@oxyhq/core 8.1.0 → 9.0.0

package/dist/esm/mixins/OxyServices.deviceBoot.js

@@ -1,119 +1,33 @@
 /**
- * Device-first bootstrap mixin (auth centralization, wave 1).
+ * Device-first token mint mixin.
  *
- * The client half of the new device-first session bootstrap: the four network
- * calls the cold boot (`coldBootV2`) and the unified refresh handler
- * (`refresh.ts`) make, plus the URL builder for the cross-apex bootstrap hop.
- * Every response is validated against the `@oxyhq/contracts` `deviceBoot`
- * schemas via `safeParseContract`, so producer (oxy-api) and consumer cannot
+ * The client half of the zero-cookie device transport: the single network call
+ * the cold boot (`coldBootV2`) and the unified re-mint handler (`refresh.ts`)
+ * make to turn a first-party `deviceId` + `deviceSecret` into a fresh access
+ * token. The response is validated against the `@oxyhq/contracts`
+ * `deviceTokenMintResponseSchema`, so producer (oxy-api) and consumer cannot
  * drift — an unexpected shape throws here rather than silently corrupting the
  * persisted store.
  *
- * These methods are ADDITIVE and carry NO persistence or token-planting side
- * effects of their own (except the bearer-authenticated calls that naturally
- * flow through `HttpService`). The cold boot / refresh handler own persistence
- * and `setTokens`, so the same network primitive can be reused from either
- * without double-planting.
+ * This method carries NO persistence or token-planting side effects of its own;
+ * the cold boot / re-mint handler own persistence and `setTokens`, so the same
+ * primitive can be reused from either without double-planting.
  */
-import { authTokenBundleSchema, tokenRefreshResponseSchema, deviceTokenIssueResponseSchema, deviceTokenMintResponseSchema, webSessionResultSchema, safeParseContract, } from '@oxyhq/contracts';
+import { deviceTokenMintResponseSchema, safeParseContract, } from '@oxyhq/contracts';
 export function OxyServicesDeviceBootMixin(Base) {
     return class extends Base {
         /**
-         * Exchange a single-use boot `code` (from the `#oxy_boot` return fragment)
-         * for a token bundle. Origin-bound + GETDEL-burned server-side.
+         * Zero-cookie mint. Present the first-party `deviceId` + `deviceSecret` to
+         * `POST /session/device/token` — NO bearer, NO cookies: possession of the
+         * secret IS the device-ownership proof. Returns a fresh short access token
+         * for the device's active account plus `nextDeviceSecret` (rotation-in-use)
+         * and the projected device-session `state`.
          *
-         * @throws if the response does not match {@link authTokenBundleSchema}.
-         */
-        async exchangeBootCode(code) {
-            try {
-                const res = await this.makeRequest('POST', '/auth/device/exchange', { code }, { cache: false });
-                const parsed = safeParseContract(authTokenBundleSchema, res);
-                if (!parsed) {
-                    throw new Error('device/exchange returned an unexpected response shape');
-                }
-                return parsed;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Same-site fast path (`*.oxy.so` apps). Reads the first-party `oxy_device`
-         * cookie via a credentialed same-origin fetch and either resolves a full
-         * session bundle or reports the device is known-but-signed-out. Never
-         * redirects.
-         *
-         * @throws if the response matches neither arm of {@link webSessionResultSchema}.
-         */
-        async requestWebSession() {
-            try {
-                const res = await this.makeRequest('POST', '/auth/device/web-session', undefined, { cache: false });
-                const parsed = safeParseContract(webSessionResultSchema, res);
-                if (!parsed) {
-                    throw new Error('device/web-session returned an unexpected response shape');
-                }
-                return parsed;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Rotate the persisted refresh-token family (web + native, one call). The
-         * caller (refresh handler / cold boot) plants + persists the rotated pair.
-         *
-         * @throws if the response does not match {@link tokenRefreshResponseSchema}.
-         */
-        async refreshWithToken(refreshToken) {
-            try {
-                const res = await this.makeRequest('POST', '/auth/refresh-token', { refreshToken }, 
-                // `skipAuth`: refresh-token is body-authenticated and is called from
-                // inside the refresh handler — sending the near-expired bearer through
-                // the preflight would deadlock. See RequestOptions.skipAuth.
-                { cache: false, skipAuth: true });
-                const parsed = safeParseContract(tokenRefreshResponseSchema, res);
-                if (!parsed) {
-                    throw new Error('auth/refresh-token returned an unexpected response shape');
-                }
-                return parsed;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Issue (or rotate) the native channel's opaque device token. Bearer-gated —
-         * the server derives the deviceId from the JWT. Native apps mirror the
-         * returned token into the shared keychain via
-         * `KeyManager.setSharedDeviceToken`.
-         *
-         * @throws if the response does not match {@link deviceTokenIssueResponseSchema}.
-         */
-        async issueNativeDeviceToken() {
-            try {
-                const res = await this.makeRequest('POST', '/auth/device/token', undefined, { cache: false });
-                const parsed = safeParseContract(deviceTokenIssueResponseSchema, res);
-                if (!parsed) {
-                    throw new Error('auth/device/token returned an unexpected response shape');
-                }
-                return parsed.deviceToken;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Zero-cookie mint (phase 2c). Present the first-party `deviceId` +
-         * `deviceSecret` to `POST /session/device/token` — NO bearer, NO cookies:
-         * possession of the secret IS the device-ownership proof. Returns a fresh
-         * short access token for the device's active account plus `nextDeviceSecret`
-         * (rotation-in-use) and the projected device-session `state`.
-         *
-         * `skipAuth` (like {@link refreshWithToken}): this call carries no bearer, so
-         * a 401 must surface DIRECTLY — never trigger `HttpService`'s 401→refresh→
-         * retry dance (which would pointlessly rotate the refresh family). The cold
-         * boot reads the 401 body (`invalid_device_secret` vs `no_active_session`) to
-         * decide whether to drop the secret and fall back or resolve signed-out.
+         * `skipAuth`: this call carries no bearer, so a 401 must surface DIRECTLY —
+         * never trigger `HttpService`'s 401→refresh→retry dance. The cold boot / re-
+         * mint handler read the 401 body (`invalid_device_secret` vs
+         * `no_active_session`) to decide whether to drop the secret and fall back or
+         * resolve signed-out.
          *
          * @throws if the response does not match {@link deviceTokenMintResponseSchema}.
          */
@@ -130,15 +44,5 @@ export function OxyServicesDeviceBootMixin(Base) {
                 throw this.handleError(error);
             }
         }
-        /**
-         * Build the top-level `GET /auth/device/bootstrap` URL for the cross-apex
-         * hop. The server validates `return_to` against the trusted-origin lane and
-         * echoes `state` back in the return fragment for CSRF verification.
-         */
-        buildBootstrapUrl(returnTo, state) {
-            const base = this.getBaseURL().replace(/\/+$/, '');
-            const params = new URLSearchParams({ return_to: returnTo, state });
-            return `${base}/auth/device/bootstrap?${params.toString()}`;
-        }
     };
 }

