@oxyhq/core 8.1.0 → 9.0.0

package/dist/esm/boot/coldBootV2.js

@@ -7,159 +7,19 @@
  * the app renders with a "Sign in with Oxy" button.
  *
  * Ordered steps (first to yield a session wins):
- *   1. `bootstrap-return` (web) — consume a `#oxy_boot` return fragment from a
- *      just-completed cross-apex hop: strip it, verify state, persist the
- *      deviceToken, exchange the code.
- *   2. `stored-tokens` — the persisted per-origin refresh family: warm-plant a
- *      still-valid access token, else rotate via `/auth/refresh-token`.
- *   3. `shared-key-signin` (native) — re-mint from the shared-keychain identity,
- *      issuing + mirroring a shared deviceToken the first time.
- *   4. `bootstrap-hop` (web) — same-apex: an inline credentialed
- *      `/auth/device/web-session` fetch (no redirect); cross-apex: ONE top-level
- *      navigation to `/auth/device/bootstrap`, guarded once-ever per origin.
- *   5. Signed out.
- *
- * All mutable guard state lives in STORAGE (localStorage `oxy.boot.attempted` +
- * sessionStorage `oxy.boot.state`), never in module scope, so the guard holds
- * under Metro/bundler re-evaluation.
+ *   1. `device-secret-mint` (web + native) — the zero-cookie transport: when the
+ *      origin persisted a `deviceId` + `deviceSecret`, mint a short access token
+ *      with a single bearer-less POST to `/session/device/token` (no cookie, no
+ *      navigation) and rotate the secret in-use.
+ *   2. `shared-key-signin` (native) — re-mint from the shared-keychain identity.
+ *   3. Signed out.
  *
  * ESM-safe (no `require()`); no react/react-native/expo imports.
  */
-import { resolveUserId } from '@oxyhq/contracts';
 import { runColdBoot } from '../utils/coldBoot.js';
-import { isWeb as detectWeb, isNative as detectNative } from '../utils/platform.js';
+import { isNative as detectNative } from '../utils/platform.js';
 import { extractErrorStatus } from '../utils/errorUtils.js';
-import { KeyManager } from '../crypto/keyManager.js';
 import { logger } from '../utils/loggerUtils.js';
-import { refreshPersistedSession } from '../session/refresh.js';
-import { consumeDeviceBootReturn, hashHasBootFragment, BOOT_STATE_SESSION_KEY, } from './deviceBootReturn.js';
-/**
- * localStorage flag marking that the cross-apex bootstrap navigation has fired
- * once for this origin. Persistent (not session) so the visible redirect
- * happens AT MOST ONCE EVER per browser+origin — a signed-out user is never
- * bounced again; they sign in explicitly.
- */
-export const BOOT_ATTEMPTED_KEY = 'oxy.boot.attempted';
-/**
- * Do not warm-plant a stored access token with less than this remaining — it
- * would need an immediate refresh anyway, so fall through to the rotate path.
- * Matches the refresh lead window.
- */
-const WARM_MIN_REMAINING_MS = 60000;
-/**
- * Generate a 128-bit hex CSRF state token. Prefers Web Crypto
- * (`crypto.getRandomValues`, present in browsers and modern Node); falls back
- * to a time+`Math.random` mix only when no CSPRNG is reachable (this token
- * gates a single-use CSRF echo, not a long-lived secret).
- */
-function generateStateToken() {
-    const cryptoObj = globalThis.crypto;
-    if (cryptoObj?.getRandomValues) {
-        const bytes = new Uint8Array(16);
-        cryptoObj.getRandomValues(bytes);
-        return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
-    }
-    return `${Date.now().toString(16)}${Math.random().toString(16).slice(2, 18)}`;
-}
-/**
- * The guarded real-globals {@link ColdBootDom}. Every accessor tolerates a
- * missing/throwing global (SSR, sandboxed iframe) by returning a neutral value
- * or no-op, so the boot degrades to signed-out rather than crashing.
