@oxyhq/services 12.0.0 → 12.1.1

package/lib/module/ui/context/inSessionTokenRefresh.js

@@ -0,0 +1,257 @@
+"use strict";
+
+/**
+ * In-session access-token refresh for the React Native / Expo SDK.
+ *
+ * THE GAP THIS CLOSES: the services `OxyContext` owns the session but never
+ * installed an `authRefreshHandler` on the owner `HttpService`, so
+ * `HttpService.refreshAccessToken` short-circuited to `null` — there was NO
+ * in-session token refresh on the RN path at all. A 15-minute access token
+ * expired with the tab/app open and nothing re-minted one; cross-apex RP feeds
+ * (mention.earth, …) then 401'd in a loop while `isAuthenticated` stayed `true`
+ * (a zombie logged-in state), because the `Domain=oxy.so` refresh cookie can't
+ * reach `api.<apex>`. (`AuthManager`, which installs a refresh handler on the
+ * web path, is only ever constructed by `WebOxyProvider` in `@oxyhq/auth`.)
+ *
+ * THE FIX, two cooperating pieces both wired from `OxyContext`:
+ *
+ *  1. {@link createInSessionRefreshHandler} — an `AuthRefreshHandler` installed
+ *     on the owner client. It re-mints a fresh access token WITHOUT a page
+ *     reload by composing the SAME silent-restore primitives cold boot uses
+ *     ({@link mintSessionViaPerApexIframe}, {@link selectActiveRefreshAccount}) —
+ *     not a copy. The linked client (`createLinkedClient`) inherits the fix for
+ *     free: its refresh delegates back to the owner's `refreshAccessToken`.
+ *
+ *  2. {@link startTokenRefreshScheduler} — a proactive scheduler that refreshes
+ *     ~{@link TOKEN_REFRESH_LEAD_MS} before expiry (and on web tab-focus / native
+ *     app-foreground), so the common case never even reaches the reactive
+ *     401-then-recover flash.
+ *
+ * Concurrency/cooldown/dedup are owned by `HttpService.refreshAccessToken`
+ * (single in-flight `tokenRefreshPromise` + cooldown) — this module does not
+ * reimplement them, so the timer / foreground / per-request triggers collapse to
+ * one network attempt (no refresh storm).
+ */
+
+import { logger as loggerUtil } from '@oxyhq/core';
+import { AppState } from 'react-native';
+import { isWebBrowser } from "../hooks/useWebSSO.js";
+import { readActiveAuthuser } from "../utils/activeAuthuser.js";
+import { mintSessionViaPerApexIframe, selectActiveRefreshAccount } from "./silentSessionRestore.js";
+
+/**
+ * Per-arm fail-fast budget (ms) for the web first-party `/auth/silent` iframe
+ * arm. Slightly more generous than the cold-boot iframe budget (2.5s) because an
+ * in-session refresh is NOT in the first-paint critical path — a couple hundred
+ * ms of extra headroom for the same-origin handshake is worth a higher success
+ * rate. `silentSignIn` still fail-fasts on `iframe.onerror`, so a hard failure
+ * returns well before this.
+ */
+const SILENT_IFRAME_REFRESH_TIMEOUT = 4000;
+
+/**
+ * Per-arm fail-fast budget (ms) for the same-apex refresh-cookie arm
+ * (`refreshAllSessions`). On a cross-apex RP the `Domain=oxy.so` cookie never
+ * reaches `api.<apex>`, so this returns `{accounts:[]}` quickly; the bound only
+ * matters if that endpoint stalls.
+ */
+const COOKIE_REFRESH_TIMEOUT = 4000;
+
+/**
+ * Lead time (ms) before access-token expiry at which the proactive scheduler
+ * refreshes. Mirrors `HttpService`'s per-request `TOKEN_REFRESH_LEAD_SECONDS`
+ * (60s) so the scheduled refresh and the request-time preflight refresh use the
+ * same window — the scheduler simply fires it during idle/background instead of
+ * waiting for the next request.
+ */
+export const TOKEN_REFRESH_LEAD_MS = 60_000;
+
+/**
+ * A single refresh arm: attempts one silent-restore mechanism and resolves to
+ * the freshly planted access token, or `null` to fall through to the next arm.
+ */
+
+/**
+ * Build the in-session `AuthRefreshHandler` for the owner client.
+ *
+ * Arms run in an explicit order; the first to plant a token wins. Each arm
+ * resolves to the planted token (read back via `getAccessToken()` — the
+ * underlying SDK call plants it internally) or `null`. A throw in one arm is
+ * logged and treated as `null` so the chain continues.
+ *
+ *   NATIVE (Expo): shared cross-app identity key re-mint
+ *     (`signInWithSharedIdentity` → challenge→sign→verify plants the tokens).
+ *     The ONLY silent native arm (mirrors cold boot's `shared-key-signin`); the
+ *     `/auth/silent` web iframe is NEVER attempted on native. Resolves to `null`
+ *     when the device holds no shared identity (e.g. a password-only native
+ *     sign-in) so a genuinely dead session reconciles to logged-out rather than
+ *     staying a zombie.
+ *
+ *   WEB, in order:
+ *     1. Per-apex `/auth/silent` iframe — {@link mintSessionViaPerApexIframe}
+ *        (shared verbatim with cold boot). The durable cross-apex path; also
+ *        covers `*.oxy.so` (the per-apex host IS the central host there).
+ *     2. FedCM silent re-auth (Chrome) — `silentSignInWithFedCM`.
+ *     3. Same-apex refresh cookie — `refreshAllSessions` + the shared
+ *        {@link selectActiveRefreshAccount}; plant the active account's rotated
+ *        token. On a cross-apex RP it returns `{accounts:[]}` (clean no-op).
+ *        Unlike the cold-boot cookie restore this does NOT rebuild multi-session
+ *        state — an in-session refresh only needs a fresh bearer.
+ *
+ * NO RECURSION: no arm issues a request through the authed client's
+ * `refreshAccessToken` path. The iframe/FedCM transports are postMessage /
+ * credential APIs; the follow-up `/session/user` fetch inside `silentSignIn`
+ * runs against the just-planted FULL-TTL token (≫ the preflight lead), so it
+ * never re-enters the refresh path; `refreshAllSessions` uses a raw `fetch`.
