@oxy.so/core 4.5.0-oxy-one.0 → 4.5.0

package/dist/esm/crypto/keyManager.js

@@ -188,7 +188,7 @@ async function initExpoCrypto() {
  */
 function uint8ArrayToHex(bytes) {
     return Array.from(bytes)
-        .map(b => b.toString(16).padStart(2, '0'))
+        .map((b) => b.toString(16).padStart(2, '0'))
         .join('');
 }
 /** Decode a lowercase hex string to bytes. Inverse of {@link uint8ArrayToHex}. */
@@ -298,7 +298,9 @@ export class KeyManager {
     }
     /** Build private-key write options (device-only accessibility) for a given keychain service. */
     static _privateWriteOpts(store, service) {
-        const opts = { keychainAccessible: store.WHEN_UNLOCKED_THIS_DEVICE_ONLY };
+        const opts = {
+            keychainAccessible: store.WHEN_UNLOCKED_THIS_DEVICE_ONLY,
+        };
         if (service) {
             opts.keychainService = service;
         }
@@ -610,7 +612,9 @@ export class KeyManager {
         }
         try {
             if (!(await signer.write(privateKey, publicKey))) {
-                logger.warn(`The identity signer store (${signer.name}) did not confirm the write`, { component: 'KeyManager' });
+                logger.warn(`The identity signer store (${signer.name}) did not confirm the write`, {
+                    component: 'KeyManager',
+                });
             }
         }
         catch (error) {
@@ -826,10 +830,14 @@ export class KeyManager {
         return {
             primaryPublicKey,
             sharedPublicKey,
-            activePublicKey: isAndroid() ? (primaryPublicKey ?? sharedPublicKey) : (sharedPublicKey ?? primaryPublicKey),
+            activePublicKey: isAndroid()
+                ? (primaryPublicKey ?? sharedPublicKey)
+                : (sharedPublicKey ?? primaryPublicKey),
             // Only a real disagreement is out of sync. A device with just one slot
             // populated has nothing to contradict.
-            inSync: primaryPublicKey === null || sharedPublicKey === null || primaryPublicKey === sharedPublicKey,
+            inSync: primaryPublicKey === null ||
+                sharedPublicKey === null ||
+                primaryPublicKey === sharedPublicKey,
         };
     }
     /**
@@ -1082,7 +1090,9 @@ export class KeyManager {
             priorPublic = await store.getItemAsync(layout.primaryPublicKeyName, primaryReadOpts);
         }
         catch (error) {
-            logger.error('Failed to read existing primary before persist', error, { component: 'KeyManager' });
+            logger.error('Failed to read existing primary before persist', error, {
+                component: 'KeyManager',
+            });
             throw new IdentityPersistError('Could not read existing identity before writing a new one; refusing to overwrite blind.', error);
         }
         // If we are replacing a DIFFERENT, currently-healthy identity, make sure
@@ -1113,7 +1123,9 @@ export class KeyManager {
                     await store.setItemAsync(layout.backupTimestampName, Date.now().toString(), backupPubWriteOpts);
                 }
                 catch (error) {
-                    logger.error('Failed to back up existing identity before overwrite', error, { component: 'KeyManager' });
+                    logger.error('Failed to back up existing identity before overwrite', error, {
+                        component: 'KeyManager',
+                    });
                     throw new IdentityPersistError('Failed to back up existing identity before overwrite', error);
                 }
             }
@@ -1127,7 +1139,9 @@ export class KeyManager {
             await store.setItemAsync(layout.primaryPrivateKeyName, canonicalPrivate, primaryPrivWriteOpts);
         }
         catch (error) {
-            logger.error('Failed to write primary identity to secure store', error, { component: 'KeyManager' });
+            logger.error('Failed to write primary identity to secure store', error, {
+                component: 'KeyManager',
+            });
             await KeyManager._rollbackPrimary(store, layout, priorPrivate, priorPublic);
             throw new IdentityPersistError('Failed to write identity to secure store', error);
         }
@@ -1151,7 +1165,9 @@ export class KeyManager {
         // trigger a spurious mismatch.
