@oxyhq/core 9.1.0 → 9.2.1

package/dist/cjs/boot/{coldBootV2.js → sessionColdBoot.js}

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runSessionColdBoot = runSessionColdBoot;
 /**
- * coldBootV2 — one device-first cold boot for every consumer.
+ * Device-first session cold boot for every consumer.
  *
  * On a fresh page load / app launch this resolves the device's session in a
  * deterministic order, built on the pure `runColdBoot` primitive. It NEVER
@@ -95,7 +95,7 @@ async function runSessionColdBoot(opts) {
                     return { kind: 'skip' };
                 }
                 // Transient (network / 5xx): keep the secret; a later attempt can succeed.
-                loggerUtils_1.logger.debug('device-secret mint failed (transient) — keeping secret', { component: 'coldBootV2', method: 'device-secret-mint' }, error);
+                loggerUtils_1.logger.debug('device-secret mint failed (transient) — keeping secret', { component: 'sessionColdBoot', method: 'device-secret-mint' }, error);
                 return { kind: 'skip' };
             }
         },
@@ -109,6 +109,19 @@ async function runSessionColdBoot(opts) {
             if (!session?.accessToken) {
                 return { kind: 'skip' };
             }
+            // `verifyChallenge` mints a rotating deviceSecret; persist it so the next
+            // boot can use the faster device-secret-mint lane (sockets + tab-focus
+            // re-mint depend on the credential being in the store).
+            if (session.deviceId && session.deviceSecret) {
+                await store.save({
+                    sessionId: session.sessionId,
+                    userId: session.user.id,
+                    deviceId: session.deviceId,
+                    deviceSecret: session.deviceSecret,
+                    accessToken: session.accessToken,
+                    expiresAt: session.expiresAt,
+                });
+            }
             return {
                 kind: 'session',
                 session: {

package/dist/cjs/index.js

@@ -18,10 +18,10 @@
  * If a symbol does not appear here, it is NOT part of the public API.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.isRTLLocale = exports.normalizeLanguageCode = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.RecoveryPhraseService = exports.SignatureService = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.verifyPublicCardAttestation = exports.parseAttestPayload = exports.parseIdPayload = exports.buildUserDid = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.ServiceCredentialMismatchError = exports.oxyClient = exports.OXY_CLOUD_URL = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.OxyServices = void 0;
-exports.isValidPassword = exports.isValidUsername = exports.isValidEmail = exports.PASSWORD_REGEX = exports.USERNAME_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.translate = exports.createDebugLogger = exports.debugError = exports.debugWarn = exports.debugLog = exports.isDev = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = void 0;
-exports.AccountDialogController = exports.switchableAccountIds = exports.projectSwitchableAccounts = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.runColdBoot = exports.CENTRAL_IDP_APEX = exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.logPerformance = exports.logPayment = exports.logDevice = exports.logUser = exports.logSession = exports.logApi = exports.logAuth = exports.LogLevel = exports.logger = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.isValidDisplayName = void 0;
-exports.packageInfo = exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshPersistedSession = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = void 0;
+exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.isRTLLocale = exports.normalizeLanguageCode = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.RecoveryPhraseService = exports.SignatureService = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.verifyPublicCardAttestation = exports.parseAttestPayload = exports.parseIdPayload = exports.buildUserDid = exports.ORGANIZATION_CATEGORIES = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.ServiceCredentialMismatchError = exports.oxyClient = exports.OXY_CLOUD_URL = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.OxyServices = void 0;
+exports.isValidUsername = exports.isValidEmail = exports.PASSWORD_REGEX = exports.USERNAME_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.translate = exports.createDebugLogger = exports.debugError = exports.debugWarn = exports.debugLog = exports.isDev = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = void 0;
