@oxyhq/core 7.1.1 → 8.1.0

package/src/mixins/OxyServices.accounts.ts

@@ -284,6 +284,10 @@ export interface Application {
   name: string;
   description?: string;
   websiteUrl?: string;
+  /** Public privacy-policy URL, rendered as a legal link on the OAuth consent screen. */
+  privacyPolicyUrl?: string;
+  /** Public terms-of-service URL, rendered as a legal link on the OAuth consent screen. */
+  termsUrl?: string;
   icon?: string;
   type: ApplicationType;
   status: ApplicationStatus;
@@ -342,6 +346,10 @@ export interface CreateApplicationInput {
   name: string;
   description?: string;
   websiteUrl?: string;
+  /** Public privacy-policy URL (absolute `https://`). Shown on the OAuth consent screen. */
+  privacyPolicyUrl?: string;
+  /** Public terms-of-service URL (absolute `https://`). Shown on the OAuth consent screen. */
+  termsUrl?: string;
   icon?: string;
   redirectUris?: string[];
   scopes?: string[];
@@ -357,6 +365,10 @@ export interface UpdateApplicationInput {
   name?: string;
   description?: string;
   websiteUrl?: string;
+  /** Public privacy-policy URL (absolute `https://`, or `''` to clear). Shown on the OAuth consent screen. */
+  privacyPolicyUrl?: string;
+  /** Public terms-of-service URL (absolute `https://`, or `''` to clear). Shown on the OAuth consent screen. */
+  termsUrl?: string;
   icon?: string;
   redirectUris?: string[];
   scopes?: string[];

package/src/mixins/OxyServices.connectedApps.ts

@@ -41,6 +41,10 @@ export interface PublicApplication {
   icon?: string;
   /** Optional public website/homepage URL for the application. */
   websiteUrl?: string;
+  /** Optional public privacy-policy URL, rendered as a legal link on the consent screen. */
+  privacyPolicyUrl?: string;
+  /** Optional public terms-of-service URL, rendered as a legal link on the consent screen. */
+  termsUrl?: string;
   /** Application classification (set by Oxy platform staff). */
   type: ApplicationType;
   /** Whether the application is an officially endorsed Oxy application. */

package/src/mixins/OxyServices.deviceBoot.ts

@@ -19,9 +19,11 @@ import {
   authTokenBundleSchema,
   tokenRefreshResponseSchema,
   deviceTokenIssueResponseSchema,
+  deviceTokenMintResponseSchema,
   webSessionResultSchema,
   safeParseContract,
   type AuthTokenBundle,
+  type DeviceTokenMintResponse,
   type TokenRefreshResponse,
   type WebSessionResult,
 } from '@oxyhq/contracts';
@@ -132,6 +134,42 @@ export function OxyServicesDeviceBootMixin<T extends typeof OxyServicesBase>(Bas
       }
     }
 
+    /**
+     * Zero-cookie mint (phase 2c). Present the first-party `deviceId` +
+     * `deviceSecret` to `POST /session/device/token` — NO bearer, NO cookies:
+     * possession of the secret IS the device-ownership proof. Returns a fresh
+     * short access token for the device's active account plus `nextDeviceSecret`
+     * (rotation-in-use) and the projected device-session `state`.
+     *
+     * `skipAuth` (like {@link refreshWithToken}): this call carries no bearer, so
+     * a 401 must surface DIRECTLY — never trigger `HttpService`'s 401→refresh→
+     * retry dance (which would pointlessly rotate the refresh family). The cold
+     * boot reads the 401 body (`invalid_device_secret` vs `no_active_session`) to
+     * decide whether to drop the secret and fall back or resolve signed-out.
+     *
+     * @throws if the response does not match {@link deviceTokenMintResponseSchema}.
+     */
+    async mintFromDeviceSecret(
+      deviceId: string,
+      deviceSecret: string,
+    ): Promise<DeviceTokenMintResponse> {
+      try {
+        const res = await this.makeRequest<unknown>(
+          'POST',
+          '/session/device/token',
+          { deviceId, deviceSecret },
+          { cache: false, skipAuth: true },
+        );
+        const parsed = safeParseContract(deviceTokenMintResponseSchema, res);
+        if (!parsed) {
+          throw new Error('session/device/token returned an unexpected response shape');
+        }
+        return parsed;
+      } catch (error) {
+        throw this.handleError(error);
+      }
+    }
+
     /**
      * Build the top-level `GET /auth/device/bootstrap` URL for the cross-apex
      * hop. The server validates `return_to` against the trusted-origin lane and

