@oxy.so/core 1.18.1 → 3.0.0

package/dist/cjs/session/index.js

@@ -0,0 +1,131 @@
+"use strict";
+/**
+ * `@oxy.so/core/session` — the device-first session machinery.
+ *
+ * The multi-account `SessionClient`, the headless account dialog, the persisted
+ * auth-state stores, the token re-mint handler and scheduler, and the cold
+ * boot. `@oxy.so/services` builds `OxyProvider` on it; an app that only calls
+ * the API with a token it already has never needs it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runColdBoot = exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.establishIdentitySession = exports.resolveIdentityPin = exports.IDENTITY_PIN_STORAGE_KEY = exports.identityPinMatches = exports.createMemoryIdentityPinStore = exports.createNativeIdentityPinStore = exports.createWebIdentityPinStore = exports.readLocalDeviceCredential = exports.publishProvenDeviceCredential = exports.normalizeSharedDeviceSessionRead = exports.decideSharedDevicePublish = exports.decideSharedDeviceJoin = exports.createSharedMirroringAuthStateStore = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.resolveAccountDelegationAccess = exports.canSwitchIntoAccount = exports.isSwitchTargetAccount = exports.showsPrincipalHeaders = exports.buildSwitcherRows = exports.resolveDeviceContext = exports.resolveActiveContext = exports.projectDevicePrincipals = exports.directoryHandle = exports.directoryDisplayName = exports.canActivateContext = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.DeviceManager = void 0;
+// Session code reaches the identity key (identity-bound sessions), so the
+// crypto shim goes first — see `../crypto/polyfill`.
+require("../crypto/polyfill");
+var deviceManager_1 = require("../utils/deviceManager");
+Object.defineProperty(exports, "DeviceManager", { enumerable: true, get: function () { return deviceManager_1.DeviceManager; } });
+// ---------------------------------------------------------------------------
+// Session sync (device-scoped multi-account session client)
+// ---------------------------------------------------------------------------
+var SessionClient_1 = require("./SessionClient");
+Object.defineProperty(exports, "SessionClient", { enumerable: true, get: function () { return SessionClient_1.SessionClient; } });
+// Shared SessionClient integration layer: the host adapter, the pure
+// DeviceSessionState projection helpers, and the client factory are defined
+// ONCE here so every `@oxy.so/services` platform variant reuses them instead of
+// duplicating a local copy. Each consumer supplies its own `TokenTransport`
+// (native vs. web mint strategies differ) to `createSessionClient`.
+var sessionClientHost_1 = require("./sessionClientHost");
+Object.defineProperty(exports, "createSessionClientHost", { enumerable: true, get: function () { return sessionClientHost_1.createSessionClientHost; } });
+var createSessionClient_1 = require("./createSessionClient");
+Object.defineProperty(exports, "createSessionClient", { enumerable: true, get: function () { return createSessionClient_1.createSessionClient; } });
+var projectSessionState_1 = require("./projectSessionState");
+Object.defineProperty(exports, "deviceStateToClientSessions", { enumerable: true, get: function () { return projectSessionState_1.deviceStateToClientSessions; } });
+Object.defineProperty(exports, "activeSessionIdOf", { enumerable: true, get: function () { return projectSessionState_1.activeSessionIdOf; } });
+Object.defineProperty(exports, "activeUserOf", { enumerable: true, get: function () { return projectSessionState_1.activeUserOf; } });
+Object.defineProperty(exports, "accountIdsOf", { enumerable: true, get: function () { return projectSessionState_1.accountIdsOf; } });
+// Pure projections over the device DIRECTORY (`GET /session/device/directory`,
+// ADR 0002) — the read model that keeps the actor (the human who authenticated)
+// and the subject (the account being acted as) apart. The flat
+// `DeviceSessionState` collapses them into one row, so it can neither tell
+// "signed in as an org" from "a person operating that org" nor hold two people
+// reaching the same org on one device.
+// `canActivateContext` is the switchability question — `available` alone, never
+// composed with `onDevice`, which is a different fact in both directions.
+// `projectDevicePrincipals` is the switcher's shape: people, each with what
+// they may become. Grouped rather than flat because the same organization
+// reached through two people is TWO rows under two humans, which a list keyed
+// by account cannot say.
