@oxyhq/services 18.0.0 → 19.0.0

package/lib/typescript/module/ui/context/OxyContext.d.ts

@@ -2,6 +2,7 @@ import type React from 'react';
 import { type ReactNode } from 'react';
 import { OxyServices } from '@oxyhq/core';
 import type { User, ApiError, SessionLoginResponse, AccountNode, CreateAccountInput, ClientSession, AccountDialogController, AccountDialogView } from '@oxyhq/core';
+import type { SecurityAlert } from '@oxyhq/contracts';
 import type { UseFollowHook } from '../hooks/useFollow.types.js';
 import { useLanguageManagement } from '../hooks/useLanguageManagement.js';
 import type { RouteName } from '../navigation/routes.js';
@@ -40,7 +41,7 @@ export interface OxyContextState {
      *
      * Commits a successful session into context state through the SAME path the
      * QR device-flow and cold boot use (so `isAuthenticated` / `user` update and
-     * the rotating refresh family is persisted). Returns a discriminated result
+     * the zero-cookie device credential is persisted). Returns a discriminated result
      * so the caller can branch on the two-factor-required case — which creates NO
      * session; the caller completes the 2FA challenge with the returned
      * `loginToken` via {@link OxyContextState.completeTwoFactorSignIn}.
@@ -52,18 +53,22 @@ export interface OxyContextState {
     /**
      * Complete a 2FA-gated password sign-in started by {@link signInWithPassword}.
      * Presents the short-lived `loginToken` with a TOTP `token` or a `backupCode`;
-     * on success the session is committed exactly like a one-step sign-in.
+     * on success the session is committed exactly like a one-step sign-in. Returns
+     * any `securityAlert` the server attached so the caller can show the same
+     * "New sign-in detected" acknowledgement as the one-step path.
      */
     completeTwoFactorSignIn: (params: {
         loginToken: string;
         token?: string;
         backupCode?: string;
         deviceName?: string;
-    }) => Promise<void>;
+    }) => Promise<{
+        securityAlert?: SecurityAlert;
+    }>;
     /**
      * Commit a session obtained out-of-band (the "Sign in with Oxy" QR device
-     * flow). Plants tokens, persists the rotating refresh family, registers the
-     * account into the device set, and hydrates the full user profile.
+     * flow). Plants tokens, persists the zero-cookie device credential, registers
+     * the account into the device set, and hydrates the full user profile.
      */
     handleWebSession: (session: SessionLoginResponse) => Promise<void>;
     logout: (targetSessionId?: string) => Promise<void>;
@@ -134,7 +139,10 @@ export interface OxyContextState {
  * Result of {@link OxyContextState.signInWithPassword}.
  *
  * `'ok'` — the password was accepted and the session committed (so
- * `isAuthenticated` / `user` are updated and the refresh family persisted).
+ * `isAuthenticated` / `user` are updated and the device credential persisted).
+ * `securityAlert` is present when the server flagged this sign-in as anomalous
+ * (new device / location) — the caller shows a "New sign-in detected"
+ * acknowledgement before proceeding; the session is already committed.
  *
  * `'2fa_required'` — the account has two-factor auth enabled, so NO session was
  * created. Complete the challenge with the returned short-lived `loginToken`
@@ -142,6 +150,7 @@ export interface OxyContextState {
  */
 export type PasswordSignInResult = {
     status: 'ok';
+    securityAlert?: SecurityAlert;
 } | {
     status: '2fa_required';
     loginToken: string;