+exports.buildIdpHubOrigin = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.normalizeOAuthRedirectUri = exports.OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY = exports.OXY_SILENT_OAUTH_ATTEMPTED_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.runColdBoot = exports.CENTRAL_IDP_APEX = exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.logPerformance = exports.logPayment = exports.logDevice = exports.logUser = exports.logSession = exports.logApi = exports.logAuth = exports.LogLevel = exports.logger = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.isValidDisplayName = exports.isValidPassword = void 0;
+exports.packageInfo = exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshPersistedSession = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.switchableAccountIds = exports.projectSwitchableAccounts = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.redeemHubTicketOnHub = exports.syncHubAfterSignIn = exports.parseHubSyncReturnUrl = exports.normalizeOfficialReturnOrigin = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isIdpHubOrigin = exports.buildHubSyncUrl = void 0;
 // Ensure crypto polyfills are loaded before anything else
 require("./crypto/polyfill");
 // ---------------------------------------------------------------------------
@@ -53,6 +53,8 @@ Object.defineProperty(exports, "getCanonicalUserHandle", { enumerable: true, get
 Object.defineProperty(exports, "getNormalizedUserHandle", { enumerable: true, get: function () { return userHandle_1.getNormalizedUserHandle; } });
 var profileLinks_1 = require("./utils/profileLinks");
 Object.defineProperty(exports, "normalizeProfileLinks", { enumerable: true, get: function () { return profileLinks_1.normalizeProfileLinks; } });
+var OxyServices_accounts_1 = require("./mixins/OxyServices.accounts");
+Object.defineProperty(exports, "ORGANIZATION_CATEGORIES", { enumerable: true, get: function () { return OxyServices_accounts_1.ORGANIZATION_CATEGORIES; } });
 // ---------------------------------------------------------------------------
 // Self-sovereign identity (DID, signed records, auth-method ↔ VM mapping,
 // verified domains). Wire shapes (DidDocument, SignedRecordEnvelope,
@@ -278,6 +280,25 @@ Object.defineProperty(exports, "generateOAuthState", { enumerable: true, get: fu
 Object.defineProperty(exports, "generatePkcePair", { enumerable: true, get: function () { return oauthPkce_1.generatePkcePair; } });
 Object.defineProperty(exports, "DEFAULT_OAUTH_SCOPE", { enumerable: true, get: function () { return oauthPkce_1.DEFAULT_OAUTH_SCOPE; } });
 Object.defineProperty(exports, "OXY_AUTHORIZE_URL", { enumerable: true, get: function () { return oauthPkce_1.OXY_AUTHORIZE_URL; } });
+Object.defineProperty(exports, "OXY_OAUTH_STATE_STORAGE_KEY", { enumerable: true, get: function () { return oauthPkce_1.OXY_OAUTH_STATE_STORAGE_KEY; } });
+Object.defineProperty(exports, "OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY", { enumerable: true, get: function () { return oauthPkce_1.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY; } });
+Object.defineProperty(exports, "OXY_SILENT_OAUTH_ATTEMPTED_KEY", { enumerable: true, get: function () { return oauthPkce_1.OXY_SILENT_OAUTH_ATTEMPTED_KEY; } });
+Object.defineProperty(exports, "OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY", { enumerable: true, get: function () { return oauthPkce_1.OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY; } });
+Object.defineProperty(exports, "normalizeOAuthRedirectUri", { enumerable: true, get: function () { return oauthPkce_1.normalizeOAuthRedirectUri; } });
+Object.defineProperty(exports, "persistOAuthHandshake", { enumerable: true, get: function () { return oauthPkce_1.persistOAuthHandshake; } });
+Object.defineProperty(exports, "readOAuthHandshake", { enumerable: true, get: function () { return oauthPkce_1.readOAuthHandshake; } });
+Object.defineProperty(exports, "clearOAuthHandshake", { enumerable: true, get: function () { return oauthPkce_1.clearOAuthHandshake; } });
+var officialOrigins_1 = require("./utils/officialOrigins");
+Object.defineProperty(exports, "buildIdpHubOrigin", { enumerable: true, get: function () { return officialOrigins_1.buildIdpHubOrigin; } });
+Object.defineProperty(exports, "buildHubSyncUrl", { enumerable: true, get: function () { return officialOrigins_1.buildHubSyncUrl; } });
+Object.defineProperty(exports, "isIdpHubOrigin", { enumerable: true, get: function () { return officialOrigins_1.isIdpHubOrigin; } });
+Object.defineProperty(exports, "isOfficialWebOrigin", { enumerable: true, get: function () { return officialOrigins_1.isOfficialWebOrigin; } });