+ */
+export function createInSessionRefreshHandler(oxyServices) {
+  const runArm = async (label, reason, arm) => {
+    try {
+      return await arm();
+    } catch (error) {
+      if (__DEV__) {
+        loggerUtil.debug(`In-session refresh arm "${label}" failed (falling through)`, {
+          component: 'inSessionTokenRefresh',
+          method: 'authRefreshHandler',
+          reason
+        }, error);
+      }
+      return null;
+    }
+  };
+  const webArms = [['silent-iframe', async () => (await mintSessionViaPerApexIframe(oxyServices, SILENT_IFRAME_REFRESH_TIMEOUT)) ? oxyServices.getAccessToken() : null], ['fedcm-silent', async () => {
+    if (oxyServices.isFedCMSupported?.() !== true) {
+      return null;
+    }
+    return (await oxyServices.silentSignInWithFedCM?.()) ? oxyServices.getAccessToken() : null;
+  }], ['refresh-cookie', async () => {
+    const snapshot = await oxyServices.refreshAllSessions({
+      timeout: COOKIE_REFRESH_TIMEOUT
+    });
+    if (snapshot.accounts.length === 0) {
+      return null;
+    }
+    const active = selectActiveRefreshAccount(snapshot.accounts, readActiveAuthuser());
+    oxyServices.httpService.setTokens(active.accessToken);
+    return oxyServices.getAccessToken();
+  }]];
+  return async reason => {
+    if (!isWebBrowser()) {
+      return runArm('native-shared-key', reason, async () => (await oxyServices.signInWithSharedIdentity?.()) ? oxyServices.getAccessToken() : null);
+    }
+    for (const [label, arm] of webArms) {
+      const token = await runArm(label, reason, arm);
+      if (token) {
+        return token;
+      }
+    }
+    return null;
+  };
+}
+
+/**
+ * Handle returned by {@link startTokenRefreshScheduler}; call `dispose()` to tear
+ * down the timer and the foreground listener.
+ */
+
+/**
+ * Start the proactive in-session refresh scheduler against `oxyServices`.
+ *
+ * Schedules a single timer to fire {@link TOKEN_REFRESH_LEAD_MS} before the
+ * current access token's `exp`, calling `httpService.refreshAccessToken`
+ * ('preflight') — which runs the installed handler and is deduped + cooldown-
+ * guarded. After every attempt it reschedules from the (possibly rotated) token.
+ * It also reschedules whenever the token changes (`onTokensChanged` — so a
+ * sign-out that clears the token cancels the timer) and, on web tab-focus /
+ * native app-foreground, refreshes immediately if already inside the lead window
+ * (a long-hidden tab throttles timers, so the token can be expired on return).
+ *
+ * The `exp` is derived directly from the JWT via `getAccessTokenExpiry()`. No-ops
+ * cleanly when there is no token, an opaque/no-`exp` token, or the host lacks
+ * `getAccessTokenExpiry` (older stubs) — the reactive 401 path stays the only
+ * refresh trigger in those cases.
+ */
+export function startTokenRefreshScheduler(oxyServices) {
+  let disposed = false;
+  let timer = null;
+  const clearTimer = () => {
+    if (timer !== null) {
+      clearTimeout(timer);
+      timer = null;
+    }
+  };
+  const runRefresh = () => {
+    // `refreshAccessToken` is deduped + cooldown-guarded internally, so this is
+    // safe to call from the timer, the foreground listener, and request-time
+    // preflight concurrently — they collapse to one network attempt.
+    const refresh = oxyServices.httpService.refreshAccessToken?.('preflight');
+    if (!refresh) {
+      return;
+    }
+    void refresh.catch(() => null).finally(() => {
+      if (!disposed) {
+        schedule();
+      }
+    });
+  };
+  const schedule = () => {
+    clearTimer();
+    if (disposed || !oxyServices.getAccessToken()) {
+      return;
+    }
+    const expSeconds = oxyServices.getAccessTokenExpiry?.() ?? null;
+    if (expSeconds === null) {
+      return;
+    }
+    const fireInMs = expSeconds * 1000 - Date.now() - TOKEN_REFRESH_LEAD_MS;
+    timer = setTimeout(runRefresh, Math.max(fireInMs, 0));
+  };
+  const onForeground = () => {
+    if (disposed || !oxyServices.getAccessToken()) {
+      return;
+    }
+    const expSeconds = oxyServices.getAccessTokenExpiry?.() ?? null;
+    if (expSeconds === null) {
+      return;
+    }
+    const remainingMs = expSeconds * 1000 - Date.now();
