@oxyhq/services 12.1.0 → 12.1.1

package/lib/typescript/commonjs/ui/context/inSessionTokenRefresh.d.ts

@@ -15,10 +15,10 @@
  *
  *  1. {@link createInSessionRefreshHandler} — an `AuthRefreshHandler` installed
  *     on the owner client. It re-mints a fresh access token WITHOUT a page
- *     reload by reusing the SAME durable per-apex silent-restore arms cold boot
- *     uses (in order; first that yields a token wins). The linked client
- *     (`createLinkedClient`) inherits the fix for free — its refresh delegates
- *     back to the owner's `refreshAccessToken`.
+ *     reload by composing the SAME silent-restore primitives cold boot uses
+ *     ({@link mintSessionViaPerApexIframe}, {@link selectActiveRefreshAccount}) —
+ *     not a copy. The linked client (`createLinkedClient`) inherits the fix for
+ *     free: its refresh delegates back to the owner's `refreshAccessToken`.
  *
  *  2. {@link startTokenRefreshScheduler} — a proactive scheduler that refreshes
  *     ~{@link TOKEN_REFRESH_LEAD_MS} before expiry (and on web tab-focus / native
@@ -42,40 +42,35 @@ export declare const TOKEN_REFRESH_LEAD_MS = 60000;
 /**
  * Build the in-session `AuthRefreshHandler` for the owner client.
  *
- * Arms (first to yield a fresh token wins; each is bounded and falls through on
- * failure). Every arm plants the fresh token internally, so on success we read
- * it back via `getAccessToken()`:
+ * Arms run in an explicit order; the first to plant a token wins. Each arm
+ * resolves to the planted token (read back via `getAccessToken()` — the
+ * underlying SDK call plants it internally) or `null`. A throw in one arm is
+ * logged and treated as `null` so the chain continues.
  *
  *   NATIVE (Expo): shared cross-app identity key re-mint
  *     (`signInWithSharedIdentity` → challenge→sign→verify plants the tokens).
  *     The ONLY silent native arm (mirrors cold boot's `shared-key-signin`); the
- *     `/auth/silent` web iframe is NEVER attempted on native. Returns `null`
+ *     `/auth/silent` web iframe is NEVER attempted on native. Resolves to `null`
  *     when the device holds no shared identity (e.g. a password-only native
  *     sign-in) so a genuinely dead session reconciles to logged-out rather than
  *     staying a zombie.
  *
  *   WEB, in order:
- *     1. First-party `/auth/silent` iframe at the per-apex IdP
- *        (`silentSignIn` with `authWebUrlOverride = autoDetectAuthWebUrl()`).
- *        The durable cross-apex path: the iframe reads the first-party
- *        `fedcm_session` cookie on `auth.<apex>` and mints a fresh Oxy token. No
- *        top-level navigation → works in a backgrounded tab. On a `*.oxy.so`
- *        app the per-apex host IS the central host, so this also covers
- *        same-apex.
+ *     1. Per-apex `/auth/silent` iframe — {@link mintSessionViaPerApexIframe}
+ *        (shared verbatim with cold boot). The durable cross-apex path; also
+ *        covers `*.oxy.so` (the per-apex host IS the central host there).
  *     2. FedCM silent re-auth (Chrome) — `silentSignInWithFedCM`.
