@oxyhq/services 14.1.0 → 16.0.0

package/src/utils/__tests__/deviceFlowSignIn.test.ts

@@ -1,34 +1,32 @@
 /**
  * @jest-environment node
  *
- * Regression coverage for the device-flow sign-in bugs:
+ * Regression coverage for the device-flow ("Sign in with Oxy" QR / "Open Oxy
+ * Auth") sign-in orchestration:
  *
  *   BUG 1 (native): tapping "Sign In with Oxy" opens `OxyAuthScreen`, which
- *   creates a device-flow AuthSession and opens auth.oxy.so/authorize. The
- *   user signs in successfully, the API authorizes the session and notifies
- *   the client via the auth-session socket — but the screen then called
- *   `switchSession` DIRECTLY without first claiming the bearer with the
- *   secret `sessionToken`. The session was authorized server-side but the app
- *   never became authenticated ("nothing happens").
+ *   creates a device-flow AuthSession. The user signs in successfully, the API
+ *   authorizes the session and notifies the client — but the screen then called
+ *   `switchSession` DIRECTLY without first claiming the bearer with the secret
+ *   `sessionToken`. The session was authorized server-side but the app never
+ *   became authenticated ("nothing happens").
  *
  *   BUG 2 (session-sync cutover regression): once claiming was fixed,
  *   `completeDeviceFlowSignIn` still committed the claimed session through
- *   `switchSession`. After the session-sync cutover, `switchSession` became an
- *   account-SWITCH between accounts already registered on the device and
- *   throws `No device account found for session "..."` for a freshly-claimed
- *   session that was never registered — surfacing as "Authorization
- *   successful but failed to complete sign in." The fix commits the claimed
- *   session through `commitSession` (`useOxy().handleWebSession`) instead —
- *   the same path a fresh password sign-in uses to register the account
- *   into the device's session set.
+ *   `switchSession`, which after the cutover is an account-SWITCH between
+ *   accounts already registered on the device and throws `No device account
+ *   found for session "..."` for a freshly-claimed session. The fix commits the
+ *   claimed session through `commitSession` (`useOxy().handleWebSession`)
+ *   instead — the SAME path a fresh password sign-in uses to register the
+ *   account into the device's server-authoritative session set.
  *
- *   These tests pin the order (claim before commit), the fail-fast behaviour
- *   on a claim that returns no usable session, and propagation of a
- *   `commitSession` failure.
+ * These tests pin the order (claim before commit), the fail-fast behaviour on a
+ * claim that returns no usable session, propagation of a `commitSession`
+ * failure, and (device-first) that the rotating refresh token the claim returns
+ * is threaded into `commitSession` so the QR sign-in persists a durable session.
  */
 
 import type { SessionLoginResponse, User } from '@oxyhq/core';
-import { ssoStateKey, ssoGuardKey, ssoDestKey } from '@oxyhq/core';
 import {
   completeDeviceFlowSignIn,
   type DeviceFlowClient,
@@ -37,6 +35,7 @@ import {
 const SESSION_ID = 'session-id-123';
 const SESSION_TOKEN = 'a'.repeat(32);
 const ACCESS_TOKEN = 'access-token-abc';
+const REFRESH_TOKEN = 'refresh-token-def';
 const USER = {
   id: 'user-1',
   username: 'nate',
@@ -52,7 +51,6 @@ describe('completeDeviceFlowSignIn', () => {
     const order: string[] = [];
 
     const oxyServices: DeviceFlowClient = {
-      requestSsoEstablishUrl: jest.fn(async () => ({ establishUrl: 'https://auth.oxy.so/sso/establish' })),
       claimSessionByToken: jest.fn(async (token: string) => {
         expect(token).toBe(SESSION_TOKEN);
         order.push('claim');
@@ -89,9 +87,40 @@ describe('completeDeviceFlowSignIn', () => {
     expect(user).toBe(USER);
   });
 
+  it('threads the claim rotating refreshToken into commitSession (durable QR session)', async () => {
+    const oxyServices: DeviceFlowClient = {
+      claimSessionByToken: jest.fn(async () => ({
+        accessToken: ACCESS_TOKEN,
+        refreshToken: REFRESH_TOKEN,
+        sessionId: SESSION_ID,
+        deviceId: 'device-1',
+        expiresAt: '2026-01-01T00:00:00.000Z',
+        user: USER,
+      })),
+    };
+    const commitSession = jest.fn(async (): Promise<void> => {});
+
+    await completeDeviceFlowSignIn({
+      oxyServices,
+      sessionId: SESSION_ID,
+      sessionToken: SESSION_TOKEN,
+      commitSession,
+    });
+
+    // The rotating refresh family is carried into the commit funnel so it
+    // persists a durable session that survives a reload without a redirect.
+    expect(commitSession).toHaveBeenCalledWith({
+      sessionId: SESSION_ID,
+      deviceId: 'device-1',
+      expiresAt: '2026-01-01T00:00:00.000Z',
+      user: MINIMAL_USER,
+      accessToken: ACCESS_TOKEN,
+      refreshToken: REFRESH_TOKEN,
+    });
+  });
+
   it('falls back to the delivered sessionId/deviceId/expiresAt when the claim omits them', async () => {
     const oxyServices: DeviceFlowClient = {
-      requestSsoEstablishUrl: jest.fn(async () => ({ establishUrl: 'https://auth.oxy.so/sso/establish' })),
       claimSessionByToken: jest.fn(async () => ({
         accessToken: ACCESS_TOKEN,
         user: USER,
@@ -118,7 +147,6 @@ describe('completeDeviceFlowSignIn', () => {
   it('does NOT commit the session when the claim fails (the original native regression)', async () => {
     const claimError = new Error('claim failed (401)');
     const oxyServices: DeviceFlowClient = {
-      requestSsoEstablishUrl: jest.fn(async () => ({ establishUrl: 'https://auth.oxy.so/sso/establish' })),
       claimSessionByToken: jest.fn(async () => {
         throw claimError;
       }),
@@ -141,7 +169,6 @@ describe('completeDeviceFlowSignIn', () => {
 
