@oxyhq/core 8.0.0 → 8.1.0

package/dist/esm/boot/coldBootV2.js

@@ -28,6 +28,7 @@
 import { resolveUserId } from '@oxyhq/contracts';
 import { runColdBoot } from '../utils/coldBoot.js';
 import { isWeb as detectWeb, isNative as detectNative } from '../utils/platform.js';
+import { extractErrorStatus } from '../utils/errorUtils.js';
 import { KeyManager } from '../crypto/keyManager.js';
 import { logger } from '../utils/loggerUtils.js';
 import { refreshPersistedSession } from '../session/refresh.js';
@@ -159,6 +160,18 @@ export function isSameApex(pageHost, apiHost) {
 function sessionFromPersisted(state, accessToken) {
     return { sessionId: state.sessionId, userId: state.userId, accessToken };
 }
+function classifyMintFailure(error) {
+    if (extractErrorStatus(error) === 401) {
+        // Structural read (not `instanceof Error`): the thrown value can be a plain
+        // ApiError-shaped object or come from another realm, where instanceof fails
+        // and a `no_active_session` would be misread as a stale secret and dropped.
+        const message = error?.message;
+        return typeof message === 'string' && message.includes('no_active_session')
+            ? 'no_active_session'
+            : 'invalid_secret';
+    }
+    return 'transient';
+}
 /**
  * Run the device-first cold boot. Resolves to the `runColdBoot` outcome and, as
  * a side effect, invokes `onSession` (winning session, token already planted)
@@ -174,7 +187,73 @@ export async function runSessionColdBoot(opts) {
     // they cannot leak across boots or break under bundler re-evaluation.
     let signedOutReason = 'no_session';
     let navigating = false;
+    // Set when the zero-cookie mint reports `no_active_session` (phase 2c): the
+    // device is authoritatively signed out, so the migratory fallback lanes below
+    // (stored-tokens / shared-key / bootstrap-hop) must NOT run — we already know
+    // there is no session and must not bounce a known-signed-out device.
+    let deviceKnownSignedOut = false;
     const steps = [];
+    // 0. device-secret-mint (phase 2c) — the zero-cookie fast path. When the
+    //    origin persisted a deviceId + deviceSecret, mint a short access token with
+    //    a single bearer-less POST (no cookie, no navigation). FIRST in the chain
+    //    so it wins over the migratory cookie lanes below. Gated OFF while a
+    //    #oxy_boot return fragment is present so `bootstrap-return` still consumes
+    //    + strips it first (a device holding a secret never triggers that hop, so
+    //    this only defers a rare stale/forged fragment). The rest of the chain
+    //    stays as the additive migratory fallback for devices not yet on the secret.
+    steps.push({
+        id: 'device-secret-mint',
+        enabled: () => !(isWeb && hashHasBootFragment(dom.getHash())),
+        run: async () => {
+            const persisted = await store.load();
+            if (!persisted?.deviceId || !persisted?.deviceSecret) {
+                return { kind: 'skip' };
+            }
+            try {
+                const mint = await oxy.mintFromDeviceSecret(persisted.deviceId, persisted.deviceSecret);
+                // Rotation-in-use anti-loss: persist the NEXT secret (+ refreshed warm
+                // fields, + the server's authoritative active account) BEFORE planting
+                // the minted access token, so a multi-tab race that rotates again can
+                // never strand this tab with a superseded secret.
+                const active = mint.state.accounts.find((a) => a.accountId === mint.state.activeAccountId);
+                const next = {
+                    ...persisted,
+                    deviceId: mint.state.deviceId,
+                    deviceSecret: mint.nextDeviceSecret,
+                    accessToken: mint.accessToken,
+                    expiresAt: mint.expiresAt,
+                    ...(active ? { sessionId: active.sessionId, userId: active.accountId } : {}),
+                };
+                await store.save(next);
+                oxy.setTokens(mint.accessToken);
+                return {
+                    kind: 'session',