- *     3. Same-apex refresh cookie — `refreshAllSessions`. On `*.oxy.so` the
- *        httpOnly `oxy_rt_${n}` cookies ride along; we plant the active
- *        account's rotated token. On a cross-apex RP it returns `{accounts:[]}`
- *        and is a clean no-op. Unlike the cold-boot cookie restore this does NOT
- *        rebuild multi-session state — an in-session refresh only needs a fresh
- *        bearer.
+ *     3. Same-apex refresh cookie — `refreshAllSessions` + the shared
+ *        {@link selectActiveRefreshAccount}; plant the active account's rotated
+ *        token. On a cross-apex RP it returns `{accounts:[]}` (clean no-op).
+ *        Unlike the cold-boot cookie restore this does NOT rebuild multi-session
+ *        state — an in-session refresh only needs a fresh bearer.
  *
- * NO RECURSION: none of these arms issue requests through the authed client's
+ * NO RECURSION: no arm issues a request through the authed client's
  * `refreshAccessToken` path. The iframe/FedCM transports are postMessage /
  * credential APIs; the follow-up `/session/user` fetch inside `silentSignIn`
  * runs against the just-planted FULL-TTL token (≫ the preflight lead), so it
- * never re-enters the refresh path; `refreshAllSessions` uses a raw `fetch` with
- * `credentials:'include'`.
+ * never re-enters the refresh path; `refreshAllSessions` uses a raw `fetch`.
  */
 export declare function createInSessionRefreshHandler(oxyServices: OxyServices): AuthRefreshHandler;
 /**
@@ -92,14 +87,15 @@ export interface TokenRefreshSchedulerHandle {
  * current access token's `exp`, calling `httpService.refreshAccessToken`
  * ('preflight') — which runs the installed handler and is deduped + cooldown-
  * guarded. After every attempt it reschedules from the (possibly rotated) token.
- * It also reschedules whenever the token changes (`onTokensChanged`) and, on
- * web tab-focus / native app-foreground, refreshes immediately if already inside
- * the lead window (a long-hidden tab throttles timers, so the token can be
- * expired on return).
+ * It also reschedules whenever the token changes (`onTokensChanged` — so a
+ * sign-out that clears the token cancels the timer) and, on web tab-focus /
+ * native app-foreground, refreshes immediately if already inside the lead window
+ * (a long-hidden tab throttles timers, so the token can be expired on return).
  *
- * No-ops cleanly when there is no token, an opaque/no-`exp` token, or the host
- * lacks `getAccessTokenExpiry` (older stubs) — in those cases the reactive 401
- * path remains the only refresh trigger.
+ * The `exp` is derived directly from the JWT via `getAccessTokenExpiry()`. No-ops
+ * cleanly when there is no token, an opaque/no-`exp` token, or the host lacks
+ * `getAccessTokenExpiry` (older stubs) — the reactive 401 path stays the only
+ * refresh trigger in those cases.
  */
 export declare function startTokenRefreshScheduler(oxyServices: OxyServices): TokenRefreshSchedulerHandle;
 //# sourceMappingURL=inSessionTokenRefresh.d.ts.map