   it('throws when the claim returns no accessToken (the session-sync regression guard)', async () => {
     const oxyServices: DeviceFlowClient = {
-      requestSsoEstablishUrl: jest.fn(async () => ({ establishUrl: 'https://auth.oxy.so/sso/establish' })),
       claimSessionByToken: jest.fn(async () => ({ sessionId: SESSION_ID, user: USER })),
     };
     const commitSession = jest.fn(async (): Promise<void> => {});
@@ -160,7 +187,6 @@ describe('completeDeviceFlowSignIn', () => {
 
   it('throws when the claim returns no user', async () => {
     const oxyServices: DeviceFlowClient = {
-      requestSsoEstablishUrl: jest.fn(async () => ({ establishUrl: 'https://auth.oxy.so/sso/establish' })),
       claimSessionByToken: jest.fn(async () => ({ accessToken: ACCESS_TOKEN, sessionId: SESSION_ID })),
     };
     const commitSession = jest.fn(async (): Promise<void> => {});
@@ -180,7 +206,6 @@ describe('completeDeviceFlowSignIn', () => {
   it('propagates a commitSession failure after a successful claim', async () => {
     const commitError = new Error('session invalid');
     const oxyServices: DeviceFlowClient = {
-      requestSsoEstablishUrl: jest.fn(async () => ({ establishUrl: 'https://auth.oxy.so/sso/establish' })),
       claimSessionByToken: jest.fn(async () => ({
         accessToken: ACCESS_TOKEN,
         sessionId: SESSION_ID,
@@ -203,110 +228,4 @@ describe('completeDeviceFlowSignIn', () => {
     expect(oxyServices.claimSessionByToken).toHaveBeenCalledTimes(1);
     expect(commitSession).toHaveBeenCalledTimes(1);
   });
-
-  describe('web durable-session establish hop', () => {
-    const RP_ORIGIN = 'https://accounts.oxy.so';
-    const RP_HREF = 'https://accounts.oxy.so/settings';
-    const ESTABLISH_URL =
-      'https://auth.oxy.so/sso/establish?et=jwt&return_to=https%3A%2F%2Faccounts.oxy.so%2F__oxy%2Fsso-callback&state=state-1';
-
-    function webDeps(overrides: Record<string, unknown> = {}) {
-      const map = new Map<string, string>();
-      const navigated: string[] = [];
-      const deps = {
-        isWeb: () => true,
-        storage: {
-          getItem: (k: string) => (map.has(k) ? (map.get(k) as string) : null),
-          setItem: (k: string, v: string) => { map.set(k, v); },
-        },
-        location: { origin: RP_ORIGIN, href: RP_HREF },
-        navigate: (url: string) => { navigated.push(url); },
-        generateState: () => 'state-1',
-        now: () => 1_700_000_000_000,
-        ...overrides,
-      };
-      return { deps, map, navigated };
-    }
-
-    function baseClient(
-      requestSsoEstablishUrl: DeviceFlowClient['requestSsoEstablishUrl'],
-    ): DeviceFlowClient {
-      return {
-        requestSsoEstablishUrl,
-        claimSessionByToken: jest.fn(async () => ({
-          accessToken: ACCESS_TOKEN,
-          sessionId: SESSION_ID,
-          deviceId: 'device-1',
-          expiresAt: '2026-01-01T00:00:00.000Z',
-          user: USER,
-        })),
-      };
-    }
-
-    it('fires the establish hop on web: requests the URL with the RP origin + state and navigates once', async () => {
-      const requestSsoEstablishUrl = jest.fn(async (origin: string, state: string) => {
-        expect(origin).toBe(RP_ORIGIN);
-        expect(state).toBe('state-1');
-        return { establishUrl: ESTABLISH_URL };
-      });
-      const oxyServices = baseClient(requestSsoEstablishUrl);
-      const { deps, map, navigated } = webDeps();
-
-      const user = await completeDeviceFlowSignIn({
-        oxyServices,
-        sessionId: SESSION_ID,
-        sessionToken: SESSION_TOKEN,
-        commitSession: jest.fn(async () => {}),
-        establishDeps: deps,
-      });
-
-      expect(user).toBe(USER);
-      expect(requestSsoEstablishUrl).toHaveBeenCalledTimes(1);
-      expect(navigated).toEqual([ESTABLISH_URL]);
-      // Bounce state persisted so the post-bounce `sso-return` step validates it.
-      expect(map.get(ssoStateKey(RP_ORIGIN))).toBe('state-1');
-      expect(map.get(ssoGuardKey(RP_ORIGIN))).toBe(String(1_700_000_000_000));
-      expect(map.get(ssoDestKey(RP_ORIGIN))).toBe(RP_HREF);
-    });
-
-    it('does NOT fire the hop on native (no request, no navigation)', async () => {
-      const requestSsoEstablishUrl = jest.fn(async () => ({ establishUrl: ESTABLISH_URL }));
-      const oxyServices = baseClient(requestSsoEstablishUrl);
-      const { deps, navigated } = webDeps({ isWeb: () => false });
-
-      await completeDeviceFlowSignIn({
-        oxyServices,
-        sessionId: SESSION_ID,
-        sessionToken: SESSION_TOKEN,
-        commitSession: jest.fn(async () => {}),
-        establishDeps: deps,
-      });
-
-      expect(requestSsoEstablishUrl).not.toHaveBeenCalled();
-      expect(navigated).toEqual([]);
-    });
-
-    it('completes sign-in even if the establish request fails — exactly one attempt, no navigation', async () => {
-      const requestSsoEstablishUrl = jest.fn(async () => {
-        throw new Error('403 unapproved');
-      });
-      const oxyServices = baseClient(requestSsoEstablishUrl);
-      const { deps, map, navigated } = webDeps();
-
-      const user = await completeDeviceFlowSignIn({
-        oxyServices,
-        sessionId: SESSION_ID,
-        sessionToken: SESSION_TOKEN,
-        commitSession: jest.fn(async () => {}),
-        establishDeps: deps,
-      });
-
-      // Sign-in still completed (the primitive is total — never throws).
-      expect(user).toBe(USER);
-      expect(requestSsoEstablishUrl).toHaveBeenCalledTimes(1);
-      expect(navigated).toEqual([]);
-      // No stale bounce state left behind on failure.
-      expect(map.size).toBe(0);
-    });
-  });
 });

