@oxyhq/core 8.1.0 → 9.1.0

package/src/session/SessionClient.ts

@@ -36,8 +36,8 @@ export interface SessionClientOptions {
   onUnauthenticated?: () => void;
   /**
    * Statically-injected `socket.io-client` factory (its `io` export).
-   * `@oxyhq/services` and `@oxyhq/auth` list `socket.io-client` as a real
-   * dependency and pass `io` in directly, so realtime session sync never
+   * `@oxyhq/services` lists `socket.io-client` as a real dependency and
+   * passes `io` in directly, so realtime session sync never
    * depends on a runtime dynamic `import('socket.io-client')` of a bare
    * specifier — which is bundler-fragile in Metro/Expo-web and Vite when
    * `@oxyhq/core` is consumed as its published dist (the import resolves to
@@ -46,40 +46,17 @@ export interface SessionClientOptions {
    * absent it falls back to `getSocketIO()`.
    */
   socketFactory?: SocketIOFactory;
-  /**
-   * Gate + credential for opening the realtime socket while SIGNED OUT (no
-   * access token), so an idle tab still joins its `device:<id>` room and can
-   * self-acquire the moment a sibling app/tab signs in on the same device.
-   * Returns:
-   *   - `true`   → connect and rely on the first-party `oxy_device` cookie
-   *     riding the same-site handshake (web `*.oxy.so`; the cookie is HttpOnly
-   *     so JS cannot read it, but the browser sends it automatically).
-   *   - a string → connect and present it as `deviceToken` in the handshake
-   *     auth (native shared-keychain device token; RN has no cookie jar).
-   *   - `false`/`null` → do NOT open a signed-out socket (the default — e.g. a
-   *     native app with no known device yet).
-   * Called at connect time (and each reconnect); may be async (keychain read).
-   */
-  signedOutSocketAuth?: () => boolean | string | null | Promise<boolean | string | null>;
-  /**
-   * Invoked when a `session_state` push (or a same-origin BroadcastChannel wake)
-   * arrives while this tab is SIGNED OUT and the pushed device state has at
-   * least one account — i.e. a sibling just signed in on this device. The
-   * consumer runs its session acquisition (cold boot / `requestWebSession`),
-   * which plants a token and flips the tab to signed-in. Guarded + idempotent:
-   * only one acquisition runs at a time, and a returned promise gates the next.
-   */
-  onSessionAppeared?: () => void | Promise<void>;
 }
 
 type StateListener = (state: DeviceSessionState | null) => void;
 
 /**
- * Same-origin `BroadcastChannel` name for instant, network-free session wake
- * across tabs of the SAME origin (e.g. two `accounts.oxy.so` tabs). Complements
- * the cookie-authed device socket, which covers same-apex cross-origin
- * (`accounts` ↔ `console` ↔ `inbox`, all `*.oxy.so`). Cross-APEX (mention.earth)
- * is covered by neither and relies on a reload — the documented limitation.
+ * Same-origin `BroadcastChannel` name for instant, network-free session-state
+ * propagation across tabs of the SAME origin (e.g. two `accounts.oxy.so` tabs):
+ * when one authenticated tab commits an account switch / sign-out, siblings
+ * re-sync their device state without waiting on the socket. Cross-origin
+ * same-apex propagation rides the authenticated device socket; cross-APEX
+ * (mention.earth) relies on a reload — the documented limitation.
  */
 const SESSION_BROADCAST_CHANNEL = 'oxy.session';
 
@@ -96,11 +73,7 @@ export class SessionClient {
   protected socket: MinimalSocket | null = null;
   private tokenUnsub: (() => void) | null = null;
   private started = false;
-  /** In-flight guard so a burst of pushes triggers at most ONE acquisition. */
-  private acquiring = false;
-  /** True while the live socket is an anonymous (signed-out) device connection. */
-  private socketAnonymous = false;
-  /** Same-origin cross-tab wake channel; null on platforms without BroadcastChannel. */
+  /** Same-origin cross-tab state-propagation channel; null on platforms without BroadcastChannel. */
   private channel: SessionBroadcastChannel | null = null;
 
