@glyphteck/veyl 0.66.2 → 0.67.0

package/dist/account.js

@@ -7281,7 +7281,7 @@ function closeSessionResources({ wallet, chatPK, chatPrivateKey, chatSigningSecr
   close(vaultAccess);
   close(vaultSigner);
   close(localCache);
-  pending.push(lockWallet(wallet));
+  lockWallet(wallet);
   lockChat(chatPrivateKey, chatPK);
   cleanBytes(chatSigningSecret, notificationPrivateKey, notificationPublicKey);
   return Promise.allSettled(pending).then(() => {
@@ -7857,6 +7857,8 @@ function settingsState(settings = defaultSettings) {
 var defaultUser = {
   uid: null,
   authReady: false,
+  authSessionReady: false,
+  authSessionActive: false,
   authCredential: null,
   profileReady: false,
   username: null,
@@ -7878,12 +7880,16 @@ var defaultUser = {
   settingsReady: false,
   settings: settingsState()
 };
+function isAccountAuthenticationError(error) {
+  const code = typeof error?.code === "string" ? error.code.toLowerCase() : "";
+  return code === "permission-denied" || code.endsWith("/permission-denied") || code === "unauthenticated" || code.endsWith("/unauthenticated");
+}
 function createUser({ cloud, network, avatarCache = null, diag = null, onSessionRevoked = null }) {
   if (!cloud) {
     throw new Error("createUser requires { cloud }");
   }
-  if (avatarCache && [avatarCache.read, avatarCache.write, avatarCache.remove, avatarCache.removeAll].some((method) => typeof method !== "function")) {
-    throw new Error("avatarCache requires read, write, remove, and removeAll");
+  if (avatarCache && [avatarCache.read, avatarCache.write, avatarCache.remove].some((method) => typeof method !== "function")) {
+    throw new Error("avatarCache requires read, write, and remove");
   }
   let activeNetwork = network;
   let state = defaultUser;
@@ -8021,9 +8027,6 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       return;
     runCacheTask("user.avatar.cache.remove", () => avatarCache.remove(uid));
   }
-  function clearCachedAvatars() {
-    runCacheTask("user.avatar.cache.clear", () => avatarCache.removeAll());
-  }
   async function fetchAvatar(uid, { version = null, force = false, clear = false, persist = true } = {}) {
     if (!uid)
       return;
@@ -8106,6 +8109,54 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
   function isCurrentUser(uid, session) {
     return started && authSession === session && userUid === uid;
   }
+  function revokeAuthentication(authUser, {
+    code = "",
+    local = false,
+    reason = "session-inactive"
+  } = {}) {
+    if (revokingSession)
+      return;
+    revokingSession = true;
+    let callback;
+    try {
+      callback = onSessionRevoked?.({
+        uid: authUser.uid,
+        code,
+        reason
+      });
+    } catch (error) {
+      callback = Promise.reject(error);
+    }
+    markDiag(diag, "user.auth.revoked", {
+      code,
+      local,
+      reason
+    });
+    setState((user) => ({
+      ...user,
+      authSessionReady: true,
+      authSessionActive: false,
+      authCredential: null
+    }));
+    let operation = Promise.resolve(callback).catch((error) => markError(diag, "user.session.revoke.local", Date.now(), error));
+    if (!local) {
+      operation = operation.then(() => cloud.auth.logout()).catch((error) => markError(diag, "user.session.revoke.auth", Date.now(), error));
+    }
+    operation.finally(() => {
+      if (userUid === authUser.uid) {
+        revokingSession = false;
+      }
+    });
+  }
+  function revokeAuthenticationError(authUser, error, reason) {
+    if (!isAccountAuthenticationError(error))
+      return false;
+    revokeAuthentication(authUser, {
+      code: error?.code || "",
+      reason
+    });
+    return true;
+  }
   function watchUser(authUser) {
     if (!started)
       return;
@@ -8115,7 +8166,6 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
     closeUserWatches();
     markDiag(diag, "user.auth.state", { signedIn: !!authUser });
     if (!authUser) {
-      const signedOutUid = userUid;
       revokingSession = false;
       userUid = null;