+var deviceDirectory_1 = require("./deviceDirectory");
+Object.defineProperty(exports, "canActivateContext", { enumerable: true, get: function () { return deviceDirectory_1.canActivateContext; } });
+Object.defineProperty(exports, "directoryDisplayName", { enumerable: true, get: function () { return deviceDirectory_1.directoryDisplayName; } });
+Object.defineProperty(exports, "directoryHandle", { enumerable: true, get: function () { return deviceDirectory_1.directoryHandle; } });
+Object.defineProperty(exports, "projectDevicePrincipals", { enumerable: true, get: function () { return deviceDirectory_1.projectDevicePrincipals; } });
+Object.defineProperty(exports, "resolveActiveContext", { enumerable: true, get: function () { return deviceDirectory_1.resolveActiveContext; } });
+Object.defineProperty(exports, "resolveDeviceContext", { enumerable: true, get: function () { return deviceDirectory_1.resolveDeviceContext; } });
+// The switcher's RENDER model over that projection — names, handles and avatar
+// URLs resolved once. Shared by `@oxy.so/services`' account dialog and the
+// auth.oxy.so chooser so the two cannot drift, the same reason the flat
+// projection lived here before it.
+var deviceSwitcherRows_1 = require("./deviceSwitcherRows");
+Object.defineProperty(exports, "buildSwitcherRows", { enumerable: true, get: function () { return deviceSwitcherRows_1.buildSwitcherRows; } });
+Object.defineProperty(exports, "showsPrincipalHeaders", { enumerable: true, get: function () { return deviceSwitcherRows_1.showsPrincipalHeaders; } });
+// The switch-target predicates over the account GRAPH — a list of accounts to
+// manage, not the device's list of identities to become (that is the directory
+// above). `isSwitchTargetAccount` is the structural half ("is this kind
+// switchable at all?"); `canSwitchIntoAccount` adds the caller's
+// `account:act_as` permission. Exported so the surfaces that render
+// `AccountNode`s — the Console workspace switcher, managed-accounts rows — ask
+// the SAME questions instead of testing a kind literal.
+var accountSwitchTargets_1 = require("./accountSwitchTargets");
+Object.defineProperty(exports, "isSwitchTargetAccount", { enumerable: true, get: function () { return accountSwitchTargets_1.isSwitchTargetAccount; } });
+Object.defineProperty(exports, "canSwitchIntoAccount", { enumerable: true, get: function () { return accountSwitchTargets_1.canSwitchIntoAccount; } });
+// The service/agent counterpart to the human switch predicates above. Kept on
+// its own semantic seam because `bot` is delegable but never human-switchable.
+var accountDelegationAccess_1 = require("./accountDelegationAccess");
+Object.defineProperty(exports, "resolveAccountDelegationAccess", { enumerable: true, get: function () { return accountDelegationAccess_1.resolveAccountDelegationAccess; } });
+// Headless controller for the unified account dialog. Framework-agnostic
+// state machine + subscribe/getSnapshot store (bind via `useSyncExternalStore`)
+// — sign-in runs through `oxy.auth` (email, password, authenticator, the
+// Commons QR / shared-keychain handoff). Reuses `SessionClient.switchAccount` /
+// `oxy.accounts.actAs` for the uniform switch.
+var accountDialogController_1 = require("./accountDialogController");
+Object.defineProperty(exports, "AccountDialogController", { enumerable: true, get: function () { return accountDialogController_1.AccountDialogController; } });
+Object.defineProperty(exports, "createAccountDialogController", { enumerable: true, get: function () { return accountDialogController_1.createAccountDialogController; } });
+// ---------------------------------------------------------------------------
+// Device-first session machinery (zero-cookie transport).
+// Persisted auth-state store, the unified re-mint handler + scheduler, and the
+// cold-boot runner. Built ON the `runColdBoot` primitive + `SessionClient`. The
+// device credential is `deviceId` + `deviceSecret`; the access token is re-minted
+// via `POST /session/device/token`.
+// ---------------------------------------------------------------------------
+var authStateStore_1 = require("./authStateStore");
+Object.defineProperty(exports, "createWebAuthStateStore", { enumerable: true, get: function () { return authStateStore_1.createWebAuthStateStore; } });
+Object.defineProperty(exports, "createNativeAuthStateStore", { enumerable: true, get: function () { return authStateStore_1.createNativeAuthStateStore; } });
+Object.defineProperty(exports, "createMemoryAuthStateStore", { enumerable: true, get: function () { return authStateStore_1.createMemoryAuthStateStore; } });
+Object.defineProperty(exports, "AUTH_STATE_STORAGE_KEY", { enumerable: true, get: function () { return authStateStore_1.AUTH_STATE_STORAGE_KEY; } });
+// The shared NATIVE DeviceSession credential — how several official apps on one
+// device end up on ONE `DeviceSession` and therefore one active context. It is an
+// ordinary revocable `deviceId` + `deviceSecret`, deliberately NOT the
+// Commons private identity key: an app that only needs a session must never be
+// handed the key that signs identity approvals.