   constructor(
@@ -248,27 +221,19 @@ export class SessionClient {
     if (this.started) return;
     this.started = true;
     this.tokenUnsub = this.host.onTokensChanged((token) => {
-      if (!token) return;
-      // A bearer just landed: an in-flight acquisition (if any) succeeded — clear
-      // the guard so a later sign-out can re-acquire.
-      this.acquiring = false;
-      if (!this.socket) return;
-      if (this.socketAnonymous) {
-        // The live socket was an anonymous (device-room-only) connection. Force a
-        // reconnect so the handshake re-runs authenticated and also joins the
-        // `user:<id>` notification room.
-        this.socketAnonymous = false;
-        this.socket.disconnect();
-        this.socket.connect();
-      } else if (!this.socket.connected) {
+      // A rotated/fresh bearer landed — reconnect a dropped socket so its
+      // handshake re-runs with the current token. Sign-out (null token) is
+      // handled by the consumer calling `stop()`.
+      if (!token || !this.socket) return;
+      if (!this.socket.connected) {
         this.socket.connect();
       }
     });
     this.openBroadcastChannel();
-    // `bootstrap` (`GET /session/device/state`) is bearer-authenticated: skip it
-    // when signed out (the signed-out socket below still joins the device room to
-    // receive pushes). A bootstrap failure is non-fatal — the socket must still
-    // connect so realtime sync survives a transient state-fetch error.
+    // `bootstrap` (`GET /session/device/state`) is bearer-authenticated. A
+    // signed-out client opens no socket and runs no bootstrap; a bootstrap
+    // failure is non-fatal — the socket still connects so realtime sync
+    // survives a transient state-fetch error.
     if (this.host.getAccessToken()) {
       try {
         await this.bootstrap();
@@ -281,8 +246,6 @@ export class SessionClient {
 
   stop(): void {
     this.started = false;
-    this.acquiring = false;
-    this.socketAnonymous = false;
     if (this.tokenUnsub) {
       this.tokenUnsub();
       this.tokenUnsub = null;
@@ -312,51 +275,22 @@ export class SessionClient {
       return;
     }
     if (!this.started) return; // stopped while the dynamic import was in flight
-    const hasToken = Boolean(this.host.getAccessToken());
-
-    // Signed-out connect gate: when there is no bearer, only open the socket if
-    // the consumer supplies a device anchor (web cookie → `true`; native token →
-    // string). This lets an idle tab receive its device's `session_state` pushes
-    // and self-acquire when a sibling signs in.
-    let signedOutAuth: boolean | string | null = false;
-    if (!hasToken && this.options.signedOutSocketAuth) {
-      try {
-        signedOutAuth = await this.options.signedOutSocketAuth();
-      } catch (error) {
-        logger.warn('[SessionClient] signedOutSocketAuth failed', { component: 'SessionClient' }, error);
-        signedOutAuth = false;
-      }
-      if (!this.started) return; // stopped while the async gate was in flight
-    }
-    const signedOutConnect = signedOutAuth !== false && signedOutAuth != null;
-    const signedOutDeviceToken = typeof signedOutAuth === 'string' ? signedOutAuth : undefined;
-    this.socketAnonymous = !hasToken && signedOutConnect;
+    // Sockets are BEARER-ONLY: the server rejects any handshake without a valid
+    // bearer, so a signed-out client never opens a socket.
+    if (!this.host.getAccessToken()) return;
 
     const socket = io(this.host.getBaseURL(), {
       transports: ['websocket'],
-      // Send the first-party `oxy_device` cookie on the same-site handshake so a
-      // signed-out browser tab can be resolved to its device room server-side.
-      withCredentials: true,
-      autoConnect: hasToken || signedOutConnect,
-      auth: (cb: (data: { token: string; deviceToken?: string }) => void) => {
-        const token = this.host.getAccessToken() ?? '';
-        // Present the native device token only while signed out (no bearer). Once
-        // a token is held the bearer path wins and the deviceToken is redundant.
-        cb(token || !signedOutDeviceToken ? { token } : { token, deviceToken: signedOutDeviceToken });
+      autoConnect: true,
+      auth: (cb: (data: { token: string }) => void) => {
+        cb({ token: this.host.getAccessToken() ?? '' });
       },
     });
     socket.on('session_state', (payload: unknown) => {
       const applied = this.applyState(payload);
       if (!applied) return;
-      // Signed-out tab: a session appeared on this device (a sibling signed in).
-      // Acquire it so this tab flips to signed-in; the planted token then
-      // reconnects the socket on the authenticated path.
-      if (!this.host.getAccessToken()) {
-        if ((this.state?.accounts.length ?? 0) > 0) {
-          this.requestAcquisition();
-        }
-        return;
-      }
+      // A push changed the active account on another device/tab — re-fetch state
+      // to plant the access token for the newly-active account.
       const active = this.state?.activeAccountId ?? null;
       if (active && active !== this.host.getCurrentAccountId()) {
         void this.bootstrap().catch((error) => {
@@ -367,34 +301,11 @@ export class SessionClient {
     this.socket = socket;
   }
 
