@oxy.so/core 4.1.0 → 4.2.0

package/dist/cjs/server/namespaces.js

@@ -1,6 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ServerReputationApi = exports.ServerAgencyApi = exports.ServerLinkedAccountsApi = exports.ServerNotificationsApi = exports.ServerAssetsApi = void 0;
+/**
+ * The server-side halves of the namespaces: what exists only with a service
+ * credential. `OxyServer` returns these from its namespace getters, so
+ * `server.assets.metadataByIds(...)` sits beside every client method of
+ * `oxy.assets`.
+ */
+const contracts_1 = require("@oxy.so/contracts");
 const assets_1 = require("../api/assets");
 const notifications_1 = require("../api/notifications");
 const linkedAccounts_1 = require("../api/linkedAccounts");
@@ -185,7 +192,57 @@ class ServerLinkedAccountsApi extends linkedAccounts_1.LinkedAccountsApi {
     }
 }
 exports.ServerLinkedAccountsApi = ServerLinkedAccountsApi;
+function agencyAuthorityOptions(signal) {
+    signal?.throwIfAborted();
+    return { cache: false, deduplicate: false, retry: false, skipAuth: true, timeout: 5000, ...(signal ? { signal } : {}) };
+}
 class ServerAgencyApi extends agency_1.AgencyApi {
+    /** Live registry discovery with this service's existing capability scopes. */
+    async serviceCatalogs(input = {}) {
+        const path = `/capabilities/catalogs${input.appId === undefined ? '' : `?appId=${encodeURIComponent(input.appId)}`}`;
+        const result = await lane(this.ctx).request('GET', path, undefined, agencyAuthorityOptions(input.signal));
+        return result.registrations;
+    }
+    /** Existing Oxy execution authority is required; this call creates none. */
+    async issueCapabilityTicket(input, options = {}) {
+        return lane(this.ctx).request('POST', '/capabilities/tickets', contracts_1.capabilityTicketRequestSchema.parse(input), agencyAuthorityOptions(options.signal));
+    }
+    /** Receiving app authenticates live introspection using its own service credential. */
+    async introspectCapabilityTicket(ticket, options = {}) {
+        if (ticket.trim() === '')
+            throw new Error('A capability ticket is required');
+        return lane(this.ctx).request('POST', '/capabilities/tickets/introspect', { ticket }, agencyAuthorityOptions(options.signal));
+    }
+    /**
+     * Authenticates the existing user-authority route with the requester's bearer.
+     * The service bearer and attribution headers cannot substitute for that user.
+     * The token goes only to this client's configured Oxy authority; never retry.
+     */
+    async createExecutionAuthorization(input, options) {
+        if (options.requesterToken === '' || /\s/.test(options.requesterToken))
+            throw new Error('A requester bearer is required');
+        const result = await this.ctx.request('POST', '/capabilities/execution-authorizations', input, {
+            ...agencyAuthorityOptions(options.signal),
+            headers: { Authorization: `Bearer ${options.requesterToken}` },
+        });
+        return result.authorization;
+    }
+    /** Revoke a direct approval on its canonical requester-authenticated lane. */
+    async revokeExecutionAuthorization(authorizationId, options) {
+        options.signal?.throwIfAborted();
+        if (!authorizationId || authorizationId.length > 255 || /\s/.test(authorizationId))
+            throw new Error('An execution authorization id is required');
+        if (!options.requesterToken || options.requesterToken.length > 16384 || /\s/.test(options.requesterToken))
+            throw new Error('A requester bearer is required');
+        await this.ctx.request('DELETE', `/capabilities/execution-authorizations/${encodeURIComponent(authorizationId)}`, undefined, { ...agencyAuthorityOptions(options.signal), headers: { Authorization: `Bearer ${options.requesterToken}` } });
+    }
+    /** Independent service proof plus present requester bearer, sent only to Oxy. */
+    async createForegroundExecutionAuthorization(input, options) {
+        if (options.requesterToken === '' || options.requesterToken.length > 16384 || /\s/.test(options.requesterToken))
+            throw new Error('A requester bearer is required');
+        const result = await lane(this.ctx).request('POST', '/capabilities/foreground-execution-authorizations', { ...contracts_1.foregroundExecutionAuthorizationInputSchema.parse(input), subjectToken: options.requesterToken }, agencyAuthorityOptions(options.signal));
+        return result.authorization;
+    }
     /**
      * Product backend → Oxy: trade the signed-in requester's access token for a
      * one-use assertion naming `agentId` (ADR 0025), authenticated with this

package/dist/cjs/server/serviceTokenLifetime.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OXY_SERVICE_TOKEN_MAX_LIFETIME_SECONDS = void 0;
