@oxyhq/core 7.1.0 → 8.0.0

package/dist/types/HttpService.d.ts

@@ -85,7 +85,7 @@ export declare class HttpService {
     private cacheSizeWarningSilentUntil;
     /**
      * Fan-out listeners notified on EVERY access-token change on this instance:
-     * explicit `setTokens`, `clearTokens`, an AuthManager-owned refresh, and the
+     * explicit `setTokens`, `clearTokens`, a refresh-handler rotation, and the
      * internal 401-driven clear. This is a Set so multiple independent observers
      * can mirror token state without clobbering each other.
      *

package/dist/types/index.d.ts

@@ -53,7 +53,7 @@ export { RecoveryPhraseService } from './crypto/recoveryPhrase';
 export type { RecoveryPhraseResult } from './crypto/recoveryPhrase';
 export { DeviceManager } from './utils/deviceManager';
 export type { DeviceFingerprint, StoredDeviceInfo } from './utils/deviceManager';
-export type { OxyConfig, PrivacySettings, NotificationPreferences, UserPreferences, User, LoginResponse, Notification, Wallet, Transaction, BlockedUser, RestrictedUser, TransferFundsRequest, PurchaseRequest, WithdrawalRequest, TransactionResponse, PaginationInfo, SearchProfilesResponse, ApiError, PaymentMethod, PaymentRequest, PaymentResponse, AnalyticsData, FollowerDetails, ContentViewer, FileMetadata, FileUploadResponse, FileListResponse, FileUpdateRequest, FileDeleteResponse, RNFileDescriptor, AssetUploadInput, FileVisibility, AssetLink, AssetMetadata, AssetVariant, Asset, AssetInitRequest, AssetInitResponse, AssetCompleteRequest, AssetLinkRequest, AssetUnlinkRequest, AssetUrlResponse, AssetDeleteSummary, AssetUpdateVisibilityRequest, AssetUpdateVisibilityResponse, ServiceAssetMetadata, ServiceAssetMetadataBySha, AccountStorageCategoryUsage, AccountStorageUsageResponse, SecurityEventType, SecurityEventSeverity, SecurityActivity, SecurityActivityResponse, AssetUploadProgress, DeviceSession, DeviceSessionsResponse, DeviceSessionLogoutResponse, UpdateDeviceNameResponse, } from './models/interfaces';
+export type { OxyConfig, PrivacySettings, NotificationPreferences, UserPreferences, User, LoginResponse, Notification, Wallet, Transaction, BlockedUser, RestrictedUser, TransferFundsRequest, PurchaseRequest, WithdrawalRequest, TransactionResponse, PaginationInfo, SearchProfilesResponse, ApiError, PaymentMethod, PaymentRequest, PaymentResponse, AnalyticsData, FollowerDetails, ContentViewer, FileMetadata, FileUploadResponse, FileListResponse, FileUpdateRequest, FileDeleteResponse, RNFileDescriptor, AssetUploadInput, FileVisibility, AssetLink, AssetMetadata, AssetVariant, Asset, AssetInitRequest, AssetInitResponse, AssetCompleteRequest, AssetLinkRequest, AssetUnlinkRequest, AssetUrlResponse, AssetDeleteSummary, AssetUpdateVisibilityRequest, AssetUpdateVisibilityResponse, ServiceAssetMetadata, ServiceAssetMetadataBySha, AccountStorageCategoryUsage, AccountStorageUsageResponse, SecurityEventType, SecurityEventSeverity, SecurityActivity, SecurityActivityResponse, AssetUploadProgress, DeviceLinkedSession, DeviceLinkedSessionsResponse, DeviceLinkedSessionLogoutResponse, UpdateDeviceNameResponse, } from './models/interfaces';
 export { SECURITY_EVENT_SEVERITY_MAP } from './models/interfaces';
 export { TopicType, TopicSource } from './models/Topic';
 export type { TopicData, TopicTranslation } from './models/Topic';
@@ -81,9 +81,10 @@ export { buildAccountsArray, createQuickAccount, getAccountDisplayName, getAccou
 export type { QuickAccount, DisplayNameUserShape } from './utils/accountUtils';
 export { registrableApex } from './utils/registrableApex';
 export { CENTRAL_IDP_APEX } from './utils/authWebUrl';
-export { SSO_CALLBACK_PATH } from './utils/ssoBounce';
 export { runColdBoot } from './utils/coldBoot';
 export type { ColdBootStep, ColdBootStepResult, ColdBootSession, ColdBootSkip, ColdBootOutcome, RunColdBootOptions, } from './utils/coldBoot';
+export { buildOAuthAuthorizeUrl, computeCodeChallenge, generateOAuthState, generatePkcePair, DEFAULT_OAUTH_SCOPE, OXY_AUTHORIZE_URL, } from './utils/oauthPkce';
+export type { PkcePair, BuildOAuthAuthorizeUrlParams } from './utils/oauthPkce';
 export { SessionClient } from './session/SessionClient';
 export type { TokenTransport, SessionClientHost, SessionClientOptions } from './session/SessionClient';
 export type { SocketIOFactory, MinimalSocket } from './session/socketLoader';