package/src/utils/deviceFlowSignIn.ts

@@ -33,16 +33,18 @@
 
 import {
   KeyManager,
-  establishIdpSessionAfterClaim,
-  type EstablishAfterClaimDeps,
   type MinimalUserData,
   type SessionLoginResponse,
-  type SsoEstablishClient,
   type User,
 } from '@oxyhq/core';
 
 interface DeviceFlowClaimResult {
   accessToken?: string;
+  /** Rotating refresh-token family head minted by `/auth/session/claim` on the
+   * trusted lane. Not on the core method's typed return, so read defensively;
+   * threaded into `commitSession` so the QR sign-in persists a durable session
+   * that survives a reload without a redirect. */
+  refreshToken?: string;
   sessionId?: string;
   deviceId?: string;
   expiresAt?: string;
@@ -55,10 +57,8 @@ interface DeviceFlowClaimResult {
  * trivially unit-testable with a stub and never pulls the RN/Expo runtime into
  * a test bundle.
  *
- * Extends {@link SsoEstablishClient} (`requestSsoEstablishUrl`) so the WEB
- * post-claim durable-session hop can be driven off the same client.
  */
-export interface DeviceFlowClient extends SsoEstablishClient {
+export interface DeviceFlowClient {
   /**
    * Exchange the device-flow `sessionToken` for the first access + refresh
    * token, planting them on the client. Single-use; replay is rejected by the
@@ -83,15 +83,12 @@ export interface CompleteDeviceFlowSignInOptions {
    * registers the account into the device's server-authoritative session set,
    * persists it durably, and hydrates the full user profile. Runs AFTER the
    * bearer is planted so its bearer-protected calls succeed.
+   *
+   * The `refreshToken` extra (optional; not on the public `SessionLoginResponse`
+   * type) carries the rotating refresh family so the commit funnel persists a
+   * durable session.
    */
-  commitSession: (session: SessionLoginResponse) => Promise<void>;
-  /**
-   * Injectable web seams for the post-claim durable-session establish hop
-   * ({@link establishIdpSessionAfterClaim}). Omit in production — the defaults
-   * resolve to `window.*` (and no-op off-web / on native). Tests inject fakes to
-   * drive the web path deterministically.
-   */
-  establishDeps?: EstablishAfterClaimDeps;
+  commitSession: (session: SessionLoginResponse & { refreshToken?: string }) => Promise<void>;
 }
 
 /**
@@ -108,7 +105,6 @@ export async function completeDeviceFlowSignIn({
   sessionId,
   sessionToken,
   commitSession,
-  establishDeps,
 }: CompleteDeviceFlowSignInOptions): Promise<User> {
   // 1) Plant the bearer + refresh tokens. The claim response is also persisted
   //    to native shared secure storage so a later cold boot has a bearer before
@@ -135,25 +131,22 @@ export async function completeDeviceFlowSignIn({
 