+exports.hasBoundedServiceTokenLifetime = hasBoundedServiceTokenLifetime;
+/** Approved I03 ceiling shared by issuance and both JWT verifiers. */
+exports.OXY_SERVICE_TOKEN_MAX_LIFETIME_SECONDS = 300;
+/** Call only after signature verification; cache checks alone confer no authority. */
+function hasBoundedServiceTokenLifetime(claims, nowSeconds = Math.floor(Date.now() / 1000)) {
+    return typeof claims.iat === 'number' && Number.isSafeInteger(claims.iat)
+        && typeof claims.exp === 'number' && Number.isSafeInteger(claims.exp)
+        && claims.iat <= nowSeconds && claims.exp > claims.iat
+        && claims.exp - claims.iat <= exports.OXY_SERVICE_TOKEN_MAX_LIFETIME_SECONDS;
+}

package/dist/cjs/session/SessionClient.js

@@ -4,6 +4,7 @@ exports.SessionClient = void 0;
 const contracts_1 = require("@oxy.so/contracts");
 const logger_1 = require("../logger");
 const cacheKey_1 = require("../utils/cacheKey");
+const tokenClaims_1 = require("../utils/tokenClaims");
 const deviceDirectory_1 = require("./deviceDirectory");
 const socketLoader_1 = require("./socketLoader");
 /**
@@ -37,6 +38,8 @@ class SessionClient {
         this.socket = null;
         this.tokenUnsub = null;
         this.started = false;
+        this.lifecycleGeneration = 0;
+        this.fullSignOutPersistence = null;
         /** Same-origin cross-tab state-propagation channel; null on platforms without BroadcastChannel. */
         this.channel = null;
         /** App-facing subscriptions to named server-pushed socket events. */
@@ -44,6 +47,35 @@ class SessionClient {
         /** Event names already bound on the CURRENT socket instance. */
         this.boundServerEvents = new Set();
     }
+    persistFullSignOut() {
+        const state = this.state;
+        if (!state || !this.options.onFullExplicitSignOut)
+            return Promise.resolve();
+        if (this.fullSignOutPersistence?.state === state)
+            return this.fullSignOutPersistence.pending;
+        const pending = this.options.onFullExplicitSignOut();
+        this.fullSignOutPersistence = { state, pending };
+        void pending.catch(() => {
+            if (this.fullSignOutPersistence?.pending === pending)
+                this.fullSignOutPersistence = null;
+        });
+        return pending;
+    }
+    async requestDevice(method, url, data, requestOptions) {
+        const generation = this.lifecycleGeneration;
+        const response = await this.host.makeRequest(method, url, data, requestOptions);
+        if (generation !== this.lifecycleGeneration)
+            throw new Error('Device session request was superseded');
+        return response;
+    }
+    /** Stop and discard only this client's local device projection; no server revocation. */
+    resetLocalState() {
+        this.lifecycleGeneration += 1;
+        this.stop();
+        this.state = null;
+        this.directory = null;
+        this.notify();
+    }
     getState() {
         return this.state;
     }
@@ -166,6 +198,7 @@ class SessionClient {
      * cross-device push, a cold mint), not just the initial "no bearer yet" case.
      */
     applyState(raw, origin = 'push', activeToken) {
+        const generation = this.lifecycleGeneration;
         const next = (0, contracts_1.safeParseContract)(contracts_1.deviceSessionStateSchema, raw);
         if (!next) {
             logger_1.logger.warn('[SessionClient] discarded invalid session state');
@@ -221,6 +254,8 @@ class SessionClient {
             next.accounts.length > 0 &&
             (activeAccountId === null || (0, cacheKey_1.computeIdentityTag)(this.host.getAccessToken()) !== activeAccountId);
         const publish = () => {
+            if (generation !== this.lifecycleGeneration || this.state !== next)
+                return;
             this.notify();
             if (next.accounts.length === 0 && this.options.onUnauthenticated) {
                 try {
@@ -239,6 +274,8 @@ class SessionClient {
         // (and this stays synchronous) for every client that never read a
         // directory, i.e. the whole account lane.
         const finishApply = () => {
+            if (generation !== this.lifecycleGeneration || this.state !== next)
+                return;
             const settling = this.settleDirectory(next);
             if (settling === null) {
                 publish();
@@ -246,8 +283,38 @@ class SessionClient {
             }
             void settling.then(publish);
         };
+        // A sibling's validated full removal is logout here too. Persist the local
+        // account-mode recovery suppression before publishing signed-out or running
+        // the empty-state refresh (which could otherwise challenge Commons again).
