@codemem/server 0.47.0 → 0.47.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (18) hide show
  1. package/dist/account/link-registry.d.ts +1 -1
  2. package/dist/account/link-registry.d.ts.map +1 -1
  3. package/dist/account/owner-recovery-candidates.d.ts +1 -0
  4. package/dist/account/owner-recovery-candidates.d.ts.map +1 -1
  5. package/dist/account/owner-recovery-evidence.d.ts +5 -0
  6. package/dist/account/owner-recovery-evidence.d.ts.map +1 -1
  7. package/dist/account/owner-recovery-service.d.ts +8 -0
  8. package/dist/account/owner-recovery-service.d.ts.map +1 -1
  9. package/dist/account/status.d.ts.map +1 -1
  10. package/dist/index.js +74 -22
  11. package/dist/index.js.map +1 -1
  12. package/dist/routes/account-operations.d.ts.map +1 -1
  13. package/dist/routes/account-owner-recovery.d.ts.map +1 -1
  14. package/package.json +2 -2
  15. package/static/app.js +28 -28
  16. package/static/app.js.br +0 -0
  17. package/static/app.js.gz +0 -0
  18. package/static/index.html +4 -1
package/dist/account/link-registry.d.ts CHANGED
@@ -36,7 +36,7 @@ export interface AccountLinkRegistry {
36
36
  intent?: AccountOperationIntent;
37
37
  context: AccountContext;
38
38
  expectedCoordinatorId: string;
39
- expectedAuthority: CoordinatorAuthLinkAuthorityKind;
39
+ expectedAuthority: CoordinatorAuthLinkAuthorityKind | null;
40
40
  expectedLifecycleToken?: symbol;
41
41
  expectedLinkId?: string;
42
42
  }): AccountLinkStartResult;
package/dist/account/link-registry.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"link-registry.d.ts","sourceRoot":"","sources":["../../src/account/link-registry.ts"],"names":[],"mappings":"AACA,OAAO,EAGN,wBAAwB,EACxB,sBAAsB,EACtB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAuB,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAE5E,KAAK,gCAAgC,GAAG,UAAU,CACjD,OAAO,sBAAsB,CAC7B,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;AAE1B,MAAM,MAAM,kBAAkB,GAC3B,yBAAyB,GACzB,uBAAuB,GACvB,oBAAoB,GACpB,gBAAgB,GAChB,iBAAiB,GACjB,eAAe,GACf,kBAAkB,GAClB,iBAAiB,GACjB,mBAAmB,GACnB,cAAc,GACd,0BAA0B,GAC1B,uBAAuB,GAEvB,oBAAoB,GACpB,uBAAuB,GACvB,yBAAyB,GACzB,sBAAsB,GACtB,aAAa;AACf,gGAAgG;GAC9F,qBAAqB;AACvB,iFAAiF;GAC/E,gBAAgB;AAClB,yFAAyF;GACvF,kBAAkB,CAAC;AACtB,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;AACtF,MAAM,WAAW,sBAAsB;IACtC,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,GAAG,kBAAkB,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,GAAG,iBAAiB,CAAC;IAClG,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACnC,mBAAmB,EAAE,OAAO,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AACD,MAAM,MAAM,sBAAsB,GAC/B;IAAE,SAAS,EAAE,sBAAsB,CAAA;CAAE,GACrC;IAAE,KAAK,EAAE,0BAA0B,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,KAAK,EAAE,uBAAuB,GAAG,yBAAyB,CAAA;CAAE,CAAC;AAClE,MAAM,WAAW,mBAAmB;IACnC,kBAAkB,CAAC,IAAI,0BAA0B,GAAG,IAAI,CAAC;IACzD,KAAK,CAAC,OAAO,EAAE;QACd,MAAM,CAAC,EAAE,sBAAsB,CAAC;QAChC,OAAO,EAAE,cAAc,CAAC;QACxB,qBAAqB,EAAE,MAAM,CAAC;QAC9B,iBAAiB,EAAE,gCAAgC,CAAC;QACpD,sBAAsB,CAAC,EAAE,MAAM,CAAC;QAChC,cAAc,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,sBAAsB,CAAC;IAC3B,cAAc,IAAI,MAAM,CAAC;IACzB,oEAAoE;IACpE,cAAc,CAAC,IAAI,OAAO,CAAC;IAC3B,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CAAC;IACxD,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CAAC;IAC7D,SAAS,IAAI,OAAO,CAAC;IACrB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC/C,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CAAC;IAC3D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AACD,MAAM,WAAW,0BAA0B;IAC1C,SAAS,IAAI,OAAO,CAAC;IACrB,OAAO,IAAI,IAAI,CAAC;CAChB;AACD,MAAM,WAAW,0BAA0B;IAC1C,WAAW,EAAE,oBAAoB,CAAC;IAClC,IAAI,CAAC,EAAE,OAAO,sBAAsB,CAAC;IACrC,MAAM,CAAC,EAAE,OAAO,wBAAwB,CAAC;IACzC,0FAA0F;IAC1F,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAuCD,wBAAgB,aAAa,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAMtF;AAkZD,wBAAgB,yBAAyB,CACxC,OAAO,EAAE,0BAA0B,GACjC,mBAAmB,CAErB"}
1