- */
-export function createBrowserColdBootDom() {
-    const safe = (fn, fallback) => {
-        try {
-            return fn();
-        }
-        catch {
-            return fallback;
-        }
-    };
-    return {
-        getHash: () => safe(() => (typeof window !== 'undefined' ? window.location.hash : ''), ''),
-        stripFragment: () => safe(() => {
-            if (typeof window !== 'undefined' && window.history?.replaceState) {
-                const { pathname, search } = window.location;
-                window.history.replaceState(null, '', `${pathname}${search}`);
-            }
-        }, undefined),
-        getSessionItem: (key) => safe(() => (typeof sessionStorage !== 'undefined' ? sessionStorage.getItem(key) : null), null),
-        setSessionItem: (key, value) => safe(() => {
-            if (typeof sessionStorage !== 'undefined')
-                sessionStorage.setItem(key, value);
-        }, undefined),
-        removeSessionItem: (key) => safe(() => {
-            if (typeof sessionStorage !== 'undefined')
-                sessionStorage.removeItem(key);
-        }, undefined),
-        getLocalItem: (key) => safe(() => (typeof localStorage !== 'undefined' ? localStorage.getItem(key) : null), null),
-        setLocalItem: (key, value) => safe(() => {
-            if (typeof localStorage !== 'undefined')
-                localStorage.setItem(key, value);
-        }, undefined),
-        getLocationHostname: () => safe(() => (typeof window !== 'undefined' ? window.location.hostname : null), null),
-        getReturnToHref: () => safe(() => {
-            if (typeof window === 'undefined')
-                return null;
-            const { origin, pathname, search } = window.location;
-            return `${origin}${pathname}${search}`;
-        }, null),
-        navigate: (url) => safe(() => {
-            if (typeof window !== 'undefined')
-                window.location.assign(url);
-        }, undefined),
-        randomState: generateStateToken,
-    };
-}
-/**
- * Registrable domain = the last two labels of a host. A deliberately SMALL
- * local helper (the plan forbids coupling the boot to `fapiAutoDetect`/`tldts`).
- * Correct for every Oxy apex (all two-label domains: `oxy.so`, `mention.earth`,
- * `alia.onl`, `homiio.com`); the only imprecision — a multi-part public suffix
- * such as `co.uk` — never arises here because the compared API host is always
- * `api.oxy.so`, so a page under a different registrable domain still classifies
- * as cross-apex.
- */
-function registrableDomain(host) {
-    const labels = host.toLowerCase().split('.').filter(Boolean);
-    return labels.length <= 2 ? labels.join('.') : labels.slice(-2).join('.');
-}
-/**
- * Is `host` an IP literal (v4/v6) or a single-label host (`localhost`)? Such
- * hosts have NO registrable domain — the last-two-labels heuristic would
- * mis-group them (`192.168.1.1` and `10.0.1.1` both collapse to `1.1`; IPv6
- * `::1` and `localhost` are single "labels"), so a LAN/dev page could be wrongly
- * classified same-apex as a different LAN API and skip the cross-apex hop.
- */
-function isIpOrSingleLabel(host) {
-    if (host.includes(':')) {
-        return true; // IPv6 literal
-    }
-    if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host)) {
-        return true; // IPv4 literal
-    }
-    return !host.includes('.'); // single-label (e.g. `localhost`)
-}
-/**
- * True when both hosts are same-site / same-apex. For a normal multi-label host
- * pair, that means sharing a registrable domain. For an IP literal or a
- * single-label host (no registrable domain), same-apex requires the two hosts
- * to be EXACTLY equal — never grouped by a spurious trailing-label match.
- */
-export function isSameApex(pageHost, apiHost) {
-    const a = pageHost.toLowerCase();
-    const b = apiHost.toLowerCase();
-    if (isIpOrSingleLabel(a) || isIpOrSingleLabel(b)) {
-        return a === b;
-    }
-    const ra = registrableDomain(a);
-    const rb = registrableDomain(b);
-    return ra !== '' && ra === rb;
-}
-/** Build a `DeviceBootSession` from a persisted state (post-refresh/warm-plant). */
-function sessionFromPersisted(state, accessToken) {
-    return { sessionId: state.sessionId, userId: state.userId, accessToken };
-}
 function classifyMintFailure(error) {
     if (extractErrorStatus(error) === 401) {
         // Structural read (not `instanceof Error`): the thrown value can be a plain
@@ -174,36 +34,21 @@ function classifyMintFailure(error) {
 }
 /**
  * Run the device-first cold boot. Resolves to the `runColdBoot` outcome and, as
- * a side effect, invokes `onSession` (winning session, token already planted)
- * or `onSignedOut` (no session — unless the boot is navigating away for the
- * cross-apex hop, in which case neither fires).