+        // Keep the push credential intact; a marker is not a destructive wipe.
+        // Unknown initial empty state, stale revisions and identity pins do not
+        // turn into logout intent. A newer state/lifecycle suppresses this publish.
+        const priorBearer = this.host.getAccessToken();
+        const bearerAccount = priorBearer ? (0, tokenClaims_1.decodeTokenClaims)(priorBearer)?.userId : null;
+        // Warm cold boot may fetch authoritative empty state before it ever had a
+        // local projection. Its authenticated holder is history too. Decoding only
+        // identifies local history; authority remains the validated REST response.
+        const warmHolderEnded = previousState === null && origin === 'request' &&
+            typeof bearerAccount === 'string' && bearerAccount.length > 0 &&
+            this.host.getDeviceCredential()?.deviceId === next.deviceId;
+        if (((previousState?.deviceId === next.deviceId && previousState.accounts.length > 0) || warmHolderEnded) &&
+            next.accounts.length === 0 && pinnedAccountId === null && this.options.onFullExplicitSignOut) {
+            try {
+                void this.persistFullSignOut().then(finishApply).catch((error) => {
+                    logger_1.logger.error('[SessionClient] failed to persist received full sign-out', error);
+                    finishApply();
+                });
+            }
+            catch (error) {
+                logger_1.logger.error('[SessionClient] failed to persist received full sign-out', error);
+                finishApply();
+            }
+            return true;
+        }
         if (needsMintBeforeNotify) {
             void transport.ensureActiveToken(next).then(finishApply).catch((error) => {
+                if (generation !== this.lifecycleGeneration)
+                    return;
                 logger_1.logger.warn('[SessionClient] ensureActiveToken failed — reverting session state', { component: 'SessionClient' }, error);
                 // Do NOT notify under a mismatched bearer. Revert to the last applied
                 // state so subscribers keep observing the account whose token is planted.
@@ -271,7 +338,7 @@ class SessionClient {
      * the token still needs to be planted. The account-match guard rejects a stale response for an
      * account that is no longer active.
      */
-    applySync(raw) {
+    async applySync(raw) {
         const sync = (0, contracts_1.safeParseContract)(contracts_1.deviceSessionSyncSchema, raw);
         if (!sync) {
             const parsed = contracts_1.deviceSessionSyncSchema.safeParse(raw);
@@ -288,6 +355,8 @@ class SessionClient {
             return;
         }
         this.commitSync(sync);
+        if (this.fullSignOutPersistence?.state === this.state)
+            await this.fullSignOutPersistence.pending;
     }
     /**
      * The apply + token-plant half of {@link applySync}, on an ALREADY-VALIDATED
@@ -365,7 +434,7 @@ class SessionClient {
     }
     /** `GET /session/device/directory` → {@link applyDirectory}. No notify. */
     async fetchDirectory() {
-        const res = await this.host.makeRequest('GET', '/session/device/directory', undefined, { cache: false });
+        const res = await this.requestDevice('GET', '/session/device/directory', undefined, { cache: false });
         return this.applyDirectory(res);
     }
     /**
@@ -474,8 +543,8 @@ class SessionClient {
         }
     }
     async bootstrap() {
-        const res = await this.host.makeRequest('GET', '/session/device/state', undefined, { cache: false });
-        this.applySync(res);
+        const res = await this.requestDevice('GET', '/session/device/state', undefined, { cache: false });
+        await this.applySync(res);
     }
     /**
      * Adopt server-authoritative state already returned by another session
@@ -518,7 +587,7 @@ class SessionClient {
      * compatibility path for callers still keyed on account ids.
      */
     async activateContext(contextId) {
-        const res = await this.host.makeRequest('POST', '/session/device/activate', { contextId }, { cache: false });
+        const res = await this.requestDevice('POST', '/session/device/activate', { contextId }, { cache: false });
         const activation = (0, contracts_1.safeParseContract)(contracts_1.deviceActivateResponseSchema, res);
         if (!activation) {
             logger_1.logger.warn('[SessionClient] discarded invalid activation response');
@@ -544,8 +613,8 @@ class SessionClient {
         }
     }
     async switchAccount(accountId) {
-        const res = await this.host.makeRequest('POST', '/session/device/switch', { accountId }, { cache: false });
-        this.applySync(res);
+        const res = await this.requestDevice('POST', '/session/device/switch', { accountId }, { cache: false });
+        await this.applySync(res);
         this.postCommitPing();
     }
     /**
@@ -560,9 +629,11 @@ class SessionClient {
      * {@link signOutPrincipal} for the two that can tell those apart.