+ {"version":3,"file":"link-registry.d.ts","sourceRoot":"","sources":["../../src/account/link-registry.ts"],"names":[],"mappings":"AACA,OAAO,EAGN,wBAAwB,EACxB,sBAAsB,EACtB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,KAAK,EAAuB,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAE5E,KAAK,gCAAgC,GAAG,UAAU,CACjD,OAAO,sBAAsB,CAC7B,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC;AAE1B,MAAM,MAAM,kBAAkB,GAC3B,yBAAyB,GACzB,uBAAuB,GACvB,oBAAoB,GACpB,gBAAgB,GAChB,iBAAiB,GACjB,eAAe,GACf,kBAAkB,GAClB,iBAAiB,GACjB,mBAAmB,GACnB,cAAc,GACd,0BAA0B,GAC1B,uBAAuB,GAEvB,oBAAoB,GACpB,uBAAuB,GACvB,yBAAyB,GACzB,sBAAsB,GACtB,aAAa;AACf,gGAAgG;GAC9F,qBAAqB;AACvB,iFAAiF;GAC/E,gBAAgB;AAClB,yFAAyF;GACvF,kBAAkB,CAAC;AACtB,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;AACtF,MAAM,WAAW,sBAAsB;IACtC,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,GAAG,kBAAkB,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,GAAG,iBAAiB,CAAC;IAClG,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACnC,mBAAmB,EAAE,OAAO,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AACD,MAAM,MAAM,sBAAsB,GAC/B;IAAE,SAAS,EAAE,sBAAsB,CAAA;CAAE,GACrC;IAAE,KAAK,EAAE,0BAA0B,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,KAAK,EAAE,uBAAuB,GAAG,yBAAyB,CAAA;CAAE,CAAC;AAClE,MAAM,WAAW,mBAAmB;IACnC,kBAAkB,CAAC,IAAI,0BAA0B,GAAG,IAAI,CAAC;IACzD,KAAK,CAAC,OAAO,EAAE;QACd,MAAM,CAAC,EAAE,sBAAsB,CAAC;QAChC,OAAO,EAAE,cAAc,CAAC;QACxB,qBAAqB,EAAE,MAAM,CAAC;QAC9B,iBAAiB,EAAE,gCAAgC,GAAG,IAAI,CAAC;QAC3D,sBAAsB,CAAC,EAAE,MAAM,CAAC;QAChC,cAAc,CAAC,EAAE,MAAM,CAAC;KACxB,GAAG,sBAAsB,CAAC;IAC3B,cAAc,IAAI,MAAM,CAAC;IACzB,oEAAoE;IACpE,cAAc,CAAC,IAAI,OAAO,CAAC;IAC3B,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CAAC;IACxD,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CAAC;IAC7D,SAAS,IAAI,OAAO,CAAC;IACrB,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC/C,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CAAC;IAC3D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AACD,MAAM,WAAW,0BAA0B;IAC1C,SAAS,IAAI,OAAO,CAAC;IACrB,OAAO,IAAI,IAAI,CAAC;CAChB;AACD,MAAM,WAAW,0BAA0B;IAC1C,WAAW,EAAE,oBAAoB,CAAC;IAClC,IAAI,CAAC,EAAE,OAAO,sBAAsB,CAAC;IACrC,MAAM,CAAC,EAAE,OAAO,wBAAwB,CAAC;IACzC,0FAA0F;IAC1F,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAuCD,wBAAgB,aAAa,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAMtF;AA0ZD,wBAAgB,yBAAyB,CACxC,OAAO,EAAE,0BAA0B,GACjC,mBAAmB,CAErB"}
package/dist/account/owner-recovery-candidates.d.ts CHANGED
@@ -25,6 +25,7 @@ export declare function readRecoveryCandidates(options: {
25
25
  adminSecret: string;
26
26
  groups: readonly string[];
27
27
  device: CandidateDevice;
28
+ timeoutS?: number;
28
29
  }): Promise<RecoveryOwnerCandidate[]>;
29
30
  export {};
30
31
  //# sourceMappingURL=owner-recovery-candidates.d.ts.map
package/dist/account/owner-recovery-candidates.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"owner-recovery-candidates.d.ts","sourceRoot":"","sources":["../../src/account/owner-recovery-candidates.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,qCAAqC,EAG1C,MAAM,eAAe,CAAC;AAGvB,MAAM,WAAW,sBAAsB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AACD,UAAU,eAAe;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACnB;AA2BD,8FAA8F;AAC9F,wBAAgB,mBAAmB,CAClC,SAAS,EAAE,SAAS,OAAO,EAAE,EAC7B,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,GACvC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAS1B;AAqBD,wBAAgB,aAAa,CAC5B,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,EAChC,iBAAiB,EAAE,MAAM,GACvB,sBAAsB,EAAE,CAU1B;AAaD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE;IACrD,kBAAkB,EAAE,OAAO,qCAAqC,CAAC;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,MAAM,EAAE,eAAe,CAAC;CACxB,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAqBpC"}
1
+ {"version":3,"file":"owner-recovery-candidates.d.ts","sourceRoot":"","sources":["../../src/account/owner-recovery-candidates.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,qCAAqC,EAG1C,MAAM,eAAe,CAAC;AAGvB,MAAM,WAAW,sBAAsB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AACD,UAAU,eAAe;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACnB;AA2BD,8FAA8F;AAC9F,wBAAgB,mBAAmB,CAClC,SAAS,EAAE,SAAS,OAAO,EAAE,EAC7B,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,GACvC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAS1B;AAqBD,wBAAgB,aAAa,CAC5B,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,EAChC,iBAAiB,EAAE,MAAM,GACvB,sBAAsB,EAAE,CAU1B;AAaD;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE;IACrD,kBAAkB,EAAE,OAAO,qCAAqC,CAAC;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,MAAM,EAAE,eAAe,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAsBpC"}
package/dist/account/owner-recovery-evidence.d.ts CHANGED
@@ -5,6 +5,11 @@ export declare class AccountOwnerRecoveryError extends Error {
5
5
  readonly code: "invalid" | "busy" | "context_changed" | "unavailable";
6
6
  constructor(code?: "invalid" | "busy" | "context_changed" | "unavailable");
7
7
  }
8
+ /**
9
+ * The fix for an unsafe local state directory, or null for any other error. Matches the
10
+ * core error by code because the bundle can carry a second copy of the core class.