package/dist/types/mixins/OxyServices.accounts.d.ts

@@ -250,6 +250,10 @@ export interface Application {
     name: string;
     description?: string;
     websiteUrl?: string;
+    /** Public privacy-policy URL, rendered as a legal link on the OAuth consent screen. */
+    privacyPolicyUrl?: string;
+    /** Public terms-of-service URL, rendered as a legal link on the OAuth consent screen. */
+    termsUrl?: string;
     icon?: string;
     type: ApplicationType;
     status: ApplicationStatus;
@@ -306,6 +310,10 @@ export interface CreateApplicationInput {
     name: string;
     description?: string;
     websiteUrl?: string;
+    /** Public privacy-policy URL (absolute `https://`). Shown on the OAuth consent screen. */
+    privacyPolicyUrl?: string;
+    /** Public terms-of-service URL (absolute `https://`). Shown on the OAuth consent screen. */
+    termsUrl?: string;
     icon?: string;
     redirectUris?: string[];
     scopes?: string[];
@@ -320,6 +328,10 @@ export interface UpdateApplicationInput {
     name?: string;
     description?: string;
     websiteUrl?: string;
+    /** Public privacy-policy URL (absolute `https://`, or `''` to clear). Shown on the OAuth consent screen. */
+    privacyPolicyUrl?: string;
+    /** Public terms-of-service URL (absolute `https://`, or `''` to clear). Shown on the OAuth consent screen. */
+    termsUrl?: string;
     icon?: string;
     redirectUris?: string[];
     scopes?: string[];
@@ -689,9 +701,7 @@ export declare function OxyServicesAccountsMixin<T extends typeof OxyServicesBas
         handleError(error: unknown): Error;
         healthCheck(): Promise<{
             status: string;
-            users
-            /** Aggregate totals for an application over the requested period. */
-            ? /** Aggregate totals for an application over the requested period. */: number;
+            users?: number;
             timestamp?: string;
             [key: string]: any;
         }>;

package/dist/types/mixins/OxyServices.connectedApps.d.ts

@@ -37,6 +37,10 @@ export interface PublicApplication {
     icon?: string;
     /** Optional public website/homepage URL for the application. */
     websiteUrl?: string;
+    /** Optional public privacy-policy URL, rendered as a legal link on the consent screen. */
+    privacyPolicyUrl?: string;
+    /** Optional public terms-of-service URL, rendered as a legal link on the consent screen. */
+    termsUrl?: string;
     /** Application classification (set by Oxy platform staff). */
     type: ApplicationType;
     /** Whether the application is an officially endorsed Oxy application. */

package/dist/types/mixins/OxyServices.devices.d.ts

@@ -2,6 +2,7 @@
  * Device Methods Mixin
  */
 import type { OxyServicesBase } from '../OxyServices.base';
+import type { DeviceLinkedSession, DeviceLinkedSessionLogoutResponse } from '../models/interfaces';
 export declare function OxyServicesDevicesMixin<T extends typeof OxyServicesBase>(Base: T): {
     new (...args: any[]): {
         /**
@@ -26,7 +27,7 @@ export declare function OxyServicesDevicesMixin<T extends typeof OxyServicesBase
          * @param sessionId - The session ID
          * @returns Array of device sessions
          */
-        getDeviceSessions(sessionId: string): Promise<any[]>;
+        getDeviceSessions(sessionId: string): Promise<DeviceLinkedSession[]>;
         /**
          * Logout all device sessions
          * @param sessionId - The session ID
@@ -34,7 +35,7 @@ export declare function OxyServicesDevicesMixin<T extends typeof OxyServicesBase
          * @param excludeCurrent - Whether to exclude the current session
          * @returns Logout result
          */
-        logoutAllDeviceSessions(sessionId: string, deviceId?: string, excludeCurrent?: boolean): Promise<any>;
+        logoutAllDeviceSessions(sessionId: string, deviceId?: string, excludeCurrent?: boolean): Promise<DeviceLinkedSessionLogoutResponse>;
         /**
          * Update device name
          * @param sessionId - The session ID