+var sharedDeviceCredential_1 = require("./sharedDeviceCredential");
+Object.defineProperty(exports, "createSharedMirroringAuthStateStore", { enumerable: true, get: function () { return sharedDeviceCredential_1.createSharedMirroringAuthStateStore; } });
+Object.defineProperty(exports, "decideSharedDeviceJoin", { enumerable: true, get: function () { return sharedDeviceCredential_1.decideSharedDeviceJoin; } });
+Object.defineProperty(exports, "decideSharedDevicePublish", { enumerable: true, get: function () { return sharedDeviceCredential_1.decideSharedDevicePublish; } });
+Object.defineProperty(exports, "normalizeSharedDeviceSessionRead", { enumerable: true, get: function () { return sharedDeviceCredential_1.normalizeSharedDeviceSessionRead; } });
+Object.defineProperty(exports, "publishProvenDeviceCredential", { enumerable: true, get: function () { return sharedDeviceCredential_1.publishProvenDeviceCredential; } });
+Object.defineProperty(exports, "readLocalDeviceCredential", { enumerable: true, get: function () { return sharedDeviceCredential_1.readLocalDeviceCredential; } });
+// Identity-bound sessions (the identity vault). The pin is the durable
+// `{publicKey, accountId}` binding between this device's PRIMARY identity key
+// and the account it authenticates as; it is what keeps such a client from
+// following the device's mutable `activeAccountId`.
+var identityPin_1 = require("./identityPin");
+Object.defineProperty(exports, "createWebIdentityPinStore", { enumerable: true, get: function () { return identityPin_1.createWebIdentityPinStore; } });
+Object.defineProperty(exports, "createNativeIdentityPinStore", { enumerable: true, get: function () { return identityPin_1.createNativeIdentityPinStore; } });
+Object.defineProperty(exports, "createMemoryIdentityPinStore", { enumerable: true, get: function () { return identityPin_1.createMemoryIdentityPinStore; } });
+Object.defineProperty(exports, "identityPinMatches", { enumerable: true, get: function () { return identityPin_1.identityPinMatches; } });
+Object.defineProperty(exports, "IDENTITY_PIN_STORAGE_KEY", { enumerable: true, get: function () { return identityPin_1.IDENTITY_PIN_STORAGE_KEY; } });
+var identitySession_1 = require("./identitySession");
+Object.defineProperty(exports, "resolveIdentityPin", { enumerable: true, get: function () { return identitySession_1.resolveIdentityPin; } });
+Object.defineProperty(exports, "establishIdentitySession", { enumerable: true, get: function () { return identitySession_1.establishIdentitySession; } });
+var refresh_1 = require("./refresh");
+Object.defineProperty(exports, "refreshPersistedSession", { enumerable: true, get: function () { return refresh_1.refreshPersistedSession; } });
+Object.defineProperty(exports, "refreshDeviceSecretArm", { enumerable: true, get: function () { return refresh_1.refreshDeviceSecretArm; } });
+Object.defineProperty(exports, "createAuthRefreshHandler", { enumerable: true, get: function () { return refresh_1.createAuthRefreshHandler; } });
+Object.defineProperty(exports, "installAuthRefreshHandler", { enumerable: true, get: function () { return refresh_1.installAuthRefreshHandler; } });
+Object.defineProperty(exports, "startTokenRefreshScheduler", { enumerable: true, get: function () { return refresh_1.startTokenRefreshScheduler; } });
+Object.defineProperty(exports, "TOKEN_REFRESH_LEAD_MS", { enumerable: true, get: function () { return refresh_1.TOKEN_REFRESH_LEAD_MS; } });
+var sessionColdBoot_1 = require("../boot/sessionColdBoot");
+Object.defineProperty(exports, "runSessionColdBoot", { enumerable: true, get: function () { return sessionColdBoot_1.runSessionColdBoot; } });
+var coldBoot_1 = require("../utils/coldBoot");
+Object.defineProperty(exports, "runColdBoot", { enumerable: true, get: function () { return coldBoot_1.runColdBoot; } });

package/dist/cjs/session/refresh.js

@@ -78,8 +78,8 @@ exports.REMINT_AFTER_EXPIRY_MS = 2000;
 async function refreshDeviceSecretArm(deps) {
     const { oxy, store } = deps;
     const pin = deps.pin ?? null;
-    return oxy.httpService.runSingleFlightDeviceSecretMint(async () => {
-        const epoch = oxy.httpService.getSessionEpoch();
+    return oxy.http.runSingleFlightDeviceSecretMint(async () => {
+        const epoch = oxy.http.getSessionEpoch();
         const persisted = await store.load();
         if (!persisted?.deviceId || !persisted?.deviceSecret) {
             return { status: 'no-secret' };
@@ -89,10 +89,10 @@ async function refreshDeviceSecretArm(deps) {
             // Unpinned callers pass NO third argument at all, so the account-mode call
             // shape (and therefore the request body) is untouched by this feature.