   // 2) Bearer is now planted — commit the session through the same path a
   //    fresh sign-in uses so it is registered into the device's
-  //    server-authoritative session set instead of an account switch.
+  //    server-authoritative session set instead of an account switch. Thread
+  //    the rotating refresh token so the commit funnel persists a durable
+  //    session that survives a reload.
   await commitSession({
     sessionId: claimed.sessionId || sessionId,
     deviceId: claimed.deviceId ?? '',
     expiresAt: claimed.expiresAt ?? '',
     user: minimalUser,
     accessToken: claimed.accessToken,
+    ...(claimed.refreshToken ? { refreshToken: claimed.refreshToken } : {}),
   });
 
-  // 3) WEB durable-session hop (no-op on native). A device-flow claim plants
-  //    ONLY in-memory tokens — no IdP `fedcm_session` cookie is ever planted, so
-  //    a reload cannot re-mint a token and the session is lost. Now that the
-  //    session is committed AND durably persisted (step 2), plant the per-apex
-  //    IdP cookie via ONE top-level establish hop. Single attempt; total (never
-  //    throws) — an establish failure leaves the committed session as-is. On web
-  //    success it navigates away, so it is the LAST step: the browser tears the
-  //    page down on the next tick, after `claimed.user` is returned to the
-  //    caller's `onSignedIn`.
-  await establishIdpSessionAfterClaim(oxyServices, establishDeps ?? {});
+  // The commit funnel persisted the rotating refresh family and registered the
+  // account into the device set, so a reload restores the session locally (web:
+  // stored-tokens / same-apex web-session; native: shared keychain) WITHOUT any
+  // IdP `fedcm_session` cookie or top-level establish hop.
 