package/dist/types/models/interfaces.d.ts

@@ -545,7 +545,7 @@ export interface AssetUploadProgress {
     status: 'uploading' | 'processing' | 'complete' | 'error';
     error?: string;
 }
-export interface DeviceSession {
+export interface DeviceLinkedSession {
     sessionId: string;
     deviceId: string;
     deviceName: string;
@@ -556,11 +556,11 @@ export interface DeviceSession {
     user?: User;
     createdAt?: string;
 }
-export interface DeviceSessionsResponse {
+export interface DeviceLinkedSessionsResponse {
     deviceId: string;
-    sessions: DeviceSession[];
+    sessions: DeviceLinkedSession[];
 }
-export interface DeviceSessionLogoutResponse {
+export interface DeviceLinkedSessionLogoutResponse {
     message: string;
     deviceId: string;
     sessionsTerminated: number;

package/dist/types/server/index.d.ts

@@ -24,4 +24,3 @@ export { createOxyCors } from './cors';
 export type { OxyCorsOptions } from './cors';
 export { verifySecret } from './verifySecret';
 export { registrableApex } from '../utils/registrableApex';
-export { SSO_CALLBACK_PATH } from '../utils/ssoBounce';

package/dist/types/session/accountDialogController.d.ts

@@ -3,7 +3,7 @@
  *
  * A framework-agnostic state machine + subscribe/getSnapshot store (the same
  * pattern {@link SessionClient} uses — no React, no RN) that both
- * `@oxyhq/services` (RN `OxyProvider`) and `@oxyhq/auth` (web `WebOxyProvider`)
+ * every `OxyProvider` platform variant (Expo/RN and RN-Web)
  * bind to via `useSyncExternalStore`, so the account chooser is ONE
  * implementation across the ecosystem instead of the five drifting copies it
  * replaces.
@@ -131,6 +131,9 @@ export declare class AccountDialogController {
     private signInToken;
     private pollTimer;
     private unsubscribeSession;
+    private unsubscribeTokens;
+    /** Last-observed SDK auth readiness (a planted bearer). Drives the fetch edge. */
+    private authed;
     private started;
     private refreshSeq;
     private snapshot;
@@ -150,6 +153,30 @@ export declare class AccountDialogController {
      * active sign-in flow (timers). Idempotent.
      */
     destroy(): void;
+    /**
+     * Whether a PRIVATE endpoint may be called right now. Mirrors the
+     * `hasAccessToken` term of `OxyContext.canUsePrivateApi`
+     * (`authResolved && isAuthenticated && tokenReady && hasAccessToken`, where
+     * `hasAccessToken = Boolean(oxyServices.getAccessToken())`): a planted bearer
+     * is the only term that decides whether a request carries auth — the other
+     * three are provider render-lifecycle gates with no headless equivalent.
+     *
+     * `listAccounts()` (`GET /accounts`) and `getUsersByIds()`
+     * (`POST /users/by-ids`) are private; calling either before cold-boot restore
+     * plants the token 401s → `HttpService` clears the bearer + emits
+     * `onTokensChanged(null)` → the app signs out. Every graph/profile fetch gates
+     * on this.
+     */
+    private isAuthenticated;
+    /**
+     * Reconcile the account graph against the current auth-readiness edge. On the
+     * signed-out → signed-in edge fetch the graph ONCE; on signed-in → signed-out
+     * drop it and re-project device-only. A no-op when readiness is unchanged, so
+     * a burst of token events / device pushes cannot restart the fetch — and a
+     * failed `listAccounts()` never flips the edge, so it cannot re-trigger itself
+     * (no retry storm).
+     */
+    private reconcileAuth;
     /** Set the dialog view directly. */
     setView(view: AccountDialogView): void;
     /** Return to the account list and cancel any in-flight sign-in flow. */