+Object.defineProperty(exports, "isAllowedDeviceJoinOrigin", { enumerable: true, get: function () { return officialOrigins_1.isAllowedDeviceJoinOrigin; } });
+Object.defineProperty(exports, "normalizeOfficialReturnOrigin", { enumerable: true, get: function () { return officialOrigins_1.normalizeOfficialReturnOrigin; } });
+Object.defineProperty(exports, "parseHubSyncReturnUrl", { enumerable: true, get: function () { return officialOrigins_1.parseHubSyncReturnUrl; } });
+var hubSync_1 = require("./session/hubSync");
+Object.defineProperty(exports, "syncHubAfterSignIn", { enumerable: true, get: function () { return hubSync_1.syncHubAfterSignIn; } });
+Object.defineProperty(exports, "redeemHubTicketOnHub", { enumerable: true, get: function () { return hubSync_1.redeemHubTicketOnHub; } });
 // ---------------------------------------------------------------------------
 // Session sync (device-scoped multi-account session client)
 // ---------------------------------------------------------------------------
@@ -330,8 +351,8 @@ Object.defineProperty(exports, "createAuthRefreshHandler", { enumerable: true, g
 Object.defineProperty(exports, "installAuthRefreshHandler", { enumerable: true, get: function () { return refresh_1.installAuthRefreshHandler; } });
 Object.defineProperty(exports, "startTokenRefreshScheduler", { enumerable: true, get: function () { return refresh_1.startTokenRefreshScheduler; } });
 Object.defineProperty(exports, "TOKEN_REFRESH_LEAD_MS", { enumerable: true, get: function () { return refresh_1.TOKEN_REFRESH_LEAD_MS; } });
-var coldBootV2_1 = require("./boot/coldBootV2");
-Object.defineProperty(exports, "runSessionColdBoot", { enumerable: true, get: function () { return coldBootV2_1.runSessionColdBoot; } });
+var sessionColdBoot_1 = require("./boot/sessionColdBoot");
+Object.defineProperty(exports, "runSessionColdBoot", { enumerable: true, get: function () { return sessionColdBoot_1.runSessionColdBoot; } });
 // API response contracts (request/response Zod schemas + inferred types) live in
 // `@oxyhq/contracts` — the single source of truth shared by the backend and every
 // client SDK. Import them directly from `@oxyhq/contracts`; `@oxyhq/core` does NOT

package/dist/cjs/mixins/OxyServices.accounts.js

@@ -1,8 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ORGANIZATION_CATEGORIES = void 0;
 exports.OxyServicesAccountsMixin = OxyServicesAccountsMixin;
 const userIdentity_1 = require("../utils/userIdentity");
 const mixinHelpers_1 = require("./mixinHelpers");
+var contracts_1 = require("@oxyhq/contracts");
+Object.defineProperty(exports, "ORGANIZATION_CATEGORIES", { enumerable: true, get: function () { return contracts_1.ORGANIZATION_CATEGORIES; } });
 function OxyServicesAccountsMixin(Base) {
     return class extends Base {
         constructor(...args) {

package/dist/cjs/mixins/OxyServices.auth.js

@@ -808,6 +808,7 @@ function OxyServicesAuthMixin(Base) {
                     password,
                     deviceName: options.deviceName,
                     deviceFingerprint: options.deviceFingerprint,
+                    ...(options.deviceId ? { deviceId: options.deviceId } : {}),
                 }, { cache: false });
                 const parsed = (0, contracts_1.safeParseContract)(contracts_1.loginResultSchema, res);
                 if (!parsed) {
@@ -836,6 +837,7 @@ function OxyServicesAuthMixin(Base) {
                     token: params.token,
                     backupCode: params.backupCode,
                     deviceName: params.deviceName,
+                    ...(params.deviceId ? { deviceId: params.deviceId } : {}),
                 }, { cache: false });
                 const parsed = (0, contracts_1.safeParseContract)(contracts_1.loginResultSchema, res);
                 if (!parsed || 'twoFactorRequired' in parsed) {
@@ -850,5 +852,64 @@ function OxyServicesAuthMixin(Base) {
                 throw this.handleError(error);
             }
         }
+        /**
+         * Exchange an OAuth authorization code (returned to the RP redirect URI
+         * after password sign-in at auth.oxy.so) for a device-first session.
+         * Public first-party clients use PKCE (`codeVerifier`); the access token is
+         * planted immediately on success.
+         */
+        async exchangeOAuthCode(params) {
+            try {
+                const res = await this.makeRequest('POST', '/auth/oauth/token', {
+                    code: params.code,
+                    clientId: params.clientId,
+                    redirectUri: params.redirectUri,
+                    codeVerifier: params.codeVerifier,
+                }, { cache: false });
+                const payload = res.data ??