11
+ */
12
+ export declare function unsafeStorageMessage(error: unknown): string | null;
8
13
  export declare function requireRecovery(condition: unknown, code?: AccountOwnerRecoveryError["code"]): asserts condition;
9
14
  export declare function recoveryId(value: unknown): value is string;
10
15
  export declare function recoveryHash(value: unknown): value is string;
package/dist/account/owner-recovery-evidence.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"owner-recovery-evidence.d.ts","sourceRoot":"","sources":["../../src/account/owner-recovery-evidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAKN,KAAK,oCAAoC,EACzC,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACX,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,MAAM,2BAA2B,CAAC;AAEnC,eAAO,MAAM,cAAc,0CAA0C,CAAC;AAKtE,qBAAa,yBAA0B,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,GAAG,iBAAiB,GAAG,aAAa;IAAjF,YAAqB,IAAI,GAAE,SAAS,GAAG,MAAM,GAAG,iBAAiB,GAAG,aAAyB,EAE5F;CACD;AACD,wBAAgB,eAAe,CAC9B,SAAS,EAAE,OAAO,EAClB,IAAI,GAAE,yBAAyB,CAAC,MAAM,CAAa,GACjD,OAAO,CAAC,SAAS,CAEnB;AACD,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAQ1D;AACD,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE5D;AACD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGtE;AACD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAIjG;AAqFD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,oCAAoC,CAWhG;AACD,MAAM,WAAW,uBAAuB;IACvC,KAAK,EAAE,OAAO,GAAG,UAAU,GAAG,cAAc,CAAC;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,oCAAoC,CAAC;IAC/C,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAC3B,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B,OAAO,EAAE,MAAM,EAAE,CAAC;CAClB;AACD,wBAAgB,sBAAsB,CACrC,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,iBAAiB,EAC5B,OAAO,EAAE,MAAM,GACb,uBAAuB,CAiDzB;AA8BD,wBAAgB,kBAAkB,CACjC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,iBAAiB,GAC1B,GAAG,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAmCnD"}
1
+ {"version":3,"file":"owner-recovery-evidence.d.ts","sourceRoot":"","sources":["../../src/account/owner-recovery-evidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAKN,KAAK,oCAAoC,EACzC,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACX,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,MAAM,2BAA2B,CAAC;AAEnC,eAAO,MAAM,cAAc,0CAA0C,CAAC;AAKtE,qBAAa,yBAA0B,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,GAAG,iBAAiB,GAAG,aAAa;IAAjF,YAAqB,IAAI,GAAE,SAAS,GAAG,MAAM,GAAG,iBAAiB,GAAG,aAAyB,EAE5F;CACD;AACD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAGlE;AACD,wBAAgB,eAAe,CAC9B,SAAS,EAAE,OAAO,EAClB,IAAI,GAAE,yBAAyB,CAAC,MAAM,CAAa,GACjD,OAAO,CAAC,SAAS,CAEnB;AACD,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAQ1D;AACD,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE5D;AACD,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGtE;AACD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAIjG;AAqFD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,oCAAoC,CAWhG;AACD,MAAM,WAAW,uBAAuB;IACvC,KAAK,EAAE,OAAO,GAAG,UAAU,GAAG,cAAc,CAAC;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,oCAAoC,CAAC;IAC/C,IAAI,EAAE,kBAAkB,EAAE,CAAC;IAC3B,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B,OAAO,EAAE,MAAM,EAAE,CAAC;CAClB;AACD,wBAAgB,sBAAsB,CACrC,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,iBAAiB,EAC5B,OAAO,EAAE,MAAM,GACb,uBAAuB,CAiDzB;AA8BD,wBAAgB,kBAAkB,CACjC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,iBAAiB,GAC1B,GAAG,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAmCnD"}
package/dist/account/owner-recovery-service.d.ts CHANGED
@@ -14,8 +14,16 @@ export interface AccountOwnerRecoveryServiceOptions {
14
14
  reviewOwner?: typeof coordinatorAuthControllerReviewAction;
15
15
  /** Read-only device-owner preview used only to suggest recorded owners. */
16
16
  previewDeviceOwner?: typeof coordinatorAuthControllerReviewAction;
17
+ /** Configured `sync_coordinator_timeout_s`, read on every request. */
18
+ readCoordinatorTimeoutS?: () => number;
17
19
  now?: () => number;
18
20
  }
21
+ /**
22
+ * Scoped owner reviews read the full Team history, and confirming sends a fresh preview
23
+ * and then the commit. Each request can take several seconds on the live coordinator, so
24
+ * the 3s sync default would abort a commit the user already approved.