package/lib/typescript/module/ui/context/OxyContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OxyContext.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/OxyContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAQL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AAEf,OAAO,EAAE,WAAW,EAAa,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EACV,IAAI,EACJ,QAAQ,EACR,oBAAoB,EACpB,WAAW,EACX,kBAAkB,EAClB,aAAa,EAGb,uBAAuB,EACvB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AAerB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA0B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAgC,CAAC;AAKvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAsB,CAAC;AAgBtD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;OASG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yBAAyB,EAAE,MAAM,CAAC;IAGlC,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAG3C,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE;;;;;;;;;OASG;IACH,kBAAkB,EAAE,CAClB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,KACvD,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEnC;;;;OAIG;IACH,uBAAuB,EAAE,CAAC,MAAM,EAAE;QAChC,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpB;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAGnE,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,iBAAiB,EAAE,MAAM,OAAO,CAC9B,KAAK,CAAC;QACJ,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CACH,CAAC;IACF,uBAAuB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,gBAAgB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,mBAAmB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,eAAe,CAAC,EAAE,CAAC,cAAc,EAAE,SAAS,GAAG;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/G,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAK7B,sFAAsF;IACtF,uBAAuB,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACxD,iEAAiE;IACjE,mBAAmB,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,IAAI,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;IACtD,gFAAgF;IAChF,kBAAkB,EAAE,MAAM,IAAI,CAAC;IAS/B,0GAA0G;IAC1G,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB;;;;;;;;;;OAUG;IACH,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,aAAa,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CACnE;AAID;;;;;;;;;GASG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,MAAM,EAAE,IAAI,CAAA;CAAE,GAChB;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,SAAS,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;CACrC;AA4FD,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CA49BzD,CAAC;AAEF,eAAO,MAAM,kBAAkB,mCAAc,CAAC;AA8D9C,eAAO,MAAM,MAAM,QAAO,eAMzB,CAAC"}
+{"version":3,"file":"OxyContext.d.ts","sourceRoot":"","sources":["../../../../../src/ui/context/OxyContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAQL,KAAK,SAAS,EACf,MAAM,OAAO,CAAC;AAEf,OAAO,EAAE,WAAW,EAAa,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EACV,IAAI,EACJ,QAAQ,EACR,oBAAoB,EACpB,WAAW,EACX,kBAAkB,EAClB,aAAa,EAGb,uBAAuB,EACvB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AASrB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAOtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA0B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAgC,CAAC;AAKvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAsB,CAAC;AAgBtD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B;;;;;;;;;OASG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,yBAAyB,EAAE,MAAM,CAAC;IAGlC,WAAW,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAG3C,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE;;;;;;;;;OASG;IACH,kBAAkB,EAAE,CAClB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,KACvD,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEnC;;;;;;OAMG;IACH,uBAAuB,EAAE,CAAC,MAAM,EAAE;QAChC,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,KAAK,OAAO,CAAC;QAAE,aAAa,CAAC,EAAE,aAAa,CAAA;KAAE,CAAC,CAAC;IAEjD;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAGnE,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,WAAW,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,iBAAiB,EAAE,MAAM,OAAO,CAC9B,KAAK,CAAC;QACJ,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC,CACH,CAAC;IACF,uBAAuB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,gBAAgB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,mBAAmB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,eAAe,CAAC,EAAE,CAAC,cAAc,EAAE,SAAS,GAAG;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/G,gBAAgB,EAAE,MAAM,IAAI,CAAC;IAK7B,sFAAsF;IACtF,uBAAuB,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACxD,iEAAiE;IACjE,mBAAmB,EAAE,OAAO,CAAC;IAC7B;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,IAAI,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;IACtD,gFAAgF;IAChF,kBAAkB,EAAE,MAAM,IAAI,CAAC;IAS/B,0GAA0G;IAC1G,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB;;;;;;;;;;OAUG;IACH,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,eAAe,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,aAAa,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CACnE;AAID;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,aAAa,CAAC,EAAE,aAAa,CAAA;CAAE,GAC/C;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,SAAS,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;CACrC;AA8FD,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAq7BzD,CAAC;AAEF,eAAO,MAAM,kBAAkB,mCAAc,CAAC;AA8D9C,eAAO,MAAM,MAAM,QAAO,eAMzB,CAAC"}

package/lib/typescript/module/ui/context/hooks/useAuthOperations.d.ts

@@ -9,10 +9,9 @@ export interface UseAuthOperationsOptions {
     /**
      * The device-first persisted auth-state store. On EXPLICIT full sign-out the
      * session blob is cleared (`store.clear()`) so a reload's cold boot finds no
-     * refresh family to restore; on sign-in a returned rotating refresh token is
-     * persisted so the next boot warm-restores without a redirect. The long-lived
-     * device token SURVIVES sign-out (the device is unchanged), so it is never
-     * cleared here.
+     * device credential to restore; on sign-in the returned zero-cookie device
+     * credential (`deviceId` + `deviceSecret`) is persisted so the next boot
+     * warm-restores without a redirect.
      */
     store: AuthStateStore;
     activeSessionId: string | null;
@@ -51,7 +50,7 @@ export interface UseAuthOperationsResult {
     logoutAll: () => Promise<void>;
 }
 /**
- * Clear the persisted refresh-token family on an explicit full sign-out.
+ * Clear the persisted device credential on an explicit full sign-out.
  * Best-effort and non-blocking: sign-out must never fail because a storage
  * write threw. Exported so `OxyContext`'s zero-account branch (a REMOTE full
  * sign-out pushed over the socket) runs the EXACT same cleanup as the local

package/lib/typescript/module/ui/context/hooks/useAuthOperations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthOperations.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/context/hooks/useAuthOperations.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,aAAa,CAAC;AAIvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,WAAW,CAAC;IACzB,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjC;;;;;;;OAOG;IACH,KAAK,EAAE,cAAc,CAAC;IACtB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvD,cAAc,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;IACnF,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,0JAA0J;IAC1J,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;;;OAKG;IACH,aAAa,EAAE,aAAa,CAAC;IAC7B,+MAA+M;IAC/M,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,uBAAuB,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;IACpC,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IACnC,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,WAAW,EAAE,MAAM,IAAI,CAAC;IACxB,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;IAClD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CACrD;AAED,MAAM,WAAW,uBAAuB;IACtC,uCAAuC;IACvC,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,kCAAkC;IAClC,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,+BAA+B;IAC/B,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAChC;AAMD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,cAAc,EACrB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,GAClD,IAAI,CAIN;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAAI,wRAmB/B,wBAAwB,KAAG,uBAsR7B,CAAC"}
+{"version":3,"file":"useAuthOperations.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/context/hooks/useAuthOperations.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,aAAa,CAAC;AAIvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,WAAW,CAAC;IACzB,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjC;;;;;;OAMG;IACH,KAAK,EAAE,cAAc,CAAC;IACtB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvD,cAAc,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;IACnF,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,0JAA0J;IAC1J,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;;;OAKG;IACH,aAAa,EAAE,aAAa,CAAC;IAC7B,+MAA+M;IAC/M,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,uBAAuB,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;IACpC,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IACnC,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,WAAW,EAAE,MAAM,IAAI,CAAC;IACxB,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;IAClD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;CACrD;AAED,MAAM,WAAW,uBAAuB;IACtC,uCAAuC;IACvC,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,kCAAkC;IAClC,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,+BAA+B;IAC/B,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAChC;AAMD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,cAAc,EACrB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,GAClD,IAAI,CAIN;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAAI,wRAmB/B,wBAAwB,KAAG,uBAqR7B,CAAC"}