       clearSettingsKey(settingsKey);
@@ -8124,17 +8174,11 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       agreementStored = null;
       agreementOverride = null;
       agreementAcceptance = null;
-      if (signedOutUid) {
-        clearCachedAvatars();
-      }
       avatarFetch = { uid: null, key: null, promise: null };
       setState({ ...defaultUser, authReady: true });
       return;
     }
     const authUidChanged = userUid !== authUser.uid;
-    if (userUid && authUidChanged) {
-      clearCachedAvatars();
-    }
     userUid = authUser.uid;
     if (authUidChanged) {
       clearSettingsKey(settingsKey);
@@ -8164,32 +8208,28 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
     userWatches.push(cloud.auth.session.watch(authUser.uid, current((authSessionState) => {
       if (authSessionState?.active) {
         const authCredential = authSessionState.authCredential;
-        setState((user) => user.authCredential?.kind === authCredential?.kind && user.authCredential?.id === authCredential?.id ? user : { ...user, authCredential });
-        return;
-      }
-      if (revokingSession)
-        return;
-      revokingSession = true;
-      if (cloud.auth.session.isLocalTermination?.(authUser.uid, authSessionState?.generation)) {
-        Promise.resolve(onSessionRevoked?.({ uid: authUser.uid })).catch((error) => markError(diag, "user.session.revoke.local", Date.now(), error)).finally(() => {
-          if (userUid === authUser.uid) {
-            revokingSession = false;
-          }
+        setState((user) => user.authSessionReady && user.authSessionActive && user.authCredential?.kind === authCredential?.kind && user.authCredential?.id === authCredential?.id ? user : {
+          ...user,
+          authSessionReady: true,
+          authSessionActive: true,
+          authCredential
         });
         return;
       }
-      Promise.resolve(onSessionRevoked?.({ uid: authUser.uid })).catch((error) => markError(diag, "user.session.revoke.local", Date.now(), error)).then(() => cloud.auth.logout()).catch((error) => markError(diag, "user.session.revoke.auth", Date.now(), error)).finally(() => {
-        if (userUid === authUser.uid) {
-          revokingSession = false;
-        }
+      revokeAuthentication(authUser, {
+        local: cloud.auth.session.isLocalTermination?.(authUser.uid, authSessionState?.generation) === true,
+        reason: "session-inactive"
       });
     }), current((error) => {
       markError(diag, "user.session.listen", authStartedAt, error);
+      revokeAuthenticationError(authUser, error, "session-listener");
     })));
     userWatches.push(cloud.user.admin.watch(authUser.uid, current((allowed) => {
       setState((user) => ({ ...user, isAdmin: allowed, adminReady: true }));
     }), current((error) => {
       markError(diag, "user.admin.listen", authStartedAt, error);
+      if (revokeAuthenticationError(authUser, error, "admin-listener"))
+        return;
       setState((user) => ({ ...user, isAdmin: false, adminReady: true }));
     })));
     userWatches.push(cloud.user.private.watch(authUser.uid, current((privateData, info = {}) => {
@@ -8213,6 +8253,8 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       }));
     }), current((error) => {
       markError(diag, "user.settings.snapshot", authStartedAt, error);
+      if (revokeAuthenticationError(authUser, error, "settings-listener"))
+        return;
       settingsStored = null;
       agreementStored = null;
       setState((user) => ({
@@ -8225,6 +8267,8 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       setState((user) => ({ ...user, banned: banned ?? null }));
     }), current((error) => {
       markError(diag, "user.moderation.listen", authStartedAt, error);
+      if (revokeAuthenticationError(authUser, error, "moderation-listener"))
+        return;
       setState((user) => ({ ...user, banned: null }));
     })));
     userWatches.push(cloud.user.blocked.watch(authUser.uid, current((blocked, info = {}) => {