             mint = pin
-                ? await oxy.mintFromDeviceSecret(persisted.deviceId, persisted.deviceSecret, {
+                ? await oxy.devices.mintToken(persisted.deviceId, persisted.deviceSecret, {
                     accountId: pin.accountId,
                 })
-                : await oxy.mintFromDeviceSecret(persisted.deviceId, persisted.deviceSecret);
+                : await oxy.devices.mintToken(persisted.deviceId, persisted.deviceSecret);
         }
         catch (error) {
             // 429 keeps the credential like any other transient failure — the secret
@@ -104,7 +104,7 @@ async function refreshDeviceSecretArm(deps) {
             // requests. Telling HttpService lengthens the next cooldown to one attempt
             // per limiter window, which lets the budget drain and the session heal.
             if ((0, errorUtils_1.extractErrorStatus)(error) === 429) {
-                oxy.httpService.noteRefreshRateLimited();
+                oxy.http.noteRefreshRateLimited();
                 return { status: 'transient' };
             }
             if ((0, errorUtils_1.extractErrorStatus)(error) === 401) {
@@ -145,11 +145,11 @@ async function refreshDeviceSecretArm(deps) {
             expiresAt: mint.expiresAt,
             ...(bound ? { sessionId: bound.sessionId, userId: bound.accountId } : {}),
         };
-        if (oxy.httpService.getSessionEpoch() !== epoch) {
-            // Signed out while minting. The server has rotated the secret, so a store
-            // that still holds the presented one must learn the rotation (the
-            // token-null lane keeps the store so a reload can restore); a store the
-            // sign-out cleared must NOT be refilled. Either way, plant nothing.
+        if (oxy.http.getSessionEpoch() !== epoch) {
+            // Signed out while minting. A store that still holds the presented
+            // secret takes the server's `nextDeviceSecret` (the token-null lane keeps
+            // the store so a reload can restore); a store the sign-out cleared must
+            // NOT be refilled. Either way, plant nothing.
             const current = await store.load();
             if (current?.deviceId === persisted.deviceId && current.deviceSecret === persisted.deviceSecret) {
                 await store.save(next);
@@ -162,10 +162,10 @@ async function refreshDeviceSecretArm(deps) {
         if (!persistedOk) {
             return { status: 'persist-failed' };
         }
-        if (oxy.httpService.getSessionEpoch() !== epoch) {
+        if (oxy.http.getSessionEpoch() !== epoch) {
             return { status: 'session-ended' };
         }
-        oxy.setTokens(mint.accessToken);
+        oxy.session.setAccessToken(mint.accessToken);
         return {
             status: 'ok',
             token: mint.accessToken,
@@ -202,7 +202,7 @@ async function refreshPersistedSession(deps) {
     const identity = deps.identity ?? null;
     // The shared keychain is never an identity-bound client's recovery path.
     const allowSharedKeyFallback = identity ? false : (deps.allowSharedKeyFallback ?? (0, platform_1.isNative)());
-    const epoch = oxy.httpService.getSessionEpoch();
+    const epoch = oxy.http.getSessionEpoch();
     // Resolved per call: a re-established identity session can move the pin, and a
     // replaced/removed local key clears it (in which case arm 1 must NOT mint —
     // an unpinned mint would adopt whatever account the device switched to).
@@ -231,13 +231,20 @@ async function refreshPersistedSession(deps) {
             // 401: secret diverged or no live session. When a key-based arm 2 can still
             // recover (native shared key, or an identity-bound client's own primary
             // key) drop ONLY the secret and keep the deviceId; otherwise (web) the
-            // session is over — clear the store.
+            // session is over.
             const persisted = await store.load();
             if (allowSharedKeyFallback || identity) {
                 if (persisted) {
                     await store.save({ ...persisted, deviceSecret: undefined });
                 }
             }
+            else if (arm1.status === 'no-session' && persisted?.deviceId && persisted.deviceSecret) {
+                // Web, a credential the server still recognises: this origin stays a
+                // holder of the browser's device (ADR 0029 D2) — the next sign-in in any
+                // app lands on it, and this app follows without opening the bridge
+                // again. Only the session fields go.