   return claimed.user;
 }

package/lib/commonjs/ui/context/inSessionTokenRefresh.js

@@ -1,243 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.TOKEN_REFRESH_LEAD_MS = void 0;
-exports.createInSessionRefreshHandler = createInSessionRefreshHandler;
-exports.startTokenRefreshScheduler = startTokenRefreshScheduler;
-var _core = require("@oxyhq/core");
-var _reactNative = require("react-native");
-var _useWebSSO = require("../hooks/useWebSSO.js");
-var _silentSessionRestore = require("./silentSessionRestore.js");
-/**
- * In-session access-token refresh for the React Native / Expo SDK.
- *
- * THE GAP THIS CLOSES: the services `OxyContext` owns the session but never
- * installed an `authRefreshHandler` on the owner `HttpService`, so
- * `HttpService.refreshAccessToken` short-circuited to `null` — there was NO
- * in-session token refresh on the RN path at all. A 15-minute access token
- * expired with the tab/app open and nothing re-minted one; cross-apex RP feeds
- * (mention.earth, …) then 401'd in a loop while `isAuthenticated` stayed `true`
- * (a zombie logged-in state), because the `Domain=oxy.so` refresh cookie can't
- * reach `api.<apex>`. (`AuthManager`, which installs a refresh handler on the
- * web path, is only ever constructed by `WebOxyProvider` in `@oxyhq/auth`.)
- *
- * THE FIX, two cooperating pieces both wired from `OxyContext`:
- *
- *  1. {@link createInSessionRefreshHandler} — an `AuthRefreshHandler` installed
- *     on the owner client. It re-mints a fresh access token WITHOUT a page
- *     reload by composing the SAME silent-restore primitive cold boot uses
- *     ({@link mintSessionViaPerApexIframe}) — not a copy. The linked client
- *     (`createLinkedClient`) inherits the fix for free: its refresh delegates
- *     back to the owner's `refreshAccessToken`.
- *
- *  2. {@link startTokenRefreshScheduler} — a proactive scheduler that refreshes
- *     ~{@link TOKEN_REFRESH_LEAD_MS} before expiry (and on web tab-focus / native
- *     app-foreground), so the common case never even reaches the reactive
- *     401-then-recover flash.
- *
- * Concurrency/cooldown/dedup are owned by `HttpService.refreshAccessToken`
- * (single in-flight `tokenRefreshPromise` + cooldown) — this module does not
- * reimplement them, so the timer / foreground / per-request triggers collapse to
- * one network attempt (no refresh storm).
- *
- * NOTE (session-sync cutover, Task 5): the web arm chain used to fall through
- * to a same-apex `oxy_rt` refresh-cookie arm (`refreshAllSessions` +
- * `selectActiveRefreshAccount`). That arm is DELETED — the device account set
- * is now server-authoritative via `SessionClient` (`@oxyhq/core`), which
- * `OxyContext` bootstraps/reprojects independently of in-session token
- * refresh. `selectActiveRefreshAccount` had no other caller and was deleted
- * with it.
- */
-
-/**
- * Per-arm fail-fast budget (ms) for the web first-party `/auth/silent` iframe
- * arm. Slightly more generous than the cold-boot iframe budget (2.5s) because an
- * in-session refresh is NOT in the first-paint critical path — a couple hundred
- * ms of extra headroom for the same-origin handshake is worth a higher success
- * rate. `silentSignIn` still fail-fasts on `iframe.onerror`, so a hard failure
- * returns well before this.
- */
-const SILENT_IFRAME_REFRESH_TIMEOUT = 4000;
-
-/**
- * Lead time (ms) before access-token expiry at which the proactive scheduler
- * refreshes. Mirrors `HttpService`'s per-request `TOKEN_REFRESH_LEAD_SECONDS`
- * (60s) so the scheduled refresh and the request-time preflight refresh use the
- * same window — the scheduler simply fires it during idle/background instead of
- * waiting for the next request.
- */
-const TOKEN_REFRESH_LEAD_MS = exports.TOKEN_REFRESH_LEAD_MS = 60_000;
-
-/**
- * A single refresh arm: attempts one silent-restore mechanism and resolves to
- * the freshly planted access token, or `null` to fall through to the next arm.
- */
-
-/**
- * Build the in-session `AuthRefreshHandler` for the owner client.
- *
- * Arms run in an explicit order; the first to plant a token wins. Each arm
- * resolves to the planted token (read back via `getAccessToken()` — the
- * underlying SDK call plants it internally) or `null`. A throw in one arm is
- * logged and treated as `null` so the chain continues.
- *
- *   NATIVE (Expo): shared cross-app identity key re-mint
- *     (`signInWithSharedIdentity` → challenge→sign→verify plants the tokens).
- *     The ONLY silent native arm (mirrors cold boot's `shared-key-signin`); the
- *     `/auth/silent` web iframe is NEVER attempted on native. Resolves to `null`
- *     when the device holds no shared identity (e.g. a password-only native
- *     sign-in) so a genuinely dead session reconciles to logged-out rather than
- *     staying a zombie.
- *
- *   WEB: Per-apex `/auth/silent` iframe — {@link mintSessionViaPerApexIframe}
- *     (shared verbatim with cold boot). The durable cross-apex path; also
- *     covers `*.oxy.so` (the per-apex host IS the central host there). There
- *     is no FedCM arm — FedCM was removed from the client sign-in/refresh path
- *     entirely (Chrome-only; see `CrossDomainAuth`'s doc comment in
