@oxyhq/services 13.3.0 → 14.0.1

package/src/ui/context/hooks/useAuthOperations.ts

@@ -1,5 +1,5 @@
-import { useCallback, useRef } from 'react';
-import type { ApiError, User } from '@oxyhq/core';
+import { useCallback } from 'react';
+import type { ApiError, SessionClient, User } from '@oxyhq/core';
 import type { AuthState } from '../../stores/authStore';
 import type { ClientSession, SessionLoginResponse } from '@oxyhq/core';
 import { DeviceManager } from '@oxyhq/core';
@@ -10,9 +10,7 @@ import type { OxyServices } from '@oxyhq/core';
 import { SignatureService } from '@oxyhq/core';
 import { isWebBrowser } from '../../hooks/useWebSSO';
 import {
-  clearActiveAuthuser,
   clearSsoBounceState,
-  writeActiveAuthuser,
   markSignedOut,
   clearSignedOut,
 } from '../../utils/activeAuthuser';
@@ -21,7 +19,6 @@ import { isCrossApexWeb, CrossApexDirectSignInError } from '../../../utils/cross
 export interface UseAuthOperationsOptions {
   oxyServices: OxyServices;
   storage: StorageInterface | null;
-  sessions: ClientSession[];
   activeSessionId: string | null;
   setActiveSessionId: (sessionId: string | null) => void;
   updateSessions: (sessions: ClientSession[], options?: { merge?: boolean }) => void;
@@ -35,7 +32,17 @@ export interface UseAuthOperationsOptions {
    * expired session still recovers via a returning-user bounce. Best-effort.
    */
   clearPriorSessionHint: () => Promise<void>;
+  /** Used only by `performSignIn`'s same-user duplicate-session dedup (legacy session-validate path; unrelated to the SessionClient device-account set). */
   switchSession: (sessionId: string) => Promise<User>;
+  /**
+   * The Fase 3-A/3-B `SessionClient` (server-authoritative device account
+   * set). `logout` / `logoutAll` route SERVER-side revocation through
+   * `sessionClient.signOut(...)` instead of the bearer/cookie logout
+   * endpoints.
+   */
+  sessionClient: SessionClient;
+  /** Reprojects `sessionClient.getState()` onto sessions/activeSessionId/user (Task 1's callback). Awaited after a partial `signOut` so the exposed state reflects the server truth before the call resolves. */
+  syncFromClient: () => Promise<void>;
   applyLanguagePreference: (user: User) => Promise<void>;
   onAuthStateChange?: (user: User | null) => void;
   onError?: (error: ApiError) => void;
@@ -67,8 +74,13 @@ const LOGOUT_ALL_ERROR_CODE = 'LOGOUT_ALL_ERROR';
  * best-effort storage write. The clear is invoked synchronously (so unit tests
  * can assert it ran) but its async settle is detached; any rejection is logged,
  * never thrown.
+ *
+ * Exported so `OxyContext`'s `syncFromClient` zero-account branch (a REMOTE
+ * full sign-out) can invoke the EXACT same cleanup as the LOCAL `logout` /
+ * `logoutAll` paths below — a remote sign-out must be indistinguishable from
+ * a local one to the next cold boot.
  */
-function clearPriorSessionHintSafe(
+export function clearPriorSessionHintSafe(
   clearPriorSessionHint: () => Promise<void>,
   logger?: (message: string, error?: unknown) => void,
 ): void {
@@ -83,7 +95,6 @@ function clearPriorSessionHintSafe(
  */
 export const useAuthOperations = ({
   oxyServices,
-  sessions,
   activeSessionId,
   setActiveSessionId,
   updateSessions,
@@ -91,6 +102,8 @@ export const useAuthOperations = ({
   clearSessionState,
   clearPriorSessionHint,
   switchSession,
+  sessionClient,
+  syncFromClient,
   applyLanguagePreference,
   onAuthStateChange,
   onError,
@@ -100,10 +113,6 @@ export const useAuthOperations = ({
   setAuthState,
   logger,
 }: UseAuthOperationsOptions): UseAuthOperationsResult => {
-  // Ref to avoid recreating callbacks when sessions change
-  const sessionsRef = useRef(sessions);
-  sessionsRef.current = sessions;
-
   /**
    * Internal function to perform challenge-response sign in.
    */
@@ -141,19 +150,22 @@ export const useAuthOperations = ({
 
