@oxyhq/core 8.0.0 → 9.0.0

package/dist/esm/session/refresh.js

@@ -1,10 +1,11 @@
 import { isNative } from '../utils/platform.js';
+import { extractErrorStatus } from '../utils/errorUtils.js';
 import { logger } from '../utils/loggerUtils.js';
 /**
  * Lead time (ms) before access-token expiry at which the proactive scheduler
- * refreshes. Mirrors `HttpService`'s per-request `TOKEN_REFRESH_LEAD_SECONDS`
- * (60s) so the scheduled refresh and the request-time preflight refresh use
- * the same window — the scheduler just fires it during idle/background.
+ * re-mints. Mirrors `HttpService`'s per-request `TOKEN_REFRESH_LEAD_SECONDS`
+ * (60s) so the scheduled re-mint and the request-time preflight use the same
+ * window — the scheduler just fires it during idle/background.
  */
 export const TOKEN_REFRESH_LEAD_MS = 60000;
 /**
@@ -16,13 +17,13 @@ const MAX_TIMEOUT_DELAY_MS = 2147483647;
 /**
  * Floor (ms) on ANY scheduled delay. An already-expired / in-lead-window token
  * computes a non-positive `exp − now − lead`; without this floor that becomes
- * `setTimeout(…, 0)`, and a FAILING refresh (offline / server error) would
+ * `setTimeout(…, 0)`, and a FAILING re-mint (offline / server error) would
  * re-arm at 0 in the finally block → a tight 100%-CPU busy loop. The floor
  * guarantees every re-arm yields the event loop.
  */
 const MIN_SCHEDULE_DELAY_MS = 1000;
 /**
- * Backoff schedule (ms) applied when a scheduled refresh FAILS: first retry
+ * Backoff schedule (ms) applied when a scheduled re-mint FAILS: first retry
  * after {@link MIN_FAILURE_BACKOFF_MS}, doubling up to {@link MAX_FAILURE_BACKOFF_MS}.
  * Reset to 0 on any success or token change. This is what converts the former
  * zero-delay failure loop into a bounded, backing-off retry.
@@ -30,72 +31,55 @@ const MIN_SCHEDULE_DELAY_MS = 1000;
 const MIN_FAILURE_BACKOFF_MS = 5000;
 const MAX_FAILURE_BACKOFF_MS = 5 * 60000;
 /**
- * Error codes (in addition to HTTP 401/403) that mean the stored refresh token
- * is permanently unusable — the family was revoked or a reuse was detected. On
- * any of these the persisted store is CLEARED (the session is truly over);
- * transient failures (network, 5xx) leave the store intact so a later attempt
- * can still succeed.
- */
-const REVOKED_REFRESH_CODES = new Set([
-    'invalid_grant',
-    'refresh_token_revoked',
-    'refresh_token_reuse',
-    'token_reuse',
-    'invalid_token',
-]);
-/** Does this error mean the refresh token is permanently dead (vs. transient)? */
-function isRevokedRefreshError(error) {
-    if (!error || typeof error !== 'object') {
-        return false;
-    }
-    const e = error;
-    if (e.status === 401 || e.status === 403) {
-        return true;
-    }
-    return typeof e.code === 'string' && REVOKED_REFRESH_CODES.has(e.code);
-}
-/**
- * Rotate the persisted session and return the fresh access token, or `null`
+ * Re-mint the persisted session and return the fresh access token, or `null`
  * when no arm could produce one.
  *
- * Arm 1 (`POST /auth/refresh-token`): if the store holds a refresh token, rotate
- * it — on success plant + persist the rotated pair; on a REVOKED error clear the
- * store; on a transient error leave the store and return `null`.
+ * Arm 1 (`POST /session/device/token`): if the store holds a `deviceId` +
+ * `deviceSecret`, mint — on success plant + persist the rotated secret. A 401
+ * means the secret is diverged (`invalid_device_secret`) or the device has no
+ * live session (`no_active_session`): drop the secret so the mint lane stops (or
+ * clear the store on web, where there is no fallback). A transient error leaves
+ * the store and returns `null`.
  *
- * Arm 2 (native shared-keychain): when there is no refresh token or arm 1 was
- * revoked, re-mint via `signInWithSharedIdentity` (which plants tokens). The
- * shared keychain — not the per-origin store — is the durable native credential,
- * so this arm does not write the store.
+ * Arm 2 (native shared-keychain): when the secret is absent or was just rejected,
+ * re-mint via `signInWithSharedIdentity` (which plants tokens). The shared
+ * keychain — not the per-origin store — is the durable native credential, so this
+ * arm does not write the store.
  */
 export async function refreshPersistedSession(deps) {
     const { oxy, store } = deps;
     const allowSharedKeyFallback = deps.allowSharedKeyFallback ?? isNative();
     const persisted = await store.load();
-    if (persisted?.refreshToken) {
+    if (persisted?.deviceId && persisted?.deviceSecret) {
         try {
-            const rotated = await oxy.refreshWithToken(persisted.refreshToken);
-            oxy.setTokens(rotated.accessToken);
+            const mint = await oxy.mintFromDeviceSecret(persisted.deviceId, persisted.deviceSecret);
+            oxy.setTokens(mint.accessToken);
+            const active = mint.state.accounts.find((a) => a.accountId === mint.state.activeAccountId);
             const next = {
-                sessionId: rotated.sessionId,
-                refreshToken: rotated.refreshToken,
-                userId: persisted.userId,
-                accessToken: rotated.accessToken,
-                expiresAt: rotated.expiresAt,
+                ...persisted,
+                deviceId: mint.state.deviceId,