@@ -8237,6 +8281,8 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       });
     }), current((error) => {
       markError(diag, "user.blocked.listen", authStartedAt, error);
+      if (revokeAuthenticationError(authUser, error, "blocked-listener"))
+        return;
       setState((user) => ({ ...user, blockedReady: false }));
     })));
     userWatches.push(cloud.user.profile.watch(authUser.uid, current((profileData, info = {}) => {
@@ -8283,6 +8329,8 @@ function createUser({ cloud, network, avatarCache = null, diag = null, onSession
       }
     }), current((error) => {
       markError(diag, "user.profile.snapshot", authStartedAt, error);
+      if (revokeAuthenticationError(authUser, error, "profile-listener"))
+        return;
       avatarFetch = { uid: null, key: null, promise: null };
       setState((user) => ({
         ...user,
@@ -41653,20 +41701,36 @@ function openAccount(options = {}) {
   let closePromise = null;
   let state;
   let chatSession = null;
+  let revokedUid = null;
+  let revocationPromise = null;
   let nextAgreement = agreementContract(options.agreement || CURRENT_AGREEMENT);
   const listeners = new Set;
   let activeWriteTail = Promise.resolve();
   const sessionCloseWork = new Set;
   const operationBarrier = createAccountOperationCloseBarrier();
+  function revokeSession(details = {}) {
+    const { uid = null } = details;
+    const accountUid = uid || state?.uid || null;
+    if (accountUid && revokedUid === accountUid) {
+      return revocationPromise || Promise.resolve();
+    }
+    revokedUid = accountUid;
+    let callback;
+    try {
+      callback = options.onSessionRevoked?.({ ...details, uid: accountUid });
+    } catch (error) {
+      callback = Promise.reject(error);
+    }
+    lock();
+    revocationPromise = Promise.resolve(callback);
+    return revocationPromise;
+  }
   const user = options.user || createUser({
     cloud,
     network: options.network || defaultNetwork,
     avatarCache,
     diag,
-    onSessionRevoked: ({ uid } = {}) => {
-      lock();
-      options.onSessionRevoked?.({ uid: uid || state?.uid || null });
-    }
+    onSessionRevoked: revokeSession
   });
   state = emptyState(user.getSnapshot(), options.network || defaultNetwork);
   const chat = createChatSession({
@@ -41915,6 +41979,24 @@ function openAccount(options = {}) {
         code: error?.code || "",
         message: error?.message || String(error)
       });
+      if (isAccountAuthenticationError(error)) {
+        revokeSession({
+          uid,
+          code: error?.code || "",
+          reason: "vault-listener"
+        }).catch((revocationError) => {
+          diag?.("account.session.revoke.error", {
+            code: revocationError?.code || "",
+            message: revocationError?.message || String(revocationError)
+          });
+        }).then(() => cloud.auth.logout()).catch((logoutError) => {
+          diag?.("account.session.revoke.auth.error", {
+            code: logoutError?.code || "",
+            message: logoutError?.message || String(logoutError)
+          });
+        });
+        return;
+      }
       lock();
       emit2({ vault: null, vaultReady: true, vaultError: error });
     });

package/dist/accountprofiles.js

@@ -249,6 +249,57 @@ function cleanBytes(...values) {
   }
 }
 
+// ../../core/passkey.js
+var PASSKEY_ENVIRONMENT_MISMATCH = "passkey-environment-mismatch";
+var PASSKEY_PROVIDER_ALREADY_LINKED = "passkey-provider-already-linked";
+var PASSKEY_REGISTER_INVALID = "passkey-register-invalid";
+var PASSKEY_RP_MISMATCH = "passkey-rp-mismatch";
+var PASSKEY_UNLINKED = "passkey-unlinked";
+var PASSKEY_CANCELLED_CODES = new Set(["ERR_USER_CANCELLED"]);
+var PASSKEY_CANCELLED_NAMES = new Set(["UserCancelledException"]);
+var PASSKEY_CONTROLLED_ERRORS = new Set([
+  PASSKEY_ENVIRONMENT_MISMATCH,
+  PASSKEY_PROVIDER_ALREADY_LINKED,
+  PASSKEY_REGISTER_INVALID,
+  PASSKEY_RP_MISMATCH,
+  PASSKEY_UNLINKED
+]);
+function canDeletePasskey(row, passkeys, currentPasskeyId) {
+  if (row?.type === "pending")
+    return true;