         if (readBackPrivate?.toLowerCase() !== canonicalPrivate ||
             readBackPublic?.toLowerCase() !== canonicalPublic) {
-            logger.error('Identity round-trip mismatch after write', undefined, { component: 'KeyManager' });
+            logger.error('Identity round-trip mismatch after write', undefined, {
+                component: 'KeyManager',
+            });
             await KeyManager._rollbackPrimary(store, layout, priorPrivate, priorPublic);
             throw new IdentityPersistError('Identity write was not persisted correctly (round-trip mismatch).');
         }
@@ -1194,7 +1210,9 @@ export class KeyManager {
             priorBackupTimestamp = await store.getItemAsync(layout.backupTimestampName, backupReadOpts);
         }
         catch (error) {
-            logger.error('Failed to snapshot identity backup before refresh', error, { component: 'KeyManager' });
+            logger.error('Failed to snapshot identity backup before refresh', error, {
+                component: 'KeyManager',
+            });
             await KeyManager._rollbackPrimary(store, layout, priorPrivate, priorPublic);
             throw new IdentityPersistError('Failed to snapshot identity backup before refresh', error);
         }
@@ -1204,7 +1222,9 @@ export class KeyManager {
             await store.setItemAsync(layout.backupTimestampName, Date.now().toString(), backupPubWriteOpts);
         }
         catch (error) {
-            logger.error('Failed to refresh identity backup after primary write', error, { component: 'KeyManager' });
+            logger.error('Failed to refresh identity backup after primary write', error, {
+                component: 'KeyManager',
+            });
             await KeyManager._rollbackBackup(store, layout, priorBackupPrivate, priorBackupPublic, priorBackupTimestamp);
             await KeyManager._rollbackPrimary(store, layout, priorPrivate, priorPublic);
             throw new IdentityPersistError('Failed to refresh identity backup after primary write', error);
@@ -1254,7 +1274,9 @@ export class KeyManager {
             }
             const sameIdentity = existing?.publicKey === publicKey;
             const keptMnemonic = mnemonic ?? (sameIdentity ? existing?.mnemonic : undefined);
-            if (sameIdentity && existing?.privateKey === privateKey && existing?.mnemonic === keptMnemonic) {
+            if (sameIdentity &&
+                existing?.privateKey === privateKey &&
+                existing?.mnemonic === keptMnemonic) {
                 return true; // Already current; do not churn the store.
             }
             await store.write(serializeDeviceBackup({
@@ -1301,7 +1323,9 @@ export class KeyManager {
     static async _readHealthyPrimary() {
         try {
             const direct = await KeyManager._readPrimaryDirect();
-            if (KeyManager._isHealthyPair(direct.privateKey, direct.publicKey) && direct.privateKey && direct.publicKey) {
+            if (KeyManager._isHealthyPair(direct.privateKey, direct.publicKey) &&
+                direct.privateKey &&
+                direct.publicKey) {
                 return {
                     privateKey: KeyManager.canonicalPrivateKey(direct.privateKey),
                     publicKey: direct.publicKey.toLowerCase(),
@@ -1398,7 +1422,9 @@ export class KeyManager {
                 try {
                     await store.deleteItemAsync(layout.backupPrivateKeyName, backupReadOpts);
                 }
-                catch { /* best effort */ }
+                catch {
+                    /* best effort */
+                }
             }
             if (priorBackupPublic) {
                 await store.setItemAsync(layout.backupPublicKeyName, priorBackupPublic, backupPubWriteOpts);
@@ -1407,7 +1433,9 @@ export class KeyManager {
                 try {
                     await store.deleteItemAsync(layout.backupPublicKeyName, backupReadOpts);
                 }
-                catch { /* best effort */ }
+                catch {
+                    /* best effort */
+                }
             }
             if (priorBackupTimestamp) {
                 await store.setItemAsync(layout.backupTimestampName, priorBackupTimestamp, backupPubWriteOpts);
@@ -1416,11 +1444,15 @@ export class KeyManager {
                 try {
                     await store.deleteItemAsync(layout.backupTimestampName, backupReadOpts);
                 }
-                catch { /* best effort */ }
+                catch {
+                    /* best effort */
+                }
             }
         }
         catch (rollbackError) {
-            logger.error('Failed to roll back identity backup after a failed refresh', rollbackError, { component: 'KeyManager' });
+            logger.error('Failed to roll back identity backup after a failed refresh', rollbackError, {
+                component: 'KeyManager',
+            });
         }
     }
     /**
@@ -1448,15 +1480,21 @@ export class KeyManager {
                 try {
                     await store.deleteItemAsync(layout.primaryPublicKeyName, primaryReadOpts);
                 }
-                catch { /* best effort */ }
+                catch {
+                    /* best effort */
+                }
                 try {
                     await store.deleteItemAsync(layout.primaryPrivateKeyName, primaryReadOpts);
                 }
-                catch { /* best effort */ }
+                catch {
+                    /* best effort */
+                }
             }
         }
         catch (rollbackError) {
-            logger.error('Failed to roll back primary identity after a failed write', rollbackError, { component: 'KeyManager' });
+            logger.error('Failed to roll back primary identity after a failed write', rollbackError, {
+                component: 'KeyManager',
+            });
         }
         finally {
             // Whatever happened, the cached verdict is no longer trustworthy.
@@ -1762,7 +1800,9 @@ export class KeyManager {
             // fetch before the device is unlocked). Do NOT cache; throw a TYPED error
             // so callers distinguish "temporarily unavailable" from "genuinely absent"
             // instead of silently treating a locked keystore as a blank device.