+    if (remainingMs <= TOKEN_REFRESH_LEAD_MS) {
+      runRefresh();
+    } else {
+      schedule();
+    }
+  };
+  const unsubscribeTokens = oxyServices.onTokensChanged(() => {
+    if (!disposed) {
+      schedule();
+    }
+  });
+  let removeForeground = null;
+  if (isWebBrowser() && typeof document !== 'undefined') {
+    const handler = () => {
+      if (document.visibilityState === 'visible') {
+        onForeground();
+      }
+    };
+    document.addEventListener('visibilitychange', handler);
+    removeForeground = () => document.removeEventListener('visibilitychange', handler);
+  } else if (!isWebBrowser() && AppState && typeof AppState.addEventListener === 'function') {
+    const subscription = AppState.addEventListener('change', state => {
+      if (state === 'active') {
+        onForeground();
+      }
+    });
+    removeForeground = () => subscription.remove();
+  }
+  schedule();
+  return {
+    dispose() {
+      disposed = true;
+      clearTimer();
+      unsubscribeTokens();
+      removeForeground?.();
+      removeForeground = null;
+    }
+  };
+}
+//# sourceMappingURL=inSessionTokenRefresh.js.map

package/lib/module/ui/context/inSessionTokenRefresh.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["logger","loggerUtil","AppState","isWebBrowser","readActiveAuthuser","mintSessionViaPerApexIframe","selectActiveRefreshAccount","SILENT_IFRAME_REFRESH_TIMEOUT","COOKIE_REFRESH_TIMEOUT","TOKEN_REFRESH_LEAD_MS","createInSessionRefreshHandler","oxyServices","runArm","label","reason","arm","error","__DEV__","debug","component","method","webArms","getAccessToken","isFedCMSupported","silentSignInWithFedCM","snapshot","refreshAllSessions","timeout","accounts","length","active","httpService","setTokens","accessToken","signInWithSharedIdentity","token","startTokenRefreshScheduler","disposed","timer","clearTimer","clearTimeout","runRefresh","refresh","refreshAccessToken","catch","finally","schedule","expSeconds","getAccessTokenExpiry","fireInMs","Date","now","setTimeout","Math","max","onForeground","remainingMs","unsubscribeTokens","onTokensChanged","removeForeground","document","handler","visibilityState","addEventListener","removeEventListener","subscription","state","remove","dispose"],"sourceRoot":"../../../../src","sources":["ui/context/inSessionTokenRefresh.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAMA,SAASA,MAAM,IAAIC,UAAU,QAAQ,aAAa;AAClD,SAASC,QAAQ,QAA6B,cAAc;AAC5D,SAASC,YAAY,QAAQ,uBAAoB;AACjD,SAASC,kBAAkB,QAAQ,4BAAyB;AAC5D,SAASC,2BAA2B,EAAEC,0BAA0B,QAAQ,2BAAwB;;AAEhG;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,6BAA6B,GAAG,IAAI;;AAE1C;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,sBAAsB,GAAG,IAAI;;AAEnC;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,qBAAqB,GAAG,MAAM;;AAE3C;AACA;AACA;AACA;;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,6BAA6BA,CAACC,WAAwB,EAAsB;EAC1F,MAAMC,MAAM,GAAG,MAAAA,CAAOC,KAAa,EAAEC,MAAyB,EAAEC,GAAe,KAA6B;IAC1G,IAAI;MACF,OAAO,MAAMA,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC,OAAOC,KAAK,EAAE;MACd,IAAIC,OAAO,EAAE;QACXhB,UAAU,CAACiB,KAAK,CACd,2BAA2BL,KAAK,4BAA4B,EAC5D;UAAEM,SAAS,EAAE,uBAAuB;UAAEC,MAAM,EAAE,oBAAoB;UAAEN;QAAO,CAAC,EAC5EE,KACF,CAAC;MACH;MACA,OAAO,IAAI;IACb;EACF,CAAC;EAED,MAAMK,OAAoC,GAAG,CAC3C,CAAC,eAAe,EAAE,YAChB,CAAC,MAAMhB,2BAA2B,CAACM,WAAW,EAAEJ,6BAA6B,CAAC,IAC1EI,WAAW,CAACW,cAAc,CAAC,CAAC,GAC5B,IAAI,CACT,EACD,CAAC,cAAc,EAAE,YAAY;IAC3B,IAAIX,WAAW,CAACY,gBAAgB,GAAG,CAAC,KAAK,IAAI,EAAE;MAC7C,OAAO,IAAI;IACb;IACA,OAAO,CAAC,MAAMZ,WAAW,CAACa,qBAAqB,GAAG,CAAC,IAAIb,WAAW,CAACW,cAAc,CAAC,CAAC,GAAG,IAAI;EAC5F,CAAC,CAAC,EACF,CAAC,gBAAgB,EAAE,YAAY;IAC7B,MAAMG,QAAQ,GAAG,MAAMd,WAAW,CAACe,kBAAkB,CAAC;MAAEC,OAAO,EAAEnB;IAAuB,CAAC,CAAC;IAC1F,IAAIiB,QAAQ,CAACG,QAAQ,CAACC,MAAM,KAAK,CAAC,EAAE;MAClC,OAAO,IAAI;IACb;IACA,MAAMC,MAAM,GAAGxB,0BAA0B,CAACmB,QAAQ,CAACG,QAAQ,EAAExB,kBAAkB,CAAC,CAAC,CAAC;IAClFO,WAAW,CAACoB,WAAW,CAACC,SAAS,CAACF,MAAM,CAACG,WAAW,CAAC;IACrD,OAAOtB,WAAW,CAACW,cAAc,CAAC,CAAC;EACrC,CAAC,CAAC,CACH;EAED,OAAO,MAAOR,MAAyB,IAA6B;IAClE,IAAI,CAACX,YAAY,CAAC,CAAC,EAAE;MACnB,OAAOS,MAAM,CAAC,mBAAmB,EAAEE,MAAM,EAAE,YACzC,CAAC,MAAMH,WAAW,CAACuB,wBAAwB,GAAG,CAAC,IAAIvB,WAAW,CAACW,cAAc,CAAC,CAAC,GAAG,IACpF,CAAC;IACH;IAEA,KAAK,MAAM,CAACT,KAAK,EAAEE,GAAG,CAAC,IAAIM,OAAO,