package/src/mixins/OxyServices.devices.ts

@@ -2,6 +2,7 @@
  * Device Methods Mixin
  */
 import type { OxyServicesBase } from '../OxyServices.base';
+import type { DeviceLinkedSession, DeviceLinkedSessionLogoutResponse } from '../models/interfaces';
 
 export function OxyServicesDevicesMixin<T extends typeof OxyServicesBase>(Base: T) {
   return class extends Base {
@@ -54,11 +55,11 @@ export function OxyServicesDevicesMixin<T extends typeof OxyServicesBase>(Base:
      * @param sessionId - The session ID
      * @returns Array of device sessions
      */
-    async getDeviceSessions(sessionId: string): Promise<any[]> {
+    async getDeviceSessions(sessionId: string): Promise<DeviceLinkedSession[]> {
       try {
         // Use makeRequest for consistent error handling and optional caching
         // Cache disabled by default to ensure fresh session data
-        return await this.makeRequest<any[]>('GET', `/session/device/sessions/${sessionId}`, undefined, {
+        return await this.makeRequest<DeviceLinkedSession[]>('GET', `/session/device/sessions/${sessionId}`, undefined, {
           cache: false, // Don't cache sessions - always get fresh data
           deduplicate: true, // Deduplicate concurrent requests for same sessionId
         });
@@ -74,12 +75,12 @@ export function OxyServicesDevicesMixin<T extends typeof OxyServicesBase>(Base:
      * @param excludeCurrent - Whether to exclude the current session
      * @returns Logout result
      */
-    async logoutAllDeviceSessions(sessionId: string, deviceId?: string, excludeCurrent?: boolean): Promise<any> {
+    async logoutAllDeviceSessions(sessionId: string, deviceId?: string, excludeCurrent?: boolean): Promise<DeviceLinkedSessionLogoutResponse> {
       try {
-        const urlParams: any = {};
+        const urlParams: Record<string, string> = {};
         if (deviceId) urlParams.deviceId = deviceId;
         if (excludeCurrent) urlParams.excludeCurrent = 'true';
-        return await this.makeRequest('POST', `/session/device/logout-all/${sessionId}`, urlParams, { cache: false });
+        return await this.makeRequest<DeviceLinkedSessionLogoutResponse>('POST', `/session/device/logout-all/${sessionId}`, urlParams, { cache: false });
       } catch (error) {
         throw this.handleError(error);
       }

package/src/mixins/__tests__/OxyServices.deviceBoot.test.ts

@@ -3,7 +3,12 @@
  * and asserts each method's route/shape, contract validation, and the
  * `skipAuth` flag on the refresh call.
  */
-import type { AuthTokenBundle, TokenRefreshResponse, WebSessionResult } from '@oxyhq/contracts';
+import type {
+  AuthTokenBundle,
+  DeviceTokenMintResponse,
+  TokenRefreshResponse,
+  WebSessionResult,
+} from '@oxyhq/contracts';
 import { OxyServices } from '../../OxyServices';
 
 const BUNDLE: AuthTokenBundle = {
@@ -96,6 +101,44 @@ describe('OxyServices.deviceBoot', () => {
     });
   });
 