25
+ */
26
+ export declare const MIN_OWNER_REVIEW_TIMEOUT_S = 10;
19
27
  /** No routes or configuration composition: these callbacks are private server capabilities. */
20
28
  declare class AccountOwnerRecoveryService {
21
29
  #private;
package/dist/account/owner-recovery-service.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"owner-recovery-service.d.ts","sourceRoot":"","sources":["../../src/account/owner-recovery-service.ts"],"names":[],"mappings":"AACA,OAAO,EACN,qCAAqC,EAGrC,gCAAgC,EAChC,gDAAgD,EAChD,yCAAyC,EACzC,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAA8B,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EACN,KAAK,sBAAsB,EAE3B,MAAM,gCAAgC,CAAC;AAkBxC,OAAO,KAAK,EACX,eAAe,EACf,sBAAsB,EACtB,cAAc,EACd,iBAAiB,EACjB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACX,eAAe,EACf,sBAAsB,EACtB,eAAe,EACf,cAAc,EACd,iBAAiB,GACjB,MAAM,2BAA2B,CAAC;AACnC,MAAM,WAAW,kCAAkC;IAClD,WAAW,EAAE,oBAAoB,CAAC;IAClC,eAAe,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACjD,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,gBAAgB,CAAC,EAAE,OAAO,gCAAgC,CAAC;IAC3D,qBAAqB,CAAC,EAAE,OAAO,yCAAyC,CAAC;IACzE,uBAAuB,CAAC,EAAE,OAAO,gDAAgD,CAAC;IAClF,WAAW,CAAC,EAAE,OAAO,qCAAqC,CAAC;IAC3D,2EAA2E;IAC3E,kBAAkB,CAAC,EAAE,OAAO,qCAAqC,CAAC;IAClE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAkCD,+FAA+F;AAC/F,cAAM,2BAA2B;;IAOhC,YAAY,OAAO,EAAE,kCAAkC,EAEtD;IA2CK,UAAU;iBAQL,CAAC;;;;OAKX;IAsGK,OAAO,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,eAAe,CAAC,CAoBvE;IA8BK,OAAO,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAc1F;IAqJK,WAAW,CAAC,KAAK,EAAE;QACxB,SAAS,EAAE,iBAAiB,CAAC;QAC7B,SAAS,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,cAAc,CAAC,CAoB1B;IAiBK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAK3B;CACD;AACD,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,kCAAkC,+BAE5F"}
1
+ {"version":3,"file":"owner-recovery-service.d.ts","sourceRoot":"","sources":["../../src/account/owner-recovery-service.ts"],"names":[],"mappings":"AACA,OAAO,EACN,qCAAqC,EAGrC,gCAAgC,EAChC,gDAAgD,EAChD,yCAAyC,EACzC,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAA8B,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EACN,KAAK,sBAAsB,EAE3B,MAAM,gCAAgC,CAAC;AAmBxC,OAAO,KAAK,EACX,eAAe,EACf,sBAAsB,EACtB,cAAc,EACd,iBAAiB,EACjB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACX,eAAe,EACf,sBAAsB,EACtB,eAAe,EACf,cAAc,EACd,iBAAiB,GACjB,MAAM,2BAA2B,CAAC;AACnC,MAAM,WAAW,kCAAkC;IAClD,WAAW,EAAE,oBAAoB,CAAC;IAClC,eAAe,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACjD,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,gBAAgB,CAAC,EAAE,OAAO,gCAAgC,CAAC;IAC3D,qBAAqB,CAAC,EAAE,OAAO,yCAAyC,CAAC;IACzE,uBAAuB,CAAC,EAAE,OAAO,gDAAgD,CAAC;IAClF,WAAW,CAAC,EAAE,OAAO,qCAAqC,CAAC;IAC3D,2EAA2E;IAC3E,kBAAkB,CAAC,EAAE,OAAO,qCAAqC,CAAC;IAClE,sEAAsE;IACtE,uBAAuB,CAAC,EAAE,MAAM,MAAM,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AACD;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAkC7C,+FAA+F;AAC/F,cAAM,2BAA2B;;IAOhC,YAAY,OAAO,EAAE,kCAAkC,EAEtD;IA+CK,UAAU;iBAQL,CAAC;;;;OAKX;IAwGK,OAAO,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,eAAe,CAAC,CAoBvE;IA8BK,OAAO,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAc1F;IAuJK,WAAW,CAAC,KAAK,EAAE;QACxB,SAAS,EAAE,iBAAiB,CAAC;QAC7B,SAAS,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,cAAc,CAAC,CAoB1B;IAmBK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAK3B;CACD;AACD,wBAAgB,iCAAiC,CAAC,OAAO,EAAE,kCAAkC,+BAE5F"}