EAAE;MAClC,MAAMc,KAAK,GAAG,MAAMvB,MAAM,CAACC,KAAK,EAAEC,MAAM,EAAEC,GAAG,CAAC;MAC9C,IAAIoB,KAAK,EAAE;QACT,OAAOA,KAAK;MACd;IACF;IACA,OAAO,IAAI;EACb,CAAC;AACH;;AAEA;AACA;AACA;AACA;;AAKA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,0BAA0BA,CAACzB,WAAwB,EAA+B;EAChG,IAAI0B,QAAQ,GAAG,KAAK;EACpB,IAAIC,KAA2C,GAAG,IAAI;EAEtD,MAAMC,UAAU,GAAGA,CAAA,KAAY;IAC7B,IAAID,KAAK,KAAK,IAAI,EAAE;MAClBE,YAAY,CAACF,KAAK,CAAC;MACnBA,KAAK,GAAG,IAAI;IACd;EACF,CAAC;EAED,MAAMG,UAAU,GAAGA,CAAA,KAAY;IAC7B;IACA;IACA;IACA,MAAMC,OAAO,GAAG/B,WAAW,CAACoB,WAAW,CAACY,kBAAkB,GAAG,WAAW,CAAC;IACzE,IAAI,CAACD,OAAO,EAAE;MACZ;IACF;IACA,KAAKA,OAAO,CACTE,KAAK,CAAC,MAAM,IAAI,CAAC,CACjBC,OAAO,CAAC,MAAM;MACb,IAAI,CAACR,QAAQ,EAAE;QACbS,QAAQ,CAAC,CAAC;MACZ;IACF,CAAC,CAAC;EACN,CAAC;EAED,MAAMA,QAAQ,GAAGA,CAAA,KAAY;IAC3BP,UAAU,CAAC,CAAC;IACZ,IAAIF,QAAQ,IAAI,CAAC1B,WAAW,CAACW,cAAc,CAAC,CAAC,EAAE;MAC7C;IACF;IACA,MAAMyB,UAAU,GAAGpC,WAAW,CAACqC,oBAAoB,GAAG,CAAC,IAAI,IAAI;IAC/D,IAAID,UAAU,KAAK,IAAI,EAAE;MACvB;IACF;IACA,MAAME,QAAQ,GAAGF,UAAU,GAAG,IAAI,GAAGG,IAAI,CAACC,GAAG,CAAC,CAAC,GAAG1C,qBAAqB;IACvE6B,KAAK,GAAGc,UAAU,CAACX,UAAU,EAAEY,IAAI,CAACC,GAAG,CAACL,QAAQ,EAAE,CAAC,CAAC,CAAC;EACvD,CAAC;EAED,MAAMM,YAAY,GAAGA,CAAA,KAAY;IAC/B,IAAIlB,QAAQ,IAAI,CAAC1B,WAAW,CAACW,cAAc,CAAC,CAAC,EAAE;MAC7C;IACF;IACA,MAAMyB,UAAU,GAAGpC,WAAW,CAACqC,oBAAoB,GAAG,CAAC,IAAI,IAAI;IAC/D,IAAID,UAAU,KAAK,IAAI,EAAE;MACvB;IACF;IACA,MAAMS,WAAW,GAAGT,UAAU,GAAG,IAAI,GAAGG,IAAI,CAACC,GAAG,CAAC,CAAC;IAClD,IAAIK,WAAW,IAAI/C,qBAAqB,EAAE;MACxCgC,UAAU,CAAC,CAAC;IACd,CAAC,MAAM;MACLK,QAAQ,CAAC,CAAC;IACZ;EACF,CAAC;EAED,MAAMW,iBAAiB,GAAG9C,WAAW,CAAC+C,eAAe,CAAC,MAAM;IAC1D,IAAI,CAACrB,QAAQ,EAAE;MACbS,QAAQ,CAAC,CAAC;IACZ;EACF,CAAC,CAAC;EAEF,IAAIa,gBAAqC,GAAG,IAAI;EAChD,IAAIxD,YAAY,CAAC,CAAC,IAAI,OAAOyD,QAAQ,KAAK,WAAW,EAAE;IACrD,MAAMC,OAAO,GAAGA,CAAA,KAAY;MAC1B,IAAID,QAAQ,CAACE,eAAe,KAAK,SAAS,EAAE;QAC1CP,YAAY,CAAC,CAAC;MAChB;IACF,CAAC;IACDK,QAAQ,CAACG,gBAAgB,CAAC,kBAAkB,EAAEF,OAAO,CAAC;IACtDF,gBAAgB,GAAGA,CAAA,KAAMC,QAAQ,CAACI,mBAAmB,CAAC,kBAAkB,EAAEH,OAAO,CAAC;EACpF,CAAC,MAAM,IAAI,CAAC1D,YAAY,CAAC,CAAC,IAAID,QAAQ,IAAI,OAAOA,QAAQ,CAAC6D,gBAAgB,KAAK,UAAU,EAAE;IACzF,MAAME,YAAY,GAAG/D,QAAQ,CAAC6D,gBAAgB,CAAC,QAAQ,EAAGG,KAAqB,IAAK;MAClF,IAAIA,KAAK,KAAK,QAAQ,EAAE;QACtBX,YAAY,CAAC,CAAC;MAChB;IACF,CAAC,CAAC;IACFI,gBAAgB,GAAGA,CAAA,KAAMM,YAAY,CAACE,MAAM,CAAC,CAAC;EAChD;EAEArB,QAAQ,CAAC,CAAC;EAEV,OAAO;IACLsB,OAAOA,CAAA,EAAS;MACd/B,QAAQ,GAAG,IAAI;MACfE,UAAU,CAAC,CAAC;MACZkB,iBAAiB,CAAC,CAAC;MACnBE,gBAAgB,GAAG,CAAC;MACpBA,gBAAgB,GAAG,IAAI;IACzB;EACF,CAAC;AACH","ignoreList":[]}

package/lib/module/ui/context/silentSessionRestore.js

@@ -0,0 +1,61 @@
+"use strict";
+
+/**
+ * Silent, no-reload session-restore PRIMITIVES — the single shared
+ * implementation used by BOTH cold boot (`OxyContext.restoreSessionsFromStorage`)
+ * and in-session token refresh (`createInSessionRefreshHandler`). Neither caller
+ * re-implements these; they compose them. Keeping one home avoids the two paths
+ * drifting on "how do we mint a first-party token without a page reload".
+ *
+ * Each function is platform-agnostic at the type level and returns plain data;
+ * the callers own the side effects that differ between them (cold boot COMMITS
+ * the recovered session into provider state; refresh only reads the freshly
+ * planted bearer).
+ */
+
+import { autoDetectAuthWebUrl } from '@oxyhq/core';
+
+/**
+ * Mint a fresh first-party session via the PER-APEX `/auth/silent` iframe — the
+ * durable cross-domain restore path that works WITHOUT a top-level navigation
+ * (so it succeeds under Safari ITP / Firefox TCP and in a backgrounded tab).
+ *
+ * The instance is configured with the CENTRAL auth URL, so we explicitly point
+ * the iframe at the per-apex host (`auth.<rp-apex>`) via `autoDetectAuthWebUrl()`
+ * + `silentSignIn`'s `authWebUrlOverride`. On a `*.oxy.so` app the per-apex host
+ * IS the central host, so this also covers same-apex. When auto-detection bails
+ * (localhost / IP / single-label / off-browser) there is no per-apex IdP and we
+ * return `null`. `silentSignIn` plants the access token internally on success.
+ *
+ * @returns the recovered session (token already planted) when complete, else
+ * `null` (no per-apex IdP, no session, or an incomplete iframe response).