package/dist/types/session/accountProjection.d.ts

@@ -5,7 +5,7 @@
  * merging the device's server-authoritative session set (`DeviceSessionState`
  * from {@link SessionClient}) with the caller's account graph (`AccountNode[]`
  * from `oxyServices.listAccounts()`), deduped by `accountId`. This lives in
- * `@oxyhq/core` so `@oxyhq/services` (RN) and `@oxyhq/auth` (web) — and
+ * `@oxyhq/core` so every `@oxyhq/services` platform variant — and
  * `auth.oxy.so` — all render the SAME list from the SAME logic and cannot
  * diverge.
  *

package/dist/types/session/projectSessionState.d.ts

@@ -4,7 +4,7 @@ import type { User } from '../models/interfaces';
 /**
  * Pure projection helpers: `DeviceSessionState` (the device-scoped
  * multi-account session-sync state produced by `SessionClient`) -> the
- * shapes consumers (`@oxyhq/services`, `@oxyhq/auth`) render today
+ * shapes `@oxyhq/services` consumers render today
  * (`ClientSession[]`, an active session id, an active `User`).
  *
  * No I/O. The caller fetches profiles via

package/dist/types/session/refresh.d.ts

@@ -1,11 +1,8 @@
 /**
  * Unified token refresh — THE single refresh implementation for web + native.
  *
- * Before device-first, refresh was duplicated: `@oxyhq/auth`'s
- * `session/tokenRefresh.ts` (per-apex `/auth/silent` iframe) and
- * `@oxyhq/services`'s `inSessionTokenRefresh.ts` (native shared-key). This
- * module replaces both with ONE persisted-refresh-token rotation shared by
- * every consumer:
+ * ONE persisted-refresh-token rotation shared by every consumer (it replaced
+ * the pre-device-first per-platform duplicates):
  *
  *  - `refreshPersistedSession` — arm 1 rotates the stored refresh-token family
  *    (`POST /auth/refresh-token`), planting + persisting the rotated pair; arm 2
@@ -16,9 +13,8 @@
  *  - `createAuthRefreshHandler` / `installAuthRefreshHandler` wire arm 1+2 into
  *    `HttpService.setAuthRefreshHandler`, keeping that layer's single-flight
  *    dedup + cooldown (this module does NOT reimplement them).
- *  - `startTokenRefreshScheduler` — a proactive scheduler (lifted from the
- *    better of the two prior duplicates, `@oxyhq/auth`'s `tokenRefresh.ts`),
- *    decoupled from any React / auth-sdk type: refreshes ~60s before `exp`,
+ *  - `startTokenRefreshScheduler` — a proactive scheduler decoupled from any
+ *    React type: refreshes ~60s before `exp`,
  *    re-arms on token change + web tab-focus, `.unref?.()`s its timer in Node.
  *
  * Framework-free; no module-level mutable state.

package/dist/types/session/sessionClientHost.d.ts

@@ -6,8 +6,7 @@ import type { SessionClientHost } from './SessionClient';
  * `SessionClient` is host-agnostic: it only needs a REST + token surface.
  * `OxyServices` already exposes all of that except `getCurrentAccountId`,
  * which has no direct equivalent — the adapter holds a mutable ref set by
- * the caller (`OxyContext` in `@oxyhq/services`, `WebOxyProvider` in
- * `@oxyhq/auth`) via `setCurrentAccountId`.
+ * the caller (`OxyContext` in `@oxyhq/services`) via `setCurrentAccountId`.
  *
  * Shared here (rather than duplicated per consumer) because it is entirely
  * platform-agnostic: every method it calls exists identically on

package/dist/types/utils/accountUtils.d.ts

@@ -1,6 +1,6 @@
 /**
  * Shared account types and pure helper functions.
- * Used by both @oxyhq/services (React Native) and @oxyhq/auth (Web) account stores.
+ * Used by the @oxyhq/services account stores (Expo/RN and RN-Web).
  */
 export interface QuickAccount {
     sessionId: string;