package/dist/account/status.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/account/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAEN,KAAK,gCAAgC,EAErC,KAAK,0BAA0B,EAC/B,wCAAwC,EACxC,gCAAgC,EAChC,yCAAyC,EACzC,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACX,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,EACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EAExB,MAAM,oBAAoB,CAAC;AAG5B,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,gBAAgB,CAAC,EAAE,OAAO,gCAAgC,CAAC;IAC3D,qBAAqB,CAAC,EAAE,OAAO,yCAAyC,CAAC;IACzE,sBAAsB,CAAC,EAAE,OAAO,wCAAwC,CAAC;IACzE,6FAA6F;IAC7F,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;CAC1D;AACD,KAAK,eAAe,GAAG,OAAO,CAAC,gCAAgC,EAAE;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC,CAAC,MAAM,CAAC,CAAC;AAClG,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,CAAC,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,KAAK,EAAE,IAAI,CACV,cAAc,EACd,UAAU,GAAG,aAAa,GAAG,YAAY,GAAG,eAAe,GAAG,aAAa,CAC3E,GAAG,IAAI,CAAC;IACT,WAAW,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACvC,+FAA+F;IAC/F,YAAY,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnF,6FAA6F;IAC7F,eAAe,CAAC,EAAE;QACjB,IAAI,EAAE,wBAAwB,CAAC;QAC/B,MAAM,EAAE,OAAO,CAAC,0BAA0B,EAAE;YAAE,KAAK,EAAE,iBAAiB,CAAA;SAAE,CAAC,CAAC;KAC1E,CAAC;IACF,MAAM,EACH;QAAE,IAAI,EAAE,aAAa,CAAA;KAAE,GACvB;QAAE,IAAI,EAAE,aAAa,CAAA;KAAE,GACvB;QACA,IAAI,EAAE,aAAa,CAAC;QACpB,IAAI,EAAE,eAAe,GAAG,iBAAiB,GAAG,mCAAmC,CAAC;KAC/E,GACD;QACA,IAAI,EAAE,QAAQ,CAAC;QACf,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,wBAAwB,GAAG,cAAc,GAAG,IAAI,CAAC;QAC5D,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,KAAK,EAAE,iBAAiB,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC;QAC1E,eAAe,EAAE,OAAO,CAAC;QACzB,OAAO,EAAE;YAAE,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,CAAC;YAAC,UAAU,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC;KAC7E,CAAC;IACL,OAAO,EAAE,OAAO,CAAC;IACjB,2FAA2F;IAC3F,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,MAAM,CAAC,EAAE;QACR,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,wBAAwB,GAAG,cAAc,GAAG,IAAI,CAAC;KAC5D,CAAC;IACF,iBAAiB,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,EACV,IAAI,GACJ,kBAAkB,GAClB,oBAAoB,GACpB,aAAa,GACb,iBAAiB,GACjB,gBAAgB,GAChB,SAAS,GACT,UAAU,GACV,mBAAmB,GACnB,kBAAkB,CAAC;IACtB,SAAS,EAAE,sBAAsB,GAAG,IAAI,CAAC;IACzC,uEAAuE;IACvE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;CAClB;AACD,KAAK,WAAW,GAAG,OAAO,CAAC,oBAAoB,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAyDpE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,iBAAiB,CAyBvE;AA2CD,KAAK,mBAAmB,GAAG,iBAAiB,GAAG,OAAO,CAAC,oBAAoB,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEhG,KAAK,WAAW,GAAG;IAClB,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC,+EAA+E;IAC/E,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,wBAAsB,iBAAiB,CACtC,OAAO,EAAE,oBAAoB,GAAG;IAAE,WAAW,EAAE,oBAAoB,CAAA;CAAE,EACrE,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,EAAE,WAAW,EACnB,WAAW,GAAE,WAAgB,GAC3B,OAAO,CAAC,mBAAmB,CAAC,CAiB9B"}
1
+ {"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/account/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAEN,KAAK,gCAAgC,EAErC,KAAK,0BAA0B,EAC/B,wCAAwC,EACxC,gCAAgC,EAChC,yCAAyC,EACzC,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACX,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,EACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EAExB,MAAM,oBAAoB,CAAC;AAG5B,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,WAAW,CAAC,EAAE,oBAAoB,CAAC;IACnC,gBAAgB,CAAC,EAAE,OAAO,gCAAgC,CAAC;IAC3D,qBAAqB,CAAC,EAAE,OAAO,yCAAyC,CAAC;IACzE,sBAAsB,CAAC,EAAE,OAAO,wCAAwC,CAAC;IACzE,6FAA6F;IAC7F,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;CAC1D;AACD,KAAK,eAAe,GAAG,OAAO,CAAC,gCAAgC,EAAE;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC,CAAC,MAAM,CAAC,CAAC;AAClG,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,CAAC,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,KAAK,EAAE,IAAI,CACV,cAAc,EACd,UAAU,GAAG,aAAa,GAAG,YAAY,GAAG,eAAe,GAAG,aAAa,CAC3E,GAAG,IAAI,CAAC;IACT,WAAW,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACvC,+FAA+F;IAC/F,YAAY,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnF,6FAA6F;IAC7F,eAAe,CAAC,EAAE;QACjB,IAAI,EAAE,wBAAwB,CAAC;QAC/B,MAAM,EAAE,OAAO,CAAC,0BAA0B,EAAE;YAAE,KAAK,EAAE,iBAAiB,CAAA;SAAE,CAAC,CAAC;KAC1E,CAAC;IACF,MAAM,EACH;QAAE,IAAI,EAAE,aAAa,CAAA;KAAE,GACvB;QAAE,IAAI,EAAE,aAAa,CAAA;KAAE,GACvB;QACA,IAAI,EAAE,aAAa,CAAC;QACpB,IAAI,EAAE,eAAe,GAAG,iBAAiB,GAAG,mCAAmC,CAAC;KAC/E,GACD;QACA,IAAI,EAAE,QAAQ,CAAC;QACf,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,wBAAwB,GAAG,cAAc,GAAG,IAAI,CAAC;QAC5D,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,KAAK,EAAE,iBAAiB,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC;QAC1E,eAAe,EAAE,OAAO,CAAC;QACzB,OAAO,EAAE;YAAE,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,CAAC;YAAC,UAAU,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC;KAC7E,CAAC;IACL,OAAO,EAAE,OAAO,CAAC;IACjB,2FAA2F;IAC3F,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;OAGG;IACH,MAAM,CAAC,EAAE;QACR,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,wBAAwB,GAAG,cAAc,GAAG,IAAI,CAAC;KAC5D,CAAC;IACF,iBAAiB,CAAC,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,EACV,IAAI,GACJ,kBAAkB,GAClB,oBAAoB,GACpB,aAAa,GACb,iBAAiB,GACjB,gBAAgB,GAChB,SAAS,GACT,UAAU,GACV,mBAAmB,GACnB,kBAAkB,CAAC;IACtB,SAAS,EAAE,sBAAsB,GAAG,IAAI,CAAC;IACzC,uEAAuE;IACvE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;CAClB;AACD,KAAK,WAAW,GAAG,OAAO,CAAC,oBAAoB,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAwDpE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,GAAG,iBAAiB,CAyBvE;AA2CD,KAAK,mBAAmB,GAAG,iBAAiB,GAAG,OAAO,CAAC,oBAAoB,EAAE;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEhG,KAAK,WAAW,GAAG;IAClB,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC,+EAA+E;IAC/E,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,wBAAsB,iBAAiB,CACtC,OAAO,EAAE,oBAAoB,GAAG;IAAE,WAAW,EAAE,oBAAoB,CAAA;CAAE,EACrE,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,EAAE,WAAW,EACnB,WAAW,GAAE,WAAgB,GAC3B,OAAO,CAAC,mBAAmB,CAAC,CAiB9B"}
package/dist/index.js CHANGED
@@ -435,11 +435,13 @@ var InProcessAccountLinkRegistry = class {
435
435
  };
436
436
  const intent = job.operation.intent ?? "connect";
437
437
  if (intent === "sign_in") return await this.#runSignIn(job, options.onBrowserStart);
438
- if (intent === "connect") await (this.#options.link ?? linkCoordinatorAccount)({
439
- ...options,
440
- expectedAuthority
441
- });
442
- else {
438
+ if (intent === "connect") {
439
+ if (expectedAuthority === null) throw new CoordinatorAccountLinkError("invalid_options");
440
+ await (this.#options.link ?? linkCoordinatorAccount)({
441
+ ...options,
442
+ expectedAuthority
443
+ });
444
+ } else {
443
445
  const result = await (this.#options.change ?? changeCoordinatorAccount)({
444
446
  ...options,
445
447
  intent,
@@ -481,6 +483,7 @@ var InProcessAccountLinkRegistry = class {
481
483
  }
482
484
  start({ intent = "connect", context, expectedCoordinatorId, expectedAuthority, expectedLifecycleToken, expectedLinkId }) {
483
485
  if (this.#shuttingDown) return { error: "account_shutting_down" };
486
+ if (expectedAuthority !== "controller_attestation" && expectedAuthority !== "device_claim" && !(intent === "sign_in" && expectedAuthority === null)) return { error: "account_context_changed" };
484
487
  const pending = this.#inProgress();
485
488
  if (pending) return pending;
486
489
  if (expectedLifecycleToken && expectedLifecycleToken !== this.lifecycleToken()) return { error: "account_context_changed" };
@@ -791,11 +794,11 @@ function associatedOwnerView(view, context, association, remote) {
791
794
  //#region src/account/status.ts
792
795
  /**
793
796
  * The owner-only state offers sign-in when the owner's Google account is
794
- * linked and this device's own Identity has none: signing in switches the
795
- * device to the owner's Identity.
797
+ * linked and this device is unlinked or still needs enrollment review.
798
+ * Rebind verifies the Google account before switching the device's Identity.