package/lib/typescript/commonjs/ui/context/inSessionTokenRefresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inSessionTokenRefresh.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/inSessionTokenRefresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EAEnB,MAAM,aAAa,CAAC;AAwBrB;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAY5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,WAAW,GAAG,kBAAkB,CA8D1F;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,OAAO,IAAI,IAAI,CAAC;CACjB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,WAAW,GAAG,2BAA2B,CA4FhG"}
+{"version":3,"file":"inSessionTokenRefresh.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/inSessionTokenRefresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EAEnB,MAAM,aAAa,CAAC;AAyBrB;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAQ5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,WAAW,GAAG,kBAAkB,CAsD1F;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,OAAO,IAAI,IAAI,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,WAAW,GAAG,2BAA2B,CA4FhG"}

package/lib/typescript/module/ui/context/OxyContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyContext.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/OxyContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EASL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,WAAW,EAAa,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAsBjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAOvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAYtD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;;;;;OAaG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yBAAyB,EAAE,MAAM,CAAC;IAGlC,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAG3C,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE;;;;;;;;;;;OAWG;IACH,kBAAkB,EAAE,CAClB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,KACvD,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEnC;;;OAGG;IACH,gBAAgB,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAGnE,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,iBAAiB,EAAE,MAAM,OAAO,CAC9B,KAAK,CAAC;QACJ,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CACH,CAAC;IACF,uBAAuB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,gBAAgB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,mBAAmB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;;;;OASG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,eAAe,CAAC,EAAE,CAAC,cAAc,EAAE,SAAS,GAAG;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/G,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAG7B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC7C,sBAAsB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,oBAAoB,EAAE,CAAC,IAAI,EAAE,yBAAyB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CACpF;AAED,QAAA,MAAM,UAAU,uCAA8C,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,MAAM,EAAE,IAAI,CAAA;CAAE,GAChB;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAMnD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,SAAS,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;CACrC;AAsPD,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAsqDzD,CAAC;AAEF,eAAO,MAAM,kBAAkB,mCAAc,CAAC;AAgE9C,eAAO,MAAM,MAAM,QAAO,eAMzB,CAAC;AAEF,eAAe,UAAU,CAAC"}
+{"version":3,"file":"OxyContext.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/OxyContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EASL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AACf,OAAO,EAAE,WAAW,EAAa,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAsBjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAOvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAYtD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;;;;;OAaG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yBAAyB,EAAE,MAAM,CAAC;IAGlC,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAG3C,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE;;;;;;;;;;;OAWG;IACH,kBAAkB,EAAE,CAClB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,KACvD,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEnC;;;OAGG;IACH,gBAAgB,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAGnE,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,iBAAiB,EAAE,MAAM,OAAO,CAC9B,KAAK,CAAC;QACJ,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CACH,CAAC;IACF,uBAAuB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,gBAAgB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,mBAAmB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;;;;OASG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,eAAe,CAAC,EAAE,CAAC,cAAc,EAAE,SAAS,GAAG;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/G,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAG7B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC7C,sBAAsB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,oBAAoB,EAAE,CAAC,IAAI,EAAE,yBAAyB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;CACpF;AAED,QAAA,MAAM,UAAU,uCAA8C,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,MAAM,EAAE,IAAI,CAAA;CAAE,GAChB;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAMnD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,SAAS,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;CACrC;AAsPD,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAqqDzD,CAAC;AAEF,eAAO,MAAM,kBAAkB,mCAAc,CAAC;AAgE9C,eAAO,MAAM,MAAM,QAAO,eAMzB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/lib/typescript/module/ui/context/inSessionTokenRefresh.d.ts

