@oxyhq/core 8.0.0 → 9.0.0

package/src/session/__tests__/refresh.test.ts

@@ -1,25 +1,33 @@
 import type { OxyServices } from '../../OxyServices';
-import type { TokenRefreshResponse } from '@oxyhq/contracts';
+import type { DeviceTokenMintResponse } from '@oxyhq/contracts';
 import type { SessionLoginResponse } from '../../models/session';
 import { refreshPersistedSession, startTokenRefreshScheduler } from '../refresh';
 import { createMemoryAuthStateStore, type PersistedAuthState } from '../authStateStore';
 
+/** The persisted zero-cookie mint credential the refresh reads. */
 const STORED: PersistedAuthState = {
   sessionId: 'sess-old',
-  refreshToken: 'refresh-old-abcdefghij',
   userId: 'user-1',
-  deviceToken: 'device-abcdefghij',
+  deviceId: 'dev-mint',
+  deviceSecret: 'ds-secret-orig',
 };
 
-const ROTATED: TokenRefreshResponse = {
+/** A successful `POST /session/device/token` mint (rotates the secret + active account). */
+const MINT: DeviceTokenMintResponse = {
   accessToken: 'access-new',
-  refreshToken: 'refresh-new-abcdefghij',
   expiresAt: '2030-01-01T00:00:00.000Z',
-  sessionId: 'sess-new',
+  nextDeviceSecret: 'ds-next-secret',
+  state: {
+    deviceId: 'dev-mint',
+    accounts: [{ accountId: 'user-1', sessionId: 'sess-new', authuser: 0 }],
+    activeAccountId: 'user-1',
+    revision: 4,
+    updatedAt: 1_700_000_000_000,
+  },
 };
 
 interface RefreshMockOverrides {
-  refreshWithToken?: OxyServices['refreshWithToken'];
+  mintFromDeviceSecret?: OxyServices['mintFromDeviceSecret'];
   signInWithSharedIdentity?: OxyServices['signInWithSharedIdentity'];
 }
 
@@ -27,14 +35,14 @@ function makeOxy(overrides: RefreshMockOverrides = {}): { oxy: OxyServices; setT
   const setTokens = jest.fn();
   const oxy = {
     setTokens,
-    refreshWithToken: overrides.refreshWithToken ?? (async () => ROTATED),
+    mintFromDeviceSecret: overrides.mintFromDeviceSecret ?? (async () => MINT),
     signInWithSharedIdentity: overrides.signInWithSharedIdentity ?? (async () => null),
   } as unknown as OxyServices;
   return { oxy, setTokens };
 }
 
-describe('refreshPersistedSession — arm 1 (refresh-token rotation)', () => {
-  it('rotates, plants, persists the new family head, and returns the new token', async () => {
+describe('refreshPersistedSession — arm 1 (device-secret mint)', () => {
+  it('mints, plants, persists the rotated secret + active account, and returns the token', async () => {
     const store = createMemoryAuthStateStore();
     await store.save(STORED);
     const { oxy, setTokens } = makeOxy();
@@ -45,53 +53,82 @@ describe('refreshPersistedSession — arm 1 (refresh-token rotation)', () => {
     expect(setTokens).toHaveBeenCalledWith('access-new');
     expect(await store.load()).toEqual({
       sessionId: 'sess-new',
-      refreshToken: 'refresh-new-abcdefghij',
       userId: 'user-1',
-      deviceToken: 'device-abcdefghij',
+      deviceId: 'dev-mint',
+      deviceSecret: 'ds-next-secret',
       accessToken: 'access-new',
       expiresAt: '2030-01-01T00:00:00.000Z',
     });
   });
 
-  it('clears the store on a family-revoked (401) error', async () => {
+  it('presents the persisted deviceId + deviceSecret to the mint', async () => {
     const store = createMemoryAuthStateStore();
     await store.save(STORED);
+    const mintFromDeviceSecret = jest.fn(async () => MINT);
+    const { oxy } = makeOxy({ mintFromDeviceSecret });
+
+    await refreshPersistedSession({ oxy, store, allowSharedKeyFallback: false });
+
+    expect(mintFromDeviceSecret).toHaveBeenCalledWith('dev-mint', 'ds-secret-orig');
+  });
+
+  it('drops only the secret (keeps deviceId) on a 401 and falls to shared-key when native', async () => {
+    const store = createMemoryAuthStateStore();
+    await store.save(STORED);
+    const SHARED: SessionLoginResponse = {
+      sessionId: 'sess-shared',
+      deviceId: 'dev-1',
+      expiresAt: '2030-01-01T00:00:00.000Z',
+      user: { id: 'user-1', username: 'u', name: {}, avatar: undefined },
+      accessToken: 'access-shared',
+    };
+    const signInWithSharedIdentity = jest.fn(async () => SHARED);
     const { oxy } = makeOxy({
-      refreshWithToken: async () => {
-        throw Object.assign(new Error('revoked'), { status: 401 });
+      mintFromDeviceSecret: async () => {
+        throw Object.assign(new Error('invalid_device_secret'), { status: 401 });
       },
+      signInWithSharedIdentity,
     });
 