+ * a side effect, invokes `onSession` (winning session, token already planted) or
+ * `onSignedOut` (no session).
  */
 export async function runSessionColdBoot(opts) {
     const { oxy, store } = opts;
-    const dom = opts.dom ?? createBrowserColdBootDom();
-    const isWeb = opts.platform?.isWeb ?? detectWeb();
     const isNative = opts.platform?.isNative ?? detectNative();
-    // Signed-out reason + navigating flag are boot-local (not module-level), so
-    // they cannot leak across boots or break under bundler re-evaluation.
+    // Boot-local (not module-level) so it cannot leak across boots or break under
+    // bundler re-evaluation.
     let signedOutReason = 'no_session';
-    let navigating = false;
-    // Set when the zero-cookie mint reports `no_active_session` (phase 2c): the
-    // device is authoritatively signed out, so the migratory fallback lanes below
-    // (stored-tokens / shared-key / bootstrap-hop) must NOT run — we already know
-    // there is no session and must not bounce a known-signed-out device.
-    let deviceKnownSignedOut = false;
     const steps = [];
-    // 0. device-secret-mint (phase 2c) — the zero-cookie fast path. When the
+    // 1. device-secret-mint (web + native) — the zero-cookie fast path. When the
     //    origin persisted a deviceId + deviceSecret, mint a short access token with
-    //    a single bearer-less POST (no cookie, no navigation). FIRST in the chain
-    //    so it wins over the migratory cookie lanes below. Gated OFF while a
-    //    #oxy_boot return fragment is present so `bootstrap-return` still consumes
-    //    + strips it first (a device holding a secret never triggers that hop, so
-    //    this only defers a rare stale/forged fragment). The rest of the chain
-    //    stays as the additive migratory fallback for devices not yet on the secret.
+    //    a single bearer-less POST (no cookie, no navigation).
     steps.push({
         id: 'device-secret-mint',
-        enabled: () => !(isWeb && hashHasBootFragment(dom.getHash())),
         run: async () => {
             const persisted = await store.load();
             if (!persisted?.deviceId || !persisted?.deviceSecret) {
@@ -234,106 +79,33 @@ export async function runSessionColdBoot(opts) {
             catch (error) {
                 const failure = classifyMintFailure(error);
                 if (failure === 'invalid_secret') {
-                    // Stale/diverged secret — drop it so the mint lane stops firing, then
-                    // fall through to the migratory refresh/cookie lanes. Setting it
-                    // undefined drops the key on the store's JSON serialization, and the
-                    // mint guard treats undefined as absent.
+                    // Stale/diverged secret — drop it so the mint lane stops firing. On
+                    // native the shared-key step below can still recover; on web this ends
+                    // signed out. Setting it undefined drops the key on the store's JSON
+                    // serialization, and the mint guard treats undefined as absent.
                     await store.save({ ...persisted, deviceSecret: undefined });
                     return { kind: 'skip' };
                 }
                 if (failure === 'no_active_session') {
-                    // Device known, no live session — authoritative signed-out. KEEP the
-                    // secret and stop the chain (do not bounce a known-signed-out device).
-                    deviceKnownSignedOut = true;
+                    // Device known, no live session — authoritative signed-out.
                     signedOutReason = 'no_session';
                     return { kind: 'skip' };
                 }
-                // Transient (network / 5xx): keep the secret, let the fallback lanes try.
-                logger.debug('device-secret mint failed (transient) — keeping secret, falling back', { component: 'coldBootV2', method: 'device-secret-mint' }, error);
+                // Transient (network / 5xx): keep the secret; a later attempt can succeed.