+                    session: { sessionId: next.sessionId, userId: next.userId, accessToken: mint.accessToken },
+                };
+            }
+            catch (error) {
+                const failure = classifyMintFailure(error);
+                if (failure === 'invalid_secret') {
+                    // Stale/diverged secret — drop it so the mint lane stops firing, then
+                    // fall through to the migratory refresh/cookie lanes. Setting it
+                    // undefined drops the key on the store's JSON serialization, and the
+                    // mint guard treats undefined as absent.
+                    await store.save({ ...persisted, deviceSecret: undefined });
+                    return { kind: 'skip' };
+                }
+                if (failure === 'no_active_session') {
+                    // Device known, no live session — authoritative signed-out. KEEP the
+                    // secret and stop the chain (do not bounce a known-signed-out device).
+                    deviceKnownSignedOut = true;
+                    signedOutReason = 'no_session';
+                    return { kind: 'skip' };
+                }
+                // Transient (network / 5xx): keep the secret, let the fallback lanes try.
+                logger.debug('device-secret mint failed (transient) — keeping secret, falling back', { component: 'coldBootV2', method: 'device-secret-mint' }, error);
+                return { kind: 'skip' };
+            }
+        },
+    });
     // 1. bootstrap-return (web) — consume a #oxy_boot fragment.
     steps.push({
         id: 'bootstrap-return',
@@ -208,6 +287,7 @@ export async function runSessionColdBoot(opts) {
     // 2. stored-tokens — warm-plant or rotate the persisted refresh family.
     steps.push({
         id: 'stored-tokens',
+        enabled: () => !deviceKnownSignedOut,
         run: async () => {
             const persisted = await store.load();
             if (!persisted) {
@@ -234,7 +314,7 @@ export async function runSessionColdBoot(opts) {
     // 3. shared-key-signin (native) — re-mint from the shared identity.
     steps.push({
         id: 'shared-key-signin',
-        enabled: () => isNative,
+        enabled: () => isNative && !deviceKnownSignedOut,
         run: async () => {
             const session = await oxy.signInWithSharedIdentity();
             if (!session?.accessToken) {
@@ -267,7 +347,7 @@ export async function runSessionColdBoot(opts) {
     // 4. bootstrap-hop (web, terminal) — same-apex inline fetch OR cross-apex nav.
     steps.push({
         id: 'bootstrap-hop',
-        enabled: () => isWeb,
+        enabled: () => isWeb && !deviceKnownSignedOut,
         run: async () => {
             const pageHost = dom.getLocationHostname();
             let apiHost = null;
@@ -300,6 +380,21 @@ export async function runSessionColdBoot(opts) {
                         accessToken: bundle.accessToken,
                         expiresAt: bundle.expiresAt,
                     };
+                    // Phase 2c: the web-session bundle may carry a rotating `deviceSecret`
+                    // but NOT a deviceId. Persist the secret and carry any prior deviceId
+                    // (from a deviceId-bearing login lane) forward so the mint lane stays
+                    // usable — this overwrite must not orphan it.
+                    const prior = await store.load();
+                    if (prior?.deviceId) {
+                        next.deviceId = prior.deviceId;
+                    }
+                    // Prefer the bundle's secret (the server just rotated onto it); keep the
+                    // prior one when the bundle omits it — this lane also runs as the
+                    // TRANSIENT-mint fallback, and must not orphan a still-valid secret.
+                    const carriedSecret = bundle.deviceSecret ?? prior?.deviceSecret;
+                    if (carriedSecret) {
+                        next.deviceSecret = carriedSecret;
+                    }
                     await store.save(next);
                     oxy.setTokens(bundle.accessToken);
                     return { kind: 'session', session: sessionFromPersisted(next, bundle.accessToken) };