package/lib/typescript/module/ui/hooks/mutations/useAccountMutations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAccountMutations.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/hooks/mutations/useAccountMutations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EACvB,eAAe,EACf,IAAI,EACJ,eAAe,EAChB,MAAM,aAAa,CAAC;AAerB;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;;aA0PnB,CAAR;YACQ,CAAA;;aACe,CAAC;YACX,CAAC;;;;;;;;;;;;;;;;;;;;;UAmB8C,CAAC;mBAC/C,CAAC;aACY,CAAA;aACI,CAAC;;;UAEtB,CAAN;mBAIA,CAAL;aAAmC,CAAC;aAAmC,CAAC;;;;;;;;;EA3LxE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,eAAe;SAMQ,MAAM;WAAS,MAAM;WAAS,MAAM;WAAS,MAAM;;;EA4EtF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,UAAU,8BAA8B;IACtC,yCAAyC;IACzC,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAClC;;;;OAIG;IACH,WAAW,EAAE,IAAI,CAAC;CACnB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB;sBAoFf,OAAO,CAAC,eAAe,CAAC,KAAG,IAAI;2BAQpB,OAAO,CAAC,eAAe,CAAC,KAAG,OAAO,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;sBARnD,OAAO,CAAC,eAAe,CAAC,KAAG,IAAI;2BAQpB,OAAO,CAAC,eAAe,CAAC,KAAG,OAAO,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;sBARnD,OAAO,CAAC,eAAe,CAAC,KAAG,IAAI;2BAQpB,OAAO,CAAC,eAAe,CAAC,KAAG,OAAO,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;sBARnD,OAAO,CAAC,eAAe,CAAC,KAAG,IAAI;2BAQpB,OAAO,CAAC,eAAe,CAAC,KAAG,OAAO,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;iBAtO5D,CAAC;uBAA8B,CAAA;iBACpC,CAAF;cAAoB,CAAC;;;qBACrB,CAAJ;qBAEkB,CAAC;;;;;;;;;;oBAMf,CAAD;kBAAwB,CAAC;mBAE3B,CAAC;;;mBAIqC,CAAC;;;;;;;;;;;;;;;;;;;;;;CA8NzC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB;cAMoB,OAAO,CAAC,eAAe,CAAC;aAAW,MAAM;;;;cAgJjG,CAAC;AAEF,4CAA4C;AAC5C,UAAU,YAAY;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CACxI;AAED,4EAA4E;AAC5E,UAAU,YAAY;IACpB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC;IACvB,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;;EAmD5C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;EA+CpC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,uFAoBjC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa;UAWd,gBAAgB;iBACT,SAAS,GAAG,QAAQ,GAAG,UAAU;eACnC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;iBACrB,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI;WAS5C,CAAC"}
+{"version":3,"file":"useAccountMutations.d.ts","sourceRoot":"","sources":["../../../../../../src/ui/hooks/mutations/useAccountMutations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EACvB,eAAe,EACf,IAAI,EACJ,eAAe,EAChB,MAAM,aAAa,CAAC;AAerB;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;;aAyPb,CAAC;YAAkC,CAAC;;aAC1C,CAAC;YACO,CAAC;;;;;;;;;;;;;;;;;;;;;UAoBL,CAAC;mBACkB,CAAC;aAAmC,CAAC;aACrD,CAAC;;;UAEO,CAAC;mBACT,CAAC;aACN,CAAC;aAIP,CAAJ;;;;;;;;;EA3LD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,eAAe;SAMQ,MAAM;WAAS,MAAM;WAAS,MAAM;WAAS,MAAM;;;EA4EtF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,UAAU,8BAA8B;IACtC,yCAAyC;IACzC,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAClC;;;;OAIG;IACH,WAAW,EAAE,IAAI,CAAC;CACnB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,wBAAwB;sBAoFf,OAAO,CAAC,eAAe,CAAC,KAAG,IAAI;2BAQpB,OAAO,CAAC,eAAe,CAAC,KAAG,OAAO,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;sBARnD,OAAO,CAAC,eAAe,CAAC,KAAG,IAAI;2BAQpB,OAAO,CAAC,eAAe,CAAC,KAAG,OAAO,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;sBARnD,OAAO,CAAC,eAAe,CAAC,KAAG,IAAI;2BAQpB,OAAO,CAAC,eAAe,CAAC,KAAG,OAAO,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;sBARnD,OAAO,CAAC,eAAe,CAAC,KAAG,IAAI;2BAQpB,OAAO,CAAC,eAAe,CAAC,KAAG,OAAO,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;iBAtO5D,CAAC;uBAA8B,CAAA;iBACpC,CAAF;cAAoB,CAAC;;;qBACrB,CAAJ;qBAEkB,CAAC;;;;;;;;;;oBAMf,CAAD;kBAAwB,CAAC;mBAE3B,CAAC;;;mBAIqC,CAAC;;;;;;;;;;;;;;;;;;;;;;CA8NzC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,wBAAwB;cAMoB,OAAO,CAAC,eAAe,CAAC;aAAW,MAAM;;;;cAgJjG,CAAC;AAEF,4CAA4C;AAC5C,UAAU,YAAY;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CACxI;AAED,4EAA4E;AAC5E,UAAU,YAAY;IACpB,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC;IACvB,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;;EAmD5C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;EA+CpC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,uFAoBjC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa;UAWd,gBAAgB;iBACT,SAAS,GAAG,QAAQ,GAAG,UAAU;eACnC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;iBACrB,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI;WAS5C,CAAC"}