- *     `@oxyhq/core` for the production sign-in loop that motivated the
- *     removal).
- *
- * NO RECURSION: no arm issues a request through the authed client's
- * `refreshAccessToken` path. The iframe transport is postMessage-based; the
- * follow-up `/session/user` fetch inside `silentSignIn`
- * runs against the just-planted FULL-TTL token (≫ the preflight lead), so it
- * never re-enters the refresh path.
- */
-function createInSessionRefreshHandler(oxyServices) {
-  const runArm = async (label, reason, arm) => {
-    try {
-      return await arm();
-    } catch (error) {
-      if (__DEV__) {
-        _core.logger.debug(`In-session refresh arm "${label}" failed (falling through)`, {
-          component: 'inSessionTokenRefresh',
-          method: 'authRefreshHandler',
-          reason
-        }, error);
-      }
-      return null;
-    }
-  };
-  const webArms = [['silent-iframe', async () => (await (0, _silentSessionRestore.mintSessionViaPerApexIframe)(oxyServices, SILENT_IFRAME_REFRESH_TIMEOUT)) ? oxyServices.getAccessToken() : null]];
-  return async reason => {
-    if (!(0, _useWebSSO.isWebBrowser)()) {
-      return runArm('native-shared-key', reason, async () => (await oxyServices.signInWithSharedIdentity?.()) ? oxyServices.getAccessToken() : null);
-    }
-    for (const [label, arm] of webArms) {
-      const token = await runArm(label, reason, arm);
-      if (token) {
-        return token;
-      }
-    }
-    return null;
-  };
-}
-
-/**
- * Handle returned by {@link startTokenRefreshScheduler}; call `dispose()` to tear
- * down the timer and the foreground listener.
- */
-
-/**
- * Start the proactive in-session refresh scheduler against `oxyServices`.
- *
- * Schedules a single timer to fire {@link TOKEN_REFRESH_LEAD_MS} before the
- * current access token's `exp`, calling `httpService.refreshAccessToken`
- * ('preflight') — which runs the installed handler and is deduped + cooldown-
- * guarded. After every attempt it reschedules from the (possibly rotated) token.
- * It also reschedules whenever the token changes (`onTokensChanged` — so a
- * sign-out that clears the token cancels the timer) and, on web tab-focus /
- * native app-foreground, refreshes immediately if already inside the lead window
- * (a long-hidden tab throttles timers, so the token can be expired on return).
- *
- * The `exp` is derived directly from the JWT via `getAccessTokenExpiry()`. No-ops
- * cleanly when there is no token, an opaque/no-`exp` token, or the host lacks
- * `getAccessTokenExpiry` (older stubs) — the reactive 401 path stays the only
- * refresh trigger in those cases.
- */
-function startTokenRefreshScheduler(oxyServices) {
-  let disposed = false;
-  let timer = null;
-  const clearTimer = () => {
-    if (timer !== null) {
-      clearTimeout(timer);
-      timer = null;
-    }
-  };
-  const runRefresh = () => {
-    // `refreshAccessToken` is deduped + cooldown-guarded internally, so this is
-    // safe to call from the timer, the foreground listener, and request-time
-    // preflight concurrently — they collapse to one network attempt.
-    const refresh = oxyServices.httpService.refreshAccessToken?.('preflight');
-    if (!refresh) {
-      return;
-    }
-    void refresh.catch(() => null).finally(() => {
-      if (!disposed) {
-        schedule();
-      }
-    });
-  };
-  const schedule = () => {
-    clearTimer();
-    if (disposed || !oxyServices.getAccessToken()) {
-      return;
-    }
-    const expSeconds = oxyServices.getAccessTokenExpiry?.() ?? null;
-    if (expSeconds === null) {
-      return;
-    }
-    const fireInMs = expSeconds * 1000 - Date.now() - TOKEN_REFRESH_LEAD_MS;
-    timer = setTimeout(runRefresh, Math.max(fireInMs, 0));
-  };
-  const onForeground = () => {
-    if (disposed || !oxyServices.getAccessToken()) {
-      return;
-    }
-    const expSeconds = oxyServices.getAccessTokenExpiry?.() ?? null;
-    if (expSeconds === null) {
-      return;
-    }
-    const remainingMs = expSeconds * 1000 - Date.now();
-    if (remainingMs <= TOKEN_REFRESH_LEAD_MS) {
-      runRefresh();
-    } else {
-      schedule();
-    }
-  };
-  const unsubscribeTokens = oxyServices.onTokensChanged(() => {
-    if (!disposed) {
-      schedule();
-    }
-  });
-  let removeForeground = null;
-  if ((0, _useWebSSO.isWebBrowser)() && typeof document !== 'undefined') {
-    const handler = () => {
-      if (document.visibilityState === 'visible') {
-        onForeground();
-      }
-    };
-    document.addEventListener('visibilitychange', handler);
-    removeForeground = () => document.removeEventListener('visibilitychange', handler);
-  } else if (!(0, _useWebSSO.isWebBrowser)() && _reactNative.AppState && typeof _reactNative.AppState.addEventListener === 'function') {
-    const subscription = _reactNative.AppState.addEventListener('change', state => {
-      if (state === 'active') {
-        onForeground();
-      }
-    });
-    removeForeground = () => subscription.remove();
-  }
-  schedule();
-  return {
-    dispose() {
-      disposed = true;
-      clearTimer();
-      unsubscribeTokens();
-      removeForeground?.();
-      removeForeground = null;
-    }
-  };
-}
-//# sourceMappingURL=inSessionTokenRefresh.js.map