package/dist/types/utils/oauthPkce.d.ts

@@ -0,0 +1,74 @@
+/**
+ * OAuth 2.0 Authorization Code + PKCE helpers for "Sign in with Oxy" third-party
+ * sign-in.
+ *
+ * Third-party Relying Parties (SPAs, static sites, and native apps that are NOT
+ * Oxy first-party) authenticate through the standard OAuth flow against
+ * `auth.oxy.so/authorize` — never FedCM, SSO bounces, or Oxy session cookies.
+ * Public clients (no secret) prove possession of the authorization code with
+ * PKCE (RFC 7636, S256): the RP generates a random `code_verifier`, sends its
+ * `code_challenge = BASE64URL(SHA-256(code_verifier))` on the authorize
+ * redirect, and later replays the raw verifier on the token exchange.
+ *
+ * All cross-platform crypto (random bytes, SHA-256) is delegated to the shared
+ * `@oxyhq/protocol` platform loaders — the exact primitives the rest of core's
+ * crypto already uses — so these helpers run identically on web, Node, and
+ * React Native. No `require()`, so the ESM build stays bundler-clean.
+ */
+/** The central Oxy IdP authorization endpoint used by default. */
+export declare const OXY_AUTHORIZE_URL = "https://auth.oxy.so/authorize";
+/** Default OAuth scope requested for a "Sign in with Oxy" third-party flow. */
+export declare const DEFAULT_OAUTH_SCOPE = "openid profile";
+/** A generated PKCE verifier/challenge pair. */
+export interface PkcePair {
+    /** The high-entropy secret replayed on the token exchange (kept client-side). */
+    codeVerifier: string;
+    /** `BASE64URL(SHA-256(codeVerifier))` — sent on the authorize redirect. */
+    codeChallenge: string;
+    /** The PKCE transformation method. Always `S256`. */
+    method: 'S256';
+}
+/** Parameters for {@link buildOAuthAuthorizeUrl}. */
+export interface BuildOAuthAuthorizeUrlParams {
+    /** Authorize endpoint; defaults to {@link OXY_AUTHORIZE_URL}. */
+    authorizeBaseUrl?: string;
+    /** The registered `ApplicationCredential` public key (`oxy_dk_…`). */
+    clientId: string;
+    /** Exact registered redirect URI to return the authorization code to. */
+    redirectUri: string;
+    /** Requested scope; defaults to {@link DEFAULT_OAUTH_SCOPE}. */
+    scope?: string;
+    /** Opaque CSRF token from {@link generateOAuthState}. */
+    state: string;
+    /** The PKCE `codeChallenge` from {@link generatePkcePair}. */
+    codeChallenge: string;
+}
+/**
+ * Compute the PKCE S256 `code_challenge` for a given verifier:
+ * `BASE64URL(SHA-256(ASCII(codeVerifier)))` (RFC 7636 §4.2). The verifier is
+ * base64url (ASCII), so its UTF-8 and ASCII byte encodings are identical.
+ *
+ * Reuses `@oxyhq/protocol`'s cross-platform {@link sha256} (which returns
+ * lowercase hex); the digest bytes are recovered and re-encoded as base64url.
+ */
+export declare function computeCodeChallenge(codeVerifier: string): Promise<string>;
+/**
+ * Generate a fresh PKCE verifier/challenge pair for an OAuth authorization-code
+ * flow. The verifier is 64 random bytes as base64url (86 chars, within RFC 7636
+ * §4.1's 43–128 range and drawn only from the unreserved set); the challenge is
+ * its S256 transform.
+ */
+export declare function generatePkcePair(): Promise<PkcePair>;
+/**
+ * Generate an opaque, single-use OAuth `state` token (32 random bytes as
+ * base64url) for CSRF protection across the authorize redirect.
+ */
+export declare function generateOAuthState(): Promise<string>;
+/**
+ * Build the `auth.oxy.so/authorize` redirect URL for an OAuth authorization-code
+ * + PKCE (S256) flow. Built via the WHATWG `URL` API so a custom
+ * `authorizeBaseUrl` that already carries a query string keeps its existing
+ * params (the OAuth params are merged in, not clobbered by a naive `?` concat).
+ * All values are percent-encoded by `URL.searchParams`.
+ */
+export declare function buildOAuthAuthorizeUrl(params: BuildOAuthAuthorizeUrlParams): string;

package/dist/types/utils/platform.d.ts

@@ -39,7 +39,7 @@ export declare function setPlatformOS(os: PlatformOS): void;
  *
  * Native defines a global `window` but no `document`, so the DOM probe — not a
  * bare `window` check — is the reliable discriminator. This is the single
- * source of truth consumed by `@oxyhq/services` and `@oxyhq/auth` (both dropped
+ * source of truth consumed by `@oxyhq/services` (which dropped
  * their local copies), so every consumer shares the exact same predicate.
  *
  * NOTE: this is a live runtime probe (not the cached `getPlatformOS()` verdict)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "7.1.0",
+  "version": "8.0.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -94,8 +94,8 @@
     }
   },
   "dependencies": {
-    "@oxyhq/contracts": "^0.10.0",
-    "@oxyhq/protocol": "^0.1.1",
+    "@oxyhq/contracts": "^0.11.0",
+    "@oxyhq/protocol": "^0.1.2",
     "bip39": "^3.1.0",
     "buffer": "^6.0.3",
     "elliptic": "^6.6.1",