+                logger.debug('device-secret mint failed (transient) — keeping secret', { component: 'coldBootV2', method: 'device-secret-mint' }, error);
                 return { kind: 'skip' };
             }
         },
     });
-    // 1. bootstrap-return (web) — consume a #oxy_boot fragment.
-    steps.push({
-        id: 'bootstrap-return',
-        enabled: () => isWeb && hashHasBootFragment(dom.getHash()),
-        run: async () => {
-            const outcome = await consumeDeviceBootReturn({
-                hash: dom.getHash(),
-                stripFragment: () => dom.stripFragment(),
-                readExpectedState: () => dom.getSessionItem(BOOT_STATE_SESSION_KEY),
-                clearExpectedState: () => dom.removeSessionItem(BOOT_STATE_SESSION_KEY),
-                store,
-                exchangeBootCode: (code) => oxy.exchangeBootCode(code),
-                plantAccessToken: (accessToken) => oxy.setTokens(accessToken),
-            });
-            if (outcome.kind === 'session') {
-                return { kind: 'session', session: outcome.session };
-            }
-            if (outcome.kind === 'state-mismatch') {
-                signedOutReason = 'state-mismatch';
-            }
-            else if (outcome.kind === 'no-session') {
-                // `DeviceBootReason` also carries 'session'; a no-session outcome with
-                // that reason (a `session` reason but no code) is still signed out.
-                signedOutReason = outcome.reason === 'new_device' ? 'new_device' : 'no_session';
-            }
-            // Fall through: a stored refresh family (a prior same-origin session) may
-            // still recover below. The once-ever flag blocks a second hop.
-            return { kind: 'skip' };
-        },
-    });
-    // 2. stored-tokens — warm-plant or rotate the persisted refresh family.
-    steps.push({
-        id: 'stored-tokens',
-        enabled: () => !deviceKnownSignedOut,
-        run: async () => {
-            const persisted = await store.load();
-            if (!persisted) {
-                return { kind: 'skip' };
-            }
-            // Warm path: a still-valid access token → plant immediately (no network).
-            if (persisted.accessToken &&
-                persisted.expiresAt &&
-                Date.parse(persisted.expiresAt) - Date.now() > WARM_MIN_REMAINING_MS) {
-                oxy.setTokens(persisted.accessToken);
-                return { kind: 'session', session: sessionFromPersisted(persisted, persisted.accessToken) };
-            }
-            // Rotate path: refreshPersistedSession plants + persists, and clears the
-            // store on a family-revoked error.
-            const token = await refreshPersistedSession({ oxy, store, allowSharedKeyFallback: isNative });
-            if (!token) {
-                return { kind: 'skip' };
-            }
-            const after = await store.load();
-            const base = after ?? persisted;
-            return { kind: 'session', session: sessionFromPersisted(base, token) };
-        },
-    });
-    // 3. shared-key-signin (native) — re-mint from the shared identity.
+    // 2. shared-key-signin (native) — re-mint from the shared identity.
     steps.push({
         id: 'shared-key-signin',
-        enabled: () => isNative && !deviceKnownSignedOut,
+        enabled: () => isNative,
         run: async () => {
             const session = await oxy.signInWithSharedIdentity();
             if (!session?.accessToken) {
                 return { kind: 'skip' };
             }
-            // First shared-key sign-in on this device: issue + persist + mirror a
-            // shared deviceToken so every native Oxy app joins one DeviceSession.
-            // Best-effort — never fail the sign-in over device-token issuance.
-            try {
-                const existing = await KeyManager.getSharedDeviceToken();
-                if (!existing) {
-                    const deviceToken = await oxy.issueNativeDeviceToken();
-                    await store.saveDeviceToken(deviceToken);
-                    await KeyManager.setSharedDeviceToken(deviceToken);
-                }
-            }
-            catch (error) {
-                logger.debug('Native deviceToken issuance skipped', { component: 'coldBootV2', method: 'shared-key-signin' }, error);
-            }
             return {
                 kind: 'session',
                 session: {
@@ -344,81 +116,6 @@ export async function runSessionColdBoot(opts) {
             };
         },
     });
-    // 4. bootstrap-hop (web, terminal) — same-apex inline fetch OR cross-apex nav.