package/lib/typescript/module/ui/session/authStore.d.ts

@@ -1,18 +1,16 @@
 /**
  * Platform `AuthStateStore` for `@oxyhq/services`.
  *
- * The device-first session model persists the rotating refresh-token family
- * head per origin (web) / per device (native). `@oxyhq/core` owns the store
- * shape + logic (`createWebAuthStateStore` / `createNativeAuthStateStore`); this
- * module only supplies the platform storage seam and wires the native device
- * token to the SHARED keychain so every native Oxy app joins one DeviceSession:
+ * The zero-cookie device model persists the durable device credential
+ * (`deviceId` + `deviceSecret`) per origin (web) / per device (native), and the
+ * SDK re-mints the access token from that credential on cold boot. `@oxyhq/core`
+ * owns the store shape + logic (`createWebAuthStateStore` /
+ * `createNativeAuthStateStore`); this module only supplies the platform storage
+ * seam:
  *
  *  - web  → `createWebAuthStateStore()` (localStorage, in-memory fallback).
- *  - native → `createNativeAuthStateStore(secureKV)` for the SESSION blob
- *    (refresh token) over `expo-secure-store` (AsyncStorage fallback), with the
- *    long-lived DEVICE token delegated to `KeyManager`'s shared keychain
- *    (`group.so.oxy.shared`) instead of per-app storage — so an in-app login on
- *    any native Oxy app attributes to the SAME server-side DeviceSession.
+ *  - native → `createNativeAuthStateStore(secureKV)` for the SESSION blob over
+ *    `expo-secure-store` (AsyncStorage fallback).
  *
  * `expo-secure-store` is loaded via a runtime-computed dynamic import (the same
  * optional-native-module pattern `OxyProvider` uses for netinfo / keyboard
@@ -23,11 +21,9 @@ import { type AuthStateStore } from '@oxyhq/core';
 /**
  * Build the platform {@link AuthStateStore} for this runtime.
  *
- * Native additionally routes the device token through the shared keychain so
- * every native Oxy app shares one server-side DeviceSession; the session blob
- * (refresh token) stays per-app in SecureStore. Best-effort keychain access —
- * a locked/failed shared-keychain read degrades to "no device token" rather
- * than throwing out of cold boot / refresh.
+ * Native persists the SESSION blob (`deviceId` + `deviceSecret` + cached access
+ * token) per-app in SecureStore; the SDK re-mints the access token from the
+ * device credential on the next cold boot.
  */
 export declare function createPlatformAuthStateStore(): AuthStateStore;
 //# sourceMappingURL=authStore.d.ts.map

package/lib/typescript/module/ui/session/authStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authStore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/authStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAIL,KAAK,cAAc,EAGpB,MAAM,aAAa,CAAC;AAmFrB;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,IAAI,cAAc,CA2C7D"}
+{"version":3,"file":"authStore.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/authStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAGL,KAAK,cAAc,EAEpB,MAAM,aAAa,CAAC;AAmFrB;;;;;;GAMG;AACH,wBAAgB,4BAA4B,IAAI,cAAc,CAM7D"}

package/lib/typescript/module/ui/session/createSessionClient.d.ts

@@ -1,4 +1,4 @@
-import { SessionClient, createSessionClientHost, type AuthStateStore, type OxyServices, type SessionClientOptions } from '@oxyhq/core';
+import { SessionClient, createSessionClientHost, type AuthStateStore, type OxyServices } from '@oxyhq/core';
 /**
  * Wire a `SessionClient` for `@oxyhq/services`.
  *
@@ -11,22 +11,18 @@ import { SessionClient, createSessionClientHost, type AuthStateStore, type OxySe
  *    core's lazy dynamic import of a bare specifier — bundler-fragile in
  *    Metro/Expo-web against the published core dist.
  *  - the device-first {@link createTokenTransport}, which mints a fallback token
- *    by rotating the persisted refresh family (`store`).
+ *    from the persisted device credential (`store` → `deviceId` + `deviceSecret`).
  *
  * `onUnauthenticated` fires when an applied device state has zero accounts (a
  * device signout-all): the provider clears the persisted store + local state so
  * a reload does not try to restore a dead session. The host is returned
  * alongside the client so the caller can call `host.setCurrentAccountId(...)`
  * as the active account changes.
+ *
+ * The realtime socket is bearer-only: a signed-out tab cannot join any device
+ * room, so there is no signed-out socket wiring.
  */
-export declare function createSessionClient(oxyServices: OxyServices, store: AuthStateStore, onUnauthenticated?: () => void, 
-/**
- * Optional signed-out realtime wiring: `signedOutSocketAuth` (open the socket
- * while signed out — web returns `true` to ride the `oxy_device` cookie,
- * native returns the shared device token) and `onSessionAppeared` (self-acquire
- * when a sibling signs in on this device).
- */
-extra?: Pick<SessionClientOptions, 'signedOutSocketAuth' | 'onSessionAppeared'>): {
+export declare function createSessionClient(oxyServices: OxyServices, store: AuthStateStore, onUnauthenticated?: () => void): {
     client: SessionClient;
     host: ReturnType<typeof createSessionClientHost>;
 };