       // Deliberate sign-in re-enables automatic silent restore: clear the durable
       // "deliberately signed out" flag so a prior sign-out no longer suppresses
-      // the `fedcm-silent` / per-apex iframe cold-boot steps.
+      // the per-apex iframe cold-boot step.
       clearSignedOut();
 
-      // Register this primary session in the device's first-party multi-account
-      // refresh-cookie set so a web key-based sign-in survives reload via
-      // `refresh-all` and coexists with switched accounts. `/auth/verify` mints the
-      // session but (unlike `/auth/login` / `/fedcm/exchange`) does NOT plant an
-      // `oxy_rt_<authuser>` slot, so we establish it here through the shared
-      // `POST /auth/session` primitive. No-op on native and cross-apex (returns
-      // `null`); records the active slot when one is genuinely allocated.
-      const verifyAuthuser = await oxyServices.establishDeviceRefreshSlot();
-      if (typeof verifyAuthuser === 'number') {
-        writeActiveAuthuser(verifyAuthuser);
+      // Register this recovered account+session into the server-authoritative
+      // device-session set: `sessionClient.addCurrentAccount()` ->
+      // `POST /session/device/add` derives identity from the bearer
+      // `verifyChallenge` already planted internally, then `syncFromClient()`
+      // reprojects the resulting server state onto the exposed
+      // sessions/activeSessionId/user. Best-effort: a failure here must NEVER
+      // fail the sign-in itself — cold boot re-registers this account into the
+      // device set on the next load regardless.
+      try {
+        await sessionClient.addCurrentAccount();
+        await syncFromClient();
+      } catch (registrationError) {
+        logger?.('Failed to register sign-in into device session set', registrationError);
       }
 
       // Get full user data
@@ -216,8 +228,10 @@ export const useAuthOperations = ({
       onAuthStateChange,
       oxyServices,
       saveActiveSessionId,
+      sessionClient,
       setActiveSessionId,
       switchSession,
+      syncFromClient,
       updateSessions,
     ],
   );
@@ -264,38 +278,37 @@ export const useAuthOperations = ({
 
       try {
         const sessionToLogout = targetSessionId || activeSessionId;
-        // Web multi-account sessions carry an `authuser` slot index backed by
-        // an httpOnly `oxy_rt_${n}` cookie. Native sessions fall through to the
-        // bearer-protected endpoint.
-        const targetSession = sessionsRef.current.find((s) => s.sessionId === sessionToLogout);
-        const targetAuthuser = targetSession?.authuser;
-        if (isWebBrowser() && typeof targetAuthuser === 'number') {
-          await oxyServices.logoutSessionByAuthuser(targetAuthuser);
-        } else {
-          await oxyServices.logoutSession(activeSessionId, sessionToLogout);
+
+        // Resolve the device account backing this session from the
+        // server-authoritative `SessionClient` state — SERVER revocation now
+        // goes through `sessionClient.signOut(...)` instead of the
+        // bearer/cookie logout endpoints.
+        const targetAccountId = sessionClient
+          .getState()
+          ?.accounts.find((account) => account.sessionId === sessionToLogout)?.accountId;
+        if (!targetAccountId) {
+          throw new Error(`No device account found for session "${sessionToLogout}"`);
         }
 
-        const filteredSessions = sessionsRef.current.filter((session) => session.sessionId !== sessionToLogout);
-        updateSessions(filteredSessions, { merge: false });
+        await sessionClient.signOut({ accountId: targetAccountId });
 