      */
     async signOut(target) {
-        const res = await this.host.makeRequest('POST', '/session/device/signout', target, { cache: false });
-        this.applySync(res);
+        const res = await this.requestDevice('POST', '/session/device/signout', target, { cache: false });
+        await this.applySync(res);
         this.postCommitPing();
+        if (this.state?.accounts.length === 0)
+            await this.persistFullSignOut();
     }
     /**
      * Remove ONE `principal → account` pair, and only that pair.
@@ -601,7 +672,7 @@ class SessionClient {
      * applied this revision.
      */
     async removeFromDevice(target) {
-        const res = await this.host.makeRequest('POST', '/session/device/signout', target, { cache: false });
+        const res = await this.requestDevice('POST', '/session/device/signout', target, { cache: false });
         const removal = (0, contracts_1.safeParseContract)(contracts_1.deviceDirectorySyncSchema, res);
         if (!removal) {
             logger_1.logger.warn('[SessionClient] discarded invalid device removal response');
@@ -609,6 +680,8 @@ class SessionClient {
         }
         const directoryApplied = this.applyDirectory(removal.directory);
         const stateApplied = this.commitSync({ state: removal.state, activeToken: removal.activeToken });
+        if (this.fullSignOutPersistence?.state === this.state)
+            await this.fullSignOutPersistence.pending;
         // `commitSync` publishes whenever the flat state moved. When only the
         // directory did — a socket push already applied this revision — the
         // directory half would otherwise never reach a subscriber.
@@ -616,10 +689,12 @@ class SessionClient {
             this.notify();
         }
         this.postCommitPing();
+        if (this.state?.accounts.length === 0)
+            await this.persistFullSignOut();
     }
     async addCurrentAccount() {
-        const res = await this.host.makeRequest('POST', '/session/device/add', undefined, { cache: false });
-        this.applySync(res);
+        const res = await this.requestDevice('POST', '/session/device/add', undefined, { cache: false });
+        await this.applySync(res);
         this.postCommitPing();
     }
     /**
@@ -721,6 +796,7 @@ class SessionClient {
         const deviceCredential = this.host.getDeviceCredential();
         if (!token && !deviceCredential)
             return;
+        const generation = this.lifecycleGeneration;
         const socket = io(this.host.getBaseURL(), {
             transports: ['websocket'],
             autoConnect: true,
@@ -745,6 +821,8 @@ class SessionClient {
         socket.on('session_state', (payload) => {
             // A socket broadcast is a `push`-origin — potentially transient, so an
             // empty state here must not erase the durable device credential.
+            if (generation !== this.lifecycleGeneration)
+                return;
             const applied = this.applyState(payload, 'push');
             if (!applied)
                 return;

package/dist/cjs/session/authStateStore.js

@@ -18,11 +18,19 @@
  * ESM-safe (no `require()`).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AUTH_STATE_TOKEN_STORAGE_KEY = exports.AUTH_STATE_STORAGE_KEY = void 0;
+exports.AUTH_STATE_TOKEN_STORAGE_KEY = exports.AUTOMATIC_IDENTITY_SIGNIN_SUPPRESSED_KEY = exports.AUTH_STATE_STORAGE_KEY = void 0;
+exports.matchesAuthState = matchesAuthState;
 exports.createMemoryAuthStateStore = createMemoryAuthStateStore;
 exports.createWebAuthStateStore = createWebAuthStateStore;
 exports.createNativeAuthStateStore = createNativeAuthStateStore;
 const logger_1 = require("../logger");
+function matchesAuthState(actual, expected) {
+    if (!actual || !expected)
+        return actual === expected;
+    return actual.deviceId === expected.deviceId && actual.deviceSecret === expected.deviceSecret &&
+        actual.sessionId === expected.sessionId && actual.userId === expected.userId &&
+        actual.accessToken === expected.accessToken && actual.expiresAt === expected.expiresAt;
+}
 /**
  * Versioned DURABLE storage key. Holds ONLY the small, re-mint-critical fields
  * (`sessionId`, `userId`, `deviceId`, `deviceSecret`) — never the large JWT
@@ -41,6 +49,7 @@ const logger_1 = require("../logger");
  * so upgrading users are not signed out; the next `save()` splits them apart.
