@oxyhq/core 9.1.0 → 9.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (68) hide show
  1. package/README.md +1 -1
  2. package/dist/cjs/.tsbuildinfo +1 -1
  3. package/dist/cjs/boot/{coldBootV2.js → sessionColdBoot.js} +2 -2
  4. package/dist/cjs/index.js +23 -4
  5. package/dist/cjs/mixins/OxyServices.auth.js +61 -0
  6. package/dist/cjs/mixins/OxyServices.deviceBoot.js +29 -1
  7. package/dist/cjs/server/index.js +8 -1
  8. package/dist/cjs/session/SessionClient.js +57 -25
  9. package/dist/cjs/session/accountDialogController.js +20 -9
  10. package/dist/cjs/session/authStateStore.js +13 -7
  11. package/dist/cjs/session/hubSync.js +55 -0
  12. package/dist/cjs/session/sessionClientHost.js +5 -0
  13. package/dist/cjs/utils/coldBoot.js +1 -1
  14. package/dist/cjs/utils/oauthPkce.js +65 -1
  15. package/dist/cjs/utils/officialOrigins.js +128 -0
  16. package/dist/esm/.tsbuildinfo +1 -1
  17. package/dist/esm/boot/{coldBootV2.js → sessionColdBoot.js} +2 -2
  18. package/dist/esm/index.js +4 -2
  19. package/dist/esm/mixins/OxyServices.auth.js +61 -0
  20. package/dist/esm/mixins/OxyServices.deviceBoot.js +30 -2
  21. package/dist/esm/server/index.js +1 -0
  22. package/dist/esm/session/SessionClient.js +57 -25
  23. package/dist/esm/session/accountDialogController.js +20 -9
  24. package/dist/esm/session/authStateStore.js +13 -7
  25. package/dist/esm/session/hubSync.js +51 -0
  26. package/dist/esm/session/sessionClientHost.js +5 -0
  27. package/dist/esm/utils/coldBoot.js +1 -1
  28. package/dist/esm/utils/oauthPkce.js +60 -0
  29. package/dist/esm/utils/officialOrigins.js +119 -0
  30. package/dist/types/.tsbuildinfo +1 -1
  31. package/dist/types/boot/{coldBootV2.d.ts → sessionColdBoot.d.ts} +1 -1
  32. package/dist/types/index.d.ts +7 -4
  33. package/dist/types/mixins/OxyServices.auth.d.ts +14 -0
  34. package/dist/types/mixins/OxyServices.deviceBoot.d.ts +6 -2
  35. package/dist/types/server/index.d.ts +1 -0
  36. package/dist/types/session/SessionClient.d.ts +6 -0
  37. package/dist/types/session/accountDialogController.d.ts +9 -1
  38. package/dist/types/session/authStateStore.d.ts +1 -1
  39. package/dist/types/session/hubSync.d.ts +20 -0
  40. package/dist/types/session/sessionClientHost.d.ts +2 -1
  41. package/dist/types/utils/coldBoot.d.ts +2 -2
  42. package/dist/types/utils/oauthPkce.d.ts +27 -0
  43. package/dist/types/utils/officialOrigins.d.ts +17 -0
  44. package/package.json +2 -2
  45. package/src/boot/__tests__/{coldBootV2.test.ts → sessionColdBoot.test.ts} +1 -1
  46. package/src/boot/{coldBootV2.ts → sessionColdBoot.ts} +2 -2
  47. package/src/index.ts +27 -3
  48. package/src/mixins/OxyServices.auth.ts +70 -1
  49. package/src/mixins/OxyServices.deviceBoot.ts +46 -1
  50. package/src/server/index.ts +8 -0
  51. package/src/session/SessionClient.ts +68 -26
  52. package/src/session/__tests__/SessionClient.additive.test.ts +1 -0
  53. package/src/session/__tests__/SessionClient.broadcastChannel.test.ts +1 -0
  54. package/src/session/__tests__/SessionClient.diagnostics.test.ts +1 -0
  55. package/src/session/__tests__/SessionClient.rest.test.ts +1 -0
  56. package/src/session/__tests__/SessionClient.socket.test.ts +1 -0
  57. package/src/session/__tests__/SessionClient.socketFactory.test.ts +1 -0
  58. package/src/session/__tests__/SessionClient.state.test.ts +1 -0
  59. package/src/session/__tests__/accountDialogController.test.ts +38 -6
  60. package/src/session/__tests__/sessionIntegration.test.ts +7 -0
  61. package/src/session/accountDialogController.ts +36 -10
  62. package/src/session/authStateStore.ts +18 -9
  63. package/src/session/hubSync.ts +79 -0
  64. package/src/session/sessionClientHost.ts +10 -2
  65. package/src/utils/__tests__/officialOrigins.test.ts +74 -0
  66. package/src/utils/coldBoot.ts +2 -2
  67. package/src/utils/oauthPkce.ts +71 -0
  68. package/src/utils/officialOrigins.ts +124 -0
package/README.md CHANGED
@@ -50,7 +50,7 @@ const hasIdentity = await KeyManager.hasIdentity();
50
50
  The session authority is the server-side `DeviceSession` (one document per device: signed-in accounts + active account + revision). `@oxyhq/core` owns the whole client side of that contract:
51
51
 
52
52
  - **`SessionClient`** (`src/session/`) — reads `GET /session/device/state`, mutates via `POST /session/device/{add,switch,signout}`, and applies `session_state` socket pushes (room `device:<deviceId>`, token-free payload) so every app on the same device stays in sync.
53
- - **`runSessionColdBoot`** (`src/boot/coldBootV2.ts`) — the ordered, short-circuit cold-boot runner used by `OxyProvider`. It restores silently from device state or resolves to logged-out; it NEVER auto-redirects to a login page.
53
+ - **`runSessionColdBoot`** (`src/boot/sessionColdBoot.ts`) — the ordered, short-circuit cold-boot runner used by `OxyProvider`. It restores silently from device state or resolves to logged-out; it NEVER auto-redirects to a login page.
54
54
  - **Zero-cookie transport** — every successful sign-in returns `deviceId` + a 256-bit `deviceSecret`, which the client persists first-party (localStorage per web origin; SecureStore on native). `POST /session/device/token` mints/refreshes a short access token from `{ deviceId, deviceSecret }` (no bearer, no cookies — possession of the secret is the proof) and rotates the secret in-use. There is no cookie, no refresh-token family, and no `#oxy_boot` bootstrap hop. Full contract: [docs/auth/device-session.md](../../docs/auth/device-session.md).
55
55
 
56
56
  Consumers never build session restore themselves — mount `OxyProvider` from `@oxyhq/services` with a registered `clientId`.