package/lib/typescript/module/ui/session/createSessionClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createSessionClient.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/createSessionClient.ts"],"names":[],"mappings":"AACA,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,oBAAoB,EAC1B,MAAM,aAAa,CAAC;AAGrB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,WAAW,EACxB,KAAK,EAAE,cAAc,EACrB,iBAAiB,CAAC,EAAE,MAAM,IAAI;AAC9B;;;;;GAKG;AACH,KAAK,CAAC,EAAE,IAAI,CAAC,oBAAoB,EAAE,qBAAqB,GAAG,mBAAmB,CAAC,GAC9E;IACD,MAAM,EAAE,aAAa,CAAC;IACtB,IAAI,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;CAClD,CAKA"}
+{"version":3,"file":"createSessionClient.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/createSessionClient.ts"],"names":[],"mappings":"AACA,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,aAAa,CAAC;AAGrB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,WAAW,EACxB,KAAK,EAAE,cAAc,EACrB,iBAAiB,CAAC,EAAE,MAAM,IAAI,GAC7B;IACD,MAAM,EAAE,aAAa,CAAC;IACtB,IAAI,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;CAClD,CAKA"}

package/lib/typescript/module/ui/session/tokenTransport.d.ts

@@ -5,10 +5,9 @@ import { type AuthStateStore, type OxyServices, type TokenTransport } from '@oxy
  * `ensureActiveToken` is the fallback the client uses when a `session_state`
  * push arrived WITHOUT an embedded `activeToken` and the app currently holds no
  * bearer. It mints one through the ONE unified refresh path
- * (`refreshPersistedSession`): rotate the persisted refresh-token family
- * (`POST /auth/refresh-token`) and, on native, fall back to the shared-keychain
- * re-mint. There is no FedCM/silent-iframe arm anymore — the per-origin
- * persisted refresh token is the durable web credential.
+ * (`refreshPersistedSession`), which presents the persisted zero-cookie device
+ * credential (`deviceId` + `deviceSecret`) at `POST /session/device/token`. The
+ * persisted device credential is the sole durable restore credential.
  *
  * Concurrent pushes coalesce onto one in-flight mint. A failure is logged and
  * swallowed: this method must never throw out (it runs inside the socket state

package/lib/typescript/module/ui/session/tokenTransport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokenTransport.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/tokenTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,aAAa,CAAC;AAGrB;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,WAAW,EACxB,KAAK,EAAE,cAAc,GACpB,cAAc,CAsChB"}
+{"version":3,"file":"tokenTransport.d.ts","sourceRoot":"","sources":["../../../../../src/ui/session/tokenTransport.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,cAAc,EACpB,MAAM,aAAa,CAAC;AAGrB;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,WAAW,EACxB,KAAK,EAAE,cAAc,GACpB,cAAc,CAsChB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/services",
-  "version": "18.0.0",
+  "version": "19.0.0",
   "description": "OxyHQ Expo/React Native SDK — UI components, screens, and native features",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",
@@ -106,10 +106,10 @@
     }
   },
   "dependencies": {
-    "@oxyhq/contracts": "0.11.0"
+    "@oxyhq/contracts": "0.13.0"
   },
   "devDependencies": {
-    "@oxyhq/core": "8.0.0",
+    "@oxyhq/core": "9.0.0",
     "nativewind": "5.0.0-preview.3",
     "react-native-css": "^3.0.0",
     "@react-native-async-storage/async-storage": "^2.0.0",
@@ -153,7 +153,7 @@
   "peerDependencies": {
     "@expo/vector-icons": "^15.0.3",
     "@oxyhq/bloom": ">=0.16.0",
-    "@oxyhq/core": "^8.0.0",
+    "@oxyhq/core": "^9.0.0",
     "@react-native-async-storage/async-storage": "^2.0.0",
     "@react-native-community/netinfo": "^11.4.1",
     "@tanstack/query-async-storage-persister": "^5.101",