package/dist/esm/mixins/index.js

@@ -75,9 +75,8 @@ const MIXIN_PIPELINE = [
     // Link previews / unfurls: SDK-owned link-metadata resolution via oxy-api,
     // so apps stop scraping link metadata locally.
     OxyServicesLinksMixin,
-    // Device-first session bootstrap: the client half of the new
-    // /auth/device/* + /auth/refresh-token surface (exchange, web-session,
-    // refresh, native device-token, bootstrap-url builder).
+    // Device-first token mint: the client half of the zero-cookie transport
+    // (`mintFromDeviceSecret` → `POST /session/device/token`).
     OxyServicesDeviceBootMixin,
     // Utility (last, can use all above)
     OxyServicesUtilityMixin,

package/dist/esm/session/SessionClient.js

@@ -2,11 +2,12 @@ import { deviceSessionStateSchema, deviceSessionSyncSchema, safeParseContract, }
 import { logger } from '../utils/loggerUtils.js';
 import { getSocketIO } from './socketLoader.js';
 /**
- * Same-origin `BroadcastChannel` name for instant, network-free session wake
- * across tabs of the SAME origin (e.g. two `accounts.oxy.so` tabs). Complements
- * the cookie-authed device socket, which covers same-apex cross-origin
- * (`accounts` ↔ `console` ↔ `inbox`, all `*.oxy.so`). Cross-APEX (mention.earth)
- * is covered by neither and relies on a reload — the documented limitation.
+ * Same-origin `BroadcastChannel` name for instant, network-free session-state
+ * propagation across tabs of the SAME origin (e.g. two `accounts.oxy.so` tabs):
+ * when one authenticated tab commits an account switch / sign-out, siblings
+ * re-sync their device state without waiting on the socket. Cross-origin
+ * same-apex propagation rides the authenticated device socket; cross-APEX
+ * (mention.earth) relies on a reload — the documented limitation.
  */
 const SESSION_BROADCAST_CHANNEL = 'oxy.session';
 export class SessionClient {
@@ -18,11 +19,7 @@ export class SessionClient {
         this.socket = null;
         this.tokenUnsub = null;
         this.started = false;
-        /** In-flight guard so a burst of pushes triggers at most ONE acquisition. */
-        this.acquiring = false;
-        /** True while the live socket is an anonymous (signed-out) device connection. */
-        this.socketAnonymous = false;
-        /** Same-origin cross-tab wake channel; null on platforms without BroadcastChannel. */
+        /** Same-origin cross-tab state-propagation channel; null on platforms without BroadcastChannel. */
         this.channel = null;
     }
     getState() {
@@ -154,30 +151,20 @@ export class SessionClient {
             return;
         this.started = true;
         this.tokenUnsub = this.host.onTokensChanged((token) => {
-            if (!token)
+            // A rotated/fresh bearer landed — reconnect a dropped socket so its
+            // handshake re-runs with the current token. Sign-out (null token) is
+            // handled by the consumer calling `stop()`.
+            if (!token || !this.socket)
                 return;
-            // A bearer just landed: an in-flight acquisition (if any) succeeded — clear
-            // the guard so a later sign-out can re-acquire.
-            this.acquiring = false;
-            if (!this.socket)
-                return;
-            if (this.socketAnonymous) {
-                // The live socket was an anonymous (device-room-only) connection. Force a
-                // reconnect so the handshake re-runs authenticated and also joins the
-                // `user:<id>` notification room.
-                this.socketAnonymous = false;
-                this.socket.disconnect();
-                this.socket.connect();
-            }
-            else if (!this.socket.connected) {
+            if (!this.socket.connected) {
                 this.socket.connect();
             }
         });
         this.openBroadcastChannel();
-        // `bootstrap` (`GET /session/device/state`) is bearer-authenticated: skip it
-        // when signed out (the signed-out socket below still joins the device room to
-        // receive pushes). A bootstrap failure is non-fatal — the socket must still
-        // connect so realtime sync survives a transient state-fetch error.
+        // `bootstrap` (`GET /session/device/state`) is bearer-authenticated. A
+        // signed-out client opens no socket and runs no bootstrap; a bootstrap
+        // failure is non-fatal — the socket still connects so realtime sync
+        // survives a transient state-fetch error.
         if (this.host.getAccessToken()) {
             try {
                 await this.bootstrap();
@@ -190,8 +177,6 @@ export class SessionClient {
     }
     stop() {
         this.started = false;
-        this.acquiring = false;
-        this.socketAnonymous = false;
         if (this.tokenUnsub) {
             this.tokenUnsub();
             this.tokenUnsub = null;
@@ -222,52 +207,23 @@ export class SessionClient {
         }
         if (!this.started)
             return; // stopped while the dynamic import was in flight
-        const hasToken = Boolean(this.host.getAccessToken());
-        // Signed-out connect gate: when there is no bearer, only open the socket if
-        // the consumer supplies a device anchor (web cookie → `true`; native token →
-        // string). This lets an idle tab receive its device's `session_state` pushes
-        // and self-acquire when a sibling signs in.
-        let signedOutAuth = false;