-    const token = await refreshPersistedSession({ oxy, store, allowSharedKeyFallback: false });
+    const token = await refreshPersistedSession({ oxy, store, allowSharedKeyFallback: true });
 
-    expect(token).toBeNull();
-    expect(await store.load()).toBeNull();
+    expect(token).toBe('access-shared');
+    expect(signInWithSharedIdentity).toHaveBeenCalledTimes(1);
+    const persisted = await store.load();
+    expect(persisted?.deviceSecret).toBeUndefined();
+    expect(persisted?.deviceId).toBe('dev-mint');
   });
 
-  it('clears the store on an invalid_grant code', async () => {
+  it('clears the store on a 401 when there is no shared-key fallback (web)', async () => {
     const store = createMemoryAuthStateStore();
     await store.save(STORED);
     const { oxy } = makeOxy({
-      refreshWithToken: async () => {
-        throw Object.assign(new Error('bad'), { code: 'invalid_grant' });
+      mintFromDeviceSecret: async () => {
+        throw Object.assign(new Error('no_active_session'), { status: 401 });
       },
     });
 
-    expect(await refreshPersistedSession({ oxy, store, allowSharedKeyFallback: false })).toBeNull();
+    const token = await refreshPersistedSession({ oxy, store, allowSharedKeyFallback: false });
+
+    expect(token).toBeNull();
     expect(await store.load()).toBeNull();
   });
 
-  it('KEEPS the store on a transient (500 / network) error', async () => {
+  it('KEEPS the store and returns null on a transient (500 / network) error', async () => {
     const store = createMemoryAuthStateStore();
     await store.save(STORED);
+    const signInWithSharedIdentity = jest.fn(async () => null);
     const { oxy } = makeOxy({
-      refreshWithToken: async () => {
+      mintFromDeviceSecret: async () => {
         throw Object.assign(new Error('server'), { status: 500 });
       },
+      signInWithSharedIdentity,
     });
 
-    expect(await refreshPersistedSession({ oxy, store, allowSharedKeyFallback: false })).toBeNull();
+    // A transient failure must NOT drop the credential nor fall through to shared-key.
+    expect(await refreshPersistedSession({ oxy, store, allowSharedKeyFallback: true })).toBeNull();
     expect(await store.load()).toEqual(STORED);
+    expect(signInWithSharedIdentity).not.toHaveBeenCalled();
   });
 });
 
@@ -104,8 +141,8 @@ describe('refreshPersistedSession — arm 2 (native shared-key fallback)', () =>
     accessToken: 'access-shared',
   };
 
-  it('re-mints via shared identity when there is no refresh token', async () => {
-    const store = createMemoryAuthStateStore(); // no stored refresh token
+  it('re-mints via shared identity when there is no persisted secret', async () => {
+    const store = createMemoryAuthStateStore(); // no stored device secret
     const signInWithSharedIdentity = jest.fn(async () => SHARED_SESSION);
     const { oxy } = makeOxy({ signInWithSharedIdentity });
 
@@ -115,31 +152,22 @@ describe('refreshPersistedSession — arm 2 (native shared-key fallback)', () =>
     expect(signInWithSharedIdentity).toHaveBeenCalledTimes(1);
   });
 
-  it('falls back to shared-key after a revoked refresh token', async () => {
+  it('does NOT try shared-key when the fallback is disabled (web)', async () => {
     const store = createMemoryAuthStateStore();
-    await store.save(STORED);
     const signInWithSharedIdentity = jest.fn(async () => SHARED_SESSION);
-    const { oxy } = makeOxy({
-      refreshWithToken: async () => {
-        throw Object.assign(new Error('revoked'), { status: 403 });
-      },
-      signInWithSharedIdentity,
-    });
-
-    const token = await refreshPersistedSession({ oxy, store, allowSharedKeyFallback: true });
+    const { oxy } = makeOxy({ signInWithSharedIdentity });
 