+                deviceSecret: mint.nextDeviceSecret,
+                accessToken: mint.accessToken,
+                expiresAt: mint.expiresAt,
+                ...(active ? { sessionId: active.sessionId, userId: active.accountId } : {}),
             };
-            if (persisted.deviceToken) {
-                next.deviceToken = persisted.deviceToken;
-            }
             await store.save(next);
-            return rotated.accessToken;
+            return mint.accessToken;
         }
         catch (error) {
-            if (isRevokedRefreshError(error)) {
-                await store.clear();
-                // Fall through to the native shared-key arm below — on a shared-key
-                // device the refresh family being revoked does not end the session.
+            if (extractErrorStatus(error) === 401) {
+                // Secret diverged / no active session. On a shared-key device drop only
+                // the secret so arm 2 below can recover; otherwise the session is over.
+                if (allowSharedKeyFallback) {
+                    await store.save({ ...persisted, deviceSecret: undefined });
+                }
+                else {
+                    await store.clear();
+                }
+                // Fall through to the native shared-key arm.
             }
             else {
-                logger.debug('Persisted refresh failed (transient) — keeping store', { component: 'refresh', method: 'refreshPersistedSession' }, error);
+                logger.debug('Persisted deviceSecret mint failed (transient) — keeping store', { component: 'refresh', method: 'refreshPersistedSession' }, error);
                 return null;
             }
         }
@@ -108,7 +92,7 @@ export async function refreshPersistedSession(deps) {
             }
         }
         catch (error) {
-            logger.debug('Shared-key refresh fallback failed', { component: 'refresh', method: 'refreshPersistedSession' }, error);
+            logger.debug('Shared-key re-mint fallback failed', { component: 'refresh', method: 'refreshPersistedSession' }, error);
         }
     }
     return null;
@@ -136,7 +120,7 @@ export function installAuthRefreshHandler(deps) {
     };
 }
 /**
- * Start the proactive refresh scheduler against `oxy`.
+ * Start the proactive re-mint scheduler against `oxy`.
  *
  * Schedules a single timer to fire {@link TOKEN_REFRESH_LEAD_MS} before the
  * current access token's `exp`, calling
@@ -144,18 +128,18 @@ export function installAuthRefreshHandler(deps) {
  * handler; deduped + cooldown-guarded). After every attempt it reschedules
  * from the possibly-rotated token. It also reschedules whenever the token
  * changes (a sign-out that clears the token cancels the timer) and, on web
- * tab-focus, refreshes immediately if already inside the lead window (a
+ * tab-focus, re-mints immediately if already inside the lead window (a
  * long-hidden tab throttles timers, so the token can be expired on return).
  *
  * No-ops cleanly when there is no token or an opaque/no-`exp` token — the
- * reactive 401 path stays the only refresh trigger in that case. The timer is
+ * reactive 401 path stays the only re-mint trigger in that case. The timer is
  * `.unref?.()`-ed so it never keeps a Node/Jest event loop alive.
  */
 export function startTokenRefreshScheduler(oxy) {
     let disposed = false;
     let timer = null;
     // 0 = no active backoff; grows on consecutive failures, resets on success /
-    // token change. Keeps a failing refresh from re-arming at zero delay.
+    // token change. Keeps a failing re-mint from re-arming at zero delay.
     let failureBackoffMs = 0;
     const clearTimer = () => {
         if (timer !== null) {
@@ -168,10 +152,10 @@ export function startTokenRefreshScheduler(oxy) {
         clearTimer();
         const clamped = Math.min(Math.max(delayMs, MIN_SCHEDULE_DELAY_MS), MAX_TIMEOUT_DELAY_MS);
         timer = setTimeout(runRefresh, clamped);
-        // Never keep a Node/Jest event loop alive for a background refresh timer.
+        // Never keep a Node/Jest event loop alive for a background re-mint timer.
         timer.unref?.();
     };
-    /** Schedule the next refresh from the current token's expiry (the healthy path). */
+    /** Schedule the next re-mint from the current token's expiry (the healthy path). */
     const scheduleFromExpiry = () => {
         clearTimer();
         if (disposed || !oxy.getAccessToken()) {

package/dist/esm/utils/registrableApex.js

@@ -4,12 +4,8 @@
  * The client FAPI auto-detection helper was removed in the device-first cutover
  * (which is why this file is now named for what it actually is, not the old
  * `fapiAutoDetect`). What survives is the pure registrable-domain kernel, still
- * used server-side by the api's device-first same-apex trust checks
- * (`deviceAuth.ts`'s `POST /auth/device/web-session`, via `sameSite.ts`'s
- * `isSameSiteTrustedRequest`) and the `@oxyhq/core/server` CORS/re-export layer.
- *
- * `registrableApex` is NOT legacy — the device-first same-apex check is a live
- * consumer, so this kernel stays regardless of the SSO/FedCM removal.
+ * used by the `@oxyhq/core/server` CORS layer (the `*.oxy.so` same-apex trust
+ * check) and its re-export surface.
  */
 import { getDomain } from 'tldts';
 /**