-    steps.push({
-        id: 'bootstrap-hop',
-        enabled: () => isWeb && !deviceKnownSignedOut,
-        run: async () => {
-            const pageHost = dom.getLocationHostname();
-            let apiHost = null;
-            try {
-                apiHost = new URL(oxy.getBaseURL()).hostname;
-            }
-            catch {
-                apiHost = null;
-            }
-            if (!pageHost || !apiHost) {
-                return { kind: 'skip' };
-            }
-            // Same-apex: inline credentialed fetch, no redirect, runs every boot.
-            if (isSameApex(pageHost, apiHost)) {
-                const result = await oxy.requestWebSession();
-                // The rotated deviceToken is on BOTH arms (it is device-level, not
-                // session-level) — persist it before branching on the session.
-                await store.saveDeviceToken(result.deviceToken);
-                if (result.reason === 'session') {
-                    const bundle = result.session;
-                    const userId = resolveUserId(bundle.user);
-                    if (!userId) {
-                        return { kind: 'skip' };
-                    }
-                    const next = {
-                        sessionId: bundle.sessionId,
-                        refreshToken: bundle.refreshToken,
-                        userId,
-                        deviceToken: result.deviceToken,
-                        accessToken: bundle.accessToken,
-                        expiresAt: bundle.expiresAt,
-                    };
-                    // Phase 2c: the web-session bundle may carry a rotating `deviceSecret`
-                    // but NOT a deviceId. Persist the secret and carry any prior deviceId
-                    // (from a deviceId-bearing login lane) forward so the mint lane stays
-                    // usable — this overwrite must not orphan it.
-                    const prior = await store.load();
-                    if (prior?.deviceId) {
-                        next.deviceId = prior.deviceId;
-                    }
-                    // Prefer the bundle's secret (the server just rotated onto it); keep the
-                    // prior one when the bundle omits it — this lane also runs as the
-                    // TRANSIENT-mint fallback, and must not orphan a still-valid secret.
-                    const carriedSecret = bundle.deviceSecret ?? prior?.deviceSecret;
-                    if (carriedSecret) {
-                        next.deviceSecret = carriedSecret;
-                    }
-                    await store.save(next);
-                    oxy.setTokens(bundle.accessToken);
-                    return { kind: 'session', session: sessionFromPersisted(next, bundle.accessToken) };
-                }
-                // Known device, signed out.
-                signedOutReason = result.reason;
-                return { kind: 'skip' };
-            }
-            // Cross-apex: ONE visible top-level navigation, once-ever per origin.
-            if (dom.getLocalItem(BOOT_ATTEMPTED_KEY)) {
-                return { kind: 'skip' };
-            }
-            const returnTo = opts.returnTo ?? dom.getReturnToHref();
-            if (!returnTo) {
-                return { kind: 'skip' };
-            }
-            const state = dom.randomState();
-            dom.setSessionItem(BOOT_STATE_SESSION_KEY, state);
-            dom.setLocalItem(BOOT_ATTEMPTED_KEY, '1');
-            navigating = true;
-            dom.navigate(oxy.buildBootstrapUrl(returnTo, state));
-            return { kind: 'skip' };
-        },
-    });
     const outcome = await runColdBoot({
         steps,
         onStepError: (id, error) => {
@@ -430,10 +127,6 @@ export async function runSessionColdBoot(opts) {
         await opts.onSession?.({ ...outcome.session, via: outcome.via });
         return outcome;
     }
-    // Navigating away for the cross-apex hop: the page is unloading, so do not
-    // flash a signed-out state.