+                await store.save({ sessionId: '', userId: '', deviceId: persisted.deviceId, deviceSecret: persisted.deviceSecret });
+            }
             else {
                 await store.clear();
             }
@@ -256,14 +263,14 @@ async function refreshPersistedSession(deps) {
     }
     // Never after a sign-out: the shared keychain holds an identity KEY, not a
     // session, and using it here would sign the user straight back in.
-    if (allowSharedKeyFallback && !oxy.httpService.hasSessionEnded()) {
+    if (allowSharedKeyFallback && !oxy.http.hasSessionEnded()) {
         try {
             // Planted here, not by the sign-in: a sign-out that lands while the
             // challenge round-trips must win, or the shared keychain signs the user
             // straight back in.
-            const session = await oxy.signInWithSharedIdentity({ plantTokens: false });
+            const session = await oxy.auth.signInWithSharedIdentity({ plantTokens: false });
             if (session?.accessToken) {
-                if (oxy.httpService.getSessionEpoch() !== epoch) {
+                if (oxy.http.getSessionEpoch() !== epoch) {
                     return null;
                 }
                 // Repopulate the fast device-secret lane from the shared-key re-mint.
@@ -277,10 +284,10 @@ async function refreshPersistedSession(deps) {
                         expiresAt: session.expiresAt,
                     });
                 }
-                if (oxy.httpService.getSessionEpoch() !== epoch) {
+                if (oxy.http.getSessionEpoch() !== epoch) {
                     return null;
                 }
-                oxy.setTokens(session.accessToken);
+                oxy.session.setAccessToken(session.accessToken);
                 return session.accessToken;
             }
         }
@@ -327,9 +334,9 @@ function createAuthRefreshHandler(deps) {
  * Returns a disposer that removes it.
  */
 function installAuthRefreshHandler(deps) {
-    deps.oxy.httpService.setAuthRefreshHandler(createAuthRefreshHandler(deps));
+    deps.oxy.http.setAuthRefreshHandler(createAuthRefreshHandler(deps));
     return () => {
-        deps.oxy.httpService.setAuthRefreshHandler(null);
+        deps.oxy.http.setAuthRefreshHandler(null);
     };
 }
 /**
@@ -371,10 +378,10 @@ function startTokenRefreshScheduler(oxy) {
     /** Schedule the next re-mint from the current token's expiry (the healthy path). */
     const scheduleFromExpiry = () => {
         clearTimer();
-        if (disposed || !oxy.getAccessToken()) {
+        if (disposed || !oxy.session.accessToken) {
             return;
         }
-        const expSeconds = oxy.getAccessTokenExpiry();
+        const expSeconds = oxy.session.accessTokenExpiry;
         if (expSeconds === null) {
             return;
         }
@@ -382,7 +389,7 @@ function startTokenRefreshScheduler(oxy) {
         // The server already answered this token's refresh with this very token:
         // asking again before `exp` only gets it back again. Ask just after expiry,
         // when the server rotates (see REMINT_AFTER_EXPIRY_MS).
-        if (untilExpiryMs > 0 && oxy.httpService.isAwaitingCurrentTokenExpiry?.()) {
+        if (untilExpiryMs > 0 && oxy.http.isAwaitingCurrentTokenExpiry?.()) {
             armTimer(untilExpiryMs + exports.REMINT_AFTER_EXPIRY_MS);
             return;
         }
@@ -394,11 +401,11 @@ function startTokenRefreshScheduler(oxy) {
         clearTimer();
         // Another lane (a request-time preflight) already asked, and the server
         // answered with this same token: re-arm for just past expiry instead.
-        if (oxy.httpService.isAwaitingCurrentTokenExpiry?.()) {
+        if (oxy.http.isAwaitingCurrentTokenExpiry?.()) {
             scheduleFromExpiry();
             return;
         }
-        void oxy.httpService.refreshAccessToken('preflight')
+        void oxy.http.refreshAccessToken('preflight')
             .then((token) => Boolean(token))
             .catch(() => false)
             .then((ok) => {
@@ -425,10 +432,10 @@ function startTokenRefreshScheduler(oxy) {
         scheduleFromExpiry();
     };
     const onFocus = () => {
-        if (disposed || !oxy.getAccessToken()) {
+        if (disposed || !oxy.session.accessToken) {
             return;
         }
-        const expSeconds = oxy.getAccessTokenExpiry();
+        const expSeconds = oxy.session.accessTokenExpiry;
         if (expSeconds === null) {
             return;
         }
@@ -443,8 +450,8 @@ function startTokenRefreshScheduler(oxy) {
     // Re-arm only on a token that actually CHANGED. The mint plants the token it
     // returns even when that is the token already held, and treating the repeat
     // as new re-armed from an in-lead-window expiry, i.e. at the 1s floor.