@@ -15,10 +15,10 @@
  *
  *  1. {@link createInSessionRefreshHandler} — an `AuthRefreshHandler` installed
  *     on the owner client. It re-mints a fresh access token WITHOUT a page
- *     reload by reusing the SAME durable per-apex silent-restore arms cold boot
- *     uses (in order; first that yields a token wins). The linked client
- *     (`createLinkedClient`) inherits the fix for free — its refresh delegates
- *     back to the owner's `refreshAccessToken`.
+ *     reload by composing the SAME silent-restore primitives cold boot uses
+ *     ({@link mintSessionViaPerApexIframe}, {@link selectActiveRefreshAccount}) —
+ *     not a copy. The linked client (`createLinkedClient`) inherits the fix for
+ *     free: its refresh delegates back to the owner's `refreshAccessToken`.
  *
  *  2. {@link startTokenRefreshScheduler} — a proactive scheduler that refreshes
  *     ~{@link TOKEN_REFRESH_LEAD_MS} before expiry (and on web tab-focus / native
@@ -42,40 +42,35 @@ export declare const TOKEN_REFRESH_LEAD_MS = 60000;
 /**
  * Build the in-session `AuthRefreshHandler` for the owner client.
  *
- * Arms (first to yield a fresh token wins; each is bounded and falls through on
- * failure). Every arm plants the fresh token internally, so on success we read
- * it back via `getAccessToken()`:
+ * Arms run in an explicit order; the first to plant a token wins. Each arm
+ * resolves to the planted token (read back via `getAccessToken()` — the
+ * underlying SDK call plants it internally) or `null`. A throw in one arm is
+ * logged and treated as `null` so the chain continues.
  *
  *   NATIVE (Expo): shared cross-app identity key re-mint
  *     (`signInWithSharedIdentity` → challenge→sign→verify plants the tokens).
  *     The ONLY silent native arm (mirrors cold boot's `shared-key-signin`); the
- *     `/auth/silent` web iframe is NEVER attempted on native. Returns `null`
+ *     `/auth/silent` web iframe is NEVER attempted on native. Resolves to `null`
  *     when the device holds no shared identity (e.g. a password-only native
  *     sign-in) so a genuinely dead session reconciles to logged-out rather than
  *     staying a zombie.
  *
  *   WEB, in order:
- *     1. First-party `/auth/silent` iframe at the per-apex IdP
- *        (`silentSignIn` with `authWebUrlOverride = autoDetectAuthWebUrl()`).
- *        The durable cross-apex path: the iframe reads the first-party
- *        `fedcm_session` cookie on `auth.<apex>` and mints a fresh Oxy token. No
- *        top-level navigation → works in a backgrounded tab. On a `*.oxy.so`
- *        app the per-apex host IS the central host, so this also covers
- *        same-apex.
+ *     1. Per-apex `/auth/silent` iframe — {@link mintSessionViaPerApexIframe}
+ *        (shared verbatim with cold boot). The durable cross-apex path; also
+ *        covers `*.oxy.so` (the per-apex host IS the central host there).
  *     2. FedCM silent re-auth (Chrome) — `silentSignInWithFedCM`.
- *     3. Same-apex refresh cookie — `refreshAllSessions`. On `*.oxy.so` the
- *        httpOnly `oxy_rt_${n}` cookies ride along; we plant the active
- *        account's rotated token. On a cross-apex RP it returns `{accounts:[]}`
- *        and is a clean no-op. Unlike the cold-boot cookie restore this does NOT
- *        rebuild multi-session state — an in-session refresh only needs a fresh
- *        bearer.
+ *     3. Same-apex refresh cookie — `refreshAllSessions` + the shared
+ *        {@link selectActiveRefreshAccount}; plant the active account's rotated
+ *        token. On a cross-apex RP it returns `{accounts:[]}` (clean no-op).
+ *        Unlike the cold-boot cookie restore this does NOT rebuild multi-session
+ *        state — an in-session refresh only needs a fresh bearer.
  *
- * NO RECURSION: none of these arms issue requests through the authed client's
+ * NO RECURSION: no arm issues a request through the authed client's
  * `refreshAccessToken` path. The iframe/FedCM transports are postMessage /
  * credential APIs; the follow-up `/session/user` fetch inside `silentSignIn`
  * runs against the just-planted FULL-TTL token (≫ the preflight lead), so it
- * never re-enters the refresh path; `refreshAllSessions` uses a raw `fetch` with
- * `credentials:'include'`.
+ * never re-enters the refresh path; `refreshAllSessions` uses a raw `fetch`.
  */
 export declare function createInSessionRefreshHandler(oxyServices: OxyServices): AuthRefreshHandler;
 /**
@@ -92,14 +87,15 @@ export interface TokenRefreshSchedulerHandle {
  * current access token's `exp`, calling `httpService.refreshAccessToken`
  * ('preflight') — which runs the installed handler and is deduped + cooldown-
  * guarded. After every attempt it reschedules from the (possibly rotated) token.
- * It also reschedules whenever the token changes (`onTokensChanged`) and, on
- * web tab-focus / native app-foreground, refreshes immediately if already inside
- * the lead window (a long-hidden tab throttles timers, so the token can be
- * expired on return).
+ * It also reschedules whenever the token changes (`onTokensChanged` — so a
+ * sign-out that clears the token cancels the timer) and, on web tab-focus /
+ * native app-foreground, refreshes immediately if already inside the lead window
+ * (a long-hidden tab throttles timers, so the token can be expired on return).
  *
- * No-ops cleanly when there is no token, an opaque/no-`exp` token, or the host
- * lacks `getAccessTokenExpiry` (older stubs) — in those cases the reactive 401
- * path remains the only refresh trigger.
+ * The `exp` is derived directly from the JWT via `getAccessTokenExpiry()`. No-ops
+ * cleanly when there is no token, an opaque/no-`exp` token, or the host lacks
+ * `getAccessTokenExpiry` (older stubs) — the reactive 401 path stays the only
+ * refresh trigger in those cases.
  */
 export declare function startTokenRefreshScheduler(oxyServices: OxyServices): TokenRefreshSchedulerHandle;
 //# sourceMappingURL=inSessionTokenRefresh.d.ts.map