-    if (!navigating) {
-        await opts.onSignedOut?.(signedOutReason);
-    }
+    await opts.onSignedOut?.(signedOutReason);
     return outcome;
 }

package/dist/esm/crypto/keyManager.js

@@ -53,11 +53,6 @@ const STORAGE_KEYS = {
     SHARED_PUBLIC_KEY: 'oxy_shared_identity_public_key',
     SHARED_SESSION_TOKEN: 'oxy_shared_session_token',
     SHARED_SESSION_ID: 'oxy_shared_session_id',
-    // Opaque device-attribution token, shared across all Oxy apps on one device
-    // so they all resolve to a SINGLE server-side DeviceSession (device-first
-    // session model). Add-only: it never carries session state, only attributes
-    // a newly-credentialed session to the shared device set.
-    SHARED_DEVICE_TOKEN: 'oxy_shared_device_token',
 };
 /**
  * iOS Keychain Access Group for sharing identities across Oxy apps
@@ -545,96 +540,6 @@ export class KeyManager {
             return false;
         }
     }
-    /**
-     * Store the opaque device-attribution token in the SHARED keychain so every
-     * Oxy app on this device reads the SAME token and therefore resolves to one
-     * server-side DeviceSession.
-     *
-     * Mirrors the shared-session storage options exactly (iOS keychain access
-     * group `group.so.oxy.shared`; Android shared secure store). Native-only —
-     * a no-op on web (the shared keychain does not exist there; web persists its
-     * deviceToken in the per-origin {@link AuthStateStore} instead).
-     */
-    static async setSharedDeviceToken(deviceToken) {
-        if (isWebPlatform()) {
-            return; // Not supported on web
-        }
-        try {
-            const store = await initSecureStore();
-            if (isIOS()) {
-                const opts = {
-                    keychainAccessible: store.WHEN_UNLOCKED,
-                    keychainAccessGroup: IOS_KEYCHAIN_GROUP,
-                };
-                await store.setItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN, deviceToken, opts);
-            }
-            else if (isAndroid()) {
-                await store.setItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN, deviceToken);
-            }
-            if (isDev()) {
-                logger.debug('Shared device token stored successfully', { component: 'KeyManager' });
-            }
-        }
-        catch (error) {
-            if (isDev()) {
-                logger.error('Failed to store shared device token', error, { component: 'KeyManager' });
-            }
-            throw error;
-        }
-    }
-    /**
-     * Read the shared device-attribution token, or `null` when none is set (or
-     * on web). Mirrors {@link getSharedSession}'s keychain-access-group read.
-     */
-    static async getSharedDeviceToken() {
-        if (isWebPlatform()) {
-            return null;
-        }
-        try {
-            const store = await initSecureStore();
-            if (isIOS()) {
-                const opts = { keychainAccessGroup: IOS_KEYCHAIN_GROUP };
-                return await store.getItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN, opts);
-            }
-            if (isAndroid()) {
-                return await store.getItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN);
-            }
-            return null;
-        }
-        catch (error) {
-            if (isDev()) {
-                logger.warn('Failed to get shared device token', { component: 'KeyManager' }, error);
-            }
-            return null;
-        }
-    }
-    /**
-     * Delete the shared device-attribution token (device signout-all). Best-effort:
-     * a keychain failure is logged, not thrown, so it cannot block a sign-out.
-     */
-    static async clearSharedDeviceToken() {
-        if (isWebPlatform()) {
-            return;
-        }
-        try {
-            const store = await initSecureStore();
-            if (isIOS()) {
-                const opts = { keychainAccessGroup: IOS_KEYCHAIN_GROUP };
-                await store.deleteItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN, opts);
-            }
-            else if (isAndroid()) {
-                await store.deleteItemAsync(STORAGE_KEYS.SHARED_DEVICE_TOKEN);
-            }
-            if (isDev()) {
-                logger.debug('Shared device token cleared successfully', { component: 'KeyManager' });
-            }
-        }
-        catch (error) {
-            if (isDev()) {
-                logger.error('Failed to clear shared device token', error, { component: 'KeyManager' });
-            }
-        }
-    }
     // ==================== END SHARED IDENTITY METHODS ====================
     /**
      * Atomically persist a key pair to secure storage with verification + backup.

package/dist/esm/index.js

@@ -156,19 +156,15 @@ export { projectSwitchableAccounts, switchableAccountIds, } from './session/acco
 // for the uniform switch and the existing device-flow methods for sign-in.
 export { AccountDialogController, createAccountDialogController, } from './session/accountDialogController.js';
 // ---------------------------------------------------------------------------
-// Device-first session machinery (auth centralization, wave 1) — additive.