-    let lastSeenToken = oxy.getAccessToken();
-    const unsubscribeTokens = oxy.onTokensChanged((token) => {
+    let lastSeenToken = oxy.session.accessToken;
+    const unsubscribeTokens = oxy.session.onChange((token) => {
         if (disposed || token === lastSeenToken) {
             return;
         }

package/dist/cjs/session/sessionClientHost.js

@@ -17,12 +17,12 @@ function createSessionClientHost(oxyServices) {
     let currentAccountId = null;
     let deviceCredential = null;
     return {
-        makeRequest: (method, url, data, options) => oxyServices.makeRequest(method, url, data, options),
-        getBaseURL: () => oxyServices.getBaseURL(),
-        getAccessToken: () => oxyServices.getAccessToken(),
+        makeRequest: (method, url, data, options) => oxyServices.request(method, url, data, options),
+        getBaseURL: () => oxyServices.baseURL,
+        getAccessToken: () => oxyServices.session.accessToken,
         getDeviceCredential: () => deviceCredential,
-        onTokensChanged: (listener) => oxyServices.onTokensChanged(listener),
-        setTokens: (accessToken) => oxyServices.setTokens(accessToken),
+        onTokensChanged: (listener) => oxyServices.session.onChange(listener),
+        setTokens: (accessToken) => oxyServices.session.setAccessToken(accessToken),
         getCurrentAccountId: () => currentAccountId,
         setCurrentAccountId: (id) => {
             currentAccountId = id;

package/dist/cjs/session/sharedDeviceCredential.js

@@ -163,8 +163,9 @@ function decideSharedDevicePublish(proven, shared) {
             if (shared.credential.deviceSecret === proven.deviceSecret) {
                 return { action: 'skip', reason: 'already-current' };
             }
-            // Same device, newer secret. Sign-in rotates the secret (the mint does
-            // not), so the just-proven one is the credential a fresh install should
+            // Same device, newer secret. Each sign-in issues a new holder credential
+            // (the older one stays valid until the device ends with nobody signed
+            // in), so the just-proven one is the credential a fresh install should
             // join with.
             return { action: 'publish' };
         }

package/dist/cjs/shared/utils/networkUtils.js

@@ -60,7 +60,7 @@ const calculateBackoffInterval = (state) => {
     const { consecutiveFailures, baseInterval, maxInterval } = state;
     if (consecutiveFailures === 0)
         return baseInterval;
-    const backoffMultiplier = Math.min(Math.pow(2, consecutiveFailures - 1), maxInterval / baseInterval);
+    const backoffMultiplier = Math.min(2 ** (consecutiveFailures - 1), maxInterval / baseInterval);
     return Math.min(baseInterval * backoffMultiplier, maxInterval);
 };
 exports.calculateBackoffInterval = calculateBackoffInterval;
@@ -173,7 +173,7 @@ const withRetry = async (fn, options = {}) => {
             if (attempt === maxRetries || !shouldRetry(error)) {
                 throw error;
             }
-            const delayMs = Math.min(baseDelay * Math.pow(2, attempt), maxDelay);
+            const delayMs = Math.min(baseDelay * 2 ** attempt, maxDelay);
             onRetry?.(error, attempt + 1);
             await (0, exports.delay)(delayMs);
         }

package/dist/cjs/utils/accountCacheSweep.js

@@ -13,15 +13,12 @@
  * those cached and the account switcher keeps drawing the pre-edit name and
  * picture for the full TTL, against a perfectly healthy server.
  *
- * The mixins compose into one class at runtime but are typed one at a time, so
- * the user mixin cannot call a method the accounts mixin owns. The key list
- * therefore lives here, once, and every writer calls {@link
- * evictOxyAccountForestCache} — exactly like the identity key list in
- * `identityCacheSweep`, which the accounts mixin already calls for the
- * mirror-image case (an account write staling the identity reads). The
- * alternative — a second hand-written copy of these keys in the other mixin —
- * is the drift that shipped the two stale-profile bugs `identityCacheSweep`
- * documents.