+ */
+export async function mintSessionViaPerApexIframe(oxyServices, timeoutMs) {
+  const perApexAuthUrl = autoDetectAuthWebUrl();
+  if (!perApexAuthUrl) {
+    return null;
+  }
+  const session = await oxyServices.silentSignIn?.({
+    authWebUrlOverride: perApexAuthUrl,
+    timeout: timeoutMs
+  });
+  if (!session?.user || !session.sessionId) {
+    return null;
+  }
+  return session;
+}
+
+/**
+ * Pick the active account from a `refreshAllSessions` snapshot: the persisted
+ * `authuser` slot when it still matches a returned account, otherwise the lowest
+ * `authuser` (the server sorts ascending, so `[0]`). Callers guarantee a
+ * non-empty list, so the result is always defined.
+ *
+ * Shared by cold-boot cookie restore and the in-session refresh cookie arm so
+ * the active-slot selection can never diverge between them.
+ */
+export function selectActiveRefreshAccount(accounts, persistedAuthuser) {
+  const matched = persistedAuthuser !== null ? accounts.find(account => account.authuser === persistedAuthuser) : undefined;
+  return matched ?? accounts[0];
+}
+//# sourceMappingURL=silentSessionRestore.js.map

package/lib/module/ui/context/silentSessionRestore.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["autoDetectAuthWebUrl","mintSessionViaPerApexIframe","oxyServices","timeoutMs","perApexAuthUrl","session","silentSignIn","authWebUrlOverride","timeout","user","sessionId","selectActiveRefreshAccount","accounts","persistedAuthuser","matched","find","account","authuser","undefined"],"sourceRoot":"../../../../src","sources":["ui/context/silentSessionRestore.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,oBAAoB,QAAQ,aAAa;;AAElD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,2BAA2BA,CAC/CC,WAAwB,EACxBC,SAAiB,EACqB;EACtC,MAAMC,cAAc,GAAGJ,oBAAoB,CAAC,CAAC;EAC7C,IAAI,CAACI,cAAc,EAAE;IACnB,OAAO,IAAI;EACb;EACA,MAAMC,OAAO,GAAG,MAAMH,WAAW,CAACI,YAAY,GAAG;IAC/CC,kBAAkB,EAAEH,cAAc;IAClCI,OAAO,EAAEL;EACX,CAAC,CAAC;EACF,IAAI,CAACE,OAAO,EAAEI,IAAI,IAAI,CAACJ,OAAO,CAACK,SAAS,EAAE;IACxC,OAAO,IAAI;EACb;EACA,OAAOL,OAAO;AAChB;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASM,0BAA0BA,CACxCC,QAAa,EACbC,iBAAgC,EAC7B;EACH,MAAMC,OAAO,GACXD,iBAAiB,KAAK,IAAI,GACtBD,QAAQ,CAACG,IAAI,CAAEC,OAAO,IAAKA,OAAO,CAACC,QAAQ,KAAKJ,iBAAiB,CAAC,GAClEK,SAAS;EACf,OAAOJ,OAAO,IAAIF,QAAQ,CAAC,CAAC,CAAC;AAC/B","ignoreList":[]}

package/lib/typescript/commonjs/ui/context/OxyContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyContext.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/OxyContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EASL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,WAAW,EAAa,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAuBjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAOvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAUtD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;;;;;OAaG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yBAAyB,EAAE,MAAM,CAAC;IAGlC,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAG3C,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE;;;;;;;;;;;OAWG;IACH,kBAAkB,EAAE,CAClB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,KACvD,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEnC;;;OAGG;IACH,gBAAgB,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAGnE,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,iBAAiB,EAAE,MAAM,OAAO,CAC9B,KAAK,CAAC;QACJ,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CACH,CAAC;IACF,uBAAuB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,gBAAgB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,mBAAmB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;;;;OASG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,eAAe,CAAC,EAAE,CAAC,cAAc,EAAE,SAAS,GAAG;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/G,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAG7B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC7C,sBAAsB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,oBAAoB,EAAE,CAAC,IAAI,EAAE,yBAAyB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CACpF;AAED,QAAA,MAAM,UAAU,uCAA8C,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,MAAM,EAAE,IAAI,CAAA;CAAE,GAChB;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAMnD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,SAAS,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;CACrC;AAsPD,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CA8oDzD,CAAC;AAEF,eAAO,MAAM,kBAAkB,mCAAc,CAAC;AAgE9C,eAAO,MAAM,MAAM,QAAO,eAMzB,CAAC;AAEF,eAAe,UAAU,CAAC"}
+{"version":3,"file":"OxyContext.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/OxyContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EASL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,WAAW,EAAa,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAsBjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAOvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAYtD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;;;;;OAaG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yBAAyB,EAAE,MAAM,CAAC;IAGlC,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAG3C,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE;;;;;;;;;;;OAWG;IACH,kBAAkB,EAAE,CAClB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,KACvD,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEnC;;;OAGG;IACH,gBAAgB,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAGnE,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,iBAAiB,EAAE,MAAM,OAAO,CAC9B,KAAK,CAAC;QACJ,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CACH,CAAC;IACF,uBAAuB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,gBAAgB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,mBAAmB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;;;;OASG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,eAAe,CAAC,EAAE,CAAC,cAAc,EAAE,SAAS,GAAG;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/G,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAG7B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC7C,sBAAsB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,oBAAoB,EAAE,CAAC,IAAI,EAAE,yBAAyB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CACpF;AAED,QAAA,MAAM,UAAU,uCAA8C,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,MAAM,EAAE,IAAI,CAAA;CAAE,GAChB;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAMnD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,SAAS,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;CACrC;AAsPD,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAqqDzD,CAAC;AAEF,eAAO,MAAM,kBAAkB,mCAAc,CAAC;AAgE9C,eAAO,MAAM,MAAM,QAAO,eAMzB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/lib/typescript/commonjs/ui/context/inSessionTokenRefresh.d.ts

@@ -0,0 +1,101 @@
+/**
+ * In-session access-token refresh for the React Native / Expo SDK.