+                    res;
+                if (!payload || typeof payload !== 'object') {
+                    throw new Error('auth/oauth/token returned an unexpected response shape');
+                }
+                const record = payload;
+                const accessToken = (record.access_token ?? record.accessToken);
+                const sessionId = (record.session_id ?? record.sessionId);
+                const deviceId = (record.deviceId ?? record.device_id);
+                const deviceSecret = (record.deviceSecret ?? record.device_secret);
+                const userRaw = record.user;
+                if (!sessionId || !deviceId || !userRaw || typeof userRaw !== 'object') {
+                    throw new Error('auth/oauth/token returned an incomplete session payload');
+                }
+                const userObj = userRaw;
+                const userId = userObj.id;
+                if (!userId) {
+                    throw new Error('auth/oauth/token returned a session without user.id');
+                }
+                const expiresInSec = typeof record.expires_in === 'number'
+                    ? record.expires_in
+                    : typeof record.expiresIn === 'number'
+                        ? record.expiresIn
+                        : 15 * 60;
+                const expiresAt = new Date(Date.now() + expiresInSec * 1000).toISOString();
+                if (accessToken) {
+                    this.setTokens(accessToken);
+                }
+                return {
+                    sessionId,
+                    deviceId,
+                    expiresAt,
+                    accessToken,
+                    deviceSecret,
+                    user: {
+                        id: userId,
+                        username: typeof userObj.username === 'string' ? userObj.username : undefined,
+                        avatar: typeof userObj.avatar === 'string' ? userObj.avatar : undefined,
+                    },
+                };
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
     };
 }

package/dist/cjs/mixins/OxyServices.deviceBoot.js

@@ -5,7 +5,7 @@ exports.OxyServicesDeviceBootMixin = OxyServicesDeviceBootMixin;
  * Device-first token mint mixin.
  *
  * The client half of the zero-cookie device transport: the single network call
- * the cold boot (`coldBootV2`) and the unified re-mint handler (`refresh.ts`)
+ * the cold boot (`sessionColdBoot`) and the unified re-mint handler (`refresh.ts`)
  * make to turn a first-party `deviceId` + `deviceSecret` into a fresh access
  * token. The response is validated against the `@oxyhq/contracts`
  * `deviceTokenMintResponseSchema`, so producer (oxy-api) and consumer cannot
@@ -47,5 +47,33 @@ function OxyServicesDeviceBootMixin(Base) {
                 throw this.handleError(error);
             }
         }
+        /** Mint a one-time hub sync ticket (bearer required). */
+        async issueHubTicket(returnOrigin) {
+            try {
+                const res = await this.makeRequest('POST', '/session/device/hub-ticket', { returnOrigin }, { cache: false });
+                const parsed = (0, contracts_1.safeParseContract)(contracts_1.deviceHubTicketIssueResponseSchema, res);
+                if (!parsed) {
+                    throw new Error('session/device/hub-ticket returned an unexpected response shape');
+                }
+                return parsed;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /** Redeem a hub sync ticket for a fresh device secret (public). */
+        async redeemHubTicket(ticket, returnOrigin) {
+            try {
+                const res = await this.makeRequest('POST', '/session/device/redeem-ticket', { ticket, returnOrigin }, { cache: false, skipAuth: true });
+                const parsed = (0, contracts_1.safeParseContract)(contracts_1.deviceHubTicketRedeemResponseSchema, res);
+                if (!parsed) {
+                    throw new Error('session/device/redeem-ticket returned an unexpected response shape');
+                }
+                return parsed;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
     };
 }

package/dist/cjs/server/index.js

@@ -16,7 +16,7 @@
  * ```