package/src/ui/context/OxyContext.tsx

@@ -31,6 +31,7 @@ import {
   createAccountDialogController,
   logger as loggerUtil,
 } from '@oxyhq/core';
+import type { SecurityAlert } from '@oxyhq/contracts';
 import {
   registerAccountDialogControls,
   notifyAccountDialogVisibility,
@@ -99,7 +100,7 @@ export interface OxyContextState {
    *
    * Commits a successful session into context state through the SAME path the
    * QR device-flow and cold boot use (so `isAuthenticated` / `user` update and
-   * the rotating refresh family is persisted). Returns a discriminated result
+   * the zero-cookie device credential is persisted). Returns a discriminated result
    * so the caller can branch on the two-factor-required case — which creates NO
    * session; the caller completes the 2FA challenge with the returned
    * `loginToken` via {@link OxyContextState.completeTwoFactorSignIn}.
@@ -113,19 +114,21 @@ export interface OxyContextState {
   /**
    * Complete a 2FA-gated password sign-in started by {@link signInWithPassword}.
    * Presents the short-lived `loginToken` with a TOTP `token` or a `backupCode`;
-   * on success the session is committed exactly like a one-step sign-in.
+   * on success the session is committed exactly like a one-step sign-in. Returns
+   * any `securityAlert` the server attached so the caller can show the same
+   * "New sign-in detected" acknowledgement as the one-step path.
    */
   completeTwoFactorSignIn: (params: {
     loginToken: string;
     token?: string;
     backupCode?: string;
     deviceName?: string;
-  }) => Promise<void>;
+  }) => Promise<{ securityAlert?: SecurityAlert }>;
 
   /**
    * Commit a session obtained out-of-band (the "Sign in with Oxy" QR device
-   * flow). Plants tokens, persists the rotating refresh family, registers the
-   * account into the device set, and hydrates the full user profile.
+   * flow). Plants tokens, persists the zero-cookie device credential, registers
+   * the account into the device set, and hydrates the full user profile.
    */
   handleWebSession: (session: SessionLoginResponse) => Promise<void>;
 
@@ -212,14 +215,17 @@ const OxyContext = createContext<OxyContextState | null>(null);
  * Result of {@link OxyContextState.signInWithPassword}.
  *
  * `'ok'` — the password was accepted and the session committed (so
- * `isAuthenticated` / `user` are updated and the refresh family persisted).
+ * `isAuthenticated` / `user` are updated and the device credential persisted).
+ * `securityAlert` is present when the server flagged this sign-in as anomalous
+ * (new device / location) — the caller shows a "New sign-in detected"
+ * acknowledgement before proceeding; the session is already committed.
  *
  * `'2fa_required'` — the account has two-factor auth enabled, so NO session was
  * created. Complete the challenge with the returned short-lived `loginToken`
  * via {@link OxyContextState.completeTwoFactorSignIn}.
  */
 export type PasswordSignInResult =
-  | { status: 'ok' }
+  | { status: 'ok'; securityAlert?: SecurityAlert }
   | { status: '2fa_required'; loginToken: string };
 
 export interface OxyContextProviderProps {
@@ -272,14 +278,16 @@ const DEFAULT_SESSION_VALIDITY_MS = 7 * 24 * 60 * 60 * 1000;
  */
 const SESSION_HANDOFF_DEADLINE = 6000;
 
-/** The internal commit input — a session plus the device-first extras that are
- * not on the public `SessionLoginResponse` (a rotating refresh token, a device
- * token). All extras optional so `SessionLoginResponse` is assignable. */
+/** The internal commit input — a session plus the zero-cookie device credential
+ * (`deviceId` + `deviceSecret`) that is not on the public `SessionLoginResponse`.
+ * All extras optional so `SessionLoginResponse` is assignable. */
 interface CommitInput {
   sessionId: string;
   accessToken?: string;
-  refreshToken?: string;
   deviceId?: string;
+  /** Rotating device secret (zero-cookie transport); persisted with `deviceId`
+   * so the cold boot can mint via `POST /session/device/token`. */
+  deviceSecret?: string;
   expiresAt?: string;
   userId?: string;
   /** Minimal user carried by the sign-in response; a best-effort fallback used
@@ -368,9 +376,9 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   }
   const oxyServices = oxyServicesRef.current;
 
-  // The device-first persisted auth-state store (per-origin refresh family on
-  // web; SecureStore session blob + shared-keychain device token on native).
-  // Built ONCE per provider mount.
+  // The device-first persisted auth-state store (per-origin zero-cookie device
+  // credential on web; SecureStore session blob on native). Built ONCE per
+  // provider mount.
   const authStoreRef = useRef<AuthStateStore | null>(null);
   if (!authStoreRef.current) {
     authStoreRef.current = createPlatformAuthStateStore();
@@ -545,19 +553,13 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   const markAuthResolvedRef = useRef(markAuthResolved);
   markAuthResolvedRef.current = markAuthResolved;
 