+ *
+ * THE GAP THIS CLOSES: the services `OxyContext` owns the session but never
+ * installed an `authRefreshHandler` on the owner `HttpService`, so
+ * `HttpService.refreshAccessToken` short-circuited to `null` — there was NO
+ * in-session token refresh on the RN path at all. A 15-minute access token
+ * expired with the tab/app open and nothing re-minted one; cross-apex RP feeds
+ * (mention.earth, …) then 401'd in a loop while `isAuthenticated` stayed `true`
+ * (a zombie logged-in state), because the `Domain=oxy.so` refresh cookie can't
+ * reach `api.<apex>`. (`AuthManager`, which installs a refresh handler on the
+ * web path, is only ever constructed by `WebOxyProvider` in `@oxyhq/auth`.)
+ *
+ * THE FIX, two cooperating pieces both wired from `OxyContext`:
+ *
+ *  1. {@link createInSessionRefreshHandler} — an `AuthRefreshHandler` installed
+ *     on the owner client. It re-mints a fresh access token WITHOUT a page
+ *     reload by composing the SAME silent-restore primitives cold boot uses
+ *     ({@link mintSessionViaPerApexIframe}, {@link selectActiveRefreshAccount}) —
+ *     not a copy. The linked client (`createLinkedClient`) inherits the fix for
+ *     free: its refresh delegates back to the owner's `refreshAccessToken`.
+ *
+ *  2. {@link startTokenRefreshScheduler} — a proactive scheduler that refreshes
+ *     ~{@link TOKEN_REFRESH_LEAD_MS} before expiry (and on web tab-focus / native
+ *     app-foreground), so the common case never even reaches the reactive
+ *     401-then-recover flash.
+ *
+ * Concurrency/cooldown/dedup are owned by `HttpService.refreshAccessToken`
+ * (single in-flight `tokenRefreshPromise` + cooldown) — this module does not
+ * reimplement them, so the timer / foreground / per-request triggers collapse to
+ * one network attempt (no refresh storm).
+ */
+import type { OxyServices, AuthRefreshHandler } from '@oxyhq/core';
+/**
+ * Lead time (ms) before access-token expiry at which the proactive scheduler
+ * refreshes. Mirrors `HttpService`'s per-request `TOKEN_REFRESH_LEAD_SECONDS`
+ * (60s) so the scheduled refresh and the request-time preflight refresh use the
+ * same window — the scheduler simply fires it during idle/background instead of
+ * waiting for the next request.
+ */
+export declare const TOKEN_REFRESH_LEAD_MS = 60000;
+/**
+ * Build the in-session `AuthRefreshHandler` for the owner client.
+ *
+ * Arms run in an explicit order; the first to plant a token wins. Each arm
+ * resolves to the planted token (read back via `getAccessToken()` — the
+ * underlying SDK call plants it internally) or `null`. A throw in one arm is
+ * logged and treated as `null` so the chain continues.
+ *
+ *   NATIVE (Expo): shared cross-app identity key re-mint
+ *     (`signInWithSharedIdentity` → challenge→sign→verify plants the tokens).
+ *     The ONLY silent native arm (mirrors cold boot's `shared-key-signin`); the
+ *     `/auth/silent` web iframe is NEVER attempted on native. Resolves to `null`
+ *     when the device holds no shared identity (e.g. a password-only native
+ *     sign-in) so a genuinely dead session reconciles to logged-out rather than
+ *     staying a zombie.
+ *
+ *   WEB, in order:
+ *     1. Per-apex `/auth/silent` iframe — {@link mintSessionViaPerApexIframe}
+ *        (shared verbatim with cold boot). The durable cross-apex path; also
+ *        covers `*.oxy.so` (the per-apex host IS the central host there).
+ *     2. FedCM silent re-auth (Chrome) — `silentSignInWithFedCM`.
+ *     3. Same-apex refresh cookie — `refreshAllSessions` + the shared
+ *        {@link selectActiveRefreshAccount}; plant the active account's rotated
+ *        token. On a cross-apex RP it returns `{accounts:[]}` (clean no-op).
+ *        Unlike the cold-boot cookie restore this does NOT rebuild multi-session
+ *        state — an in-session refresh only needs a fresh bearer.
+ *
+ * NO RECURSION: no arm issues a request through the authed client's
+ * `refreshAccessToken` path. The iframe/FedCM transports are postMessage /
+ * credential APIs; the follow-up `/session/user` fetch inside `silentSignIn`
+ * runs against the just-planted FULL-TTL token (≫ the preflight lead), so it
+ * never re-enters the refresh path; `refreshAllSessions` uses a raw `fetch`.
+ */
+export declare function createInSessionRefreshHandler(oxyServices: OxyServices): AuthRefreshHandler;
+/**
+ * Handle returned by {@link startTokenRefreshScheduler}; call `dispose()` to tear
+ * down the timer and the foreground listener.
+ */
+export interface TokenRefreshSchedulerHandle {
+    dispose(): void;
+}
+/**
+ * Start the proactive in-session refresh scheduler against `oxyServices`.
+ *
+ * Schedules a single timer to fire {@link TOKEN_REFRESH_LEAD_MS} before the
+ * current access token's `exp`, calling `httpService.refreshAccessToken`
+ * ('preflight') — which runs the installed handler and is deduped + cooldown-
+ * guarded. After every attempt it reschedules from the (possibly rotated) token.
+ * It also reschedules whenever the token changes (`onTokensChanged` — so a
+ * sign-out that clears the token cancels the timer) and, on web tab-focus /
+ * native app-foreground, refreshes immediately if already inside the lead window
+ * (a long-hidden tab throttles timers, so the token can be expired on return).
+ *
+ * The `exp` is derived directly from the JWT via `getAccessTokenExpiry()`. No-ops
+ * cleanly when there is no token, an opaque/no-`exp` token, or the host lacks
+ * `getAccessTokenExpiry` (older stubs) — the reactive 401 path stays the only
+ * refresh trigger in those cases.