  */
 exports.AUTH_STATE_STORAGE_KEY = 'oxy.auth.v1';
+exports.AUTOMATIC_IDENTITY_SIGNIN_SUPPRESSED_KEY = 'oxy.auth.automatic-identity-signin-suppressed.v1';
 /**
  * Versioned BEST-EFFORT warm-token storage key. Holds the short-lived
  * `{ accessToken, expiresAt }` pair only. Its write is genuinely non-fatal — a
@@ -204,6 +213,12 @@ function createMemoryAuthStateStore() {
             current = state;
             return true;
         },
+        saveIfCurrent: async (state, guard) => {
+            if (!guard.isCurrent() || !matchesAuthState(current, guard.expectedState))
+                return false;
+            current = state;
+            return true;
+        },
         clear: async () => {
             current = null;
         },
@@ -331,8 +346,110 @@ function createNativeAuthStateStore(storage) {
     // Same in-memory mirror as the web store — a locked/failed SecureStore write
     // must not silently lose the session for the app's lifetime.
     let sessionMirror;
+    let suppressedMirror;
+    let pending = Promise.resolve();
+    const serialize = (operation) => {
+        const result = pending.then(operation);
+        pending = result.then(() => undefined, () => undefined);
+        return result;
+    };
+    const readCurrent = async () => {
+        if (sessionMirror !== undefined)
+            return sessionMirror;
+        const [durable, warm] = await Promise.all([
+            storage.getItem(exports.AUTH_STATE_STORAGE_KEY), storage.getItem(exports.AUTH_STATE_TOKEN_STORAGE_KEY),
+        ]);
+        return composeState(durable, warm);
+    };
+    const persistState = async (state) => {
+        sessionMirror = state;
+        // Durable credential FIRST, then VERIFY. On Android SecureStore an
+        // oversize/failed write can resolve WITHOUT throwing, so a read-back is the
+        // only reliable proof. The mirror keeps the session live for this app run,
+        // but a failed DURABLE write means the mint credential will NOT survive a
+        // cold restart — surface it, never swallow.
+        let durablePersisted = false;
+        try {
+            const durableJson = serializeDurable(state);
+            await storage.setItem(exports.AUTH_STATE_STORAGE_KEY, durableJson);
+            durablePersisted = (await storage.getItem(exports.AUTH_STATE_STORAGE_KEY)) === durableJson;
+            if (!durablePersisted) {
+                logger_1.logger.error('[authStateStore] durable credential read-back mismatch after save — the device credential did not persist (likely oversize SecureStore value); the session survives this app run via the in-memory mirror but will be lost on cold restart', undefined, { component: 'authStateStore' });
+            }
+        }
+        catch (error) {
+            logger_1.logger.error('[authStateStore] durable credential persist threw — the device credential did not persist; the session survives this app run via the in-memory mirror but will be lost on cold restart', error, { component: 'authStateStore' });
+        }
+        // Warm token AFTER, best-effort. Its failure is genuinely non-fatal (the
+        // durable credential re-mints a fresh token) and must never abort or
+        // corrupt the durable write above.
+        try {
+            const warmJson = serializeWarmToken(state);
+            if (warmJson) {
+                await storage.setItem(exports.AUTH_STATE_TOKEN_STORAGE_KEY, warmJson);
+            }
+            else {
+                await storage.removeItem(exports.AUTH_STATE_TOKEN_STORAGE_KEY);
+            }
+        }
+        catch {
+            // Locked / oversize keychain — non-fatal warm-boot loss only.
+        }
+        // Report ONLY the durable-credential landing; the warm-token outcome above
+        // is intentionally excluded (it is a best-effort optimization).
+        return durablePersisted;
+    };
     return {
-        load: async () => {
+        isAutomaticIdentitySignInSuppressed: () => serialize(async () => {
+            if (suppressedMirror !== undefined)
+                return suppressedMirror;
+            try {
+                return (await storage.getItem(exports.AUTOMATIC_IDENTITY_SIGNIN_SUPPRESSED_KEY)) !== null;
+            }
+            catch {
+                return true; // Unknown storage must not start a new key sign-in.