-        if (sessionToLogout === activeSessionId) {
-          if (filteredSessions.length > 0) {
-            await switchSession(filteredSessions[0].sessionId);
-          } else {
-            // Genuine FULL sign-out (no sessions remain): clear the per-origin
-            // SSO bounce state so a fresh deliberate sign-in can re-probe, drop
-            // the persisted active device slot so the next cold boot does not
-            // prioritize a now-signed-out `oxy_active_authuser`, and SET the
-            // deliberately-signed-out flag so the silent cold-boot steps
-            // (`fedcm-silent` / per-apex iframe) do not re-mint a session from a
-            // still-live IdP session on the next reload (mirrors `logoutAll`).
-            markSignedOut();
-            clearActiveAuthuser();
-            clearSsoBounceState();
-            clearPriorSessionHintSafe(clearPriorSessionHint, logger);
-            await clearSessionState();
-            return;
-          }
+        // The server has already decided what (if anything) remains active on
+        // this device; reproject that truth onto the exposed sessions /
+        // activeSessionId / user before deciding whether additional LOCAL
+        // teardown is needed.
+        const remainingAccounts = sessionClient.getState()?.accounts ?? [];
+        await syncFromClient();
+
+        if (sessionToLogout === activeSessionId && remainingAccounts.length === 0) {
+          // Genuine FULL sign-out (no sessions remain): clear the per-origin
+          // SSO bounce state so a fresh deliberate sign-in can re-probe, and
+          // SET the deliberately-signed-out flag so the silent cold-boot step
+          // (per-apex iframe) does not re-mint a session from a
+          // still-live IdP session on the next reload (mirrors `logoutAll`).
+          markSignedOut();
+          clearSsoBounceState();
+          clearPriorSessionHintSafe(clearPriorSessionHint, logger);
+          await clearSessionState();
         }
       } catch (error) {
         const isInvalid = isInvalidSessionError(error);
@@ -324,10 +337,9 @@ export const useAuthOperations = ({
       clearPriorSessionHint,
       logger,
       onError,
-      oxyServices,
+      sessionClient,
       setAuthState,
-      switchSession,
-      updateSessions,
+      syncFromClient,
     ],
   );
 
@@ -343,15 +355,12 @@ export const useAuthOperations = ({
     }
 
     try {
-      // Always invoke the bearer-protected global endpoint first: the public
-      // `logoutAll`/`signOutAll` contract means revoking this user's sessions
-      // across devices, not just clearing refresh cookies presented by the
-      // current browser. On web, follow up with the cookie endpoint so every
-      // device-local account slot is expired in the browser as well.
-      await oxyServices.logoutAllSessions(activeSessionId);
+      // Server-side revocation of every account on this device now flows
+      // through the SessionClient (`POST /session/device/signout` with
+      // `{ all: true }`) — replaces the bearer `logoutAllSessions` +
+      // web-cookie `logoutAllSessionsViaCookie` pair.
+      await sessionClient.signOut({ all: true });
       if (isWebBrowser()) {
-        await oxyServices.logoutAllSessionsViaCookie();
-        clearActiveAuthuser();
         // Deliberate full sign-out: suppress automatic silent restore on the next
         // cold boot so a still-live IdP session does not re-mint a session.
         markSignedOut();
@@ -373,7 +382,7 @@ export const useAuthOperations = ({
       });
       throw error instanceof Error ? error : new Error('Logout all failed');
     }
-  }, [activeSessionId, clearSessionState, clearPriorSessionHint, logger, onError, oxyServices, setAuthState]);
+  }, [activeSessionId, clearSessionState, clearPriorSessionHint, logger, onError, sessionClient, setAuthState]);
 
   return {
     signIn,

package/src/ui/context/inSessionTokenRefresh.ts

@@ -15,10 +15,10 @@
  *
  *  1. {@link createInSessionRefreshHandler} — an `AuthRefreshHandler` installed
  *     on the owner client. It re-mints a fresh access token WITHOUT a page
- *     reload by composing the SAME silent-restore primitives cold boot uses
- *     ({@link mintSessionViaPerApexIframe}, {@link selectActiveRefreshAccount}) —
- *     not a copy. The linked client (`createLinkedClient`) inherits the fix for
- *     free: its refresh delegates back to the owner's `refreshAccessToken`.
+ *     reload by composing the SAME silent-restore primitive cold boot uses
+ *     ({@link mintSessionViaPerApexIframe}) — not a copy. The linked client
+ *     (`createLinkedClient`) inherits the fix for free: its refresh delegates
+ *     back to the owner's `refreshAccessToken`.
  *
  *  2. {@link startTokenRefreshScheduler} — a proactive scheduler that refreshes
  *     ~{@link TOKEN_REFRESH_LEAD_MS} before expiry (and on web tab-focus / native
@@ -29,6 +29,14 @@
  * (single in-flight `tokenRefreshPromise` + cooldown) — this module does not
  * reimplement them, so the timer / foreground / per-request triggers collapse to
  * one network attempt (no refresh storm).
+ *
+ * NOTE (session-sync cutover, Task 5): the web arm chain used to fall through
+ * to a same-apex `oxy_rt` refresh-cookie arm (`refreshAllSessions` +
+ * `selectActiveRefreshAccount`). That arm is DELETED — the device account set
+ * is now server-authoritative via `SessionClient` (`@oxyhq/core`), which
+ * `OxyContext` bootstraps/reprojects independently of in-session token
+ * refresh. `selectActiveRefreshAccount` had no other caller and was deleted
+ * with it.
  */
 import type {
   OxyServices,
@@ -38,8 +46,7 @@ import type {
 import { logger as loggerUtil } from '@oxyhq/core';
 import { AppState, type AppStateStatus } from 'react-native';
 import { isWebBrowser } from '../hooks/useWebSSO';
-import { readActiveAuthuser } from '../utils/activeAuthuser';
-import { mintSessionViaPerApexIframe, selectActiveRefreshAccount } from './silentSessionRestore';
+import { mintSessionViaPerApexIframe } from './silentSessionRestore';
 
