@comfyorg/account-core 1.0.0-alpha.1 → 1.0.0-alpha.3

package/dist/telemetry.d.ts

@@ -4,10 +4,24 @@
  * every host. The package never calls a telemetry API itself; call sites
  * stay host-specific.
  */
+import type { WebSessionBootstrapEvent, WebSessionIdentityOptions } from './core/webSessionIdentity.js';
 export declare const SESSION_TELEMETRY_EVENT: {
     readonly refreshSucceeded: "auth.unified.refresh.succeeded";
     readonly refreshFailed: "auth.unified.refresh.failed";
+    readonly bootstrap: "session_bootstrap";
+    readonly signedOutRemotely: "session_signed_out_remotely";
 };
+export type WebSessionTelemetryEvent = {
+    readonly name: typeof SESSION_TELEMETRY_EVENT.bootstrap;
+    readonly properties: WebSessionBootstrapEvent;
+} | {
+    readonly name: typeof SESSION_TELEMETRY_EVENT.signedOutRemotely;
+    readonly properties: {
+        readonly origin: string;
+    };
+};
+/** The web-session identity's telemetry hooks, routed to one host sink. */
+export declare function webSessionTelemetryHooks(track: (event: WebSessionTelemetryEvent) => void): Pick<WebSessionIdentityOptions, 'onBootstrap' | 'onSignedOutRemotely'>;
 /**
  * The cloud app's `billing.operation.*` events, emitted by the billing
  * operation lifecycle for every observed `billing_op_id` regardless of
@@ -19,6 +33,18 @@ export declare const BILLING_OPERATION_TELEMETRY_EVENT: {
     readonly failed: "billing.operation.failed";
     readonly timeout: "billing.operation.timeout";
 };
+/**
+ * Payment friction the lifecycle observes inside one operation: a bank
+ * challenge and its verdict, each retryable decline, and a hosted step the
+ * customer was sent to and came back from.
+ */
+export declare const BILLING_CHECKOUT_FRICTION_TELEMETRY_EVENT: {
+    readonly challengeRequired: "billing.checkout.challenge_required";
+    readonly challengeCompleted: "billing.checkout.challenge_completed";
+    readonly challengeFailed: "billing.checkout.challenge_failed";
+    readonly redirectStarted: "billing.checkout.redirect_started";
+    readonly returned: "billing.checkout.returned";
+};
 export declare const AUTH_TELEMETRY_EVENT: {
     readonly signUpOpened: "app:user_sign_up_opened";
     readonly authCompleted: "app:user_auth_completed";

package/dist/telemetry.js

@@ -1,13 +1,22 @@
-/**
- * Shared telemetry vocabulary. The event names match the cloud app's
- * TelemetryEvents verbatim so an auth outcome is one queryable event across
- * every host. The package never calls a telemetry API itself; call sites
- * stay host-specific.
- */
 export const SESSION_TELEMETRY_EVENT = {
     refreshSucceeded: 'auth.unified.refresh.succeeded',
-    refreshFailed: 'auth.unified.refresh.failed'
+    refreshFailed: 'auth.unified.refresh.failed',
+    bootstrap: 'session_bootstrap',
+    signedOutRemotely: 'session_signed_out_remotely'
 };
+/** The web-session identity's telemetry hooks, routed to one host sink. */
+export function webSessionTelemetryHooks(track) {
+    return {
+        onBootstrap: ({ outcome, origin }) => track({
+            name: SESSION_TELEMETRY_EVENT.bootstrap,
+            properties: { outcome, origin }
+        }),
+        onSignedOutRemotely: ({ origin }) => track({
+            name: SESSION_TELEMETRY_EVENT.signedOutRemotely,
+            properties: { origin }
+        })
+    };
+}
 /**
  * The cloud app's `billing.operation.*` events, emitted by the billing
  * operation lifecycle for every observed `billing_op_id` regardless of
@@ -19,6 +28,18 @@ export const BILLING_OPERATION_TELEMETRY_EVENT = {
     failed: 'billing.operation.failed',
     timeout: 'billing.operation.timeout'
 };
+/**
+ * Payment friction the lifecycle observes inside one operation: a bank
+ * challenge and its verdict, each retryable decline, and a hosted step the
+ * customer was sent to and came back from.
+ */
+export const BILLING_CHECKOUT_FRICTION_TELEMETRY_EVENT = {
+    challengeRequired: 'billing.checkout.challenge_required',
+    challengeCompleted: 'billing.checkout.challenge_completed',
+    challengeFailed: 'billing.checkout.challenge_failed',
+    redirectStarted: 'billing.checkout.redirect_started',
+    returned: 'billing.checkout.returned'
+};
 export const AUTH_TELEMETRY_EVENT = {
     signUpOpened: 'app:user_sign_up_opened',
     authCompleted: 'app:user_auth_completed',