-  // Re-boot indirection: the SessionClient is built in the ref initializer below
-  // (before `runColdBoot` is defined), but its `onSessionAppeared` must re-run the
-  // cold boot to self-acquire when a sibling signs in on this device. A ref bridges
-  // the ordering; it is assigned right after `runColdBoot` is declared.
-  const runColdBootRef = useRef<(() => Promise<void>) | null>(null);
-
   // Server-authoritative device session client. Built ONCE per `oxyServices`
-  // instance. `onUnauthenticated` (a device signout-all pushed over the socket,
-  // or bootstrapped as zero-account) clears the persisted store + local state so
-  // a reload does not try to restore a session the device no longer has.
-  // `signedOutSocketAuth` + `onSessionAppeared` power the signed-out sync channel:
-  // an idle tab joins its `device:<id>` room (web via the `oxy_device` cookie,
-  // native via the shared device token) and self-acquires on a sibling sign-in.
+  // instance. `onUnauthenticated` (a device signout-all pushed over the
+  // bearer-authenticated socket, or bootstrapped as zero-account) clears the
+  // persisted store + local state so a reload does not try to restore a session
+  // the device no longer has. The realtime socket is bearer-only now: a
+  // signed-out tab cannot join any device room, so there is no signed-out sync
+  // wiring here.
   const sessionClientPairRef = useRef<ReturnType<typeof createSessionClient> | null>(null);
   if (!sessionClientPairRef.current) {
     sessionClientPairRef.current = createSessionClient(
@@ -569,22 +571,6 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
           logger('Failed to clear local state on remote sign-out', clearError);
         });
       },
-      {
-        signedOutSocketAuth: async () => {
-          // Web (`*.oxy.so`): the first-party `oxy_device` cookie rides the
-          // same-site handshake automatically — just connect.
-          if (isWebBrowser()) return true;
-          // Native (no cookie jar): present the shared device token if we have one.
-          try {
-            return (await authStore.loadDeviceToken()) ?? false;
-          } catch {
-            return false;
-          }
-        },
-        onSessionAppeared: () => {
-          void runColdBootRef.current?.();
-        },
-      },
     );
   }
   const { client: sessionClient, host: sessionClientHost } = sessionClientPairRef.current;
@@ -678,7 +664,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       }
     }
     await clearSessionState();
-    // Explicit FULL wipe: also drop the persisted refresh family so a reload
+    // Explicit FULL wipe: also drop the persisted device credential so a reload
     // finds nothing to restore.
     await authStore.clear();
     useAccountStore.getState().reset();
@@ -736,10 +722,10 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   }, [logger, oxyServices]);
 
   // Unified in-session refresh (SDK-owned; every RP inherits it). Installs the
-  // ONE core refresh handler (rotate the persisted refresh family; native falls
-  // back to the shared keychain) plus the proactive scheduler that refreshes
-  // ~60s before expiry and on tab-focus. Replaces the deleted services-local
-  // `inSessionTokenRefresh` module.
+  // ONE core refresh handler (re-mint from the persisted zero-cookie device
+  // credential via `POST /session/device/token`) plus the proactive scheduler
+  // that refreshes ~60s before expiry and on tab-focus. Replaces the deleted
+  // services-local `inSessionTokenRefresh` module.
   useEffect(() => {
     const dispose = installAuthRefreshHandler({ oxy: oxyServices, store: authStore });
     const scheduler = startTokenRefreshScheduler(oxyServices);
@@ -751,27 +737,27 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
 
   // ── Session commit funnel ────────────────────────────────────────────────
   // The single place a session becomes committed: plant tokens, persist the
-  // rotating refresh family, register the account into the server-authoritative
-  // device set, and hydrate the full user. Used by the QR device flow
-  // (`handleWebSession`), password sign-in, 2FA completion, and the cold boot.
+  // zero-cookie device credential (`deviceId` + `deviceSecret`), register the
+  // account into the server-authoritative device set, and hydrate the full user.
+  // Used by the QR device flow (`handleWebSession`), password sign-in, 2FA
+  // completion, and the cold boot.
   const commitSession = useCallback(
     async (input: CommitInput, options: { activate: boolean }): Promise<void> => {
       if (input.accessToken) {
         oxyServices.setTokens(input.accessToken);
       }
 
-      // Persist the durable blob when a rotating refresh token is present
-      // (trusted-lane sign-ins). The cold boot has usually persisted already;
-      // this is idempotent. A missing refresh token means the session survives
-      // reload via the device cookie (web) / shared keychain (native) instead.
-      if (input.refreshToken && input.userId) {
+      // Persist the durable blob when the zero-cookie device credential
+      // (`deviceId` + `deviceSecret`) is present. The cold boot has usually
+      // persisted already; this is idempotent. Without the credential there is
+      // nothing durable to persist and the session lives only for this runtime.
+      if (input.deviceId && input.deviceSecret && input.userId) {
         try {
-          const deviceToken = (await authStore.loadDeviceToken()) ?? undefined;
           const next: PersistedAuthState = {
             sessionId: input.sessionId,
-            refreshToken: input.refreshToken,
             userId: input.userId,
-            ...(deviceToken ? { deviceToken } : {}),
+            deviceId: input.deviceId,
+            deviceSecret: input.deviceSecret,
             ...(input.accessToken ? { accessToken: input.accessToken } : {}),
             ...(input.expiresAt ? { expiresAt: input.expiresAt } : {}),
           };
@@ -859,9 +845,9 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
         {
           sessionId: session.sessionId,
           accessToken: session.accessToken,
-          // deviceFlow threads a rotating refresh token on the runtime object
+          // deviceFlow threads the rotating deviceSecret on the runtime object
           // even though `SessionLoginResponse` does not type it.
-          refreshToken: (session as { refreshToken?: string }).refreshToken,
+          deviceSecret: (session as { deviceSecret?: string }).deviceSecret,
           deviceId: session.deviceId,
           expiresAt: session.expiresAt,
           userId: session.user.id,
@@ -935,9 +921,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       password: string,
       opts?: { deviceName?: string; deviceFingerprint?: string },
     ): Promise<PasswordSignInResult> => {
-      const deviceToken = (await authStore.loadDeviceToken()) ?? undefined;
       const result = await oxyServices.passwordSignIn(identifier, password, {
-        deviceToken,
         deviceName: opts?.deviceName,
         deviceFingerprint: opts?.deviceFingerprint,
       });
@@ -949,7 +933,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
         {
           sessionId: result.sessionId,
           accessToken: result.accessToken,
-          refreshToken: result.refreshToken,
+          deviceSecret: result.deviceSecret,
           deviceId: result.deviceId,
           expiresAt: result.expiresAt,
           userId: result.user.id,
@@ -957,9 +941,9 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
         },
         { activate: true },
       );
-      return { status: 'ok' };
+      return { status: 'ok', ...(result.securityAlert ? { securityAlert: result.securityAlert } : {}) };
     },
-    [oxyServices, authStore, commitSession],
+    [oxyServices, commitSession],
   );
 