-  /**
-   * Run the consumer's session acquisition at most once at a time. A returned
-   * promise gates the next attempt (reset on settle), so a failed acquisition
-   * can retry on the NEXT push while a burst of identical pushes cannot pile up.
-   */
-  private requestAcquisition(): void {
-    if (this.acquiring || !this.options.onSessionAppeared) return;
-    this.acquiring = true;
-    let result: void | Promise<void>;
-    try {
-      result = this.options.onSessionAppeared();
-    } catch (error) {
-      this.acquiring = false;
-      logger.error('[SessionClient] onSessionAppeared threw', error);
-      return;
-    }
-    void Promise.resolve(result).catch((error) => {
-      logger.warn('[SessionClient] onSessionAppeared rejected', { component: 'SessionClient' }, error);
-    }).finally(() => {
-      this.acquiring = false;
-    });
-  }
-
   /**
    * Open the same-origin `BroadcastChannel` (web only). A sibling tab that
-   * commits a session posts a wake ping; on receipt a signed-in tab re-syncs its
-   * device state and a signed-out tab self-acquires — instant + network-free for
-   * the common "two tabs of the same origin" case, with no state (and no tokens)
+   * commits an account switch / sign-out posts a wake ping; on receipt an
+   * authenticated tab re-syncs its device state — instant + network-free for the
+   * common "two tabs of the same origin" case, with no state (and no tokens)
    * ever crossing the channel. No-op on native (no BroadcastChannel).
    */
   private openBroadcastChannel(): void {
@@ -412,14 +323,12 @@ export class SessionClient {
       if (!event || typeof event.data !== 'object' || event.data === null) return;
       if ((event.data as { type?: unknown }).type !== 'commit') return;
       // BroadcastChannel never echoes to the posting context, so this is a
-      // sibling's commit. Re-sync (signed-in) or acquire (signed-out). Neither
-      // path re-posts, so there is no cross-tab ping loop.
+      // sibling's commit. An authenticated tab re-syncs its device state; the
+      // re-sync does not re-post, so there is no cross-tab ping loop.
       if (this.host.getAccessToken()) {
         void this.bootstrap().catch((error) => {
           logger.warn('[SessionClient] broadcast re-sync failed', { component: 'SessionClient' }, error);
         });
-      } else {
-        this.requestAcquisition();
       }
     };
     this.channel = channel;