package/lib/typescript/module/ui/context/inSessionTokenRefresh.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inSessionTokenRefresh.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/inSessionTokenRefresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EAEnB,MAAM,aAAa,CAAC;AAwBrB;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAY5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,WAAW,GAAG,kBAAkB,CA8D1F;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,OAAO,IAAI,IAAI,CAAC;CACjB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,WAAW,GAAG,2BAA2B,CA4FhG"}
+{"version":3,"file":"inSessionTokenRefresh.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/inSessionTokenRefresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EAEnB,MAAM,aAAa,CAAC;AAyBrB;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,QAAS,CAAC;AAQ5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,WAAW,GAAG,kBAAkB,CAsD1F;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,OAAO,IAAI,IAAI,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,WAAW,GAAG,2BAA2B,CA4FhG"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/services",
-  "version": "12.1.0",
+  "version": "12.1.1",
   "description": "OxyHQ Expo/React Native SDK — UI components, screens, and native features",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",

package/src/ui/context/OxyContext.tsx

@@ -1418,14 +1418,13 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
             // step that prevents the re-bounce loop: when it finds a session,
             // the terminal `sso-bounce` never fires.
             //
-            // The instance is configured with `authWebUrl=auth.oxy.so` (central,
-            // for the bounce + FedCM), so we explicitly point the iframe at the
-            // per-apex host via `autoDetectAuthWebUrl()` and `silentSignIn`'s
-            // `authWebUrlOverride`. On a `*.oxy.so` RP the per-apex host IS the
-            // central host (`auth.oxy.so`), so this is a same-host no-op-
-            // equivalent. When auto-detection bails (localhost/IP/single-label)
-            // there is no per-apex IdP and the step skips. Web only; on native
-            // `isWebBrowser()` gates it off, so native never runs an iframe.
+            // The per-apex iframe mint itself lives in
+            // `mintSessionViaPerApexIframe` (shared verbatim with the in-session
+            // refresh handler so the two paths can never drift): it points the
+            // iframe at `autoDetectAuthWebUrl()` and skips when there is no
+            // per-apex IdP (localhost/IP/single-label/off-browser). Web only; on
+            // native `isWebBrowser()` gates it off, so native never runs an
+            // iframe.
             //
             // FIX-B: additionally skipped when `stored-session` already won.
             // FIX-D: bounded by `SILENT_IFRAME_TIMEOUT` (plus `iframe.onerror`

package/src/ui/context/inSessionTokenRefresh.ts

@@ -15,10 +15,10 @@
  *
  *  1. {@link createInSessionRefreshHandler} — an `AuthRefreshHandler` installed
  *     on the owner client. It re-mints a fresh access token WITHOUT a page
- *     reload by reusing the SAME durable per-apex silent-restore arms cold boot
- *     uses (in order; first that yields a token wins). The linked client
- *     (`createLinkedClient`) inherits the fix for free — its refresh delegates
- *     back to the owner's `refreshAccessToken`.
+ *     reload by composing the SAME silent-restore primitives cold boot uses
+ *     ({@link mintSessionViaPerApexIframe}, {@link selectActiveRefreshAccount}) —
+ *     not a copy. The linked client (`createLinkedClient`) inherits the fix for
+ *     free: its refresh delegates back to the owner's `refreshAccessToken`.
  *
  *  2. {@link startTokenRefreshScheduler} — a proactive scheduler that refreshes
  *     ~{@link TOKEN_REFRESH_LEAD_MS} before expiry (and on web tab-focus / native
@@ -35,10 +35,11 @@ import type {
   AuthRefreshHandler,
   AuthRefreshReason,
 } from '@oxyhq/core';
-import { autoDetectAuthWebUrl, logger as loggerUtil } from '@oxyhq/core';
+import { logger as loggerUtil } from '@oxyhq/core';
 import { AppState, type AppStateStatus } from 'react-native';
 import { isWebBrowser } from '../hooks/useWebSSO';
 import { readActiveAuthuser } from '../utils/activeAuthuser';
+import { mintSessionViaPerApexIframe, selectActiveRefreshAccount } from './silentSessionRestore';
 
 /**
  * Per-arm fail-fast budget (ms) for the web first-party `/auth/silent` iframe
@@ -67,114 +68,97 @@ const COOKIE_REFRESH_TIMEOUT = 4000;
  */
 export const TOKEN_REFRESH_LEAD_MS = 60_000;
 
-function debugRefresh(message: string, reason: AuthRefreshReason, error?: unknown): void {
-  if (__DEV__) {
-    loggerUtil.debug(
-      message,
-      { component: 'inSessionTokenRefresh', method: 'authRefreshHandler', reason },
-      error,
-    );
-  }
-}
+/**
+ * A single refresh arm: attempts one silent-restore mechanism and resolves to
+ * the freshly planted access token, or `null` to fall through to the next arm.
+ */
+type RefreshArm = () => Promise<string | null>;
 