-        if (!hasToken && this.options.signedOutSocketAuth) {
-            try {
-                signedOutAuth = await this.options.signedOutSocketAuth();
-            }
-            catch (error) {
-                logger.warn('[SessionClient] signedOutSocketAuth failed', { component: 'SessionClient' }, error);
-                signedOutAuth = false;
-            }
-            if (!this.started)
-                return; // stopped while the async gate was in flight
-        }
-        const signedOutConnect = signedOutAuth !== false && signedOutAuth != null;
-        const signedOutDeviceToken = typeof signedOutAuth === 'string' ? signedOutAuth : undefined;
-        this.socketAnonymous = !hasToken && signedOutConnect;
+        // Sockets are BEARER-ONLY: the server rejects any handshake without a valid
+        // bearer, so a signed-out client never opens a socket.
+        if (!this.host.getAccessToken())
+            return;
         const socket = io(this.host.getBaseURL(), {
             transports: ['websocket'],
-            // Send the first-party `oxy_device` cookie on the same-site handshake so a
-            // signed-out browser tab can be resolved to its device room server-side.
-            withCredentials: true,
-            autoConnect: hasToken || signedOutConnect,
+            autoConnect: true,
             auth: (cb) => {
-                const token = this.host.getAccessToken() ?? '';
-                // Present the native device token only while signed out (no bearer). Once
-                // a token is held the bearer path wins and the deviceToken is redundant.
-                cb(token || !signedOutDeviceToken ? { token } : { token, deviceToken: signedOutDeviceToken });
+                cb({ token: this.host.getAccessToken() ?? '' });
             },
         });
         socket.on('session_state', (payload) => {
             const applied = this.applyState(payload);
             if (!applied)
                 return;
-            // Signed-out tab: a session appeared on this device (a sibling signed in).
-            // Acquire it so this tab flips to signed-in; the planted token then
-            // reconnects the socket on the authenticated path.
-            if (!this.host.getAccessToken()) {
-                if ((this.state?.accounts.length ?? 0) > 0) {
-                    this.requestAcquisition();
-                }
-                return;
-            }
+            // A push changed the active account on another device/tab — re-fetch state
+            // to plant the access token for the newly-active account.
             const active = this.state?.activeAccountId ?? null;
             if (active && active !== this.host.getCurrentAccountId()) {
                 void this.bootstrap().catch((error) => {
@@ -277,35 +233,11 @@ export class SessionClient {
         });
         this.socket = socket;
     }
-    /**
-     * Run the consumer's session acquisition at most once at a time. A returned
-     * promise gates the next attempt (reset on settle), so a failed acquisition
-     * can retry on the NEXT push while a burst of identical pushes cannot pile up.
-     */
-    requestAcquisition() {
-        if (this.acquiring || !this.options.onSessionAppeared)
-            return;
-        this.acquiring = true;
-        let result;
-        try {
-            result = this.options.onSessionAppeared();
-        }
-        catch (error) {
-            this.acquiring = false;
-            logger.error('[SessionClient] onSessionAppeared threw', error);
-            return;
-        }
-        void Promise.resolve(result).catch((error) => {
-            logger.warn('[SessionClient] onSessionAppeared rejected', { component: 'SessionClient' }, error);
-        }).finally(() => {
-            this.acquiring = false;
-        });
-    }
     /**
      * Open the same-origin `BroadcastChannel` (web only). A sibling tab that
-     * commits a session posts a wake ping; on receipt a signed-in tab re-syncs its
-     * device state and a signed-out tab self-acquires — instant + network-free for
-     * the common "two tabs of the same origin" case, with no state (and no tokens)
+     * commits an account switch / sign-out posts a wake ping; on receipt an
+     * authenticated tab re-syncs its device state — instant + network-free for the
+     * common "two tabs of the same origin" case, with no state (and no tokens)
      * ever crossing the channel. No-op on native (no BroadcastChannel).
      */
     openBroadcastChannel() {
@@ -328,16 +260,13 @@ export class SessionClient {
             if (event.data.type !== 'commit')
                 return;
             // BroadcastChannel never echoes to the posting context, so this is a
-            // sibling's commit. Re-sync (signed-in) or acquire (signed-out). Neither
-            // path re-posts, so there is no cross-tab ping loop.
+            // sibling's commit. An authenticated tab re-syncs its device state; the
+            // re-sync does not re-post, so there is no cross-tab ping loop.
             if (this.host.getAccessToken()) {
                 void this.bootstrap().catch((error) => {
                     logger.warn('[SessionClient] broadcast re-sync failed', { component: 'SessionClient' }, error);
                 });
             }
-            else {
-                this.requestAcquisition();
-            }
         };
         this.channel = channel;
     }