package/src/session/__tests__/SessionClient.broadcastChannel.test.ts

@@ -0,0 +1,113 @@
+/**
+ * SessionClient same-origin `BroadcastChannel` cross-tab state propagation.
+ *
+ * This is the AUTHENTICATED-only survivor of the zero-cookie cutover: when one
+ * authenticated tab commits an account switch / sign-out, same-origin siblings
+ * re-sync their device state instantly without waiting on the socket. The
+ * signed-out "self-acquire on sibling sign-in" wake is gone (sockets are now
+ * bearer-only), so every case here runs with a bearer present.
+ */
+import type { DeviceSessionState } from '@oxyhq/contracts';
+
+type Handler = (...args: unknown[]) => void;
+class FakeSocket {
+  connected = false;
+  handlers = new Map<string, Handler[]>();
+  on(event: string, cb: Handler) { const l = this.handlers.get(event) ?? []; l.push(cb); this.handlers.set(event, l); }
+  off(event: string, cb?: Handler) { if (!cb) { this.handlers.delete(event); return; } this.handlers.set(event, (this.handlers.get(event) ?? []).filter((h) => h !== cb)); }
+  connect() { this.connected = true; this.trigger('connect'); }
+  disconnect() { this.connected = false; }
+  trigger(event: string, ...args: unknown[]) { for (const h of this.handlers.get(event) ?? []) h(...args); }
+}
+let fakeSocket: FakeSocket;
+const ioMock = jest.fn((_uri: string, opts?: Record<string, unknown>) => {
+  if (!opts || opts.autoConnect !== false) fakeSocket.connected = true;
+  return fakeSocket;
+});
+jest.mock('socket.io-client', () => ({ __esModule: true, io: (...args: unknown[]) => ioMock(...(args as [string, Record<string, unknown>?])) }));
+
+// A same-name in-process BroadcastChannel bus: postMessage delivers to every
+// OTHER open channel of the same name (never the sender) — matching the spec.
+type BusEntry = { name: string; onmessage: ((event: { data: unknown }) => void) | null };
+const bus = new Set<BusEntry>();
+class FakeBroadcastChannel {
+  private entry: BusEntry;
+  constructor(public name: string) { this.entry = { name, onmessage: null }; bus.add(this.entry); }
+  get onmessage(): ((event: { data: unknown }) => void) | null { return this.entry.onmessage; }
+  set onmessage(cb: ((event: { data: unknown }) => void) | null) { this.entry.onmessage = cb; }
+  postMessage(data: unknown) {
+    for (const e of bus) {
+      if (e === this.entry || e.name !== this.name) continue;
+      e.onmessage?.({ data });
+    }
+  }
+  close() { bus.delete(this.entry); }
+}
+
+import { SessionClient, type SessionClientHost } from '../SessionClient';
+
+const STATE = (rev: number, accounts = [{ accountId: 'a1', sessionId: 's1', authuser: 0 }]): DeviceSessionState =>
+  ({ deviceId: 'd1', accounts, activeAccountId: accounts[0]?.accountId ?? null, revision: rev, updatedAt: 1720000000000 });
+const SYNC = (rev: number) => ({ state: STATE(rev), activeToken: { accessToken: `jwt-${rev}`, expiresAt: 'x' } });
+
+function makeHost(over: Partial<SessionClientHost> = {}): SessionClientHost {
+  return {
+    makeRequest: jest.fn().mockResolvedValue(SYNC(1)),
+    getBaseURL: () => 'http://test.invalid',
+    getAccessToken: () => 'tok',
+    onTokensChanged: () => () => undefined,
+    setTokens: jest.fn(),
+    getCurrentAccountId: () => 'a1',
+    ...over,
+  };
+}
+
+const flush = async () => { await Promise.resolve(); await Promise.resolve(); };
+
+beforeEach(() => {
+  fakeSocket = new FakeSocket();
+  ioMock.mockClear();
+  bus.clear();
+  (globalThis as { BroadcastChannel?: unknown }).BroadcastChannel = FakeBroadcastChannel as unknown;
+});
+afterEach(() => {
+  (globalThis as { BroadcastChannel?: unknown }).BroadcastChannel = undefined;
+});
+
+describe('SessionClient BroadcastChannel cross-tab re-sync (authenticated)', () => {
+  it('a local mutation wakes an authenticated same-origin sibling to re-sync (bootstrap)', async () => {
+    const bMakeRequest = jest.fn().mockResolvedValue(SYNC(1));
+    const b = new SessionClient(makeHost({ makeRequest: bMakeRequest, getAccessToken: () => 'tok-b' }), {});
+    await b.start();
+    bMakeRequest.mockClear();
+    const a = new SessionClient(makeHost({ getAccessToken: () => 'tok-a' }), {});
+    await a.start();
+    await a.addCurrentAccount();
+    await flush();
+    expect(bMakeRequest).toHaveBeenCalledWith('GET', '/session/device/state', undefined, { cache: false });
+    a.stop();
+    b.stop();
+  });
+
+  it('does not re-sync the posting tab from its own commit ping (no self-loop)', async () => {
+    const makeRequest = jest.fn().mockResolvedValue(SYNC(1));
+    const a = new SessionClient(makeHost({ makeRequest, getAccessToken: () => 'tok-a' }), {});
+    await a.start();
+    makeRequest.mockClear();
+    // `addCurrentAccount` POSTs then posts a commit ping; the ping never echoes
+    // to the sender, so this tab must NOT re-fetch its own device state.
+    await a.addCurrentAccount();
+    await flush();
+    expect(makeRequest).not.toHaveBeenCalledWith('GET', '/session/device/state', undefined, { cache: false });
+    a.stop();
+  });
+
+  it('is a no-op on platforms without BroadcastChannel (native)', async () => {
+    (globalThis as { BroadcastChannel?: unknown }).BroadcastChannel = undefined;
+    const c = new SessionClient(makeHost({ getAccessToken: () => 'tok' }), {});
+    await c.start();
+    // Mutations must not throw when BroadcastChannel is absent.
+    await expect(c.switchAccount('a1')).resolves.toBeUndefined();
+    c.stop();
+  });
+});

package/src/session/__tests__/SessionClient.socket.test.ts

@@ -105,21 +105,21 @@ describe('SessionClient socket', () => {
     c.stop();
   });
 