-    expect(token).toBe('access-shared');
-    expect(await store.load()).toBeNull(); // revoked family was cleared
-    expect(signInWithSharedIdentity).toHaveBeenCalledTimes(1);
+    expect(await refreshPersistedSession({ oxy, store, allowSharedKeyFallback: false })).toBeNull();
+    expect(signInWithSharedIdentity).not.toHaveBeenCalled();
   });
 
-  it('does NOT try shared-key when the fallback is disabled (web)', async () => {
+  it('returns null when the shared-key re-mint yields no session', async () => {
     const store = createMemoryAuthStateStore();
-    const signInWithSharedIdentity = jest.fn(async () => SHARED_SESSION);
+    const signInWithSharedIdentity = jest.fn(async () => null);
     const { oxy } = makeOxy({ signInWithSharedIdentity });
 
-    expect(await refreshPersistedSession({ oxy, store, allowSharedKeyFallback: false })).toBeNull();
-    expect(signInWithSharedIdentity).not.toHaveBeenCalled();
+    expect(await refreshPersistedSession({ oxy, store, allowSharedKeyFallback: true })).toBeNull();
+    expect(signInWithSharedIdentity).toHaveBeenCalledTimes(1);
   });
 });
 

package/src/session/accountDialogController.ts

@@ -106,7 +106,7 @@ export interface AccountDialogControllerOptions {
    * falls back to `SessionClient.registerAndActivate` (registration + activation
    * only — no provider-side durable persist/hydration).
    */
-  commitSession?: (session: SessionLoginResponse & { refreshToken?: string }) => Promise<void>;
+  commitSession?: (session: SessionLoginResponse) => Promise<void>;
   /** Notified after a completed sign-in (bearer planted + session committed). */
   onSignedIn?: (user: MinimalUserData) => void;
   /** Central IdP apex for `openPasswordAtOxyAuth` (defaults to `CENTRAL_IDP_APEX`). */
@@ -142,7 +142,7 @@ export class AccountDialogController {
   private readonly sessionClient: SessionClient;
   private readonly clientId: string | null;
   private readonly locale?: string;
-  private readonly commitSession?: (session: SessionLoginResponse & { refreshToken?: string }) => Promise<void>;
+  private readonly commitSession?: (session: SessionLoginResponse) => Promise<void>;
   private readonly onSignedIn?: (user: MinimalUserData) => void;
   private readonly idpApex: string;
   private readonly pollIntervalMs: number;
@@ -454,7 +454,6 @@ export class AccountDialogController {
             expiresAt: result.expiresAt,
             user: result.user,
             accessToken: result.accessToken,
-            ...(readRefreshToken(result) ? { refreshToken: readRefreshToken(result) } : {}),
           },
           result.user,
         );
@@ -633,7 +632,6 @@ export class AccountDialogController {
       name: claimed.user.name,
       avatar: claimed.user.avatar ?? undefined,
     };
-    const refreshToken = readRefreshToken(claimed);
     try {
       await this.completeSignIn(
         {
@@ -642,7 +640,6 @@ export class AccountDialogController {
           expiresAt: claimed.expiresAt ?? '',
           user: minimalUser,
           accessToken: claimed.accessToken,
-          ...(refreshToken ? { refreshToken } : {}),
         },
         minimalUser,
       );
@@ -656,7 +653,7 @@ export class AccountDialogController {
    * by the shared-key, QR, and mint-switch paths so they cannot drift.
    */
   private async completeSignIn(
-    session: SessionLoginResponse & { refreshToken?: string },
+    session: SessionLoginResponse,
     user: MinimalUserData,
   ): Promise<void> {
     await this.commitAuthorizedSession(session, user);
@@ -675,7 +672,7 @@ export class AccountDialogController {
    * `SessionClient.registerAndActivate` (registration + activation only).
    */
   private async commitAuthorizedSession(
-    session: SessionLoginResponse & { refreshToken?: string },
+    session: SessionLoginResponse,
     user: MinimalUserData,
   ): Promise<void> {
     if (this.commitSession) {
@@ -751,17 +748,6 @@ export function createAccountDialogController(
 // Local helpers
 // ---------------------------------------------------------------------------
 