+            }
+        }),
+        setAutomaticIdentitySignInSuppressed: (suppressed, guard) => serialize(async () => {
+            if (guard) {
+                let current = sessionMirror;
+                if (current === undefined) {
+                    try {
+                        const [durable, warm] = await Promise.all([
+                            storage.getItem(exports.AUTH_STATE_STORAGE_KEY), storage.getItem(exports.AUTH_STATE_TOKEN_STORAGE_KEY),
+                        ]);
+                        current = composeState(durable, warm);
+                    }
+                    catch {
+                        suppressedMirror = true;
+                        return false;
+                    }
+                }
+                const expected = guard.expectedState;
+                if (!guard.isCurrent() || !current ||
+                    current.deviceId !== expected.deviceId || current.deviceSecret !== expected.deviceSecret ||
+                    current.sessionId !== expected.sessionId || current.userId !== expected.userId ||
+                    current.accessToken !== expected.accessToken || current.expiresAt !== expected.expiresAt)
+                    return false;
+            }
+            suppressedMirror = suppressed;
+            try {
+                if (suppressed)
+                    await storage.setItem(exports.AUTOMATIC_IDENTITY_SIGNIN_SUPPRESSED_KEY, '1');
+                else
+                    await storage.removeItem(exports.AUTOMATIC_IDENTITY_SIGNIN_SUPPRESSED_KEY);
+                const actual = await storage.getItem(exports.AUTOMATIC_IDENTITY_SIGNIN_SUPPRESSED_KEY);
+                const verified = suppressed ? actual === '1' : actual === null;
+                if (!verified)
+                    suppressedMirror = true;
+                return verified;
+            }
+            catch {
+                suppressedMirror = true;
+                return false;
+            }
+        }),
+        load: () => serialize(async () => {
             if (sessionMirror !== undefined) {
                 return sessionMirror;
             }
@@ -346,46 +463,20 @@ function createNativeAuthStateStore(storage) {
             catch {
                 return null;
             }
-        },
-        save: async (state) => {
-            sessionMirror = state;
-            // Durable credential FIRST, then VERIFY. On Android SecureStore an
-            // oversize/failed write can resolve WITHOUT throwing, so a read-back is the
-            // only reliable proof. The mirror keeps the session live for this app run,
-            // but a failed DURABLE write means the mint credential will NOT survive a
-            // cold restart — surface it, never swallow.
-            let durablePersisted = false;
+        }),
+        save: (state) => serialize(() => persistState(state)),
+        saveIfCurrent: (state, guard) => serialize(async () => {
             try {
-                const durableJson = serializeDurable(state);
-                await storage.setItem(exports.AUTH_STATE_STORAGE_KEY, durableJson);
-                durablePersisted = (await storage.getItem(exports.AUTH_STATE_STORAGE_KEY)) === durableJson;
-                if (!durablePersisted) {
-                    logger_1.logger.error('[authStateStore] durable credential read-back mismatch after save — the device credential did not persist (likely oversize SecureStore value); the session survives this app run via the in-memory mirror but will be lost on cold restart', undefined, { component: 'authStateStore' });
-                }
-            }
-            catch (error) {
-                logger_1.logger.error('[authStateStore] durable credential persist threw — the device credential did not persist; the session survives this app run via the in-memory mirror but will be lost on cold restart', error, { component: 'authStateStore' });
-            }
-            // Warm token AFTER, best-effort. Its failure is genuinely non-fatal (the
-            // durable credential re-mints a fresh token) and must never abort or
-            // corrupt the durable write above.
-            try {
-                const warmJson = serializeWarmToken(state);
-                if (warmJson) {
-                    await storage.setItem(exports.AUTH_STATE_TOKEN_STORAGE_KEY, warmJson);
-                }
-                else {
-                    await storage.removeItem(exports.AUTH_STATE_TOKEN_STORAGE_KEY);
-                }
+                const current = await readCurrent();
+                if (!guard.isCurrent() || !matchesAuthState(current, guard.expectedState))
+                    return false;
             }
             catch {
-                // Locked / oversize keychain — non-fatal warm-boot loss only.
+                return false;
             }
-            // Report ONLY the durable-credential landing; the warm-token outcome above
-            // is intentionally excluded (it is a best-effort optimization).
-            return durablePersisted;
-        },
-        clear: async () => {
+            return persistState(state);
+        }),
+        clear: () => serialize(async () => {
             sessionMirror = null;
             try {
                 await storage.removeItem(exports.AUTH_STATE_STORAGE_KEY);
@@ -399,6 +490,6 @@ function createNativeAuthStateStore(storage) {
             catch {
                 // Non-fatal.
             }
-        },
+        }),
     };
 }