package/dist/esm/session/accountDialogController.js

@@ -330,7 +330,6 @@ export class AccountDialogController {
                     expiresAt: result.expiresAt,
                     user: result.user,
                     accessToken: result.accessToken,
-                    ...(readRefreshToken(result) ? { refreshToken: readRefreshToken(result) } : {}),
                 }, result.user);
             }
             // Re-project + refetch immediately; the subscription also fires.
@@ -506,7 +505,6 @@ export class AccountDialogController {
             name: claimed.user.name,
             avatar: claimed.user.avatar ?? undefined,
         };
-        const refreshToken = readRefreshToken(claimed);
         try {
             await this.completeSignIn({
                 sessionId: claimed.sessionId || sessionId,
@@ -514,7 +512,6 @@ export class AccountDialogController {
                 expiresAt: claimed.expiresAt ?? '',
                 user: minimalUser,
                 accessToken: claimed.accessToken,
-                ...(refreshToken ? { refreshToken } : {}),
             }, minimalUser);
         }
         catch (error) {
@@ -604,16 +601,6 @@ export function createAccountDialogController(options) {
 // ---------------------------------------------------------------------------
 // Local helpers
 // ---------------------------------------------------------------------------
-/**
- * The rotating refresh-token family head is threaded on the runtime object by
- * the trusted device-flow / switch lanes even though it is NOT on the typed
- * return of `claimSessionByToken` / `switchToAccount`. Read it defensively so
- * the commit funnel can persist a durable session.
- */
-function readRefreshToken(value) {
-    const token = value.refreshToken;
-    return typeof token === 'string' ? token : undefined;
-}
 /** Current document URL on web; empty string where `location` is absent (native/SSR). */
 function currentLocationHref() {
     const location = globalThis.location;