-/**
- * The rotating refresh-token family head is threaded on the runtime object by
- * the trusted device-flow / switch lanes even though it is NOT on the typed
- * return of `claimSessionByToken` / `switchToAccount`. Read it defensively so
- * the commit funnel can persist a durable session.
- */
-function readRefreshToken(value: unknown): string | undefined {
-  const token = (value as { refreshToken?: unknown }).refreshToken;
-  return typeof token === 'string' ? token : undefined;
-}
-
 /** Current document URL on web; empty string where `location` is absent (native/SSR). */
 function currentLocationHref(): string {
   const location = (globalThis as { location?: { href?: string } }).location;

package/src/session/authStateStore.ts

@@ -1,12 +1,12 @@
 /**
  * Persisted auth state — ONE shape, web + native.
  *
- * The device-first session model (auth-centralization wave 1) persists the
- * rotating refresh-token family head per ORIGIN so a reload restores the
- * session locally without a redirect. This module is the storage seam: a tiny
- * `load / save / clear` interface plus platform factories, so the cold boot
- * (`coldBootV2`) and the unified refresh handler (`refresh.ts`) never touch a
- * platform storage API directly.
+ * The zero-cookie device transport persists the device credential per ORIGIN so
+ * a reload restores the session locally without a redirect: `deviceId` +
+ * `deviceSecret` mint a fresh access token via `POST /session/device/token`.
+ * This module is the storage seam: a tiny `load / save / clear` interface plus
+ * platform factories, so the cold boot (`coldBootV2`) and the unified re-mint
+ * handler (`refresh.ts`) never touch a platform storage API directly.
  *
  * Platform-agnostic — the native factory takes an INJECTED key/value store
  * (`@oxyhq/services` passes a SecureStore-backed adapter) so `@oxyhq/core`
@@ -20,25 +20,38 @@
 /**
  * The persisted session credential set for a single origin.
  *
- * `refreshToken` is the rotating single-use family head; `sessionId` + `userId`
- * identify the owning device session and account. `deviceToken` is the opaque,
- * add-only device attribution token (mirrored to the shared keychain on native
- * so every Oxy app on one phone shares one DeviceSession).
+ * `sessionId` + `userId` identify the owning device session and active account.
+ * `deviceId` + `deviceSecret` are the zero-cookie mint credential: the client
+ * presents BOTH at `POST /session/device/token` — the secret is the proof, the
+ * deviceId selects the device doc. The secret is rotated in-use: the mint returns
+ * `nextDeviceSecret`, which the cold boot / re-mint handler persist BEFORE
+ * planting the minted access token (multi-tab anti-loss).
  *
- * `accessToken` + `expiresAt` are OPTIONAL warm-boot fields. Persisting them
- * lets the cold boot plant a still-valid access token on the very first paint
- * WITHOUT a blocking `/auth/refresh-token` round-trip — the proactive scheduler
- * then rotates it in the background. They are a strict optimization: the store
- * is fully functional (via `refreshToken`) when they are absent or stale, and
- * the access token is short-lived, so persisting it adds no exposure the
- * already-persisted refresh token does not (see the plan's XSS risk note — the
- * refresh token is the dominant secret either way).
+ * `accessToken` + `expiresAt` are OPTIONAL warm-boot fields. Persisting them lets
+ * the cold boot plant a still-valid access token on the very first paint WITHOUT
+ * a blocking mint round-trip — the proactive scheduler then rotates it in the
+ * background. They are a strict optimization: the store is fully functional (via
+ * `deviceSecret`) when they are absent or stale, and the access token is
+ * short-lived, so persisting it adds no exposure the already-persisted
+ * `deviceSecret` does not.
  */
 export interface PersistedAuthState {
   sessionId: string;
-  refreshToken: string;
   userId: string;
-  deviceToken?: string;
+  /**
+   * The stable device identifier this session is bound to (zero-cookie
+   * transport). Persisted alongside {@link deviceSecret} because the
+   * `POST /session/device/token` mint presents BOTH. Sourced from every login
+   * lane (password / 2FA / QR claim / challenge verify) via the response's
+   * `deviceId`.
+   */
+  deviceId?: string;
+  /**
+   * The rotating device secret (zero-cookie transport). Possession of it mints a
+   * short access token for the device's active account via
+   * `POST /session/device/token`. Rotated in-use.
+   */
+  deviceSecret?: string;
   /** Optional warm-boot access token (short-lived; see interface docs). */
   accessToken?: string;
   /** Optional warm-boot access-token expiry, ISO-8601. */
@@ -46,27 +59,15 @@ export interface PersistedAuthState {
 }
 