 /**
  * Per-arm fail-fast budget (ms) for the web first-party `/auth/silent` iframe
@@ -51,14 +58,6 @@ import { mintSessionViaPerApexIframe, selectActiveRefreshAccount } from './silen
  */
 const SILENT_IFRAME_REFRESH_TIMEOUT = 4000;
 
-/**
- * Per-arm fail-fast budget (ms) for the same-apex refresh-cookie arm
- * (`refreshAllSessions`). On a cross-apex RP the `Domain=oxy.so` cookie never
- * reaches `api.<apex>`, so this returns `{accounts:[]}` quickly; the bound only
- * matters if that endpoint stalls.
- */
-const COOKIE_REFRESH_TIMEOUT = 4000;
-
 /**
  * Lead time (ms) before access-token expiry at which the proactive scheduler
  * refreshes. Mirrors `HttpService`'s per-request `TOKEN_REFRESH_LEAD_SECONDS`
@@ -90,22 +89,19 @@ type RefreshArm = () => Promise<string | null>;
  *     sign-in) so a genuinely dead session reconciles to logged-out rather than
  *     staying a zombie.
  *
- *   WEB, in order:
- *     1. Per-apex `/auth/silent` iframe — {@link mintSessionViaPerApexIframe}
- *        (shared verbatim with cold boot). The durable cross-apex path; also
- *        covers `*.oxy.so` (the per-apex host IS the central host there).
- *     2. FedCM silent re-auth (Chrome) — `silentSignInWithFedCM`.
- *     3. Same-apex refresh cookie — `refreshAllSessions` + the shared
- *        {@link selectActiveRefreshAccount}; plant the active account's rotated
- *        token. On a cross-apex RP it returns `{accounts:[]}` (clean no-op).
- *        Unlike the cold-boot cookie restore this does NOT rebuild multi-session
- *        state — an in-session refresh only needs a fresh bearer.
+ *   WEB: Per-apex `/auth/silent` iframe — {@link mintSessionViaPerApexIframe}
+ *     (shared verbatim with cold boot). The durable cross-apex path; also
+ *     covers `*.oxy.so` (the per-apex host IS the central host there). There
+ *     is no FedCM arm — FedCM was removed from the client sign-in/refresh path
+ *     entirely (Chrome-only; see `CrossDomainAuth`'s doc comment in
+ *     `@oxyhq/core` for the production sign-in loop that motivated the
+ *     removal).
  *
  * NO RECURSION: no arm issues a request through the authed client's
- * `refreshAccessToken` path. The iframe/FedCM transports are postMessage /
- * credential APIs; the follow-up `/session/user` fetch inside `silentSignIn`
+ * `refreshAccessToken` path. The iframe transport is postMessage-based; the
+ * follow-up `/session/user` fetch inside `silentSignIn`
  * runs against the just-planted FULL-TTL token (≫ the preflight lead), so it
- * never re-enters the refresh path; `refreshAllSessions` uses a raw `fetch`.
+ * never re-enters the refresh path.
  */
 export function createInSessionRefreshHandler(oxyServices: OxyServices): AuthRefreshHandler {
   const runArm = async (label: string, reason: AuthRefreshReason, arm: RefreshArm): Promise<string | null> => {
@@ -129,21 +125,6 @@ export function createInSessionRefreshHandler(oxyServices: OxyServices): AuthRef
         ? oxyServices.getAccessToken()
         : null,
     ],
-    ['fedcm-silent', async () => {
-      if (oxyServices.isFedCMSupported?.() !== true) {
-        return null;
-      }
-      return (await oxyServices.silentSignInWithFedCM?.()) ? oxyServices.getAccessToken() : null;
-    }],
-    ['refresh-cookie', async () => {
-      const snapshot = await oxyServices.refreshAllSessions({ timeout: COOKIE_REFRESH_TIMEOUT });
-      if (snapshot.accounts.length === 0) {
-        return null;
-      }
-      const active = selectActiveRefreshAccount(snapshot.accounts, readActiveAuthuser());
-      oxyServices.httpService.setTokens(active.accessToken);
-      return oxyServices.getAccessToken();
-    }],
   ];
 