-// Persisted auth-state store, the unified refresh handler + scheduler, the
-// cold-boot v2 runner, and the device-boot return-fragment consumer. Built ON
-// the existing `runColdBoot` primitive + `SessionClient`; the legacy
-// FedCM/SSO/CrossDomainAuth surface is untouched (cutover happens in F4).
+// Device-first session machinery (zero-cookie transport).
+// Persisted auth-state store, the unified re-mint handler + scheduler, and the
+// cold-boot runner. Built ON the `runColdBoot` primitive + `SessionClient`. The
+// device credential is `deviceId` + `deviceSecret`; the access token is re-minted
+// via `POST /session/device/token`.
 // ---------------------------------------------------------------------------
-export { createWebAuthStateStore, createNativeAuthStateStore, createMemoryAuthStateStore, AUTH_STATE_STORAGE_KEY, DEVICE_TOKEN_STORAGE_KEY, } from './session/authStateStore.js';
+export { createWebAuthStateStore, createNativeAuthStateStore, createMemoryAuthStateStore, AUTH_STATE_STORAGE_KEY, } from './session/authStateStore.js';
 export { refreshPersistedSession, createAuthRefreshHandler, installAuthRefreshHandler, startTokenRefreshScheduler, TOKEN_REFRESH_LEAD_MS, } from './session/refresh.js';
-export { runSessionColdBoot, createBrowserColdBootDom, isSameApex, BOOT_ATTEMPTED_KEY, } from './boot/coldBootV2.js';
-export { consumeDeviceBootReturn, parseDeviceBootFragment, hashHasBootFragment, BOOT_FRAGMENT_PARAM, BOOT_STATE_SESSION_KEY, } from './boot/deviceBootReturn.js';
-// The web-session result contract (`WebSessionResult`) is owned by
-// `@oxyhq/contracts` — import it directly from there; `@oxyhq/core` does not
-// re-export contract types.
+export { runSessionColdBoot } from './boot/coldBootV2.js';
 // API response contracts (request/response Zod schemas + inferred types) live in
 // `@oxyhq/contracts` — the single source of truth shared by the backend and every
 // client SDK. Import them directly from `@oxyhq/contracts`; `@oxyhq/core` does NOT

package/dist/esm/mixins/OxyServices.auth.js

@@ -791,11 +791,10 @@ export function OxyServicesAuthMixin(Base) {
          * (`{ twoFactorRequired, loginToken }`) to complete via
          * {@link completeTwoFactorSignIn}, or a session arm.
          *
-         * `options.deviceToken` attributes the new session to the caller's existing
-         * device set (so an in-app login from a cross-apex, cookie-less web app
-         * still joins the same DeviceSession). On the session arm, a returned access
-         * token is planted immediately (mirroring {@link verifyChallenge}), so the
-         * caller has an authenticated client without a second round-trip.
+         * On the session arm, a returned access token is planted immediately
+         * (mirroring {@link verifyChallenge}), so the caller has an authenticated
+         * client without a second round-trip. The response's `deviceId` +
+         * `deviceSecret` are the zero-cookie restore credential the caller persists.
          */
         async passwordSignIn(identifier, password, options = {}) {
             try {
@@ -804,7 +803,6 @@ export function OxyServicesAuthMixin(Base) {
                     password,
                     deviceName: options.deviceName,
                     deviceFingerprint: options.deviceFingerprint,
-                    deviceToken: options.deviceToken,
                 }, { cache: false });
                 const parsed = safeParseContract(loginResultSchema, res);
                 if (!parsed) {
@@ -832,7 +830,6 @@ export function OxyServicesAuthMixin(Base) {
                     loginToken: params.loginToken,
                     token: params.token,
                     backupCode: params.backupCode,
-                    deviceToken: params.deviceToken,
                     deviceName: params.deviceName,
                 }, { cache: false });
                 const parsed = safeParseContract(loginResultSchema, res);