package/lib/commonjs/ui/context/inSessionTokenRefresh.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_core","require","_reactNative","_useWebSSO","_silentSessionRestore","SILENT_IFRAME_REFRESH_TIMEOUT","TOKEN_REFRESH_LEAD_MS","exports","createInSessionRefreshHandler","oxyServices","runArm","label","reason","arm","error","__DEV__","loggerUtil","debug","component","method","webArms","mintSessionViaPerApexIframe","getAccessToken","isWebBrowser","signInWithSharedIdentity","token","startTokenRefreshScheduler","disposed","timer","clearTimer","clearTimeout","runRefresh","refresh","httpService","refreshAccessToken","catch","finally","schedule","expSeconds","getAccessTokenExpiry","fireInMs","Date","now","setTimeout","Math","max","onForeground","remainingMs","unsubscribeTokens","onTokensChanged","removeForeground","document","handler","visibilityState","addEventListener","removeEventListener","AppState","subscription","state","remove","dispose"],"sourceRoot":"../../../../src","sources":["ui/context/inSessionTokenRefresh.ts"],"mappings":";;;;;;;;AA6CA,IAAAA,KAAA,GAAAC,OAAA;AACA,IAAAC,YAAA,GAAAD,OAAA;AACA,IAAAE,UAAA,GAAAF,OAAA;AACA,IAAAG,qBAAA,GAAAH,OAAA;AAhDA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAWA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMI,6BAA6B,GAAG,IAAI;;AAE1C;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMC,qBAAqB,GAAAC,OAAA,CAAAD,qBAAA,GAAG,MAAM;;AAE3C;AACA;AACA;AACA;;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASE,6BAA6BA,CAACC,WAAwB,EAAsB;EAC1F,MAAMC,MAAM,GAAG,MAAAA,CAAOC,KAAa,EAAEC,MAAyB,EAAEC,GAAe,KAA6B;IAC1G,IAAI;MACF,OAAO,MAAMA,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC,OAAOC,KAAK,EAAE;MACd,IAAIC,OAAO,EAAE;QACXC,YAAU,CAACC,KAAK,CACd,2BAA2BN,KAAK,4BAA4B,EAC5D;UAAEO,SAAS,EAAE,uBAAuB;UAAEC,MAAM,EAAE,oBAAoB;UAAEP;QAAO,CAAC,EAC5EE,KACF,CAAC;MACH;MACA,OAAO,IAAI;IACb;EACF,CAAC;EAED,MAAMM,OAAoC,GAAG,CAC3C,CAAC,eAAe,EAAE,YAChB,CAAC,MAAM,IAAAC,iDAA2B,EAACZ,WAAW,EAAEJ,6BAA6B,CAAC,IAC1EI,WAAW,CAACa,cAAc,CAAC,CAAC,GAC5B,IAAI,CACT,CACF;EAED,OAAO,MAAOV,MAAyB,IAA6B;IAClE,IAAI,CAAC,IAAAW,uBAAY,EAAC,CAAC,EAAE;MACnB,OAAOb,MAAM,CAAC,mBAAmB,EAAEE,MAAM,EAAE,YACzC,CAAC,MAAMH,WAAW,CAACe,wBAAwB,GAAG,CAAC,IAAIf,WAAW,CAACa,cAAc,CAAC,CAAC,GAAG,IACpF,CAAC;IACH;IAEA,KAAK,MAAM,CAACX,KAAK,EAAEE,GAAG,CAAC,IAAIO,OAAO,EAAE;MAClC,MAAMK,KAAK,GAAG,MAAMf,MAAM,CAACC,KAAK,EAAEC,MAAM,EAAEC,GAAG,CAAC;MAC9C,IAAIY,KAAK,EAAE;QACT,OAAOA,KAAK;MACd;IACF;IACA,OAAO,IAAI;EACb,CAAC;AACH;;AAEA;AACA;AACA;AACA;;AAKA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,0BAA0BA,CAACjB,WAAwB,EAA+B;EAChG,IAAIkB,QAAQ,GAAG,KAAK;EACpB,IAAIC,KAA2C,GAAG,IAAI;EAEtD,MAAMC,UAAU,GAAGA,CAAA,KAAY;IAC7B,IAAID,KAAK,KAAK,IAAI,EAAE;MAClBE,YAAY,CAACF,KAAK,CAAC;MACnBA,KAAK,GAAG,IAAI;IACd;EACF,CAAC;EAED,MAAMG,UAAU,GAAGA,CAAA,KAAY;IAC7B;IACA;IACA;IACA,MAAMC,OAAO,GAAGvB,WAAW,CAACwB,WAAW,CAACC,kBAAkB,GAAG,WAAW,CAAC;IACzE,IAAI,CAACF,OAAO,EAAE;MACZ;IACF;IACA,KAAKA,OAAO,CACTG,KAAK,CAAC,MAAM,IAAI,CAAC,CACjBC,OAAO,CAAC,MAAM;MACb,IAAI,CAACT,QAAQ,EAAE;QACbU,QAAQ,CAAC,CAAC;MACZ;IACF,CAAC,CAAC;EACN,CAAC;EAED,MAAMA,QAAQ,GAAGA,CAAA,KAAY;IAC3BR,UAAU,CAAC,CAAC;IACZ,IAAIF,QAAQ,IAAI,CAAClB,WAAW,CAACa,cAAc,CAAC,CAAC,EAAE;MAC7C;IACF;IACA,MAAMgB,UAAU,GAAG7B,WAAW,CAAC8B,oBAAoB,GAAG,CAAC,IAAI,IAAI;IAC/D,IAAID,UAAU,KAAK,IAAI,EAAE;MACvB;IACF;IACA,MAAME,QAAQ,GAAGF,UAAU,GAAG,IAAI,GAAGG,IAAI,CAACC,GAAG,CAAC,CAAC,GAAGpC,qBAAqB;IACvEsB,KAAK,GAAGe,UAAU,CAACZ,UAAU,EAAEa,IAAI,CAACC,GAAG,CAACL,QAAQ,EAAE,CAAC,CAAC,CAAC;EACvD,CAAC;EAED,MAAMM,YAAY,GAAGA,CAAA,KAAY;IAC/B,IAAInB,QAAQ,IAAI,CAAClB,WAAW,CAACa,cAAc,CAAC,CAAC,EAAE;MAC7C;IACF;IACA,MAAMgB,UAAU,GAAG7B,WAAW,CAAC8B,oBAAoB,GAAG,CAAC,IAAI,IAAI;IAC/D,IAAID,UAAU,KAAK,IAAI,EAAE;MACvB;IACF;IACA,MAAMS,WAAW,GAAGT,UAAU,GAAG,IAAI,GAAGG,IAAI,CAACC,GAAG,CAAC,CAAC;IAClD,IAAIK,WAAW,IAAIzC,qBAAqB,EAAE;MACxCyB,UAAU,CAAC,CAAC;IACd,CAAC,MAAM;MACLM,QAAQ,CAAC,CAAC;IACZ;EACF,CAAC;EAED,MAAMW,iBAAiB,GAAGvC,WAAW,CAACwC,eAAe,CAAC,MAAM;IAC1D,IAAI,CAACtB,QAAQ,EAAE;MACbU,QAAQ,CAAC,CAAC;IACZ;EACF,CAAC,CAAC;EAEF,IAAIa,gBAAqC,GAAG,IAAI;EAChD,IAAI,IAAA3B,uBAAY,EAAC,CAAC,IAAI,OAAO4B,QAAQ,KAAK,WAAW,EAAE;IACrD,MAAMC,OAAO,GAAGA,CAAA,KAAY;MAC1B,IAAID,QAAQ,CAACE,eAAe,KAAK,SAAS,EAAE;QAC1CP,YAAY,CAAC,CAAC;MAChB;IACF,CAAC;IACDK,QAAQ,CAACG,gBAAgB,CAAC,kBAAkB,EAAEF,OAAO,CAAC;IACtDF,gBAAgB,GAAGA,CAAA,KAAMC,QAAQ,CAACI,mBAAmB,CAAC,kBAAkB,EAAEH,OAAO,CAAC;EACpF,CAAC,MAAM,IAAI,CAAC,IAAA7B,uBAAY,EAAC,CAAC,IAAIiC,qBAAQ,IAAI,OAAOA,qBAAQ,CAACF,gBAAgB,KAAK,UAAU,EAAE;IACzF,MAAMG,YAAY,GAAGD,qBAAQ,CAACF,gBAAgB,CAAC,QAAQ,EAAGI,KAAqB,IAAK;MAClF,IAAIA,KAAK,KAAK,QAAQ,EAAE;QACtBZ,YAAY,CAAC,CAAC;MAChB;IACF,CAAC,CAAC;IACFI,gBAAgB,GAAGA,CAAA,KAAMO,YAAY,CAACE,MAAM,CAAC,CAAC;EAChD;EAEAtB,QAAQ,CAAC,CAAC;EAEV,OAAO;IACLuB,OAAOA,CAAA,EAAS;MACdjC,QAAQ,GAAG,IAAI;MACfE,UAAU,CAAC,CAAC;MACZmB,iBAAiB,CAAC,CAAC;MACnBE,gBAAgB,GAAG,CAAC;MACpBA,gBAAgB,GAAG,IAAI;IACzB;EACF,CAAC;AACH","ignoreList":[]}