   return async (reason: AuthRefreshReason): Promise<string | null> => {

package/src/ui/context/silentSessionRestore.ts

@@ -1,14 +1,20 @@
 /**
- * Silent, no-reload session-restore PRIMITIVES — the single shared
+ * Silent, no-reload session-restore PRIMITIVE — the single shared
  * implementation used by BOTH cold boot (`OxyContext.restoreSessionsFromStorage`)
  * and in-session token refresh (`createInSessionRefreshHandler`). Neither caller
- * re-implements these; they compose them. Keeping one home avoids the two paths
+ * re-implements it; they compose it. Keeping one home avoids the two paths
  * drifting on "how do we mint a first-party token without a page reload".
  *
- * Each function is platform-agnostic at the type level and returns plain data;
- * the callers own the side effects that differ between them (cold boot COMMITS
- * the recovered session into provider state; refresh only reads the freshly
- * planted bearer).
+ * Platform-agnostic at the type level and returns plain data; the callers own
+ * the side effects that differ between them (cold boot COMMITS the recovered
+ * session into provider state; refresh only reads the freshly planted bearer).
+ *
+ * NOTE (session-sync cutover, Task 5): this file used to also export
+ * `selectActiveRefreshAccount`, which picked the active account out of a
+ * `refreshAllSessions` (`oxy_rt` refresh-cookie) snapshot. Deleted — its only
+ * caller was the in-session refresh handler's now-deleted `refresh-cookie`
+ * arm. The device account SET is server-authoritative via `SessionClient`
+ * (`@oxyhq/core`) now.
  */
 import type { OxyServices, SessionLoginResponse } from '@oxyhq/core';
 import { autoDetectAuthWebUrl } from '@oxyhq/core';
@@ -45,23 +51,3 @@ export async function mintSessionViaPerApexIframe(
   }
   return session;
 }
-
-/**
- * Pick the active account from a `refreshAllSessions` snapshot: the persisted
- * `authuser` slot when it still matches a returned account, otherwise the lowest
- * `authuser` (the server sorts ascending, so `[0]`). Callers guarantee a
- * non-empty list, so the result is always defined.
- *
- * Shared by cold-boot cookie restore and the in-session refresh cookie arm so
- * the active-slot selection can never diverge between them.
- */
-export function selectActiveRefreshAccount<T extends { authuser: number }>(
-  accounts: T[],
-  persistedAuthuser: number | null,
-): T {
-  const matched =
-    persistedAuthuser !== null
-      ? accounts.find((account) => account.authuser === persistedAuthuser)
-      : undefined;
-  return matched ?? accounts[0];
-}