+  describe('mintFromDeviceSecret', () => {
+    const MINT: DeviceTokenMintResponse = {
+      accessToken: 'access-minted',
+      expiresAt: '2030-01-01T00:00:00.000Z',
+      nextDeviceSecret: 'ds-next-secret',
+      state: {
+        deviceId: 'dev-1',
+        accounts: [{ accountId: 'user-1', sessionId: 'sess-1', authuser: 0 }],
+        activeAccountId: 'user-1',
+        revision: 3,
+        updatedAt: 1_700_000_000_000,
+      },
+    };
+
+    it('POSTs deviceId + deviceSecret with skipAuth and returns the validated mint', async () => {
+      makeRequest.mockResolvedValueOnce(MINT);
+      const result = await oxy.mintFromDeviceSecret('dev-1', 'ds-current-secret');
+      expect(result).toEqual(MINT);
+      expect(makeRequest).toHaveBeenCalledWith(
+        'POST',
+        '/session/device/token',
+        { deviceId: 'dev-1', deviceSecret: 'ds-current-secret' },
+        { cache: false, skipAuth: true },
+      );
+    });
+
+    it('throws on an unexpected response shape', async () => {
+      makeRequest.mockResolvedValueOnce({ accessToken: 'a', expiresAt: 'b' });
+      await expect(oxy.mintFromDeviceSecret('dev-1', 'ds')).rejects.toThrow();
+    });
+
+    it('propagates a rejected request (e.g. 401 invalid_device_secret)', async () => {
+      const err = Object.assign(new Error('invalid_device_secret'), { status: 401 });
+      makeRequest.mockRejectedValueOnce(err);
+      await expect(oxy.mintFromDeviceSecret('dev-1', 'ds')).rejects.toThrow('invalid_device_secret');
+    });
+  });
+
   describe('buildBootstrapUrl', () => {
     it('builds the bootstrap URL with encoded params', () => {
       const url = oxy.buildBootstrapUrl('https://accounts.oxy.so/home', 'st-1');

package/src/mixins/__tests__/accounts.test.ts

@@ -83,7 +83,7 @@ const appFixture: Application = {
   isOfficial: true,
   isInternal: false,
   capabilities: [],
-  redirectUris: ['https://mention.earth/__oxy/sso-callback'],
+  redirectUris: ['https://mention.earth/oauth/callback'],
   scopes: ['profile'],
   createdByUserId: 'u1',
   ownerAccountId: 'acc1',

package/src/models/interfaces.ts

@@ -645,8 +645,10 @@ export interface AssetUploadProgress {
   error?: string;
 }
 
-// Device Session interfaces
-export interface DeviceSession {
+// Device-linked session interfaces — the sessions that share one physical
+// device (GET /session/device/sessions/:sessionId). Distinct from the
+// server-authority `DeviceSession` Mongoose model / `DeviceSessionState`.
+export interface DeviceLinkedSession {
   sessionId: string;
   deviceId: string;
   deviceName: string;
@@ -658,12 +660,12 @@ export interface DeviceSession {
   createdAt?: string;
 }
 
-export interface DeviceSessionsResponse {
+export interface DeviceLinkedSessionsResponse {
   deviceId: string;
-  sessions: DeviceSession[];
+  sessions: DeviceLinkedSession[];
 }
 
-export interface DeviceSessionLogoutResponse {
+export interface DeviceLinkedSessionLogoutResponse {
   message: string;
   deviceId: string;
   sessionsTerminated: number;

package/src/server/index.ts

@@ -69,9 +69,3 @@ export { verifySecret } from './verifySecret';
 // Pure host handling (no browser deps), so it is safe on the server subpath and
 // lets `@oxyhq/api` derive `auth.<apex>` without duplicating PSL logic.
 export { registrableApex } from '../utils/registrableApex';
-
-// The single RP callback path the IdP redirects back to. A pure wire-contract
-// constant (no browser deps at module top level), re-used server-side so the
-// `/sso/establish-token` `return_to` cannot drift from what `/sso/establish`
-// validates.
-export { SSO_CALLBACK_PATH } from '../utils/ssoBounce';

package/src/session/__tests__/authStateStore.test.ts

@@ -65,6 +65,33 @@ describe('createWebAuthStateStore', () => {
     expect(await store.load()).toEqual(SAMPLE);
   });
 
+  it('round-trips the optional phase-2c deviceId + deviceSecret', async () => {
+    installLocalStorage(makeFakeStorage());
+    const store = createWebAuthStateStore();
+    const withCreds: PersistedAuthState = { ...SAMPLE, deviceId: 'dev-abc', deviceSecret: 'ds-secret-xyz' };
+
+    await store.save(withCreds);
+    const loaded = await store.load();
+    expect(loaded?.deviceId).toBe('dev-abc');
+    expect(loaded?.deviceSecret).toBe('ds-secret-xyz');
+    expect(loaded).toEqual(withCreds);
+  });
+
+  it('deserializes a legacy blob with no device credentials (additive — fields absent)', async () => {
+    const storage = makeFakeStorage();
+    installLocalStorage(storage);
+    const store = createWebAuthStateStore();
+
+    storage.setItem(
+      AUTH_STATE_STORAGE_KEY,
+      JSON.stringify({ sessionId: 's-1', refreshToken: 'r-abcdefghijklmnop', userId: 'u-1' }),
+    );
+    const loaded = await store.load();
+    expect(loaded).not.toBeNull();
+    expect(loaded && 'deviceId' in loaded).toBe(false);
+    expect(loaded && 'deviceSecret' in loaded).toBe(false);
+  });
+
   it('clear() wipes the session but the deviceToken survives', async () => {
     installLocalStorage(makeFakeStorage());
     const store = createWebAuthStateStore();