   const completeTwoFactorSignIn = useCallback(
@@ -968,20 +952,18 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       token?: string;
       backupCode?: string;
       deviceName?: string;
-    }): Promise<void> => {
-      const deviceToken = (await authStore.loadDeviceToken()) ?? undefined;
+    }): Promise<{ securityAlert?: SecurityAlert }> => {
       const result = await oxyServices.completeTwoFactorSignIn({
         loginToken: params.loginToken,
         token: params.token,
         backupCode: params.backupCode,
-        deviceToken,
         deviceName: params.deviceName,
       });
       await commitSession(
         {
           sessionId: result.sessionId,
           accessToken: result.accessToken,
-          refreshToken: result.refreshToken,
+          deviceSecret: result.deviceSecret,
           deviceId: result.deviceId,
           expiresAt: result.expiresAt,
           userId: result.user.id,
@@ -989,8 +971,9 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
         },
         { activate: true },
       );
+      return { securityAlert: result.securityAlert };
     },
-    [oxyServices, authStore, commitSession],
+    [oxyServices, commitSession],
   );
 
   // ── Cold boot ────────────────────────────────────────────────────────────
@@ -1031,19 +1014,9 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
           markAuthResolvedRef.current();
         },
         onSignedOut: () => {
+          // The realtime socket is bearer-only: a signed-out tab cannot join any
+          // device room, so there is no signed-out socket to start here.
           markAuthResolvedRef.current();
-          // Open the signed-out realtime channel so this idle tab joins its
-          // `device:<id>` room (web `oxy_device` cookie / native device token)
-          // and self-acquires when a sibling signs in. Idempotent, best-effort.
-          void sessionClient.start().catch((startError) => {
-            if (__DEV__) {
-              loggerUtil.debug(
-                'signed-out socket start failed (non-fatal)',
-                { component: 'OxyContext', method: 'runColdBoot' },
-                startError as unknown,
-              );
-            }
-          });
         },
         onStepError: (id, error) => {
           if (__DEV__) {
@@ -1067,20 +1040,16 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       // Backstop: resolve on every exit path so the gate can never hang.
       markAuthResolvedRef.current();
     }
-  }, [oxyServices, authStore, sessionClient]);
-  // Bridge for `onSessionAppeared` (SessionClient) → re-run the cold boot to
-  // self-acquire when a sibling signs in on this device while this tab is idle.
-  runColdBootRef.current = runColdBoot;
+  }, [oxyServices, authStore]);
 
   useEffect(() => {
     if (initialized) {
       return;
     }
     // IdP mode (`coldBoot={false}`): this provider is NOT the ecosystem session
-    // authority, so it never runs the device-first restore and never opens the
-    // signed-out device-state socket (`runColdBoot` → `onSignedOut` is the sole
-    // place that socket starts). Resolve auth immediately as signed out so there
-    // is no boot spinner; a deliberate sign-in still commits a normal session.
+    // authority, so it never runs the device-first restore. Resolve auth
+    // immediately as signed out so there is no boot spinner; a deliberate sign-in
+    // still commits a normal session.
     if (!coldBoot) {
       setInitialized(true);
       markAuthResolved();
@@ -1204,7 +1173,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
         {
           sessionId: result.sessionId,
           accessToken: result.accessToken,
-          refreshToken: (result as { refreshToken?: string }).refreshToken,
+          deviceSecret: (result as { deviceSecret?: string }).deviceSecret,
           deviceId: result.deviceId,
           expiresAt: result.expiresAt,
           userId: result.user.id,
@@ -1367,7 +1336,7 @@ const LOADING_STATE: OxyContextState = {
   getPublicKey: () => Promise.resolve(null),
   signIn: () => rejectMissingProvider<User>(),
   signInWithPassword: () => rejectMissingProvider<PasswordSignInResult>(),
-  completeTwoFactorSignIn: () => rejectMissingProvider<void>(),
+  completeTwoFactorSignIn: () => rejectMissingProvider<{ securityAlert?: SecurityAlert }>(),
   handleWebSession: () => rejectMissingProvider<void>(),
   logout: () => rejectMissingProvider<void>(),
   logoutAll: () => rejectMissingProvider<void>(),