package/src/ui/hooks/useAuth.ts

@@ -18,7 +18,7 @@
  * ```
  *
  * Cross-domain SSO:
- * - Web: Automatic via FedCM (Chrome 108+, Safari 16.4+)
+ * - Web: Automatic via the per-apex `/auth/silent` iframe + terminal `/sso` bounce (SDK cold boot)
  * - Native: Automatic via shared Keychain/Account Manager
  * - Manual sign-in: signIn() redirects to the IdP (web) or opens the auth sheet (native)
  */
@@ -150,8 +150,9 @@ export function useAuth(): UseAuthReturn {
     const isIdentityProvider = isWebBrowser() &&
       window.location.hostname === idpHostname;
 
-    // Web (not on IdP): use the tokenless redirect SSO flow. FedCM / silent SSO
-    // already run on page load; an explicit click needs interactive auth.
+    // Web (not on IdP): use the tokenless redirect SSO flow. The silent
+    // cross-domain restore (per-apex `/auth/silent` iframe + `/sso` bounce)
+    // already ran on page load; an explicit click needs interactive auth.
     if (isWebBrowser() && !publicKey && !isIdentityProvider) {
       oxyServices.signInWithRedirect?.({
         redirectUri: window.location.href,

package/src/ui/hooks/useOxyAuthSession.ts

@@ -23,7 +23,7 @@
 import { useState, useEffect, useCallback, useRef } from 'react';
 import { Linking, Platform } from 'react-native';
 import io, { type Socket } from 'socket.io-client';
-import type { OxyServices, User } from '@oxyhq/core';
+import type { OxyServices, SessionLoginResponse, User } from '@oxyhq/core';
 import { createDebugLogger } from '@oxyhq/core';
 import { completeDeviceFlowSignIn } from '../../utils/deviceFlowSignIn';
 
@@ -232,7 +232,7 @@ function generateSessionToken(): string {
 export function useOxyAuthSession(
   oxyServices: OxyServices,
   clientId: string | null,
-  switchSession: ((sessionId: string) => Promise<User>) | undefined,
+  commitSession: ((session: SessionLoginResponse) => Promise<void>) | undefined,
   options: UseOxyAuthSessionOptions = {},
 ): UseOxyAuthSessionResult {
   const { onSignedIn } = options;
@@ -284,8 +284,13 @@ export function useOxyAuthSession(
   // Without that exchange the SDK has no bearer token — the session is
   // authorized server-side but the app never becomes authenticated and the UI
   // sits "Waiting for authorization..." forever. Once `claimSessionByToken`
-  // plants the tokens in the HttpService, the rest of the session wiring flows
-  // through the normal `switchSession` path. Shared with both containers via
+  // plants the tokens in the HttpService, the claimed session is committed via
+  // `commitSession` (`useOxy().handleWebSession`) — the SAME path a fresh
+  // password sign-in or a silent cross-domain restore uses to register the
+  // account into the device's server-authoritative session set. It is NOT yet a
+  // member of that set, so
+  // `switchSession` (an account-SWITCH between accounts already on the
+  // device) is the wrong primitive here. Shared with both containers via
   // `completeDeviceFlowSignIn` so the two paths cannot drift.
   const handleAuthSuccess = useCallback(
     async (sessionId: string, sessionToken: string) => {
@@ -293,14 +298,14 @@ export function useOxyAuthSession(
       isProcessingRef.current = true;
 
       try {
-        if (!switchSession) {
-          throw new Error('Session management unavailable');
+        if (!commitSession) {
+          throw new Error('Session commit unavailable');
         }
         const user = await completeDeviceFlowSignIn({
           oxyServices,
           sessionId,
           sessionToken,
-          switchSession,
+          commitSession,
         });
         onSignedInRef.current?.(user);
       } catch (err) {
@@ -309,7 +314,7 @@ export function useOxyAuthSession(
         isProcessingRef.current = false;
       }
     },
-    [oxyServices, switchSession],
+    [oxyServices, commitSession],
   );
 
   // Start polling for authorization.

package/src/ui/hooks/useSessionManagement.ts

@@ -2,14 +2,13 @@ import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import { isDev, type ApiError, type User } from '@oxyhq/core';
 import type { ClientSession } from '@oxyhq/core';
 import { mergeSessions, normalizeAndSortSessions, sessionsArraysEqual } from '@oxyhq/core';
-import { fetchSessionsWithFallback, validateSessionBatch } from '../utils/sessionHelpers';
+import { fetchSessionsWithFallback } from '../utils/sessionHelpers';
 import { getStorageKeys, type StorageInterface } from '../utils/storageHelpers';
 import { handleAuthError, isInvalidSessionError } from '../utils/errorHandlers';
 import type { OxyServices } from '@oxyhq/core';
 import type { QueryClient } from '@tanstack/react-query';
 import { clearQueryCache } from './queryClient';
 import { isWebBrowser } from './useWebSSO';
-import { writeActiveAuthuser } from '../utils/activeAuthuser';
 
 export interface UseSessionManagementOptions {
   oxyServices: OxyServices;
@@ -229,68 +228,18 @@ export const useSessionManagement = ({
     };
   }, []);
 
-  const findReplacementSession = useCallback(
-    async (sessionIds: string[]): Promise<User | null> => {
-      if (!sessionIds.length) {
-        return null;
-      }
-
-      const validationResults = await validateSessionBatch(oxyServices, sessionIds, {
-        maxConcurrency: 3,
-      });
-
-      const validSession = validationResults.find((result) => result.valid);
-      if (!validSession) {