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.registrableApex = exports.verifySecret = exports.createOxyCors = exports.UPSTREAM_HEADERS_TIMEOUT_MS = exports.MAX_URL_LENGTH = exports.MAX_REDIRECTS = exports.DEFAULT_USER_AGENT = exports.BLOCKED_HOSTNAMES = exports.ALLOWED_PROTOCOLS = exports.ALLOWED_PORTS = exports.UpstreamError = exports.SsrfRejection = exports.safeFetch = exports.isBlockedIp = exports.assertSafePublicUrl = exports.createOxyRateLimit = exports.requireOxyAuth = exports.isOxyAuthenticated = exports.getRequiredOxyUserId = exports.getOxyUserId = exports.createOxyAuthMiddleware = exports.createOptionalOxyAuth = void 0;
+exports.parseHubSyncReturnUrl = exports.normalizeOfficialReturnOrigin = exports.isOfficialWebOrigin = exports.isIdpHubOrigin = exports.buildHubSyncUrl = exports.buildIdpHubOrigin = exports.registrableApex = exports.verifySecret = exports.createOxyCors = exports.UPSTREAM_HEADERS_TIMEOUT_MS = exports.MAX_URL_LENGTH = exports.MAX_REDIRECTS = exports.DEFAULT_USER_AGENT = exports.BLOCKED_HOSTNAMES = exports.ALLOWED_PROTOCOLS = exports.ALLOWED_PORTS = exports.UpstreamError = exports.SsrfRejection = exports.safeFetch = exports.isBlockedIp = exports.assertSafePublicUrl = exports.createOxyRateLimit = exports.requireOxyAuth = exports.isOxyAuthenticated = exports.getRequiredOxyUserId = exports.getOxyUserId = exports.createOxyAuthMiddleware = exports.createOptionalOxyAuth = void 0;
 var auth_1 = require("./auth");
 Object.defineProperty(exports, "createOptionalOxyAuth", { enumerable: true, get: function () { return auth_1.createOptionalOxyAuth; } });
 Object.defineProperty(exports, "createOxyAuthMiddleware", { enumerable: true, get: function () { return auth_1.createOxyAuthMiddleware; } });
@@ -52,3 +52,10 @@ Object.defineProperty(exports, "verifySecret", { enumerable: true, get: function
 // lets `@oxyhq/api` derive `auth.<apex>` without duplicating PSL logic.
 var registrableApex_1 = require("../utils/registrableApex");
 Object.defineProperty(exports, "registrableApex", { enumerable: true, get: function () { return registrableApex_1.registrableApex; } });
+var officialOrigins_1 = require("../utils/officialOrigins");
+Object.defineProperty(exports, "buildIdpHubOrigin", { enumerable: true, get: function () { return officialOrigins_1.buildIdpHubOrigin; } });
+Object.defineProperty(exports, "buildHubSyncUrl", { enumerable: true, get: function () { return officialOrigins_1.buildHubSyncUrl; } });
+Object.defineProperty(exports, "isIdpHubOrigin", { enumerable: true, get: function () { return officialOrigins_1.isIdpHubOrigin; } });
+Object.defineProperty(exports, "isOfficialWebOrigin", { enumerable: true, get: function () { return officialOrigins_1.isOfficialWebOrigin; } });
+Object.defineProperty(exports, "normalizeOfficialReturnOrigin", { enumerable: true, get: function () { return officialOrigins_1.normalizeOfficialReturnOrigin; } });
+Object.defineProperty(exports, "parseHubSyncReturnUrl", { enumerable: true, get: function () { return officialOrigins_1.parseHubSyncReturnUrl; } });

package/dist/cjs/session/SessionClient.js

@@ -63,21 +63,32 @@ class SessionClient {
             return false;
         }
         this.state = next;
-        this.notify();
-        if (this.options.transport) {
-            void this.options.transport.ensureActiveToken(next).catch((error) => {
+        const transport = this.options.transport;
+        const needsMintBeforeNotify = transport != null && next.accounts.length > 0 && !this.host.getAccessToken();
+        const finishApply = () => {
+            this.notify();
+            if (next.accounts.length === 0 && this.options.onUnauthenticated) {
+                try {
+                    this.options.onUnauthenticated();
+                }
+                catch (error) {
+                    loggerUtils_1.logger.error('[SessionClient] onUnauthenticated threw', error);
+                }
+            }
+        };
+        if (needsMintBeforeNotify) {
+            void transport.ensureActiveToken(next).then(finishApply).catch((error) => {
                 loggerUtils_1.logger.warn('[SessionClient] ensureActiveToken failed', { component: 'SessionClient' }, error);
+                finishApply();
             });
         }
-        // A device signout-all leaves zero accounts — tell the provider to clear
-        // the persisted store so a reload does not try to restore a dead session.