+ */
+export declare function startTokenRefreshScheduler(oxyServices: OxyServices): TokenRefreshSchedulerHandle;
+//# sourceMappingURL=inSessionTokenRefresh.d.ts.map

package/lib/typescript/commonjs/ui/context/inSessionTokenRefresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inSessionTokenRefresh.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/inSessionTokenRefresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EAEnB,MAAM,aAAa,CAAC;AAyBrB;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAQ5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,WAAW,GAAG,kBAAkB,CAsD1F;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,OAAO,IAAI,IAAI,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,WAAW,GAAG,2BAA2B,CA4FhG"}

package/lib/typescript/commonjs/ui/context/silentSessionRestore.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Silent, no-reload session-restore PRIMITIVES — the single shared
+ * implementation used by BOTH cold boot (`OxyContext.restoreSessionsFromStorage`)
+ * and in-session token refresh (`createInSessionRefreshHandler`). Neither caller
+ * re-implements these; they compose them. Keeping one home avoids the two paths
+ * drifting on "how do we mint a first-party token without a page reload".
+ *
+ * Each function is platform-agnostic at the type level and returns plain data;
+ * the callers own the side effects that differ between them (cold boot COMMITS
+ * the recovered session into provider state; refresh only reads the freshly
+ * planted bearer).
+ */
+import type { OxyServices, SessionLoginResponse } from '@oxyhq/core';
+/**
+ * Mint a fresh first-party session via the PER-APEX `/auth/silent` iframe — the
+ * durable cross-domain restore path that works WITHOUT a top-level navigation
+ * (so it succeeds under Safari ITP / Firefox TCP and in a backgrounded tab).
+ *
+ * The instance is configured with the CENTRAL auth URL, so we explicitly point
+ * the iframe at the per-apex host (`auth.<rp-apex>`) via `autoDetectAuthWebUrl()`
+ * + `silentSignIn`'s `authWebUrlOverride`. On a `*.oxy.so` app the per-apex host
+ * IS the central host, so this also covers same-apex. When auto-detection bails
+ * (localhost / IP / single-label / off-browser) there is no per-apex IdP and we
+ * return `null`. `silentSignIn` plants the access token internally on success.
+ *
+ * @returns the recovered session (token already planted) when complete, else
+ * `null` (no per-apex IdP, no session, or an incomplete iframe response).
+ */
+export declare function mintSessionViaPerApexIframe(oxyServices: OxyServices, timeoutMs: number): Promise<SessionLoginResponse | null>;
+/**
+ * Pick the active account from a `refreshAllSessions` snapshot: the persisted
+ * `authuser` slot when it still matches a returned account, otherwise the lowest
+ * `authuser` (the server sorts ascending, so `[0]`). Callers guarantee a
+ * non-empty list, so the result is always defined.
+ *
+ * Shared by cold-boot cookie restore and the in-session refresh cookie arm so
+ * the active-slot selection can never diverge between them.
+ */
+export declare function selectActiveRefreshAccount<T extends {
+    authuser: number;
+}>(accounts: T[], persistedAuthuser: number | null): T;
+//# sourceMappingURL=silentSessionRestore.d.ts.map

package/lib/typescript/commonjs/ui/context/silentSessionRestore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"silentSessionRestore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/silentSessionRestore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGrE;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,2BAA2B,CAC/C,WAAW,EAAE,WAAW,EACxB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAatC;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,SAAS;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,EACvE,QAAQ,EAAE,CAAC,EAAE,EACb,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAC/B,CAAC,CAMH"}

package/lib/typescript/module/ui/context/OxyContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyContext.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/OxyContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EASL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,WAAW,EAAa,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAuBjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAOvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAUtD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;;;;;OAaG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yBAAyB,EAAE,MAAM,CAAC;IAGlC,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAG3C,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE;;;;;;;;;;;OAWG;IACH,kBAAkB,EAAE,CAClB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,KACvD,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEnC;;;OAGG;IACH,gBAAgB,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAGnE,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,iBAAiB,EAAE,MAAM,OAAO,CAC9B,KAAK,CAAC;QACJ,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CACH,CAAC;IACF,uBAAuB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,gBAAgB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,mBAAmB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;;;;OASG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,eAAe,CAAC,EAAE,CAAC,cAAc,EAAE,SAAS,GAAG;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/G,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAG7B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC7C,sBAAsB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,oBAAoB,EAAE,CAAC,IAAI,EAAE,yBAAyB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CACpF;AAED,QAAA,MAAM,UAAU,uCAA8C,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,MAAM,EAAE,IAAI,CAAA;CAAE,GAChB;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAMnD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,SAAS,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;CACrC;AAsPD,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CA8oDzD,CAAC;AAEF,eAAO,MAAM,kBAAkB,mCAAc,CAAC;AAgE9C,eAAO,MAAM,MAAM,QAAO,eAMzB,CAAC;AAEF,eAAe,UAAU,CAAC"}
+{"version":3,"file":"OxyContext.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/OxyContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EASL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,WAAW,EAAa,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAsBjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAOvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAYtD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;;;;;OAaG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yBAAyB,EAAE,MAAM,CAAC;IAGlC,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAG3C,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE;;;;;;;;;;;OAWG;IACH,kBAAkB,EAAE,CAClB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,KACvD,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEnC;;;OAGG;IACH,gBAAgB,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAGnE,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,iBAAiB,EAAE,MAAM,OAAO,CAC9B,KAAK,CAAC;QACJ,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CACH,CAAC;IACF,uBAAuB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,gBAAgB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,mBAAmB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;;;;OASG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,eAAe,CAAC,EAAE,CAAC,cAAc,EAAE,SAAS,GAAG;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/G,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAG7B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC7C,sBAAsB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,oBAAoB,EAAE,CAAC,IAAI,EAAE,yBAAyB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CACpF;AAED,QAAA,MAAM,UAAU,uCAA8C,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,MAAM,EAAE,IAAI,CAAA;CAAE,GAChB;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAMnD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,SAAS,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;CACrC;AAsPD,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAqqDzD,CAAC;AAEF,eAAO,MAAM,kBAAkB,mCAAc,CAAC;AAgE9C,eAAO,MAAM,MAAM,QAAO,eAMzB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/lib/typescript/module/ui/context/inSessionTokenRefresh.d.ts

@@ -0,0 +1,101 @@
+/**
+ * In-session access-token refresh for the React Native / Expo SDK.
