {
+            this.reconcileAuth();
+        });
+        // Initial projection is device-only. `refresh()` fetches the graph IFF a
+        // bearer is already planted (warm start); when signed out (cold boot before
+        // restore) it re-projects from device state and makes NO private call.
         void this.refresh();
     }
     /**
@@ -118,10 +136,58 @@ class AccountDialogController {
             this.unsubscribeSession();
             this.unsubscribeSession = null;
         }
+        if (this.unsubscribeTokens) {
+            this.unsubscribeTokens();
+            this.unsubscribeTokens = null;
+        }
         this.clearPollTimer();
         this.listeners.clear();
     }
     // =========================================================================
+    // Auth readiness (SDK-canonical — mirrors OxyContext.canUsePrivateApi)
+    // =========================================================================
+    /**
+     * Whether a PRIVATE endpoint may be called right now. Mirrors the
+     * `hasAccessToken` term of `OxyContext.canUsePrivateApi`
+     * (`authResolved && isAuthenticated && tokenReady && hasAccessToken`, where
+     * `hasAccessToken = Boolean(oxyServices.getAccessToken())`): a planted bearer
+     * is the only term that decides whether a request carries auth — the other
+     * three are provider render-lifecycle gates with no headless equivalent.
+     *
+     * `listAccounts()` (`GET /accounts`) and `getUsersByIds()`
+     * (`POST /users/by-ids`) are private; calling either before cold-boot restore
+     * plants the token 401s → `HttpService` clears the bearer + emits
+     * `onTokensChanged(null)` → the app signs out. Every graph/profile fetch gates
+     * on this.
+     */
+    isAuthenticated() {
+        return Boolean(this.oxyServices.getAccessToken());
+    }
+    /**
+     * Reconcile the account graph against the current auth-readiness edge. On the
+     * signed-out → signed-in edge fetch the graph ONCE; on signed-in → signed-out
+     * drop it and re-project device-only. A no-op when readiness is unchanged, so
+     * a burst of token events / device pushes cannot restart the fetch — and a
+     * failed `listAccounts()` never flips the edge, so it cannot re-trigger itself
+     * (no retry storm).
+     */
+    reconcileAuth() {
+        const authed = this.isAuthenticated();
+        if (authed === this.authed)
+            return;
+        this.authed = authed;
+        if (authed) {
+            void this.refresh();
+            return;
+        }
+        // Signed out: the graph is no longer fetchable/switchable — drop it and
+        // re-project from the device session set alone.
+        this.graph = [];
+        this.error = null;
+        this.loading = false;
+        this.emit();
+    }
+    // =========================================================================
     // View actions
     // =========================================================================
     /** Set the dialog view directly. */
@@ -150,6 +216,17 @@ class AccountDialogController {
      */
     async refresh() {
         const seq = ++this.refreshSeq;
+        // Never hit the private `listAccounts()` while signed out: at cold boot the
+        // bearer is not planted yet, so the call 401s → `HttpService` clears the
+        // token and signs the user out. Re-project from the device session set alone
+        // (`projectSwitchableAccounts` works from `SessionClient` state) and stop.
+        if (!this.isAuthenticated()) {
+            this.graph = [];
+            this.loading = false;
+            this.error = null;
+            this.emit();
+            return;
+        }
         const hadAccounts = this.snapshot.accounts.length > 0;
         this.loading = !hadAccounts;
         this.error = null;
@@ -179,6 +256,9 @@ class AccountDialogController {
      * subscription so a newly-added device account gets a name/avatar.
      */
     async ensureProfiles() {
+        // `getUsersByIds` is private — skip the whole path while signed out.
+        if (!this.isAuthenticated())
+            return;
         const ids = (0, accountProjection_1.switchableAccountIds)(this.sessionClient.getState(), this.graph);
         if (ids.every((id) => this.profilesById.has(id)))
             return;
@@ -186,6 +266,11 @@ class AccountDialogController {
         this.emit();
     }
     async loadProfiles(seq) {
+        // `getUsersByIds` (`POST /users/by-ids`) is a private call — never issue it
+        // while signed out (the 401 → sign-out cascade). Callers already gate; this
+        // guards the network chokepoint too (e.g. the token was cleared mid-refresh).
+        if (!this.isAuthenticated())
+            return;
         const ids = (0, accountProjection_1.switchableAccountIds)(this.sessionClient.getState(), this.graph);
         if (ids.length === 0)
             return;

package/dist/cjs/session/accountProjection.js

@@ -6,7 +6,7 @@
  * merging the device's server-authoritative session set (`DeviceSessionState`
  * from {@link SessionClient}) with the caller's account graph (`AccountNode[]`
  * from `oxyServices.listAccounts()`), deduped by `accountId`. This lives in
- * `@oxyhq/core` so `@oxyhq/services` (RN) and `@oxyhq/auth` (web) — and
+ * `@oxyhq/core` so every `@oxyhq/services` platform variant — and
  * `auth.oxy.so` — all render the SAME list from the SAME logic and cannot
  * diverge.
  *

package/dist/cjs/session/projectSessionState.js

@@ -7,7 +7,7 @@ exports.accountIdsOf = accountIdsOf;
 /**
  * Pure projection helpers: `DeviceSessionState` (the device-scoped
  * multi-account session-sync state produced by `SessionClient`) -> the
- * shapes consumers (`@oxyhq/services`, `@oxyhq/auth`) render today
+ * shapes `@oxyhq/services` consumers render today
  * (`ClientSession[]`, an active session id, an active `User`).
  *
  * No I/O. The caller fetches profiles via

package/dist/cjs/session/sessionClientHost.js

@@ -7,8 +7,7 @@ exports.createSessionClientHost = createSessionClientHost;
  * `SessionClient` is host-agnostic: it only needs a REST + token surface.
  * `OxyServices` already exposes all of that except `getCurrentAccountId`,
  * which has no direct equivalent — the adapter holds a mutable ref set by
- * the caller (`OxyContext` in `@oxyhq/services`, `WebOxyProvider` in
- * `@oxyhq/auth`) via `setCurrentAccountId`.
+ * the caller (`OxyContext` in `@oxyhq/services`) via `setCurrentAccountId`.
  *
  * Shared here (rather than duplicated per consumer) because it is entirely
  * platform-agnostic: every method it calls exists identically on

package/dist/cjs/utils/accountUtils.js

@@ -1,7 +1,7 @@
 "use strict";
 /**
  * Shared account types and pure helper functions.
- * Used by both @oxyhq/services (React Native) and @oxyhq/auth (Web) account stores.
+ * Used by the @oxyhq/services account stores (Expo/RN and RN-Web).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getAccountColor = exports.createQuickAccount = exports.buildAccountsArray = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.formatPublicKeyHandle = void 0;