-        if (next.accounts.length === 0 && this.options.onUnauthenticated) {
-            try {
-                this.options.onUnauthenticated();
-            }
-            catch (error) {
-                loggerUtils_1.logger.error('[SessionClient] onUnauthenticated threw', error);
+        else {
+            if (transport) {
+                void transport.ensureActiveToken(next).catch((error) => {
+                    loggerUtils_1.logger.warn('[SessionClient] ensureActiveToken failed', { component: 'SessionClient' }, error);
+                });
             }
+            finishApply();
         }
         return true;
     }
@@ -155,19 +166,24 @@ class SessionClient {
         this.started = true;
         this.tokenUnsub = this.host.onTokensChanged((token) => {
             // A rotated/fresh bearer landed — reconnect a dropped socket so its
-            // handshake re-runs with the current token. Sign-out (null token) is
-            // handled by the consumer calling `stop()`.
-            if (!token || !this.socket)
+            // handshake re-runs with the current token. Sign-out (null token) keeps
+            // the device-scoped socket when a device credential is available.
+            if (!this.socket)
                 return;
-            if (!this.socket.connected) {
+            if (token) {
+                if (!this.socket.connected) {
+                    this.socket.connect();
+                }
+                return;
+            }
+            const cred = this.host.getDeviceCredential();
+            if (cred && !this.socket.connected) {
                 this.socket.connect();
             }
         });
         this.openBroadcastChannel();
-        // `bootstrap` (`GET /session/device/state`) is bearer-authenticated. A
-        // signed-out client opens no socket and runs no bootstrap; a bootstrap
-        // failure is non-fatal — the socket still connects so realtime sync
-        // survives a transient state-fetch error.
+        // Device-scoped socket: bearer when authenticated, else deviceId+deviceSecret so
+        // signed-out tabs still receive `session_state` and can mint on change.
         if (this.host.getAccessToken()) {
             try {
                 await this.bootstrap();
@@ -210,15 +226,29 @@ class SessionClient {
         }
         if (!this.started)
             return; // stopped while the dynamic import was in flight
-        // Sockets are BEARER-ONLY: the server rejects any handshake without a valid
-        // bearer, so a signed-out client never opens a socket.
-        if (!this.host.getAccessToken())
+        const token = this.host.getAccessToken();
+        const deviceCredential = this.host.getDeviceCredential();
+        if (!token && !deviceCredential)
             return;
         const socket = io(this.host.getBaseURL(), {
             transports: ['websocket'],
             autoConnect: true,
+            reconnection: true,
+            reconnectionAttempts: Infinity,
+            reconnectionDelay: 1000,
+            reconnectionDelayMax: 10000,
             auth: (cb) => {
-                cb({ token: this.host.getAccessToken() ?? '' });
+                const bearer = this.host.getAccessToken();
+                if (bearer) {
+                    cb({ token: bearer });
+                    return;
+                }
+                const cred = this.host.getDeviceCredential();
+                if (cred) {
+                    cb({ deviceId: cred.deviceId, deviceSecret: cred.deviceSecret });
+                    return;
+                }
+                cb({ token: '' });
             },
         });
         socket.on('session_state', (payload) => {
@@ -226,9 +256,11 @@ class SessionClient {
             if (!applied)
                 return;
             // A push changed the active account on another device/tab — re-fetch state
-            // to plant the access token for the newly-active account.
+            // to plant the access token for the newly-active account. When this tab is
+            // still signed out, applyState mints via ensureActiveToken first; bootstrap
+            // requires a bearer and must not run until then.
             const active = this.state?.activeAccountId ?? null;
-            if (active && active !== this.host.getCurrentAccountId()) {
+            if (active && active !== this.host.getCurrentAccountId() && this.host.getAccessToken()) {
                 void this.bootstrap().catch((error) => {
                     loggerUtils_1.logger.warn('[SessionClient] post-push token fetch failed', { component: 'SessionClient' }, error);
                 });

package/dist/cjs/session/accountDialogController.js

@@ -31,6 +31,7 @@ exports.AccountDialogController = void 0;
 exports.createAccountDialogController = createAccountDialogController;
 const loggerUtils_1 = require("../utils/loggerUtils");
 const authWebUrl_1 = require("../utils/authWebUrl");
+const oauthPkce_1 = require("../utils/oauthPkce");
 const accountProjection_1 = require("./accountProjection");
 const DEFAULT_POLL_INTERVAL_MS = 3000;
 const IDLE_SIGN_IN = {
@@ -72,6 +73,7 @@ class AccountDialogController {
         this.commitSession = options.commitSession;
         this.onSignedIn = options.onSignedIn;
         this.idpApex = options.idpApex ?? authWebUrl_1.CENTRAL_IDP_APEX;
+        this.authRedirectUri = options.authRedirectUri ?? null;
         this.pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
         this.openUrl = options.openUrl;
         this.snapshot = this.computeSnapshot();
@@ -425,18 +427,27 @@ class AccountDialogController {
      * @param params.state - Optional opaque state echoed back on return.