package/dist/esm/session/authStateStore.js

@@ -1,12 +1,12 @@
 /**
  * Persisted auth state — ONE shape, web + native.
  *
- * The device-first session model (auth-centralization wave 1) persists the
- * rotating refresh-token family head per ORIGIN so a reload restores the
- * session locally without a redirect. This module is the storage seam: a tiny
- * `load / save / clear` interface plus platform factories, so the cold boot
- * (`coldBootV2`) and the unified refresh handler (`refresh.ts`) never touch a
- * platform storage API directly.
+ * The zero-cookie device transport persists the device credential per ORIGIN so
+ * a reload restores the session locally without a redirect: `deviceId` +
+ * `deviceSecret` mint a fresh access token via `POST /session/device/token`.
+ * This module is the storage seam: a tiny `load / save / clear` interface plus
+ * platform factories, so the cold boot (`coldBootV2`) and the unified re-mint
+ * handler (`refresh.ts`) never touch a platform storage API directly.
  *
  * Platform-agnostic — the native factory takes an INJECTED key/value store
  * (`@oxyhq/services` passes a SecureStore-backed adapter) so `@oxyhq/core`
@@ -22,12 +22,6 @@
  * `oxy_shared_*` keychain keys in `KeyManager`, so it never collides.
  */
 export const AUTH_STATE_STORAGE_KEY = 'oxy.auth.v1';
-/**
- * Storage key for the long-lived device-attribution token. Separate from
- * {@link AUTH_STATE_STORAGE_KEY} because it must OUTLIVE a session `clear()`
- * (sign-out) — the device is unchanged across sign-ins.
- */
-export const DEVICE_TOKEN_STORAGE_KEY = 'oxy.device.v1';
 /**
  * Parse + shape-validate a stored blob. Returns `null` for anything that is
  * not a well-formed {@link PersistedAuthState} (absent, malformed JSON, wrong
@@ -49,21 +43,15 @@ function deserialize(raw) {
     }
     const candidate = parsed;
     if (typeof candidate.sessionId !== 'string' ||
-        typeof candidate.refreshToken !== 'string' ||
         typeof candidate.userId !== 'string' ||
         candidate.sessionId.length === 0 ||
-        candidate.refreshToken.length === 0 ||
         candidate.userId.length === 0) {
         return null;
     }
     const state = {
         sessionId: candidate.sessionId,
-        refreshToken: candidate.refreshToken,
         userId: candidate.userId,
     };
-    if (typeof candidate.deviceToken === 'string' && candidate.deviceToken.length > 0) {
-        state.deviceToken = candidate.deviceToken;
-    }
     if (typeof candidate.deviceId === 'string' && candidate.deviceId.length > 0) {
         state.deviceId = candidate.deviceId;
     }
@@ -86,7 +74,6 @@ function deserialize(raw) {
  */
 export function createMemoryAuthStateStore() {
     let current = null;
-    let deviceToken = null;
     return {
         load: async () => current,
         save: async (state) => {
@@ -95,13 +82,6 @@ export function createMemoryAuthStateStore() {
         clear: async () => {
             current = null;
         },
-        loadDeviceToken: async () => deviceToken,
-        saveDeviceToken: async (token) => {
-            deviceToken = token;
-        },
-        clearDeviceToken: async () => {
-            deviceToken = null;
-        },
     };
 }
 /**
@@ -132,8 +112,8 @@ function safeGetLocalStorage() {
  *    for this page's lifetime — never throws on construction.
  *  - Individual `getItem`/`setItem`/`removeItem` are each wrapped: a read that
  *    throws yields `null`; a write that throws (quota, private mode) is
- *    swallowed. The persisted-refresh lane treats a failed persist as "no
- *    durable state" (falls back to the bootstrap hop) rather than crashing.
+ *    swallowed. The re-mint lane treats a failed persist as "no durable state"
+ *    rather than crashing.
  */
 export function createWebAuthStateStore() {
