@gatemux/dsh-gatemux-login 1.0.1 → 1.0.2

package/account.js

@@ -68,6 +68,16 @@ function parseGrant(payload, issuer) {
   return { version: 1, accessToken, refreshToken, expiresAt, issuer }
 }
 
+/**
+ * Read a stored record as a grant this deployment may use.
+ * @param record - record at this provider's key, or undefined when none is stored.
+ * @param issuer - origin a grant must carry to be usable here.
+ * @returns the parsed grant, or null when no record is stored or it is unusable.
+ */
+function usableGrant(record, issuer) {
+  return record !== undefined && record.kind === 'grant' ? parseGrant(record.payload, issuer) : null
+}
+
 /** Accept a bare HTTPS origin, rejecting paths, credentials, and non-HTTPS schemes. */
 function originOf(value) {
   let url
@@ -182,22 +192,27 @@ export class GateMuxAccount extends DeepSeekAccount {
   /** Discard a stored grant issued by another environment. */
   async [Service.init]() {
     const record = await this.ctx.credentials.readRecord(KEY)
-    if (record === undefined) return
-    const grant = record.kind === 'grant' ? parseGrant(record.payload, this.issuer) : null
-    if (grant !== null) return
+    if (record === undefined || usableGrant(record, this.issuer) !== null) return
     await this.ctx.credentials.deleteRecord(KEY)
     this.logger.warn('stored grant discarded', { reason: 'unreadable-or-foreign-issuer' })
   }
 
   async getState() {
     const record = await this.ctx.credentials.readRecord(KEY)
-    if (record !== undefined && (record.kind !== 'grant' || parseGrant(record.payload, this.issuer) === null)) {
-      throw new GateMuxAuthError('stored grant is unreadable', 'storage')
+    const grant = usableGrant(record, this.issuer)
+    // A record this deployment cannot use reads as absent instead of raising: every
+    // caller turns a throw into a failure with no diagnosis. `startSignIn` returns
+    // this outside its own catch, so a raise there rejects the start call and the
+    // dialog reports a sign-in failure for a record the person never supplied, and
+    // `watch` ends the account stream. The record is left in place for a sign-in to
+    // overwrite; discarding it here could delete a grant committed since the read.
+    if (record !== undefined && grant === null) {
+      this.logger.warn('stored grant is unreadable', { reason: 'unreadable-or-foreign-issuer' })
     }
     const attempt = this.attempt?.view ?? null
     return {
-      status: record === undefined ? 'signed-out' : 'credential-stored',
-      attempt: record === undefined && attempt?.phase === 'succeeded' ? null : attempt,
+      status: grant === null ? 'signed-out' : 'credential-stored',
+      attempt: grant === null && attempt?.phase === 'succeeded' ? null : attempt,
       links: {
         usageUrl: `${this.consoleOrigin}/app/usage`,
         topUpUrl: `${this.consoleOrigin}/app/billing`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gatemux/dsh-gatemux-login",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "type": "module",
   "description": "Sign in with GateMux for DeepSeek Harness: users pay from their own GateMux balance.",
   "publishConfig": {