 /**
- * The storage seam consumed by the cold boot and the refresh handler. Async
+ * The storage seam consumed by the cold boot and the re-mint handler. Async
  * throughout so one interface fits both synchronous web `localStorage` and
- * asynchronous native SecureStore/AsyncStorage.
- *
- * Two lifetimes:
- *  - The SESSION credential blob (`load`/`save`/`clear`) is per-sign-in and is
- *    wiped on `clear()` (sign-out).
- *  - The DEVICE token (`loadDeviceToken`/`saveDeviceToken`/`clearDeviceToken`)
- *    is long-lived device attribution that SURVIVES `clear()`: a signed-out
- *    browser is still the same device, and a later in-app (cross-apex,
- *    cookie-less) login sends this token so the new session joins the SAME
- *    server-side DeviceSession. Only an explicit device signout-all
- *    (`clearDeviceToken`) removes it.
+ * asynchronous native SecureStore/AsyncStorage. `clear()` (sign-out) wipes the
+ * per-sign-in credential blob.
  */
 export interface AuthStateStore {
   load(): Promise<PersistedAuthState | null>;
   save(state: PersistedAuthState): Promise<void>;
   clear(): Promise<void>;
-  loadDeviceToken(): Promise<string | null>;
-  saveDeviceToken(token: string): Promise<void>;
-  clearDeviceToken(): Promise<void>;
 }
 
 /**
@@ -86,13 +87,6 @@ export interface NativeKeyValueStorage {
  */
 export const AUTH_STATE_STORAGE_KEY = 'oxy.auth.v1';
 
-/**
- * Storage key for the long-lived device-attribution token. Separate from
- * {@link AUTH_STATE_STORAGE_KEY} because it must OUTLIVE a session `clear()`
- * (sign-out) — the device is unchanged across sign-ins.
- */
-export const DEVICE_TOKEN_STORAGE_KEY = 'oxy.device.v1';
-
 /**
  * Parse + shape-validate a stored blob. Returns `null` for anything that is
  * not a well-formed {@link PersistedAuthState} (absent, malformed JSON, wrong
@@ -114,21 +108,21 @@ function deserialize(raw: string | null): PersistedAuthState | null {
   const candidate = parsed as Record<string, unknown>;
   if (
     typeof candidate.sessionId !== 'string' ||
-    typeof candidate.refreshToken !== 'string' ||
     typeof candidate.userId !== 'string' ||
     candidate.sessionId.length === 0 ||
-    candidate.refreshToken.length === 0 ||
     candidate.userId.length === 0
   ) {
     return null;
   }
   const state: PersistedAuthState = {
     sessionId: candidate.sessionId,
-    refreshToken: candidate.refreshToken,
     userId: candidate.userId,
   };
-  if (typeof candidate.deviceToken === 'string' && candidate.deviceToken.length > 0) {
-    state.deviceToken = candidate.deviceToken;
+  if (typeof candidate.deviceId === 'string' && candidate.deviceId.length > 0) {
+    state.deviceId = candidate.deviceId;
+  }
+  if (typeof candidate.deviceSecret === 'string' && candidate.deviceSecret.length > 0) {
+    state.deviceSecret = candidate.deviceSecret;
   }
   if (typeof candidate.accessToken === 'string' && candidate.accessToken.length > 0) {
     state.accessToken = candidate.accessToken;
@@ -147,7 +141,6 @@ function deserialize(raw: string | null): PersistedAuthState | null {
  */
 export function createMemoryAuthStateStore(): AuthStateStore {
   let current: PersistedAuthState | null = null;
-  let deviceToken: string | null = null;
   return {
     load: async () => current,
     save: async (state) => {
@@ -156,13 +149,6 @@ export function createMemoryAuthStateStore(): AuthStateStore {
     clear: async () => {
       current = null;
     },
-    loadDeviceToken: async () => deviceToken,
-    saveDeviceToken: async (token) => {
-      deviceToken = token;
-    },
-    clearDeviceToken: async () => {
-      deviceToken = null;
-    },
   };
 }
 