+  return row?.type === "passkey" && Array.isArray(passkeys) && passkeys.length > 1 && row.id !== cleanText(currentPasskeyId);
+}
+function passkeyError(code, message, cause) {
+  const error = new Error(message);
+  error.code = code;
+  error.cause = cause;
+  return error;
+}
+function normalizePasskeyLoginError(error, options = {}) {
+  if (options.localhostSilo === true && error?.code === "functions/failed-precondition" && cleanText(error?.message).includes("Localhost uses a separate passkey silo")) {
+    return passkeyError(PASSKEY_ENVIRONMENT_MISMATCH, "This passkey belongs to glyphteck.com, not localhost.", error);
+  }
+  if (error?.code === "functions/not-found") {
+    return passkeyError(PASSKEY_UNLINKED, "This passkey is no longer linked to an account.", error);
+  }
+  if (error?.code === "functions/failed-precondition") {
+    return passkeyError(PASSKEY_RP_MISMATCH, "This passkey belongs to a different Glyphteck passkey setup.", error);
+  }
+  return error;
+}
+function normalizePasskeyRegisterError(error, options = {}) {
+  if (error?.name === "CredentialAlreadyExistsException" || error?.name === "InvalidStateError" || error?.code === "functions/already-exists") {
+    return passkeyError(PASSKEY_PROVIDER_ALREADY_LINKED, "you already have a passkey for this account", error);
+  }
+  if (error?.code === "functions/failed-precondition") {
+    return passkeyError(PASSKEY_RP_MISMATCH, "This passkey belongs to a different Glyphteck passkey setup.", error);
+  }
+  if (options.invalidArgument === true && error?.code === "functions/invalid-argument" && error?.message) {
+    return passkeyError(PASSKEY_REGISTER_INVALID, error.message, error);
+  }
+  return error;
+}
+
 // ../../core/account/profiles.js
 var ACCOUNT_PROFILES_VERSION = 1;
 var PROFILE_ID_RE = /^[0-9a-f]{32}$/;
@@ -606,7 +657,7 @@ function requirePorts(options) {
     onError: typeof options.onError === "function" ? options.onError : null
   };
 }
-async function resolveAuthenticatedProfile(owner, generation, reason) {
+async function resolveAuthenticatedProfile(owner, generation, reason, details = {}) {
   ensureGeneration(owner, generation);
   const registry = owner.registry;
   const context = Object.freeze({
@@ -614,6 +665,7 @@ async function resolveAuthenticatedProfile(owner, generation, reason) {
     generation,
     reason,
     requestedProfileId: owner.requestedProfileId,
+    rejectedProfileId: details.rejectedProfileId || null,
     isCurrent: () => !owner.closing && !owner.closed && owner.generation === generation
   });
   const profileId = await owner.ports.resolveAuthenticatedProfile(registry, context);
@@ -981,7 +1033,9 @@ async function applyAuthenticatedProfile(owner, profile, generation, reason, opt
 }
 async function resumeAuthenticatedProfile(owner, generation, reason, options = {}) {
   publish(owner, reason, null);
-  const profile = await resolveAuthenticatedProfile(owner, generation, reason);
+  const profile = await resolveAuthenticatedProfile(owner, generation, reason, {
+    rejectedProfileId: options.rejectedProfileId
+  });
   return applyAuthenticatedProfile(owner, profile, generation, reason, options);
 }
 function transitionFailure(owner, error, generation, profileId) {
@@ -1009,12 +1063,15 @@ async function initialize(owner) {
     throw error;
   }
 }
-function requestAuthenticatedProfileResume(owner) {
+function requestAuthenticatedProfileResume(owner, options = {}) {
   ensureReady(owner);
+  const rejectedProfileId = options.rejectedProfileId == null ? null : readAccountProfileId(options.rejectedProfileId);
   const generation = requestSelection(owner, null, false);
   return enqueue(owner, async () => {
     try {
-      return await resumeAuthenticatedProfile(owner, generation, "restoring");
+      return await resumeAuthenticatedProfile(owner, generation, "restoring", {
+        rejectedProfileId
+      });
     } catch (error) {
       if (!isStaleAccountProfileTransition(error))
         publish(owner, "error", error);
@@ -1159,9 +1216,11 @@ async function updateStoredProfile(owner, profileId, fields) {
