[SDK] Add refreshSession and migrate the session-pinned infra (#11381)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

src/ageAssurance/useBeginAgeAssurance.ts

@@ -1,5 +1,4 @@
 import {Platform} from 'react-native'
-import {type AppBskyAgeassuranceBegin, AtpAgent} from '@atproto/api'
 import {useMutation} from '@tanstack/react-query'
 
 import {wait} from '#/lib/async/wait'
@@ -9,26 +8,28 @@ import {
   PUBLIC_APPVIEW_DID,
 } from '#/lib/constants'
 import {isNetworkError} from '#/lib/hooks/useCleanError'
-import {useAgent} from '#/state/session'
+import {createLexClient} from '#/lib/lexClient'
+import {usePdsClient} from '#/state/session'
 import {usePatchAgeAssuranceServerState} from '#/ageAssurance'
 import {logger} from '#/ageAssurance/logger'
 import {useAnalytics} from '#/analytics'
 import {BLUESKY_PROXY_DID} from '#/env'
 import {useGeolocation} from '#/geolocation'
+import {app, com} from '#/lexicons'
 
 const IS_DEV_ENV = BLUESKY_PROXY_DID !== PUBLIC_APPVIEW_DID
 const APPVIEW = IS_DEV_ENV ? DEV_ENV_APPVIEW : PUBLIC_APPVIEW
 
 export function useBeginAgeAssurance() {
   const ax = useAnalytics()
-  const agent = useAgent()
+  const pdsClient = usePdsClient()
   const geolocation = useGeolocation()
   const patchAgeAssuranceStateResponse = usePatchAgeAssuranceServerState()
 
   return useMutation({
     async mutationFn(
       props: Omit<
-        AppBskyAgeassuranceBegin.InputSchema,
+        app.bsky.ageassurance.begin.$InputBody,
         'countryCode' | 'regionCode'
       >,
     ) {
@@ -38,17 +39,22 @@ export function useBeginAgeAssurance() {
         throw new Error(`Geolocation not available, cannot init age assurance.`)
       }
 
-      const {
-        data: {token},
-      } = await agent.com.atproto.server.getServiceAuth({
+      const {token} = await pdsClient.call(com.atproto.server.getServiceAuth, {
         aud: BLUESKY_PROXY_DID,
         lxm: `app.bsky.ageassurance.begin`,
       })
 
-      const appView = new AtpAgent({service: APPVIEW})
-      appView.sessionManager.session = {...agent.session!}
-      appView.sessionManager.session.accessJwt = token
-      appView.sessionManager.session.refreshJwt = ''
+      /*
+       * A single-use client scoped to the service-auth token: it has no session,
+       * so nothing can refresh it, and the request goes straight to the appview
+       * with the token as a static `authorization` header. A raw client is
+       * allowed to preset that header where a session-backed one is not, which
+       * also makes the old `refreshJwt = ''` clone unnecessary.
+       */
+      const scopedClient = createLexClient({
+        service: APPVIEW,
+        headers: {authorization: `Bearer ${token}`},
+      })
 
       ax.metric('ageAssurance:api:begin', {
         platform: Platform.OS,
@@ -60,9 +66,9 @@ export function useBeginAgeAssurance() {
        * 2s wait is good actually. Email sending takes a hot sec and this helps
        * ensure the email is ready for the user once they open their inbox.
        */
-      const {data} = await wait(
+      const data = await wait(
         2e3,
-        appView.app.bsky.ageassurance.begin({
+        scopedClient.call(app.bsky.ageassurance.begin, {
           ...props,
           countryCode,
           regionCode,