      * @returns The absolute auth.oxy.so sign-in URL.
      */
-    openPasswordAtOxyAuth(params = {}) {
+    async openPasswordAtOxyAuth(params = {}) {
         const base = `https://auth.${this.idpApex}`;
         const url = new URL('/login', base);
-        const returnUrl = params.returnUrl ?? currentLocationHref();
-        if (returnUrl) {
-            url.searchParams.set('redirect_uri', returnUrl);
+        const rawRedirect = params.redirectUri ??
+            this.authRedirectUri ??
+            params.returnUrl ??
+            currentLocationOrigin();
+        const redirectUri = rawRedirect ? (0, oauthPkce_1.normalizeOAuthRedirectUri)(rawRedirect) : '';
+        if (redirectUri) {
+            url.searchParams.set('redirect_uri', redirectUri);
         }
         if (this.clientId) {
             url.searchParams.set('client_id', this.clientId);
         }
-        if (params.state) {
-            url.searchParams.set('state', params.state);
+        const state = params.state ?? (await (0, oauthPkce_1.generateOAuthState)());
+        url.searchParams.set('state', state);
+        const { codeChallenge, codeVerifier } = await (0, oauthPkce_1.generatePkcePair)();
+        url.searchParams.set('code_challenge', codeChallenge);
+        url.searchParams.set('code_challenge_method', 'S256');
+        if (!(0, oauthPkce_1.persistOAuthHandshake)(state, codeVerifier)) {
+            throw new Error('Could not persist OAuth handshake for password sign-in');
         }
         const href = url.toString();
         this.openUrl?.(href);
@@ -516,6 +527,7 @@ class AccountDialogController {
                 expiresAt: claimed.expiresAt ?? '',
                 user: minimalUser,
                 accessToken: claimed.accessToken,
+                ...(claimed.deviceSecret ? { deviceSecret: claimed.deviceSecret } : {}),
             }, minimalUser);
         }
         catch (error) {
@@ -606,8 +618,8 @@ function createAccountDialogController(options) {
 // ---------------------------------------------------------------------------
 // Local helpers
 // ---------------------------------------------------------------------------
-/** Current document URL on web; empty string where `location` is absent (native/SSR). */
-function currentLocationHref() {
+/** Current document origin on web; empty string where `location` is absent (native/SSR). */
+function currentLocationOrigin() {
     const location = globalThis.location;
-    return typeof location?.href === 'string' ? location.href : '';
+    return typeof location?.origin === 'string' ? location.origin : '';
 }

package/dist/cjs/session/authStateStore.js

@@ -6,7 +6,7 @@
  * a reload restores the session locally without a redirect: `deviceId` +
  * `deviceSecret` mint a fresh access token via `POST /session/device/token`.
  * This module is the storage seam: a tiny `load / save / clear` interface plus
- * platform factories, so the cold boot (`coldBootV2`) and the unified re-mint
+ * platform factories, so the cold boot (`sessionColdBoot`) and the unified re-mint
  * handler (`refresh.ts`) never touch a platform storage API directly.
  *
  * Platform-agnostic — the native factory takes an INJECTED key/value store
@@ -48,15 +48,21 @@ function deserialize(raw) {
         return null;
     }
     const candidate = parsed;
-    if (typeof candidate.sessionId !== 'string' ||
-        typeof candidate.userId !== 'string' ||
-        candidate.sessionId.length === 0 ||
-        candidate.userId.length === 0) {
+    const hasDeviceCredential = typeof candidate.deviceId === 'string' &&
+        candidate.deviceId.length > 0 &&
+        typeof candidate.deviceSecret === 'string' &&
+        candidate.deviceSecret.length > 0;
+    const hasSessionIdentity = typeof candidate.sessionId === 'string' &&
+        typeof candidate.userId === 'string' &&
+        candidate.sessionId.length > 0 &&
+        candidate.userId.length > 0;
+    // Device-only bootstrap (post join, pre-sign-in): durable credential without session.