+ * The key list lives here, once, and every writer (`users.updateMe`, the
+ * `accounts` namespace) reads it — exactly like the identity key list in
+ * `identityCacheSweep`, which account writes use for the mirror-image case (an
+ * account write staling the identity reads). A second hand-written copy of
+ * these keys in another namespace is the drift that shipped the two
+ * stale-profile bugs `identityCacheSweep` documents.
  *
  * WHY THE LIST NEEDS A PREFIX AND THE DETAIL DOES NOT
  * --------------------------------------------------
@@ -71,10 +68,9 @@ function oxyAccountDetailCacheKey(accountId) {
  *                    account in it (create, archive, ownership transfer) has no
  *                    detail row to name, and clears only the lists.
  */
-function evictOxyAccountForestCache(oxy, accountId) {
-    oxy.clearCacheEntry(exports.OXY_ACCOUNT_LIST_CACHE_KEY);
-    oxy.clearCacheByPrefix(exports.OXY_ACCOUNT_LIST_CACHE_QUERY_PREFIX);
-    if (accountId) {
-        oxy.clearCacheEntry(oxyAccountDetailCacheKey(accountId));
-    }
+function evictOxyAccountForestCache(http, accountId) {
+    http.invalidateCache({
+        keys: accountId ? [exports.OXY_ACCOUNT_LIST_CACHE_KEY, oxyAccountDetailCacheKey(accountId)] : [exports.OXY_ACCOUNT_LIST_CACHE_KEY],
+        prefixes: [exports.OXY_ACCOUNT_LIST_CACHE_QUERY_PREFIX],
+    });
 }

package/dist/cjs/utils/asyncUtils.js

@@ -1,49 +1,25 @@
 "use strict";
 /**
- * Async utilities for common asynchronous patterns and error handling
+ * Retry with exponential backoff and jitter — the policy `HttpService` uses.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.delay = void 0;
-exports.withErrorHandling = withErrorHandling;
-exports.parallelWithErrorHandling = parallelWithErrorHandling;
 exports.retryAsync = retryAsync;
-exports.debounceAsync = debounceAsync;
-exports.throttleAsync = throttleAsync;
-exports.sequentialWithProgress = sequentialWithProgress;
-exports.batchAsync = batchAsync;
-exports.createCancellableAsync = createCancellableAsync;
-exports.withTimeout = withTimeout;
-exports.withLoadingState = withLoadingState;
-exports.retryOnError = retryOnError;
-const logger_1 = require("../logger");
 const errorUtils_1 = require("./errorUtils");
 /**
- * Wrapper for async operations with automatic error handling
- * Returns null on error instead of throwing
- */
-async function withErrorHandling(operation, errorHandler, context) {
-    try {
-        return await operation();
-    }
-    catch (error) {
-        if (errorHandler) {
-            errorHandler(error);
-        }
-        else {
-            logger_1.logger.error(`Error in ${context || 'operation'}`, error instanceof Error ? error : new Error(String(error)), {
-                component: 'asyncUtils',
-                method: 'withErrorHandling',
-            });
-        }
-        return null;
-    }
-}
-/**
- * Execute multiple async operations in parallel with error handling
+ * Whether an error came from a request hitting its own timeout.
+ *
+ * A timeout and a caller cancellation both surface from `fetch` as an
+ * `AbortError`, so this only recognises one that has already been CLASSIFIED
+ * (by `HttpService`, which knows which of its own timers fired). An
+ * unclassified abort is treated as a cancellation, which is the safe
+ * direction: refusing to retry something that was abandoned costs nothing,
+ * while retrying it is the defect this whole option exists to fix.
  */
-async function parallelWithErrorHandling(operations, errorHandler) {
-    const results = await Promise.allSettled(operations.map((op, index) => withErrorHandling(op, error => errorHandler?.(error, index))));
-    return results.map(result => result.status === 'fulfilled' ? result.value : null);
+function isTimeoutError(error) {
+    if (!error || typeof error !== 'object')
+        return false;
+    const candidate = error;
+    return candidate.timeout === true || candidate.code === errorUtils_1.ErrorCodes.TIMEOUT;
 }
 /**
  * Extract an HTTP status code from an error value, tolerating both the
@@ -68,21 +44,15 @@ function extractHttpStatus(error) {
     return undefined;
 }
 /**
- * Whether an error came from a request hitting its own timeout.
+ * Retry an async operation with exponential backoff
  *
- * A timeout and a caller cancellation both surface from `fetch` as an
- * `AbortError`, so this only recognises one that has already been CLASSIFIED
- * (by `HttpService`, which knows which of its own timers fired). An
- * unclassified abort is treated as a cancellation, which is the safe
- * direction: refusing to retry something that was abandoned costs nothing,
- * while retrying it is the defect this whole option exists to fix.