     const storage = safeGetLocalStorage();
@@ -145,7 +125,6 @@ export function createWebAuthStateStore() {
     // means "never written this session" → fall back to storage; any set value
     // (including `null` after clear) is authoritative and preferred over storage.
     let sessionMirror;
-    let deviceTokenMirror;
     return {
         load: async () => {
             if (sessionMirror !== undefined) {
@@ -177,35 +156,6 @@ export function createWebAuthStateStore() {
                 // Non-fatal — see save().
             }
         },
-        loadDeviceToken: async () => {
-            if (deviceTokenMirror !== undefined) {
-                return deviceTokenMirror;
-            }
-            try {
-                return storage.getItem(DEVICE_TOKEN_STORAGE_KEY);
-            }
-            catch {
-                return null;
-            }
-        },
-        saveDeviceToken: async (token) => {
-            deviceTokenMirror = token;
-            try {
-                storage.setItem(DEVICE_TOKEN_STORAGE_KEY, token);
-            }
-            catch {
-                // Non-fatal — see save().
-            }
-        },
-        clearDeviceToken: async () => {
-            deviceTokenMirror = null;
-            try {
-                storage.removeItem(DEVICE_TOKEN_STORAGE_KEY);
-            }
-            catch {
-                // Non-fatal — see save().
-            }
-        },
     };
 }
 /**
@@ -220,7 +170,6 @@ export function createNativeAuthStateStore(storage) {
     // Same in-memory mirror as the web store — a locked/failed SecureStore write
     // must not silently lose the session for the app's lifetime.
     let sessionMirror;
-    let deviceTokenMirror;
     return {
         load: async () => {
             if (sessionMirror !== undefined) {
@@ -251,34 +200,5 @@ export function createNativeAuthStateStore(storage) {
                 // Non-fatal.
             }
         },
-        loadDeviceToken: async () => {
-            if (deviceTokenMirror !== undefined) {
-                return deviceTokenMirror;
-            }
-            try {
-                return await storage.getItem(DEVICE_TOKEN_STORAGE_KEY);
-            }
-            catch {
-                return null;
-            }
-        },
-        saveDeviceToken: async (token) => {
-            deviceTokenMirror = token;
-            try {
-                await storage.setItem(DEVICE_TOKEN_STORAGE_KEY, token);
-            }
-            catch {
-                // Non-fatal.
-            }
-        },
-        clearDeviceToken: async () => {
-            deviceTokenMirror = null;
-            try {
-                await storage.removeItem(DEVICE_TOKEN_STORAGE_KEY);
-            }
-            catch {
-                // Non-fatal.
-            }
-        },
     };
 }

package/dist/esm/session/createSessionClient.js

@@ -22,15 +22,8 @@ import { createSessionClientHost } from './sessionClientHost.js';
  * specifier (bundler-fragile in Metro/Expo-web and Vite against the published
  * dist). When omitted, the client falls back to the lazy loader.
  */
-export function createSessionClient(oxyServices, transport, socketFactory, 
-/**
- * Optional signed-out realtime wiring: `signedOutSocketAuth` (open the socket
- * while signed out so an idle tab receives its device pushes) and
- * `onSessionAppeared` (self-acquire when a sibling signs in). See
- * {@link SessionClientOptions}.
- */
-extra) {
+export function createSessionClient(oxyServices, transport, socketFactory) {
     const host = createSessionClientHost(oxyServices);
-    const client = new SessionClient(host, { transport, socketFactory, ...extra });
+    const client = new SessionClient(host, { transport, socketFactory });
     return { client, host };
 }