796
799
  */
797
800
  function withOwnerSignIn(owner, own, context, remote) {
798
- if (owner.ownerProjection?.status.profileState !== "linked" || own.canSignIn !== true || own.remote.kind !== "status" || own.remote.state !== "unlinked") return owner;
801
+ if (owner.ownerProjection?.status.profileState !== "linked" || own.remote.kind !== "status" || own.remote.state !== "review_required" && !(own.canSignIn === true && own.remote.state === "unlinked")) return owner;
799
802
  return {
800
803
  ...owner,
801
804
  canSignIn: true,
@@ -1010,7 +1013,10 @@ async function finishAccountStatus(options, context, fresh, remote, read) {
1010
1013
  const associated = await readAssociatedOwner(options, context, currentView, remote, signal);
1011
1014
  if (associated) {
1012
1015
  const owner = withOwnerSignIn(associated, currentView, context, remote);
1013
- if (read.ownIdentityOnly && owner.signIn?.contextId === context.contextId) return attachOperation(currentView, options.registry);
1016
+ if (read.ownIdentityOnly && owner.signIn?.contextId === context.contextId) return attachOperation({
1017
+ ...currentView,
1018
+ canSignIn: true
1019
+ }, options.registry);
1014
1020
  return attachOperation(owner, options.registry, context.contextId);
1015
1021
  }
1016
1022
  }
@@ -1147,7 +1153,7 @@ function isCurrent(options, operation) {
1147
1153
  return !("error" in fresh) && fresh.setup === "ready" && fresh.context?.groupId === operation.groupId && fresh.context.contextId === operation.contextId;
1148
1154
  }
1149
1155
  function validStartBody(body) {
1150
- return body !== null && validString(body.groupId) && validString(body.contextId) && validString(body.coordinatorId) && (body.intent !== "disconnect" || validString(body.expectedLinkId)) && (body.intent === void 0 || body.intent === "connect" || body.intent === "refresh" || body.intent === "disconnect" || body.intent === "sign_in") && (body.authority === "controller_attestation" || body.authority === "device_claim");
1156
+ return body !== null && validString(body.groupId) && validString(body.contextId) && validString(body.coordinatorId) && (body.intent !== "disconnect" || validString(body.expectedLinkId)) && (body.intent === void 0 || body.intent === "connect" || body.intent === "refresh" || body.intent === "disconnect" || body.intent === "sign_in") && (body.authority === "controller_attestation" || body.authority === "device_claim" || body.intent === "sign_in" && body.authority === null);
1151
1157
  }
1152
1158
  function unlinkTargetChanged(body, view) {
1153
1159
  return body.intent === "disconnect" && body.expectedLinkId !== view.unlinkTarget;
@@ -1266,6 +1272,14 @@ var AccountOwnerRecoveryError = class extends Error {
1266
1272
  this.code = code;
1267
1273
  }
1268
1274
  };
1275
+ /**
1276
+ * The fix for an unsafe local state directory, or null for any other error. Matches the
1277
+ * core error by code because the bundle can carry a second copy of the core class.
1278
+ */
1279
+ function unsafeStorageMessage(error) {
1280
+ if (!(error instanceof Error) || !("code" in error)) return null;
1281
+ return error.code === "account_owner_association_directory_unsafe" ? error.message : null;
1282
+ }
1269
1283
  function requireRecovery(condition, code = "invalid") {
1270
1284
  if (!condition) throw new AccountOwnerRecoveryError(code);
1271
1285
  }
@@ -1574,6 +1588,11 @@ async function dispatch(c, service) {
1574
1588
  function accountOwnerRecoveryRoutes(service) {
1575
1589
  const app = new Hono();
1576
1590
  app.onError((error, c) => {
1591
+ const storage = unsafeStorageMessage(error);
1592
+ if (storage) return c.json({
1593
+ error: "account_owner_recovery_storage_unsafe",
1594
+ detail: storage
1595
+ }, 409);
1577
1596
  if (!(error instanceof AccountOwnerRecoveryError)) return c.json({ error: "account_owner_recovery_unavailable" }, 503);
1578
1597
  return c.json({ error: `account_owner_recovery_${error.code}` }, {
1579
1598
  invalid: 400,
@@ -15774,16 +15793,44 @@ function assertPublishedConfigLock(path, staged) {
15774
15793
  function accountOwnerAssociationDirectory() {
15775
15794
  return join(homedir(), ".codemem", "account-owner-associations");
15776
15795
  }
15796
+ /**
15797
+ * A state directory that other local users could change. The message names the path and
15798
+ * the command that fixes it, because callers show it to the person who owns the directory.