-        return null;
-      }
-
-      const validation = await oxyServices.validateSession(validSession.sessionId, {
-        useHeaderValidation: true,
-      });
-
-      if (!validation?.valid || !validation.user) {
-        return null;
-      }
-
-      const user = validation.user as User;
-      await activateSession(validSession.sessionId, user);
-      return user;
-    },
-    [activateSession, oxyServices],
-  );
-
   const switchSession = useCallback(
     async (sessionId: string): Promise<User> => {
       try {
-        // Web multi-account: when the target session was sourced from
-        // `refreshAllSessions` it carries its `authuser` slot index. We
-        // proactively plant that slot's access token via the httpOnly
-        // refresh cookie BEFORE validating, so the bearer-protected
-        // validate/getCurrentUser calls have the correct in-memory token
-        // after a cold reload or account switch in another tab. The native
-        // path arrives here only after a bearer has been planted by
+        // On web, the bearer must already be in memory (planted by
+        // `claimSessionByToken`, a cold-boot silent-restore step, or a prior
+        // `SessionClient` sync) before validating — there is no client-side
+        // `oxy_rt` refresh-cookie slot to fall back on; the device account SET
+        // is server-authoritative via `SessionClient` now. The native path
+        // arrives here only after a bearer has been planted by
         // `claimSessionByToken` or secure shared-session restore.
-        if (isWebBrowser()) {
-          const targetSession = sessionsRef.current.find((s) => s.sessionId === sessionId);
-          const targetAuthuser = targetSession?.authuser;
-          if (typeof targetAuthuser === 'number') {
-            const refreshed = await oxyServices.refreshTokenViaCookie({ authuser: targetAuthuser });
-            if (refreshed === null) {
-              // Slot's refresh cookie is missing / expired / reused. Fall
-              // through to the invalid-session branch below by throwing the
-              // canonical invalid-session error.
-              throw new Error('Session is invalid or expired');
-            }
-            // Plant the slot's fresh access token; subsequent bearer calls
-            // (`validateSession`, `getCurrentUser`) will use it. The server
-            // also rotated the cookie at this point.
-            oxyServices.httpService.setTokens(refreshed.accessToken);
-            writeActiveAuthuser(targetAuthuser);
-          }
-
-          if (!oxyServices.getAccessToken()) {
-            throw new Error('Session is invalid or expired');
-          }
+        if (isWebBrowser() && !oxyServices.getAccessToken()) {
+          throw new Error('Session is invalid or expired');
         }
 
         const validation = await oxyServices.validateSession(sessionId, { useHeaderValidation: true });
@@ -322,22 +271,12 @@ export const useSessionManagement = ({
         const invalidSession = isInvalidSessionError(error);
 
         if (invalidSession) {
+          // Server authority (`SessionClient` bootstrap/sync) reconciles which
+          // account is actually active — just drop the invalid session from
+          // the local view rather than guessing at a replacement.
           updateSessions(sessionsRef.current.filter((session) => session.sessionId !== sessionId), {
             merge: false,
           });
-          if (sessionId === activeSessionIdRef.current) {
-            const otherSessionIds = sessionsRef.current
-              .filter(
-                (session) =>
-                  session.sessionId !== sessionId && !removedSessionsRef.current.has(session.sessionId),
-              )
-              .map((session) => session.sessionId);
-
-            const replacementUser = await findReplacementSession(otherSessionIds);
-            if (replacementUser) {
-              return replacementUser;
-            }
-          }
         }
 
         handleAuthError(error, {
@@ -352,7 +291,6 @@ export const useSessionManagement = ({
     },
     [
       activateSession,
-      findReplacementSession,
       logger,
       onError,
       oxyServices,
@@ -389,18 +327,10 @@ export const useSessionManagement = ({
           updateSessions(deviceSessions, { merge: true });
         } catch (error) {
           if (isInvalidSessionError(error)) {
-            const otherSessions = sessionsRef.current
-              .filter(
-                (session) =>
-                  session.sessionId !== activeSessionId &&
-                  !removedSessionsRef.current.has(session.sessionId),
-              )
-              .map((session) => session.sessionId);
-
-            const replacementUser = await findReplacementSession(otherSessions);
-            if (!replacementUser) {
-              await clearSessionState();
-            }
+            // Server authority (`SessionClient` bootstrap/sync) reconciles
+            // which account is actually active — just clear local state
+            // rather than guessing at a replacement session.
+            await clearSessionState();
             return;
           }
 
@@ -422,7 +352,6 @@ export const useSessionManagement = ({
     },
     [
       clearSessionState,
-      findReplacementSession,
       logger,
       onError,
       oxyServices,