@@ -194,8 +180,8 @@ function safeGetLocalStorage(): Storage | null {
  *    for this page's lifetime — never throws on construction.
  *  - Individual `getItem`/`setItem`/`removeItem` are each wrapped: a read that
  *    throws yields `null`; a write that throws (quota, private mode) is
- *    swallowed. The persisted-refresh lane treats a failed persist as "no
- *    durable state" (falls back to the bootstrap hop) rather than crashing.
+ *    swallowed. The re-mint lane treats a failed persist as "no durable state"
+ *    rather than crashing.
  */
 export function createWebAuthStateStore(): AuthStateStore {
   const storage = safeGetLocalStorage();
@@ -207,7 +193,6 @@ export function createWebAuthStateStore(): AuthStateStore {
   // means "never written this session" → fall back to storage; any set value
   // (including `null` after clear) is authoritative and preferred over storage.
   let sessionMirror: PersistedAuthState | null | undefined;
-  let deviceTokenMirror: string | null | undefined;
   return {
     load: async () => {
       if (sessionMirror !== undefined) {
@@ -236,32 +221,6 @@ export function createWebAuthStateStore(): AuthStateStore {
         // Non-fatal — see save().
       }
     },
-    loadDeviceToken: async () => {
-      if (deviceTokenMirror !== undefined) {
-        return deviceTokenMirror;
-      }
-      try {
-        return storage.getItem(DEVICE_TOKEN_STORAGE_KEY);
-      } catch {
-        return null;
-      }
-    },
-    saveDeviceToken: async (token) => {
-      deviceTokenMirror = token;
-      try {
-        storage.setItem(DEVICE_TOKEN_STORAGE_KEY, token);
-      } catch {
-        // Non-fatal — see save().
-      }
-    },
-    clearDeviceToken: async () => {
-      deviceTokenMirror = null;
-      try {
-        storage.removeItem(DEVICE_TOKEN_STORAGE_KEY);
-      } catch {
-        // Non-fatal — see save().
-      }
-    },
   };
 }
 
@@ -277,7 +236,6 @@ export function createNativeAuthStateStore(storage: NativeKeyValueStorage): Auth
   // Same in-memory mirror as the web store — a locked/failed SecureStore write
   // must not silently lose the session for the app's lifetime.
   let sessionMirror: PersistedAuthState | null | undefined;
-  let deviceTokenMirror: string | null | undefined;
   return {
     load: async () => {
       if (sessionMirror !== undefined) {
@@ -305,31 +263,5 @@ export function createNativeAuthStateStore(storage: NativeKeyValueStorage): Auth
         // Non-fatal.
       }
     },
-    loadDeviceToken: async () => {
-      if (deviceTokenMirror !== undefined) {
-        return deviceTokenMirror;
-      }
-      try {
-        return await storage.getItem(DEVICE_TOKEN_STORAGE_KEY);
-      } catch {
-        return null;
-      }
-    },
-    saveDeviceToken: async (token) => {
-      deviceTokenMirror = token;
-      try {
-        await storage.setItem(DEVICE_TOKEN_STORAGE_KEY, token);
-      } catch {
-        // Non-fatal.
-      }
-    },
-    clearDeviceToken: async () => {
-      deviceTokenMirror = null;
-      try {
-        await storage.removeItem(DEVICE_TOKEN_STORAGE_KEY);
-      } catch {
-        // Non-fatal.
-      }
-    },
   };
 }

package/src/session/createSessionClient.ts

@@ -1,5 +1,5 @@
 import type { OxyServices } from '../OxyServices';
-import { SessionClient, type SessionClientOptions, type TokenTransport } from './SessionClient';
+import { SessionClient, type TokenTransport } from './SessionClient';
 import type { SocketIOFactory } from './socketLoader';
 import { createSessionClientHost } from './sessionClientHost';
 
@@ -29,18 +29,11 @@ export function createSessionClient(
   oxyServices: OxyServices,
   transport: TokenTransport,
   socketFactory?: SocketIOFactory,
-  /**
-   * Optional signed-out realtime wiring: `signedOutSocketAuth` (open the socket
-   * while signed out so an idle tab receives its device pushes) and
-   * `onSessionAppeared` (self-acquire when a sibling signs in). See
-   * {@link SessionClientOptions}.
-   */
-  extra?: Pick<SessionClientOptions, 'signedOutSocketAuth' | 'onSessionAppeared'>,
 ): {
   client: SessionClient;
   host: ReturnType<typeof createSessionClientHost>;
 } {
   const host = createSessionClientHost(oxyServices);
-  const client = new SessionClient(host, { transport, socketFactory, ...extra });
+  const client = new SessionClient(host, { transport, socketFactory });
   return { client, host };
 }