15799
+ */
15800
+ var AccountOwnerAssociationDirectoryError = class extends Error {
15801
+ path;
15802
+ problem;
15803
+ code = "account_owner_association_directory_unsafe";
15804
+ constructor(path, problem) {
15805
+ super(directoryProblemMessage(path, problem));
15806
+ this.path = path;
15807
+ this.problem = problem;
15808
+ this.name = "AccountOwnerAssociationDirectoryError";
15809
+ }
15810
+ };
15811
+ function directoryProblemMessage(path, problem) {
15812
+ if (problem === "shared_write") return `${path} is writable by other users. Run \`chmod go-w ${path}\`, then try again.`;
15813
+ if (problem === "not_private") return `${path} must be private to you. Run \`chmod 700 ${path}\`, then try again.`;
15814
+ if (problem === "wrong_owner") return `${path} is owned by another user. Make it yours.`;
15815
+ return `${path} must be a real directory, not a file or symlink.`;
15816
+ }
15817
+ function directoryProblem(stat, options) {
15818
+ if (!stat.isDirectory() || stat.isSymbolicLink()) return "not_directory";
15819
+ if (typeof process.getuid === "function" && stat.uid !== process.getuid()) return "wrong_owner";
15820
+ if (options.private) return (stat.mode & 511) === 448 ? null : "not_private";
15821
+ return (stat.mode & 18) === 0 ? null : "shared_write";
15822
+ }
15777
15823
  function checkDirectory(path, options = {}) {
15824
+ let stat;
15778
15825
  try {
15779
- const stat = lstatSync(path);
15780
- const unsafeMode = options.private ? (stat.mode & 511) !== 448 : (stat.mode & 18) !== 0;
15781
- if (!stat.isDirectory() || stat.isSymbolicLink() || unsafeMode || typeof process.getuid === "function" && stat.uid !== process.getuid()) throw new Error("account_owner_association_invalid");
15782
- return true;
15826
+ stat = lstatSync(path);
15783
15827
  } catch (error) {
15784
15828
  if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") return false;
15785
15829
  throw error;
15786
15830
  }
15831
+ const problem = directoryProblem(stat, options);
15832
+ if (problem) throw new AccountOwnerAssociationDirectoryError(path, problem);
15833
+ return true;
15787
15834
  }
15788
15835
  /** Missing directories stay missing during reads. Never follow a state-directory symlink. */
15789
15836
  function readAccountOwnerAssociationDirectory(path) {
@@ -16169,7 +16216,8 @@ async function readRecoveryCandidates(options) {
16169
16216
  groupId,
16170
16217
  deviceId: device.deviceId,
16171
16218
  fingerprint: device.fingerprint,
16172
- identityId: device.identityId
16219
+ identityId: device.identityId,
16220
+ timeoutS: options.timeoutS
16173
16221
  });
16174
16222
  } catch {
16175
16223
  continue;
@@ -16257,8 +16305,6 @@ function assertNoCompetingOwner(destinations, ownerIdentityId) {
16257
16305
  requireRecovery(!existing || existing.ownerIdentityId === ownerIdentityId);
16258
16306
  }
16259
16307
  }
16260
- //#endregion
16261
- //#region src/account/owner-recovery-service.ts
16262
16308
  var CANDIDATE_TTL_MS = 6e4;
16263
16309
  function groupAction(state) {
16264
16310
  if (state === "ready") return "new";
@@ -16285,6 +16331,10 @@ var AccountOwnerRecoveryService = class {
16285
16331
  #now() {
16286
16332
  return (this.#options.now ?? Date.now)();
16287
16333
  }
16334
+ #timeoutS() {
16335
+ const configured = this.#options.readCoordinatorTimeoutS?.() ?? 0;
16336
+ return Math.max(10, Number.isFinite(configured) ? configured : 0);
16337
+ }
16288
16338
  #assertCurrent(capture, reservation) {
16289
16339
  requireRecovery(!this.#closed, "unavailable");
16290
16340
  requireRecovery(!reservation || reservation.isCurrent(), "context_changed");
@@ -16338,7 +16388,8 @@ var AccountOwnerRecoveryService = class {
16338
16388
  deviceId: c.deviceId,
16339
16389
  fingerprint: c.fingerprint,
16340
16390
  identityId: c.identityId
16341
- }
16391
+ },
16392
+ timeoutS: this.#timeoutS()
16342
16393
  });
16343
16394
  this.#assertCurrent(capture);
16344
16395
  this.#candidateCache = {
@@ -16360,7 +16411,8 @@ var AccountOwnerRecoveryService = class {
16360
16411
  groupId,
16361
16412
  deviceId: capture.context.deviceId,
16362
16413
  fingerprint: capture.context.fingerprint,
16363
- identityId: selection.existingOwnerId
16414
+ identityId: selection.existingOwnerId,
16415
+ timeoutS: this.#timeoutS()
16364
16416
  };
16365
16417
  }
16366
16418
  async #previewReview(entry, groupId) {
@@ -16526,7 +16578,7 @@ var AccountOwnerRecoveryService = class {
16526
16578
  return { outcome: {
16527
16579
  groupId,
16528
16580
  status: staleDenial(error) ? "failed" : "unknown",
16529
- message: "Check coordinator status or import original receipts before trying again."
16581
+ message: unsafeStorageMessage(error) ?? "Check coordinator status or import original receipts before trying again."
16530
16582
  } };
16531
16583
  }
16532
16584
  }
@@ -16601,11 +16653,11 @@ var AccountOwnerRecoveryService = class {
16601
16653
  async #importGroup(entry, groupId, receipt, reservation) {
16602
16654
  try {
16603
16655
  return await this.#verifyAndRetain(entry, groupId, receipt, reservation);
16604
- } catch {
16656
+ } catch (error) {
16605
16657
  return {
16606
16658
  groupId,
16607
16659
  status: "unknown",
16608
- message: "Context or proof outcome changed; check status before importing again."
16660
+ message: unsafeStorageMessage(error) ?? "Context or proof outcome changed; check status before importing again."
16609
16661
  };
16610
16662
  }
16611
16663
  }