-  it('does not connect the socket when there is no token (autoConnect false)', async () => {
+  it('does not open a socket at all when signed out (bearer-only)', async () => {
     const c = new SessionClient(makeHost({ getAccessToken: () => null }));
     await c.start();
-    const [, opts] = ioMock.mock.calls[0];
-    expect(opts?.autoConnect).toBe(false);
+    expect(ioMock).not.toHaveBeenCalled();
     c.stop();
   });
 
-  it('reconnects when a token arrives after being disconnected', async () => {
-    let tokenListener: ((t: string | null) => void) | null = null;
-    const host = makeHost({ getAccessToken: () => null, onTokensChanged: (l) => { tokenListener = l; return () => undefined; } });
+  it('reconnects an existing socket when a fresh token arrives after a transient drop', async () => {
+    const listeners: Array<(t: string | null) => void> = [];
+    const host = makeHost({ onTokensChanged: (l) => { listeners.push(l); return () => undefined; } });
     const c = new SessionClient(host);
     await c.start();
-    fakeSocket.connected = false;
-    tokenListener?.('fresh-token');
+    expect(fakeSocket.connected).toBe(true); // authenticated connect on start
+    fakeSocket.connected = false; // simulate a transient socket drop
+    listeners.forEach((l) => l('fresh-token'));
     expect(fakeSocket.connected).toBe(true);
     c.stop();
   });

package/src/session/__tests__/authStateStore.test.ts

@@ -3,16 +3,18 @@ import {
   createNativeAuthStateStore,
   createMemoryAuthStateStore,
   AUTH_STATE_STORAGE_KEY,
-  DEVICE_TOKEN_STORAGE_KEY,
   type PersistedAuthState,
   type NativeKeyValueStorage,
 } from '../authStateStore';
 
+/**
+ * The zero-cookie persisted shape: `sessionId` + `userId` are the only required
+ * fields; `deviceId` / `deviceSecret` (the mint credential) and
+ * `accessToken` / `expiresAt` (warm-boot) are all optional round-trip fields.
+ */
 const SAMPLE: PersistedAuthState = {
   sessionId: 's-1',
-  refreshToken: 'r-abcdefghijklmnop',
   userId: 'u-1',
-  deviceToken: 'd-1234567890',
   accessToken: 'a-jwt',
   expiresAt: '2030-01-01T00:00:00.000Z',
 };
@@ -65,7 +67,7 @@ describe('createWebAuthStateStore', () => {
     expect(await store.load()).toEqual(SAMPLE);
   });
 
-  it('round-trips the optional phase-2c deviceId + deviceSecret', async () => {
+  it('round-trips the optional deviceId + deviceSecret mint credential', async () => {
     installLocalStorage(makeFakeStorage());
     const store = createWebAuthStateStore();
     const withCreds: PersistedAuthState = { ...SAMPLE, deviceId: 'dev-abc', deviceSecret: 'ds-secret-xyz' };
@@ -77,53 +79,47 @@ describe('createWebAuthStateStore', () => {
     expect(loaded).toEqual(withCreds);
   });
 
-  it('deserializes a legacy blob with no device credentials (additive — fields absent)', async () => {
+  it('deserializes a minimal blob with no device credentials (fields absent)', async () => {
     const storage = makeFakeStorage();
     installLocalStorage(storage);
     const store = createWebAuthStateStore();
 
-    storage.setItem(
-      AUTH_STATE_STORAGE_KEY,
-      JSON.stringify({ sessionId: 's-1', refreshToken: 'r-abcdefghijklmnop', userId: 'u-1' }),
-    );
+    storage.setItem(AUTH_STATE_STORAGE_KEY, JSON.stringify({ sessionId: 's-1', userId: 'u-1' }));
     const loaded = await store.load();
-    expect(loaded).not.toBeNull();
+    expect(loaded).toEqual({ sessionId: 's-1', userId: 'u-1' });
     expect(loaded && 'deviceId' in loaded).toBe(false);
     expect(loaded && 'deviceSecret' in loaded).toBe(false);
+    expect(loaded && 'accessToken' in loaded).toBe(false);
   });
 
-  it('clear() wipes the session but the deviceToken survives', async () => {
+  it('clear() wipes the persisted session', async () => {
     installLocalStorage(makeFakeStorage());
     const store = createWebAuthStateStore();
 