 /**
  * Build the in-session `AuthRefreshHandler` for the owner client.
  *
- * Arms (first to yield a fresh token wins; each is bounded and falls through on
- * failure). Every arm plants the fresh token internally, so on success we read
- * it back via `getAccessToken()`:
+ * Arms run in an explicit order; the first to plant a token wins. Each arm
+ * resolves to the planted token (read back via `getAccessToken()` — the
+ * underlying SDK call plants it internally) or `null`. A throw in one arm is
+ * logged and treated as `null` so the chain continues.
  *
  *   NATIVE (Expo): shared cross-app identity key re-mint
  *     (`signInWithSharedIdentity` → challenge→sign→verify plants the tokens).
  *     The ONLY silent native arm (mirrors cold boot's `shared-key-signin`); the
- *     `/auth/silent` web iframe is NEVER attempted on native. Returns `null`
+ *     `/auth/silent` web iframe is NEVER attempted on native. Resolves to `null`
  *     when the device holds no shared identity (e.g. a password-only native
  *     sign-in) so a genuinely dead session reconciles to logged-out rather than
  *     staying a zombie.
  *
  *   WEB, in order:
- *     1. First-party `/auth/silent` iframe at the per-apex IdP
- *        (`silentSignIn` with `authWebUrlOverride = autoDetectAuthWebUrl()`).
- *        The durable cross-apex path: the iframe reads the first-party
- *        `fedcm_session` cookie on `auth.<apex>` and mints a fresh Oxy token. No
- *        top-level navigation → works in a backgrounded tab. On a `*.oxy.so`
- *        app the per-apex host IS the central host, so this also covers
- *        same-apex.
+ *     1. Per-apex `/auth/silent` iframe — {@link mintSessionViaPerApexIframe}
+ *        (shared verbatim with cold boot). The durable cross-apex path; also
+ *        covers `*.oxy.so` (the per-apex host IS the central host there).
  *     2. FedCM silent re-auth (Chrome) — `silentSignInWithFedCM`.
- *     3. Same-apex refresh cookie — `refreshAllSessions`. On `*.oxy.so` the
- *        httpOnly `oxy_rt_${n}` cookies ride along; we plant the active
- *        account's rotated token. On a cross-apex RP it returns `{accounts:[]}`
- *        and is a clean no-op. Unlike the cold-boot cookie restore this does NOT
- *        rebuild multi-session state — an in-session refresh only needs a fresh
- *        bearer.
+ *     3. Same-apex refresh cookie — `refreshAllSessions` + the shared
+ *        {@link selectActiveRefreshAccount}; plant the active account's rotated
+ *        token. On a cross-apex RP it returns `{accounts:[]}` (clean no-op).
+ *        Unlike the cold-boot cookie restore this does NOT rebuild multi-session
+ *        state — an in-session refresh only needs a fresh bearer.
  *
- * NO RECURSION: none of these arms issue requests through the authed client's
+ * NO RECURSION: no arm issues a request through the authed client's
  * `refreshAccessToken` path. The iframe/FedCM transports are postMessage /
  * credential APIs; the follow-up `/session/user` fetch inside `silentSignIn`
  * runs against the just-planted FULL-TTL token (≫ the preflight lead), so it
- * never re-enters the refresh path; `refreshAllSessions` uses a raw `fetch` with
- * `credentials:'include'`.
+ * never re-enters the refresh path; `refreshAllSessions` uses a raw `fetch`.
  */
 export function createInSessionRefreshHandler(oxyServices: OxyServices): AuthRefreshHandler {
-  return async (reason: AuthRefreshReason): Promise<string | null> => {
-    if (!isWebBrowser()) {
-      try {
-        const session = await oxyServices.signInWithSharedIdentity?.();
-        if (session) {
-          // `verifyChallenge` inside `signInWithSharedIdentity` already planted
-          // the fresh tokens; read the planted access token back out.
-          return oxyServices.getAccessToken();
-        }
-      } catch (error) {
-        debugRefresh('Native shared-key in-session refresh failed', reason, error);
+  const runArm = async (label: string, reason: AuthRefreshReason, arm: RefreshArm): Promise<string | null> => {
+    try {
+      return await arm();
+    } catch (error) {
+      if (__DEV__) {
+        loggerUtil.debug(
+          `In-session refresh arm "${label}" failed (falling through)`,
+          { component: 'inSessionTokenRefresh', method: 'authRefreshHandler', reason },
+          error,
+        );
       }
       return null;
     }
+  };
 