package/src/HttpService.ts

@@ -128,7 +128,7 @@ const CSRF_FETCH_RETRY_DELAY_MS = 500;
 /**
  * Cooldown (ms) applied after a failed access-token refresh before another
  * refresh is attempted. Prevents a refresh storm (and server hammering) when
- * the AuthManager's refresh handler is failing — every in-flight request that
+ * the auth refresh handler is failing — every in-flight request that
  * hits a 401 would otherwise trigger its own refresh.
  */
 const TOKEN_REFRESH_COOLDOWN_MS = 15000;
@@ -244,7 +244,7 @@ export class HttpService {
 
   /**
    * Fan-out listeners notified on EVERY access-token change on this instance:
-   * explicit `setTokens`, `clearTokens`, an AuthManager-owned refresh, and the
+   * explicit `setTokens`, `clearTokens`, a refresh-handler rotation, and the
    * internal 401-driven clear. This is a Set so multiple independent observers
    * can mirror token state without clobbering each other.
    *
@@ -527,9 +527,9 @@ export class HttpService {
 
         // Handle response
         if (!response.ok) {
-          // On 401, delegate refresh to AuthManager and retry once before
-          // giving up. HttpService deliberately does not know any session
-          // routes; the AuthManager is the single session authority.
+          // On 401, delegate to the installed auth refresh handler and retry
+          // once before giving up. HttpService deliberately does not know any
+          // session routes; the refresh handler owns session rotation.
           if (response.status === 401 && !config._isAuthRetry && !config.skipAuth) {
             const refreshed = await this.refreshAccessToken('response-401');
             if (refreshed) {
@@ -1045,7 +1045,7 @@ export class HttpService {
             this.tokenStore.setTokens(newToken);
             this.notifyTokenChange();
           }
-          this.logger.debug('Token refreshed via AuthManager');
+          this.logger.debug('Token refreshed via the auth refresh handler');
           return newToken;
         })
         .catch((error) => {

package/src/i18n/locales/en-US.json

@@ -384,7 +384,11 @@
       "subtitle": "Add another account to switch between them quickly"
     },
     "label": "Account switcher",
-    "searchPlaceholder": "Search accounts"
+    "searchPlaceholder": "Search accounts",
+    "scanTitle": "Scan to sign in",
+    "scanSubtitle": "Open the Oxy app on your phone and scan this code",
+    "scanWithOxy": "Scan with the Oxy app to continue",
+    "scanQr": "Scan QR code"
   },
   "reputation": {
     "faq": {
@@ -1905,5 +1909,44 @@
       "earlyAdopter": "Early Adopter",
       "earlyAdopterDesc": "Been part of the community from the start"
     }
+  },
+  "consent": {
+    "title": "Continue to {{app}}",
+    "subtitle": "Use your Oxy account to sign in to {{app}}. Review what this connection means before you continue.",
+    "provenance": {
+      "title": "Who is requesting access",
+      "official": "Official Oxy application",
+      "developer": "Published by {{developer}}",
+      "thirdParty": "Third-party application"
+    },
+    "permissions": {
+      "title": "Permissions requested",
+      "basic": "Sign you in and read your basic profile"
+    },
+    "scopes": {
+      "openid": "Confirm your identity",
+      "profile": "Read your basic profile",
+      "email": "Read your email address",
+      "offlineAccess": "Keep you signed in when you're away",
+      "userRead": "Read your basic profile",
+      "filesRead": "Read your files",
+      "filesWrite": "Upload and modify your files",
+      "filesDelete": "Delete your files",
+      "webhooksReceive": "Receive webhooks",
+      "chatCompletions": "Use AI chat on your behalf",
+      "modelsRead": "List available AI models",
+      "federationWrite": "Act across federated services"
+    },
+    "account": {
+      "title": "Signing in as"
+    },
+    "links": {
+      "website": "Website",
+      "privacy": "Privacy Policy",
+      "terms": "Terms of Service"
+    },
+    "allow": "Continue to {{app}}",
+    "deny": "Cancel",
+    "disclaimer": "By continuing, {{app}} will be able to sign in with your Oxy account. You can manage connected apps anytime in your Oxy account settings."
   }
-}
+}