package/src/session/__tests__/refresh.test.ts

@@ -53,6 +53,20 @@ describe('refreshPersistedSession — arm 1 (refresh-token rotation)', () => {
     });
   });
 
+  it('carries the persisted deviceId + deviceSecret (phase 2c) forward across a rotation', async () => {
+    const store = createMemoryAuthStateStore();
+    await store.save({ ...STORED, deviceId: 'dev-mint', deviceSecret: 'ds-secret-orig' });
+    const { oxy } = makeOxy();
+
+    await refreshPersistedSession({ oxy, store, allowSharedKeyFallback: false });
+
+    const persisted = await store.load();
+    expect(persisted?.deviceId).toBe('dev-mint');
+    expect(persisted?.deviceSecret).toBe('ds-secret-orig');
+    // The refresh family head still rotated.
+    expect(persisted?.refreshToken).toBe('refresh-new-abcdefghij');
+  });
+
   it('clears the store on a family-revoked (401) error', async () => {
     const store = createMemoryAuthStateStore();
     await store.save(STORED);

package/src/session/accountDialogController.ts

@@ -3,7 +3,7 @@
  *
  * A framework-agnostic state machine + subscribe/getSnapshot store (the same
  * pattern {@link SessionClient} uses — no React, no RN) that both
- * `@oxyhq/services` (RN `OxyProvider`) and `@oxyhq/auth` (web `WebOxyProvider`)
+ * every `OxyProvider` platform variant (Expo/RN and RN-Web)
  * bind to via `useSyncExternalStore`, so the account chooser is ONE
  * implementation across the ecosystem instead of the five drifting copies it
  * replaces.

package/src/session/accountProjection.ts

@@ -5,7 +5,7 @@
  * merging the device's server-authoritative session set (`DeviceSessionState`
  * from {@link SessionClient}) with the caller's account graph (`AccountNode[]`
  * from `oxyServices.listAccounts()`), deduped by `accountId`. This lives in
- * `@oxyhq/core` so `@oxyhq/services` (RN) and `@oxyhq/auth` (web) — and
+ * `@oxyhq/core` so every `@oxyhq/services` platform variant — and
  * `auth.oxy.so` — all render the SAME list from the SAME logic and cannot
  * diverge.
  *

package/src/session/authStateStore.ts

@@ -39,6 +39,26 @@ export interface PersistedAuthState {
   refreshToken: string;
   userId: string;
   deviceToken?: string;
+  /**
+   * The stable device identifier this session is bound to (phase 2c —
+   * zero-cookie transport). Persisted alongside {@link deviceSecret} because the
+   * `POST /session/device/token` mint presents BOTH — the secret is the proof,
+   * the deviceId selects the device doc. Sourced from the lanes that carry it
+   * (password login / 2FA / QR claim / challenge verify); the cookie-bootstrap
+   * lanes (`AuthTokenBundle`) omit it and preserve any prior value. Additive: a
+   * blob without it simply never takes the mint lane and falls back to the
+   * refresh family.
+   */
+  deviceId?: string;
+  /**
+   * The rotating device secret (phase 2c — zero-cookie transport). Possession of
+   * it mints a short access token for the device's active account via
+   * `POST /session/device/token`, replacing the cookie lane. Rotated in-use: the
+   * mint returns `nextDeviceSecret`, which the cold boot persists BEFORE planting
+   * the minted access token (multi-tab anti-loss). Additive and optional — same
+   * XSS risk profile as the already-persisted `refreshToken`.
+   */
+  deviceSecret?: string;
   /** Optional warm-boot access token (short-lived; see interface docs). */
   accessToken?: string;
   /** Optional warm-boot access-token expiry, ISO-8601. */
@@ -130,6 +150,12 @@ function deserialize(raw: string | null): PersistedAuthState | null {
   if (typeof candidate.deviceToken === 'string' && candidate.deviceToken.length > 0) {
     state.deviceToken = candidate.deviceToken;
   }
+  if (typeof candidate.deviceId === 'string' && candidate.deviceId.length > 0) {
+    state.deviceId = candidate.deviceId;
+  }
+  if (typeof candidate.deviceSecret === 'string' && candidate.deviceSecret.length > 0) {
+    state.deviceSecret = candidate.deviceSecret;
+  }
   if (typeof candidate.accessToken === 'string' && candidate.accessToken.length > 0) {
     state.accessToken = candidate.accessToken;
   }