-    // WEB arm 1 — first-party silent iframe at the per-apex IdP.
-    try {
-      const perApexAuthUrl = autoDetectAuthWebUrl();
-      if (perApexAuthUrl) {
-        const session = await oxyServices.silentSignIn?.({
-          authWebUrlOverride: perApexAuthUrl,
-          timeout: SILENT_IFRAME_REFRESH_TIMEOUT,
-        });
-        if (session) {
-          return oxyServices.getAccessToken();
-        }
+  const webArms: Array<[string, RefreshArm]> = [
+    ['silent-iframe', async () =>
+      (await mintSessionViaPerApexIframe(oxyServices, SILENT_IFRAME_REFRESH_TIMEOUT))
+        ? oxyServices.getAccessToken()
+        : null,
+    ],
+    ['fedcm-silent', async () => {
+      if (oxyServices.isFedCMSupported?.() !== true) {
+        return null;
       }
-    } catch (error) {
-      debugRefresh('Silent-iframe in-session refresh failed', reason, error);
-    }
-
-    // WEB arm 2 — FedCM silent re-auth (Chrome).
-    try {
-      if (oxyServices.isFedCMSupported?.() === true) {
-        const session = await oxyServices.silentSignInWithFedCM?.();
-        if (session) {
-          return oxyServices.getAccessToken();
-        }
+      return (await oxyServices.silentSignInWithFedCM?.()) ? oxyServices.getAccessToken() : null;
+    }],
+    ['refresh-cookie', async () => {
+      const snapshot = await oxyServices.refreshAllSessions({ timeout: COOKIE_REFRESH_TIMEOUT });
+      if (snapshot.accounts.length === 0) {
+        return null;
       }
-    } catch (error) {
-      debugRefresh('FedCM-silent in-session refresh failed', reason, error);
+      const active = selectActiveRefreshAccount(snapshot.accounts, readActiveAuthuser());
+      oxyServices.httpService.setTokens(active.accessToken);
+      return oxyServices.getAccessToken();
+    }],
+  ];
+
+  return async (reason: AuthRefreshReason): Promise<string | null> => {
+    if (!isWebBrowser()) {
+      return runArm('native-shared-key', reason, async () =>
+        (await oxyServices.signInWithSharedIdentity?.()) ? oxyServices.getAccessToken() : null,
+      );
     }
 
-    // WEB arm 3 — same-apex refresh cookie.
-    try {
-      const snapshot = await oxyServices.refreshAllSessions({ timeout: COOKIE_REFRESH_TIMEOUT });
-      if (snapshot.accounts.length > 0) {
-        const persistedAuthuser = readActiveAuthuser();
-        const active =
-          (persistedAuthuser !== null
-            ? snapshot.accounts.find((account) => account.authuser === persistedAuthuser)
-            : undefined) ?? snapshot.accounts[0];
-        oxyServices.httpService.setTokens(active.accessToken);
-        return oxyServices.getAccessToken();
+    for (const [label, arm] of webArms) {
+      const token = await runArm(label, reason, arm);
+      if (token) {
+        return token;
       }
-    } catch (error) {
-      debugRefresh('Refresh-cookie in-session refresh failed', reason, error);
     }
-
     return null;
   };
 }
@@ -194,14 +178,15 @@ export interface TokenRefreshSchedulerHandle {
  * current access token's `exp`, calling `httpService.refreshAccessToken`
  * ('preflight') — which runs the installed handler and is deduped + cooldown-
  * guarded. After every attempt it reschedules from the (possibly rotated) token.
- * It also reschedules whenever the token changes (`onTokensChanged`) and, on
- * web tab-focus / native app-foreground, refreshes immediately if already inside
- * the lead window (a long-hidden tab throttles timers, so the token can be
- * expired on return).
+ * It also reschedules whenever the token changes (`onTokensChanged` — so a
+ * sign-out that clears the token cancels the timer) and, on web tab-focus /
+ * native app-foreground, refreshes immediately if already inside the lead window
+ * (a long-hidden tab throttles timers, so the token can be expired on return).
  *
- * No-ops cleanly when there is no token, an opaque/no-`exp` token, or the host
- * lacks `getAccessTokenExpiry` (older stubs) — in those cases the reactive 401
- * path remains the only refresh trigger.
+ * The `exp` is derived directly from the JWT via `getAccessTokenExpiry()`. No-ops
+ * cleanly when there is no token, an opaque/no-`exp` token, or the host lacks
+ * `getAccessTokenExpiry` (older stubs) — the reactive 401 path stays the only
+ * refresh trigger in those cases.
  */
 export function startTokenRefreshScheduler(oxyServices: OxyServices): TokenRefreshSchedulerHandle {
   let disposed = false;