package/src/i18n/locales/es-ES.json

@@ -581,7 +581,11 @@
       "subtitle": "Añade otra cuenta para cambiar rápidamente entre ellas"
     },
     "label": "Selector de cuentas",
-    "searchPlaceholder": "Buscar cuentas"
+    "searchPlaceholder": "Buscar cuentas",
+    "scanTitle": "Escanea para iniciar sesión",
+    "scanSubtitle": "Abre la app de Oxy en tu móvil y escanea este código",
+    "scanWithOxy": "Escanea con la app de Oxy para continuar",
+    "scanQr": "Escanear código QR"
   },
   "feedback": {
     "type": {
@@ -1905,5 +1909,44 @@
       "earlyAdopter": "Pionero",
       "earlyAdopterDesc": "Has formado parte de la comunidad desde el principio"
     }
+  },
+  "consent": {
+    "title": "Continuar a {{app}}",
+    "subtitle": "Usa tu cuenta de Oxy para iniciar sesión en {{app}}. Revisa qué implica esta conexión antes de continuar.",
+    "provenance": {
+      "title": "Quién solicita acceso",
+      "official": "Aplicación oficial de Oxy",
+      "developer": "Publicada por {{developer}}",
+      "thirdParty": "Aplicación de terceros"
+    },
+    "permissions": {
+      "title": "Permisos solicitados",
+      "basic": "Iniciar sesión y leer tu perfil básico"
+    },
+    "scopes": {
+      "openid": "Confirmar tu identidad",
+      "profile": "Leer tu perfil básico",
+      "email": "Leer tu dirección de correo",
+      "offlineAccess": "Mantener tu sesión iniciada cuando no estés",
+      "userRead": "Leer tu perfil básico",
+      "filesRead": "Leer tus archivos",
+      "filesWrite": "Subir y modificar tus archivos",
+      "filesDelete": "Eliminar tus archivos",
+      "webhooksReceive": "Recibir webhooks",
+      "chatCompletions": "Usar el chat con IA en tu nombre",
+      "modelsRead": "Ver los modelos de IA disponibles",
+      "federationWrite": "Actuar en servicios federados"
+    },
+    "account": {
+      "title": "Iniciando sesión como"
+    },
+    "links": {
+      "website": "Sitio web",
+      "privacy": "Política de privacidad",
+      "terms": "Términos del servicio"
+    },
+    "allow": "Continuar a {{app}}",
+    "deny": "Cancelar",
+    "disclaimer": "Al continuar, {{app}} podrá iniciar sesión con tu cuenta de Oxy. Puedes gestionar las apps conectadas cuando quieras en los ajustes de tu cuenta de Oxy."
   }
-}
+}

package/src/index.ts

@@ -304,9 +304,9 @@ export type {
     SecurityActivity,
     SecurityActivityResponse,
     AssetUploadProgress,
-    DeviceSession,
-    DeviceSessionsResponse,
-    DeviceSessionLogoutResponse,
+    DeviceLinkedSession,
+    DeviceLinkedSessionsResponse,
+    DeviceLinkedSessionLogoutResponse,
     UpdateDeviceNameResponse,
 } from './models/interfaces';
 export { SECURITY_EVENT_SEVERITY_MAP } from './models/interfaces';
@@ -494,20 +494,13 @@ export type { QuickAccount, DisplayNameUserShape } from './utils/accountUtils';
 // ---------------------------------------------------------------------------
 // Registrable-domain + central-IdP-apex helpers.
 //
-// The client SSO-bounce / silent-iframe / FedCM machinery was removed in the
-// device-first cutover (wave 2, ecosystem-wide bump complete). `registrableApex`
-// (eTLD+1) and `CENTRAL_IDP_APEX` are still genuinely used: `registrableApex`
-// via the `@oxyhq/core/server` re-export consumed by
-// `packages/api/src/utils/sameSite.ts` for same-site origin checks, and
-// `CENTRAL_IDP_APEX` by `server/cors.ts`'s `createOxyCors` (auto-allows
-// `*.oxy.so`). `SSO_CALLBACK_PATH` has no remaining importer outside this
-// module as of wave 2 — kept exported for now rather than removed here (an
-// export deletion is a logic change, out of scope for a comment sweep); flag
-// for a follow-up dead-export cleanup pass.
+// `registrableApex` (eTLD+1) is consumed via the `@oxyhq/core/server`
+// re-export by `packages/api/src/utils/sameSite.ts` for same-site origin
+// checks; `CENTRAL_IDP_APEX` by `server/cors.ts`'s `createOxyCors` (auto-allows
+// `*.oxy.so`).
 // ---------------------------------------------------------------------------
 export { registrableApex } from './utils/registrableApex';
 export { CENTRAL_IDP_APEX } from './utils/authWebUrl';
-export { SSO_CALLBACK_PATH } from './utils/ssoBounce';
 