package/src/session/projectSessionState.ts

@@ -5,7 +5,7 @@ import type { User } from '../models/interfaces';
 /**
  * Pure projection helpers: `DeviceSessionState` (the device-scoped
  * multi-account session-sync state produced by `SessionClient`) -> the
- * shapes consumers (`@oxyhq/services`, `@oxyhq/auth`) render today
+ * shapes `@oxyhq/services` consumers render today
  * (`ClientSession[]`, an active session id, an active `User`).
  *
  * No I/O. The caller fetches profiles via

package/src/session/refresh.ts

@@ -1,11 +1,8 @@
 /**
  * Unified token refresh — THE single refresh implementation for web + native.
  *
- * Before device-first, refresh was duplicated: `@oxyhq/auth`'s
- * `session/tokenRefresh.ts` (per-apex `/auth/silent` iframe) and
- * `@oxyhq/services`'s `inSessionTokenRefresh.ts` (native shared-key). This
- * module replaces both with ONE persisted-refresh-token rotation shared by
- * every consumer:
+ * ONE persisted-refresh-token rotation shared by every consumer (it replaced
+ * the pre-device-first per-platform duplicates):
  *
  *  - `refreshPersistedSession` — arm 1 rotates the stored refresh-token family
  *    (`POST /auth/refresh-token`), planting + persisting the rotated pair; arm 2
@@ -16,9 +13,8 @@
  *  - `createAuthRefreshHandler` / `installAuthRefreshHandler` wire arm 1+2 into
  *    `HttpService.setAuthRefreshHandler`, keeping that layer's single-flight
  *    dedup + cooldown (this module does NOT reimplement them).
- *  - `startTokenRefreshScheduler` — a proactive scheduler (lifted from the
- *    better of the two prior duplicates, `@oxyhq/auth`'s `tokenRefresh.ts`),
- *    decoupled from any React / auth-sdk type: refreshes ~60s before `exp`,
+ *  - `startTokenRefreshScheduler` — a proactive scheduler decoupled from any
+ *    React type: refreshes ~60s before `exp`,
  *    re-arms on token change + web tab-focus, `.unref?.()`s its timer in Node.
  *
  * Framework-free; no module-level mutable state.
@@ -138,6 +134,15 @@ export async function refreshPersistedSession(deps: RefreshDeps): Promise<string
       if (persisted.deviceToken) {
         next.deviceToken = persisted.deviceToken;
       }
+      // The refresh response carries no device credentials — carry the persisted
+      // deviceId/deviceSecret (phase 2c) forward so a rotation never drops the
+      // zero-cookie mint lane (mirrors the deviceToken preservation above).
+      if (persisted.deviceId) {
+        next.deviceId = persisted.deviceId;
+      }
+      if (persisted.deviceSecret) {
+        next.deviceSecret = persisted.deviceSecret;
+      }
       await store.save(next);
       return rotated.accessToken;
     } catch (error) {

package/src/session/sessionClientHost.ts

@@ -7,8 +7,7 @@ import type { SessionClientHost } from './SessionClient';
  * `SessionClient` is host-agnostic: it only needs a REST + token surface.
  * `OxyServices` already exposes all of that except `getCurrentAccountId`,
  * which has no direct equivalent — the adapter holds a mutable ref set by
- * the caller (`OxyContext` in `@oxyhq/services`, `WebOxyProvider` in
- * `@oxyhq/auth`) via `setCurrentAccountId`.
+ * the caller (`OxyContext` in `@oxyhq/services`) via `setCurrentAccountId`.
  *
  * Shared here (rather than duplicated per consumer) because it is entirely
  * platform-agnostic: every method it calls exists identically on