package/dist/testing.d.ts

@@ -36,7 +36,8 @@ export interface FakeWebSessionEndpoint {
 /**
  * A `fetch` serving ingest's session routes under `/api/auth`. POST with a
  * bearer proof signs `signInUser` in; DELETE and revoke-all leave the cookie
- * revoked, as the real endpoint does.
+ * revoked, as the real endpoint does. Revoke-all serves only the cookie path,
+ * which needs the CSRF token and `X-Comfy-Client`.
  */
 export declare function createFakeWebSessionEndpoint({ state, signInUser, now }: {
     state: FakeWebSessionState;

package/dist/testing.js

@@ -67,15 +67,15 @@ function routesFor(signInUser, now) {
         [
             'POST /api/auth/sessions/revoke-all',
             (endpoint, headers) => {
-                if (!headers.get('authorization')?.startsWith('Bearer ')) {
-                    return errorResponse(401, 'no_session');
-                }
                 if (endpoint.state.kind === 'dead') {
                     return errorResponse(401, endpoint.state.code);
                 }
                 if (headers.get('x-csrf-token') !== FAKE_CSRF_TOKEN) {
                     return errorResponse(403, 'csrf_invalid');
                 }
+                if (!headers.has('x-comfy-client')) {
+                    return errorResponse(403, 'origin_not_allowed');
+                }
                 revoke(endpoint);
                 return jsonResponse(200, { revoked: 1 });
             }
@@ -85,7 +85,8 @@ function routesFor(signInUser, now) {
 /**
  * A `fetch` serving ingest's session routes under `/api/auth`. POST with a
  * bearer proof signs `signInUser` in; DELETE and revoke-all leave the cookie
- * revoked, as the real endpoint does.
+ * revoked, as the real endpoint does. Revoke-all serves only the cookie path,
+ * which needs the CSRF token and `X-Comfy-Client`.
  */
 export function createFakeWebSessionEndpoint({ state, signInUser = fakeWebSessionUser(), now = Date.now }) {
     const requests = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@comfyorg/account-core",
-  "version": "1.0.0-alpha.1",
+  "version": "1.0.0-alpha.3",
   "description": "Shared account layer: a framework-free session core that exchanges a signed-in identity for the workspace-scoped Cloud JWT with valid-on-read freshness, plus the package-owned Firebase identity entry. It has no view layer and no Vue dependency; the composables and unstyled components ship from @comfyorg/account-ui",
   "keywords": [],
   "homepage": "https://comfy.org",
@@ -127,6 +127,8 @@
     "zod": "^3.23.8"
   },
   "scripts": {
+    "format": "oxfmt --write",
+    "format:check": "oxfmt --check",
     "build": "pnpm run clean && tsc -p tsconfig.build.json",
     "check:pack": "tsx scripts/checkPublishable.ts",
     "clean": "node --input-type=module -e \"import { rmSync } from 'node:fs'; rmSync('dist', { recursive: true, force: true })\"",