-    await store.save(SAMPLE);
-    await store.saveDeviceToken('device-token-xyz');
+    await store.save({ ...SAMPLE, deviceId: 'dev-abc', deviceSecret: 'ds-secret-xyz' });
     await store.clear();
 
     expect(await store.load()).toBeNull();
-    expect(await store.loadDeviceToken()).toBe('device-token-xyz');
   });
 
-  it('persists the deviceToken under a separate long-lived key', async () => {
+  it('returns null for malformed JSON or a blob missing a required field', async () => {
     const storage = makeFakeStorage();
     installLocalStorage(storage);
     const store = createWebAuthStateStore();
 
-    await store.saveDeviceToken('dt');
-    expect(storage.getItem(DEVICE_TOKEN_STORAGE_KEY)).toBe('dt');
-    await store.clearDeviceToken();
-    expect(await store.loadDeviceToken()).toBeNull();
-  });
+    storage.setItem(AUTH_STATE_STORAGE_KEY, 'not-json');
+    expect(await store.load()).toBeNull();
 
-  it('returns null for a malformed or incomplete blob', async () => {
-    const storage = makeFakeStorage();
-    installLocalStorage(storage);
-    const store = createWebAuthStateStore();
+    // Missing userId → invalid.
+    storage.setItem(AUTH_STATE_STORAGE_KEY, JSON.stringify({ sessionId: 's' }));
+    expect(await store.load()).toBeNull();
 
-    storage.setItem(AUTH_STATE_STORAGE_KEY, 'not-json');
+    // Missing sessionId → invalid.
+    storage.setItem(AUTH_STATE_STORAGE_KEY, JSON.stringify({ userId: 'u' }));
     expect(await store.load()).toBeNull();
 
-    storage.setItem(AUTH_STATE_STORAGE_KEY, JSON.stringify({ sessionId: 's', userId: 'u' }));
+    // Empty required strings → invalid.
+    storage.setItem(AUTH_STATE_STORAGE_KEY, JSON.stringify({ sessionId: '', userId: '' }));
     expect(await store.load()).toBeNull();
   });
 
@@ -141,23 +137,16 @@ describe('createWebAuthStateStore', () => {
     expect(await store.load()).toEqual(SAMPLE);
   });
 
-  it('swallows a write that throws (quota / private mode) without rejecting', async () => {
+  it('swallows a write that throws (quota / private mode) without rejecting, and the mirror keeps the session live', async () => {
     installLocalStorage(makeFakeStorage({ throwOnSet: true }));
     const store = createWebAuthStateStore();
+    const withCreds: PersistedAuthState = { ...SAMPLE, deviceId: 'dev-abc', deviceSecret: 'ds-secret-xyz' };
 
-    await expect(store.save(SAMPLE)).resolves.toBeUndefined();
+    await expect(store.save(withCreds)).resolves.toBeUndefined();
     // The write never reached storage...
     expect(localStorage.getItem(AUTH_STATE_STORAGE_KEY)).toBeNull();
-    // ...but the in-memory mirror keeps the session live for this page's lifetime.
-    expect(await store.load()).toEqual(SAMPLE);
-  });
-
-  it('the mirror keeps the deviceToken live when the write throws', async () => {
-    installLocalStorage(makeFakeStorage({ throwOnSet: true }));
-    const store = createWebAuthStateStore();
-
-    await store.saveDeviceToken('dt-mirrored');
-    expect(await store.loadDeviceToken()).toBe('dt-mirrored');
+    // ...but the in-memory mirror keeps the session (incl. the mint credential) live.
+    expect(await store.load()).toEqual(withCreds);
   });
 
   it('a cleared session reads null even if storage later holds a stale blob (mirror wins)', async () => {
@@ -198,13 +187,11 @@ describe('createNativeAuthStateStore', () => {
     expect(await store.load()).toEqual(SAMPLE);
   });
 
-  it('deviceToken survives a session clear', async () => {
+  it('clear() wipes the persisted session', async () => {
     const store = createNativeAuthStateStore(makeNativeStorage());
-    await store.save(SAMPLE);
-    await store.saveDeviceToken('dt-native');
+    await store.save({ ...SAMPLE, deviceId: 'dev-1', deviceSecret: 'ds-1' });
     await store.clear();
     expect(await store.load()).toBeNull();
-    expect(await store.loadDeviceToken()).toBe('dt-native');
   });
 
   it('keeps the session live via the mirror when the injected storage throws (locked keychain)', async () => {