package/lib/commonjs/ui/context/silentSessionRestore.js

@@ -1,56 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.mintSessionViaPerApexIframe = mintSessionViaPerApexIframe;
-var _core = require("@oxyhq/core");
-/**
- * Silent, no-reload session-restore PRIMITIVE — the single shared
- * implementation used by BOTH cold boot (`OxyContext.restoreSessionsFromStorage`)
- * and in-session token refresh (`createInSessionRefreshHandler`). Neither caller
- * re-implements it; they compose it. Keeping one home avoids the two paths
- * drifting on "how do we mint a first-party token without a page reload".
- *
- * Platform-agnostic at the type level and returns plain data; the callers own
- * the side effects that differ between them (cold boot COMMITS the recovered
- * session into provider state; refresh only reads the freshly planted bearer).
- *
- * NOTE (session-sync cutover, Task 5): this file used to also export
- * `selectActiveRefreshAccount`, which picked the active account out of a
- * `refreshAllSessions` (`oxy_rt` refresh-cookie) snapshot. Deleted — its only
- * caller was the in-session refresh handler's now-deleted `refresh-cookie`
- * arm. The device account SET is server-authoritative via `SessionClient`
- * (`@oxyhq/core`) now.
- */
-
-/**
- * Mint a fresh first-party session via the PER-APEX `/auth/silent` iframe — the
- * durable cross-domain restore path that works WITHOUT a top-level navigation
- * (so it succeeds under Safari ITP / Firefox TCP and in a backgrounded tab).
- *
- * The instance is configured with the CENTRAL auth URL, so we explicitly point
- * the iframe at the per-apex host (`auth.<rp-apex>`) via `autoDetectAuthWebUrl()`
- * + `silentSignIn`'s `authWebUrlOverride`. On a `*.oxy.so` app the per-apex host
- * IS the central host, so this also covers same-apex. When auto-detection bails
- * (localhost / IP / single-label / off-browser) there is no per-apex IdP and we
- * return `null`. `silentSignIn` plants the access token internally on success.
- *
- * @returns the recovered session (token already planted) when complete, else
- * `null` (no per-apex IdP, no session, or an incomplete iframe response).
- */
-async function mintSessionViaPerApexIframe(oxyServices, timeoutMs) {
-  const perApexAuthUrl = (0, _core.autoDetectAuthWebUrl)();
-  if (!perApexAuthUrl) {
-    return null;
-  }
-  const session = await oxyServices.silentSignIn?.({
-    authWebUrlOverride: perApexAuthUrl,
-    timeout: timeoutMs
-  });
-  if (!session?.user || !session.sessionId) {
-    return null;
-  }
-  return session;
-}
-//# sourceMappingURL=silentSessionRestore.js.map

package/lib/commonjs/ui/context/silentSessionRestore.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_core","require","mintSessionViaPerApexIframe","oxyServices","timeoutMs","perApexAuthUrl","autoDetectAuthWebUrl","session","silentSignIn","authWebUrlOverride","timeout","user","sessionId"],"sourceRoot":"../../../../src","sources":["ui/context/silentSessionRestore.ts"],"mappings":";;;;;;AAmBA,IAAAA,KAAA,GAAAC,OAAA;AAnBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeC,2BAA2BA,CAC/CC,WAAwB,EACxBC,SAAiB,EACqB;EACtC,MAAMC,cAAc,GAAG,IAAAC,0BAAoB,EAAC,CAAC;EAC7C,IAAI,CAACD,cAAc,EAAE;IACnB,OAAO,IAAI;EACb;EACA,MAAME,OAAO,GAAG,MAAMJ,WAAW,CAACK,YAAY,GAAG;IAC/CC,kBAAkB,EAAEJ,cAAc;IAClCK,OAAO,EAAEN;EACX,CAAC,CAAC;EACF,IAAI,CAACG,OAAO,EAAEI,IAAI,IAAI,CAACJ,OAAO,CAACK,SAAS,EAAE;IACxC,OAAO,IAAI;EACb;EACA,OAAOL,OAAO;AAChB","ignoreList":[]}