+ *
+ * THE GAP THIS CLOSES: the services `OxyContext` owns the session but never
+ * installed an `authRefreshHandler` on the owner `HttpService`, so
+ * `HttpService.refreshAccessToken` short-circuited to `null` — there was NO
+ * in-session token refresh on the RN path at all. A 15-minute access token
+ * expired with the tab/app open and nothing re-minted one; cross-apex RP feeds
+ * (mention.earth, …) then 401'd in a loop while `isAuthenticated` stayed `true`
+ * (a zombie logged-in state), because the `Domain=oxy.so` refresh cookie can't
+ * reach `api.<apex>`. (`AuthManager`, which installs a refresh handler on the
+ * web path, is only ever constructed by `WebOxyProvider` in `@oxyhq/auth`.)
+ *
+ * THE FIX, two cooperating pieces both wired from `OxyContext`:
+ *
+ *  1. {@link createInSessionRefreshHandler} — an `AuthRefreshHandler` installed
+ *     on the owner client. It re-mints a fresh access token WITHOUT a page
+ *     reload by composing the SAME silent-restore primitives cold boot uses
+ *     ({@link mintSessionViaPerApexIframe}, {@link selectActiveRefreshAccount}) —
+ *     not a copy. The linked client (`createLinkedClient`) inherits the fix for
+ *     free: its refresh delegates back to the owner's `refreshAccessToken`.
+ *
+ *  2. {@link startTokenRefreshScheduler} — a proactive scheduler that refreshes
+ *     ~{@link TOKEN_REFRESH_LEAD_MS} before expiry (and on web tab-focus / native
+ *     app-foreground), so the common case never even reaches the reactive
+ *     401-then-recover flash.
+ *
+ * Concurrency/cooldown/dedup are owned by `HttpService.refreshAccessToken`
+ * (single in-flight `tokenRefreshPromise` + cooldown) — this module does not
+ * reimplement them, so the timer / foreground / per-request triggers collapse to
+ * one network attempt (no refresh storm).
+ */
+import type { OxyServices, AuthRefreshHandler } from '@oxyhq/core';
+/**
+ * Lead time (ms) before access-token expiry at which the proactive scheduler
+ * refreshes. Mirrors `HttpService`'s per-request `TOKEN_REFRESH_LEAD_SECONDS`
+ * (60s) so the scheduled refresh and the request-time preflight refresh use the
+ * same window — the scheduler simply fires it during idle/background instead of
+ * waiting for the next request.
+ */
+export declare const TOKEN_REFRESH_LEAD_MS = 60000;
+/**
+ * Build the in-session `AuthRefreshHandler` for the owner client.
+ *
+ * Arms run in an explicit order; the first to plant a token wins. Each arm
+ * resolves to the planted token (read back via `getAccessToken()` — the
+ * underlying SDK call plants it internally) or `null`. A throw in one arm is
+ * logged and treated as `null` so the chain continues.
+ *
+ *   NATIVE (Expo): shared cross-app identity key re-mint
+ *     (`signInWithSharedIdentity` → challenge→sign→verify plants the tokens).
+ *     The ONLY silent native arm (mirrors cold boot's `shared-key-signin`); the
+ *     `/auth/silent` web iframe is NEVER attempted on native. Resolves to `null`
+ *     when the device holds no shared identity (e.g. a password-only native
+ *     sign-in) so a genuinely dead session reconciles to logged-out rather than
+ *     staying a zombie.
+ *
+ *   WEB, in order:
+ *     1. Per-apex `/auth/silent` iframe — {@link mintSessionViaPerApexIframe}
+ *        (shared verbatim with cold boot). The durable cross-apex path; also
+ *        covers `*.oxy.so` (the per-apex host IS the central host there).
+ *     2. FedCM silent re-auth (Chrome) — `silentSignInWithFedCM`.
+ *     3. Same-apex refresh cookie — `refreshAllSessions` + the shared
+ *        {@link selectActiveRefreshAccount}; plant the active account's rotated
+ *        token. On a cross-apex RP it returns `{accounts:[]}` (clean no-op).
+ *        Unlike the cold-boot cookie restore this does NOT rebuild multi-session
+ *        state — an in-session refresh only needs a fresh bearer.
+ *
+ * NO RECURSION: no arm issues a request through the authed client's
+ * `refreshAccessToken` path. The iframe/FedCM transports are postMessage /
+ * credential APIs; the follow-up `/session/user` fetch inside `silentSignIn`
+ * runs against the just-planted FULL-TTL token (≫ the preflight lead), so it
+ * never re-enters the refresh path; `refreshAllSessions` uses a raw `fetch`.
+ */
+export declare function createInSessionRefreshHandler(oxyServices: OxyServices): AuthRefreshHandler;
+/**
+ * Handle returned by {@link startTokenRefreshScheduler}; call `dispose()` to tear
+ * down the timer and the foreground listener.
+ */
+export interface TokenRefreshSchedulerHandle {
+    dispose(): void;
+}
+/**
+ * Start the proactive in-session refresh scheduler against `oxyServices`.
+ *
+ * Schedules a single timer to fire {@link TOKEN_REFRESH_LEAD_MS} before the
+ * current access token's `exp`, calling `httpService.refreshAccessToken`
+ * ('preflight') — which runs the installed handler and is deduped + cooldown-
+ * guarded. After every attempt it reschedules from the (possibly rotated) token.
+ * It also reschedules whenever the token changes (`onTokensChanged` — so a
+ * sign-out that clears the token cancels the timer) and, on web tab-focus /
+ * native app-foreground, refreshes immediately if already inside the lead window
+ * (a long-hidden tab throttles timers, so the token can be expired on return).
+ *
+ * The `exp` is derived directly from the JWT via `getAccessTokenExpiry()`. No-ops
+ * cleanly when there is no token, an opaque/no-`exp` token, or the host lacks
+ * `getAccessTokenExpiry` (older stubs) — the reactive 401 path stays the only
+ * refresh trigger in those cases.
+ */
+export declare function startTokenRefreshScheduler(oxyServices: OxyServices): TokenRefreshSchedulerHandle;
+//# sourceMappingURL=inSessionTokenRefresh.d.ts.map

package/lib/typescript/module/ui/context/inSessionTokenRefresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inSessionTokenRefresh.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/inSessionTokenRefresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EAEnB,MAAM,aAAa,CAAC;AAyBrB;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAQ5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,WAAW,GAAG,kBAAkB,CAsD1F;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,OAAO,IAAI,IAAI,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,WAAW,GAAG,2BAA2B,CA4FhG"}