package/dist/esm/boot/deviceBootReturn.js

@@ -129,6 +129,21 @@ export async function consumeDeviceBootReturn(deps) {
                 accessToken: bundle.accessToken,
                 expiresAt: bundle.expiresAt,
             };
+            // Phase 2c: the cookie-bootstrap bundle may carry a rotating `deviceSecret`
+            // but NOT a deviceId. Persist the secret, and carry any prior deviceId
+            // forward (from a deviceId-bearing login lane) so the pair stays usable by
+            // the zero-cookie mint — an overwrite here must not orphan the mint lane.
+            const prior = await deps.store.load();
+            if (prior?.deviceId) {
+                next.deviceId = prior.deviceId;
+            }
+            // Prefer the bundle's secret (the server just rotated onto it); keep the
+            // prior one when the bundle omits it so a cookie-lane boot can never orphan
+            // a still-valid secret captured by an earlier login lane.
+            const carriedSecret = bundle.deviceSecret ?? prior?.deviceSecret;
+            if (carriedSecret) {
+                next.deviceSecret = carriedSecret;
+            }
             await deps.store.save(next);
             deps.plantAccessToken(bundle.accessToken);
             return {

package/dist/esm/mixins/OxyServices.deviceBoot.js

@@ -15,7 +15,7 @@
  * and `setTokens`, so the same network primitive can be reused from either
  * without double-planting.
  */
-import { authTokenBundleSchema, tokenRefreshResponseSchema, deviceTokenIssueResponseSchema, webSessionResultSchema, safeParseContract, } from '@oxyhq/contracts';
+import { authTokenBundleSchema, tokenRefreshResponseSchema, deviceTokenIssueResponseSchema, deviceTokenMintResponseSchema, webSessionResultSchema, safeParseContract, } from '@oxyhq/contracts';
 export function OxyServicesDeviceBootMixin(Base) {
     return class extends Base {
         /**
@@ -102,6 +102,34 @@ export function OxyServicesDeviceBootMixin(Base) {
                 throw this.handleError(error);
             }
         }
+        /**
+         * Zero-cookie mint (phase 2c). Present the first-party `deviceId` +
+         * `deviceSecret` to `POST /session/device/token` — NO bearer, NO cookies:
+         * possession of the secret IS the device-ownership proof. Returns a fresh
+         * short access token for the device's active account plus `nextDeviceSecret`
+         * (rotation-in-use) and the projected device-session `state`.
+         *
+         * `skipAuth` (like {@link refreshWithToken}): this call carries no bearer, so
+         * a 401 must surface DIRECTLY — never trigger `HttpService`'s 401→refresh→
+         * retry dance (which would pointlessly rotate the refresh family). The cold
+         * boot reads the 401 body (`invalid_device_secret` vs `no_active_session`) to
+         * decide whether to drop the secret and fall back or resolve signed-out.
+         *
+         * @throws if the response does not match {@link deviceTokenMintResponseSchema}.
+         */
+        async mintFromDeviceSecret(deviceId, deviceSecret) {
+            try {
+                const res = await this.makeRequest('POST', '/session/device/token', { deviceId, deviceSecret }, { cache: false, skipAuth: true });
+                const parsed = safeParseContract(deviceTokenMintResponseSchema, res);
+                if (!parsed) {
+                    throw new Error('session/device/token returned an unexpected response shape');
+                }
+                return parsed;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
         /**
          * Build the top-level `GET /auth/device/bootstrap` URL for the cross-apex
          * hop. The server validates `return_to` against the trusted-origin lane and

package/dist/esm/session/authStateStore.js

@@ -64,6 +64,12 @@ function deserialize(raw) {
     if (typeof candidate.deviceToken === 'string' && candidate.deviceToken.length > 0) {
         state.deviceToken = candidate.deviceToken;
     }
+    if (typeof candidate.deviceId === 'string' && candidate.deviceId.length > 0) {
+        state.deviceId = candidate.deviceId;
+    }
+    if (typeof candidate.deviceSecret === 'string' && candidate.deviceSecret.length > 0) {
+        state.deviceSecret = candidate.deviceSecret;
+    }
     if (typeof candidate.accessToken === 'string' && candidate.accessToken.length > 0) {
         state.accessToken = candidate.accessToken;
     }

package/dist/esm/session/refresh.js

@@ -85,6 +85,15 @@ export async function refreshPersistedSession(deps) {
             if (persisted.deviceToken) {
                 next.deviceToken = persisted.deviceToken;
             }
+            // The refresh response carries no device credentials — carry the persisted
+            // deviceId/deviceSecret (phase 2c) forward so a rotation never drops the
+            // zero-cookie mint lane (mirrors the deviceToken preservation above).
+            if (persisted.deviceId) {
+                next.deviceId = persisted.deviceId;
+            }
+            if (persisted.deviceSecret) {
+                next.deviceSecret = persisted.deviceSecret;
+            }
             await store.save(next);
             return rotated.accessToken;
         }