+    if (!hasSessionIdentity && !hasDeviceCredential) {
         return null;
     }
     const state = {
-        sessionId: candidate.sessionId,
-        userId: candidate.userId,
+        sessionId: hasSessionIdentity ? candidate.sessionId : '',
+        userId: hasSessionIdentity ? candidate.userId : '',
     };
     if (typeof candidate.deviceId === 'string' && candidate.deviceId.length > 0) {
         state.deviceId = candidate.deviceId;

package/dist/cjs/session/hubSync.js

@@ -0,0 +1,55 @@
+"use strict";
+/**
+ * Post-sign-in hub sync — plant device credentials on auth.oxy.so via a
+ * one-time server ticket (no secrets in URL fragments).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.syncHubAfterSignIn = syncHubAfterSignIn;
+exports.redeemHubTicketOnHub = redeemHubTicketOnHub;
+const officialOrigins_1 = require("../utils/officialOrigins");
+/**
+ * After a successful sign-in on an official web app, mint a hub ticket and
+ * redirect to auth.oxy.so/sync so the IdP hub can redeem it and persist the
+ * shared device credential for silent OAuth restore on other origins.
+ *
+ * No-op on native, non-official origins, and when already on the IdP hub.
+ */
+async function syncHubAfterSignIn(oxy, opts) {
+    if (opts?.enabled === false) {
+        return false;
+    }
+    if (typeof globalThis === 'undefined') {
+        return false;
+    }
+    const location = globalThis.location;
+    if (!location) {
+        return false;
+    }
+    if ((0, officialOrigins_1.isIdpHubOrigin)()) {
+        return false;
+    }
+    if (!(0, officialOrigins_1.isOfficialWebOrigin)(location.origin)) {
+        return false;
+    }
+    const hubOrigin = (0, officialOrigins_1.buildIdpHubOrigin)();
+    const issued = await oxy.issueHubTicket(hubOrigin);
+    const returnUrl = `${location.origin}${location.pathname}${location.search}`;
+    const syncUrl = (0, officialOrigins_1.buildHubSyncUrl)(issued.ticket, returnUrl);
+    window.location.assign(syncUrl);
+    return true;
+}
+/** Redeem a hub ticket on auth.oxy.so and persist credentials locally. */
+async function redeemHubTicketOnHub(oxy, store, ticket) {
+    const hubOrigin = (0, officialOrigins_1.buildIdpHubOrigin)();
+    const creds = await oxy.redeemHubTicket(ticket, hubOrigin);
+    const prior = await store.load();
+    await store.save({
+        sessionId: prior?.sessionId ?? '',
+        userId: prior?.userId ?? '',
+        deviceId: creds.deviceId,
+        deviceSecret: creds.deviceSecret,
+        ...(prior?.accessToken ? { accessToken: prior.accessToken } : {}),
+        ...(prior?.expiresAt ? { expiresAt: prior.expiresAt } : {}),
+    });
+    return true;
+}

package/dist/cjs/session/sessionClientHost.js

@@ -15,15 +15,20 @@ exports.createSessionClientHost = createSessionClientHost;
  */
 function createSessionClientHost(oxyServices) {
     let currentAccountId = null;
+    let deviceCredential = null;
     return {
         makeRequest: (method, url, data, options) => oxyServices.makeRequest(method, url, data, options),
         getBaseURL: () => oxyServices.getBaseURL(),
         getAccessToken: () => oxyServices.getAccessToken(),
+        getDeviceCredential: () => deviceCredential,
         onTokensChanged: (listener) => oxyServices.onTokensChanged(listener),
         setTokens: (accessToken) => oxyServices.setTokens(accessToken),
         getCurrentAccountId: () => currentAccountId,
         setCurrentAccountId: (id) => {
             currentAccountId = id;
         },
+        setDeviceCredential: (credential) => {
+            deviceCredential = credential;
+        },
     };
 }

package/dist/cjs/utils/coldBoot.js

@@ -17,7 +17,7 @@
  *     web bundle — the reason any run-once guard for a step must live in the
  *     calling consumer, never in a core module-level singleton).
  *   - Architecture-agnostic: it knows nothing about HOW a step resolves a
- *     session; `runSessionColdBoot` (`boot/coldBootV2.ts`) is the current
+ *     session; `runSessionColdBoot` (`boot/sessionColdBoot.ts`) is the current
  *     device-first consumer.
  *
  * A step is skipped (without running) when its `enabled` predicate returns