+ * By default, does not retry on 4xx errors (client errors). The default
+ * predicate accepts both the axios-style `error.response.status` and the
+ * flat `error.status` shape produced by {@link handleHttpError}, so callers
+ * never accidentally retry a deterministic client failure.
+ *
+ * Use the `shouldRetry` callback to customize retry behavior.
  */
-function isTimeoutError(error) {
-    if (!error || typeof error !== 'object')
-        return false;
-    const candidate = error;
-    return candidate.timeout === true || candidate.code === errorUtils_1.ErrorCodes.TIMEOUT;
-}
 async function retryAsync(operation, maxRetriesOrOptions = 3, baseDelayArg = 1000, shouldRetryArg) {
     // An options-object overload rather than a fifth positional parameter:
     // `retryOnError` below and other in-tree callers pass positionally, and a
@@ -139,7 +109,7 @@ async function retryAsync(operation, maxRetriesOrOptions = 3, baseDelayArg = 100
                 break;
             }
             // Calculate delay with exponential backoff and jitter
-            const delay = baseDelay * Math.pow(2, attempt) + Math.random() * 1000;
+            const delay = baseDelay * 2 ** attempt + Math.random() * 1000;
             // Nothing may start, or even sleep, past the deadline — otherwise the
             // budget bounds the attempts but not the wall clock the caller feels.
             if (deadline !== undefined && Date.now() + delay >= deadline) {
@@ -150,114 +120,3 @@ async function retryAsync(operation, maxRetriesOrOptions = 3, baseDelayArg = 100
     }
     throw lastError;
 }
-/**
- * Debounce async function calls
- */
-function debounceAsync(func, delay) {
-    let timeoutId;
-    return (...args) => {
-        return new Promise((resolve, reject) => {
-            clearTimeout(timeoutId);
-            timeoutId = setTimeout(async () => {
-                try {
-                    const result = await func(...args);
-                    resolve(result);
-                }
-                catch (error) {
-                    reject(error);
-                }
-            }, delay);
-        });
-    };
-}
-/**
- * Throttle async function calls
- */
-function throttleAsync(func, limit, interval) {
-    let inThrottle = false;
-    let lastPromise = null;
-    return (...args) => {
-        if (inThrottle) {
-            return lastPromise;
-        }
-        inThrottle = true;
-        lastPromise = func(...args);
-        setTimeout(() => {
-            inThrottle = false;
-        }, interval);
-        return lastPromise;
-    };
-}
-/**
- * Execute async operations sequentially with progress tracking
- */
-async function sequentialWithProgress(operations, onProgress) {
-    const results = [];
-    for (let i = 0; i < operations.length; i++) {
-        const result = await operations[i]();
-        results.push(result);
-        onProgress?.(i + 1, operations.length);
-    }
-    return results;
-}
-/**
- * Batch async operations
- */
-async function batchAsync(items, batchSize, processor) {
-    for (let i = 0; i < items.length; i += batchSize) {
-        const batch = items.slice(i, i + batchSize);
-        await processor(batch);
-    }
-}
-/**
- * Create a cancellable async operation
- */
-function createCancellableAsync(operation) {
-    let abortController = null;
-    return {
-        execute: async () => {
-            abortController = new AbortController();
-            return await operation(abortController.signal);
-        },
-        cancel: () => {
-            abortController?.abort();
-        }
-    };
-}
-/**
- * Timeout wrapper for async operations
- */
-async function withTimeout(operation, timeoutMs, timeoutMessage) {
-    const timeoutPromise = new Promise((_, reject) => {
-        setTimeout(() => {
-            reject(new Error(timeoutMessage || `Operation timed out after ${timeoutMs}ms`));
-        }, timeoutMs);
-    });
-    return Promise.race([operation, timeoutPromise]);
-}
-/**
- * Execute async operation with loading state
- */
-async function withLoadingState(operation, setLoading) {
-    setLoading(true);
-    try {
-        return await operation();
-    }
-    finally {
-        setLoading(false);
-    }
-}
-/**
- * Create a promise that resolves after a delay
- */
-const delay = (ms) => new Promise(resolve => setTimeout(resolve, ms));
-exports.delay = delay;
-/**
- * Execute async operation with retry on specific errors
- */
-async function retryOnError(operation, retryableErrors, maxRetries = 3) {
-    return retryAsync(operation, maxRetries, 1000, (error) => {
-        const errorCode = error?.code || error?.status || error?.message;
-        return retryableErrors.includes(errorCode);
-    });
-}