   return profile;
 }
 async function signOutStoredProfile(owner, profile) {
+  const hadActive = !!owner.active;
+  const wasActive = owner.active?.profile.profileId === profile.profileId;
   try {
     publish(owner, "signing-out", null);
-    if (!owner.active || owner.active.profile.profileId === profile.profileId) {
+    if (!hadActive || wasActive) {
       const lease = owner.active?.lease || {
         generation: owner.generation,
         profileId: profile.profileId,
@@ -1184,7 +1243,11 @@ async function signOutStoredProfile(owner, profile) {
     await mutateRegistry(owner, (current) => current.selectedProfileId === profile.profileId ? deselectAccountProfile(current, profile.profileId) : current);
     if (owner.requestedProfileId === profile.profileId)
       owner.requestedProfileId = null;
-    await resumeAuthenticatedProfile(owner, owner.generation, "restoring", { clearEmpty: false });
+    if (!hadActive || wasActive) {
+      await resumeAuthenticatedProfile(owner, owner.generation, "restoring", { clearEmpty: false });
+    } else {
+      publish(owner, "idle", null);
+    }
     if (signOutFailure)
       throw signOutFailure;
     return profile;
@@ -1193,18 +1256,19 @@ async function signOutStoredProfile(owner, profile) {
     throw error;
   }
 }
-function requestProfileSignOut(owner) {
+function requestProfileSignOut(owner, requestedProfileId = null) {
   ensureReady(owner);
-  const profileId = owner.active?.profile.profileId || owner.registry.selectedProfileId;
+  const profileId = requestedProfileId == null ? owner.active?.profile.profileId || owner.registry.selectedProfileId : readAccountProfileId(requestedProfileId);
   const profile = profileId ? accountProfileById(owner.registry, profileId) : null;
   if (!profile)
-    return Promise.reject(new Error("active account profile required"));
-  owner.generation += 1;
-  owner.requestedProfileId = null;
-  if (owner.openingLease)
-    owner.openingLease.valid = false;
-  if (owner.active)
+    return Promise.reject(new Error("account profile required"));
+  if (owner.active?.profile.profileId === profileId) {
+    owner.generation += 1;
+    owner.requestedProfileId = null;
+    if (owner.openingLease)
+      owner.openingLease.valid = false;
     owner.active.lease.valid = false;
+  }
   publish(owner);
   return enqueue(owner, () => signOutStoredProfile(owner, profile));
 }
@@ -1346,9 +1410,9 @@ function createAccountProfiles(options = {}) {
       const generation = requestSelection(owner, profileId, false);
       return enqueue(owner, () => switchExisting(owner, profileId, generation));
     },
-    resumeAuthenticated: () => requestAuthenticatedProfileResume(owner),
+    resumeAuthenticated: (options2) => requestAuthenticatedProfileResume(owner, options2),
     refresh: () => requestProfileRefresh(owner),
-    signOut: () => requestProfileSignOut(owner),
+    signOut: (profileId) => requestProfileSignOut(owner, profileId),
     remove: (profileId) => requestProfileRemoval(owner, profileId),
     getActiveRuntime: () => owner.active?.runtime || null,
     close: () => closeProfiles(owner)

package/dist/auth.js

@@ -82,8 +82,8 @@ function normalizePasskeyLoginError(error, options = {}) {
   return error;
 }
 function normalizePasskeyRegisterError(error, options = {}) {
-  if (error?.name === "InvalidStateError" || error?.code === "functions/already-exists") {
-    return passkeyError(PASSKEY_PROVIDER_ALREADY_LINKED, "this provider already has a passkey for this account. choose another provider, device, or security key", error);
+  if (error?.name === "CredentialAlreadyExistsException" || error?.name === "InvalidStateError" || error?.code === "functions/already-exists") {
+    return passkeyError(PASSKEY_PROVIDER_ALREADY_LINKED, "you already have a passkey for this account", error);
   }
   if (error?.code === "functions/failed-precondition") {
     return passkeyError(PASSKEY_RP_MISMATCH, "This passkey belongs to a different Glyphteck passkey setup.", error);