 export { runColdBoot } from './utils/coldBoot';
 export type {
@@ -519,6 +512,20 @@ export type {
     RunColdBootOptions,
 } from './utils/coldBoot';
 
+// ---------------------------------------------------------------------------
+// OAuth 2.0 Authorization Code + PKCE helpers ("Sign in with Oxy" third party).
+// Standard OAuth against auth.oxy.so/authorize — no FedCM/cookies/SSO bounce.
+// ---------------------------------------------------------------------------
+export {
+    buildOAuthAuthorizeUrl,
+    computeCodeChallenge,
+    generateOAuthState,
+    generatePkcePair,
+    DEFAULT_OAUTH_SCOPE,
+    OXY_AUTHORIZE_URL,
+} from './utils/oauthPkce';
+export type { PkcePair, BuildOAuthAuthorizeUrlParams } from './utils/oauthPkce';
+
 // ---------------------------------------------------------------------------
 // Session sync (device-scoped multi-account session client)
 // ---------------------------------------------------------------------------
@@ -531,7 +538,7 @@ export type { SocketIOFactory, MinimalSocket } from './session/socketLoader';
 
 // Shared SessionClient integration layer: the host adapter, the pure
 // DeviceSessionState projection helpers, and the client factory are defined
-// ONCE here so `@oxyhq/services` and `@oxyhq/auth` both reuse them instead of
+// ONCE here so every `@oxyhq/services` platform variant reuses them instead of
 // duplicating a local copy. Each consumer supplies its own `TokenTransport`
 // (native vs. web mint strategies differ) to `createSessionClient`.
 export { createSessionClientHost } from './session/sessionClientHost';
@@ -546,7 +553,7 @@ export {
 // Unified account-list projection (THE single source of truth for the account
 // chooser: device sign-ins ∪ account graph, deduped by accountId). Pure +
 // I/O-free — the caller hydrates profiles via `getUsersByIds`. Shared by
-// `@oxyhq/services`, `@oxyhq/auth`, and auth.oxy.so so the list can't diverge.
+// `@oxyhq/services` and auth.oxy.so so the list can't diverge.
 export {
     projectSwitchableAccounts,
     switchableAccountIds,

package/src/mixins/OxyServices.accounts.ts

@@ -284,6 +284,10 @@ export interface Application {
   name: string;
   description?: string;
   websiteUrl?: string;
+  /** Public privacy-policy URL, rendered as a legal link on the OAuth consent screen. */
+  privacyPolicyUrl?: string;
+  /** Public terms-of-service URL, rendered as a legal link on the OAuth consent screen. */
+  termsUrl?: string;
   icon?: string;
   type: ApplicationType;
   status: ApplicationStatus;
@@ -342,6 +346,10 @@ export interface CreateApplicationInput {
   name: string;
   description?: string;
   websiteUrl?: string;
+  /** Public privacy-policy URL (absolute `https://`). Shown on the OAuth consent screen. */
+  privacyPolicyUrl?: string;
+  /** Public terms-of-service URL (absolute `https://`). Shown on the OAuth consent screen. */
+  termsUrl?: string;
   icon?: string;
   redirectUris?: string[];
   scopes?: string[];
@@ -357,6 +365,10 @@ export interface UpdateApplicationInput {
   name?: string;
   description?: string;
   websiteUrl?: string;
+  /** Public privacy-policy URL (absolute `https://`, or `''` to clear). Shown on the OAuth consent screen. */
+  privacyPolicyUrl?: string;
+  /** Public terms-of-service URL (absolute `https://`, or `''` to clear). Shown on the OAuth consent screen. */
+  termsUrl?: string;
   icon?: string;
   redirectUris?: string[];
   scopes?: string[];