-            logger.error('Failed to read identity from secure storage', error, { component: 'KeyManager' });
+            logger.error('Failed to read identity from secure storage', error, {
+                component: 'KeyManager',
+            });
             throw new IdentityUnavailableError('Failed to read identity from secure storage.', error);
         }
         // Storage succeeded. Now classify the result. From here onward, any
@@ -1789,7 +1829,9 @@ export class KeyManager {
                 }
             }
             else {
-                logger.warn('KeyManager.hasIdentity: stored key material is malformed', { component: 'KeyManager' });
+                logger.warn('KeyManager.hasIdentity: stored key material is malformed', {
+                    component: 'KeyManager',
+                });
             }
         }
         // Cache result. Storage succeeded, so this verdict is stable:
@@ -1914,7 +1956,9 @@ export class KeyManager {
             try {
                 const backupSuccess = await KeyManager.backupIdentity();
                 if (!backupSuccess && isDev()) {
-                    logger.warn('Failed to backup identity before deletion - proceeding anyway', { component: 'KeyManager' });
+                    logger.warn('Failed to backup identity before deletion - proceeding anyway', {
+                        component: 'KeyManager',
+                    });
                 }
             }
             catch (backupError) {
@@ -2042,7 +2086,9 @@ export class KeyManager {
             const probeHash = '0'.repeat(64);
             const signature = signSecp256k1Digest(canonicalPrivateKey, probeHash);
             if (!verifySecp256k1Digest(publicKey, probeHash, signature)) {
-                logger.error('Identity sign/verify probe failed during integrity check', undefined, { component: 'KeyManager' });
+                logger.error('Identity sign/verify probe failed during integrity check', undefined, {
+                    component: 'KeyManager',
+                });
                 return false;
             }
             return true;
@@ -2116,8 +2162,11 @@ export class KeyManager {
             if (!backupPrivateKey || !backupPublicKey) {
                 return false; // No backup available
             }
-            if (!KeyManager.isValidPrivateKey(backupPrivateKey) || !KeyManager.isValidPublicKey(backupPublicKey)) {
-                logger.warn('Backup identity is malformed; refusing to restore', { component: 'KeyManager' });
+            if (!KeyManager.isValidPrivateKey(backupPrivateKey) ||
+                !KeyManager.isValidPublicKey(backupPublicKey)) {
+                logger.warn('Backup identity is malformed; refusing to restore', {
+                    component: 'KeyManager',
+                });
                 return false;
             }
             // Verify backup keys derive consistently. Hex is case-insensitive so
@@ -2125,7 +2174,9 @@ export class KeyManager {
             // be considered valid.
             const derivedPublicKey = KeyManager.derivePublicKey(backupPrivateKey);
             if (derivedPublicKey.toLowerCase() !== backupPublicKey.toLowerCase()) {
-                logger.warn('Backup public key does not match derived; refusing to restore', { component: 'KeyManager' });
+                logger.warn('Backup public key does not match derived; refusing to restore', {
+                    component: 'KeyManager',
+                });
                 return false;
             }
             // Guard 3: if ANY primary key material is still present and identifies a
@@ -2134,8 +2185,7 @@ export class KeyManager {
             // the user. We check the private key too (not just the public): a
             // present private key that derives to a non-backup public means a real,
             // different identity is sitting in the primary slot.
-            if (primaryPublic &&
-                primaryPublic.toLowerCase() !== backupPublicKey.toLowerCase()) {
+            if (primaryPublic && primaryPublic.toLowerCase() !== backupPublicKey.toLowerCase()) {
                 logger.error('Primary public key is present, corrupt-or-mismatched, AND differs from the backup. Refusing to restore to avoid switching accounts.', undefined, { component: 'KeyManager' });
                 return false;
             }
@@ -2151,7 +2201,9 @@ export class KeyManager {
                 await KeyManager._persistIdentityAtomic(backupPrivateKey, backupPublicKey, 'restore');
             }
             catch (error) {
-                logger.error('Failed to persist identity restored from backup', error, { component: 'KeyManager' });
+                logger.error('Failed to persist identity restored from backup', error, {
+                    component: 'KeyManager',
+                });
                 return false;
             }
             await store.setItemAsync(layout.backupTimestampName, Date.now().toString(), backupReadOpts);
@@ -2289,7 +2341,8 @@ export class KeyManager {
         if (!(await KeyManager._commitRecovery(record.privateKey, record.publicKey))) {
             return false;
         }
-        if (record.mnemonic && (await KeyManager._phraseDerivesPublicKey(record.mnemonic, record.publicKey))) {
+        if (record.mnemonic &&
+            (await KeyManager._phraseDerivesPublicKey(record.mnemonic, record.publicKey))) {
             try {
                 await KeyManager.storeRecoveryMnemonic(record.mnemonic);
             }
@@ -2357,7 +2410,9 @@ export class KeyManager {
             return true;
         }
         catch (error) {
-            logger.error('Recovery: failed to persist recovered identity', error, { component: 'KeyManager' });
+            logger.error('Recovery: failed to persist recovered identity', error, {
+                component: 'KeyManager',
+            });
             return false;
         }
     }

package/dist/esm/crypto/recoveryPhrase.js

@@ -24,7 +24,7 @@ function toHex(data) {
     // Convert to array of numbers if needed
     const bytes = data instanceof Uint8Array ? data : new Uint8Array(data);
     return Array.from(bytes)
-        .map(b => b.toString(16).padStart(2, '0'))
+        .map((b) => b.toString(16).padStart(2, '0'))
         .join('');
 }
 /** UTF-8 encode an ASCII label to bytes (for HKDF salt/info). */
@@ -233,7 +233,7 @@ export class RecoveryPhraseService {
      * Convert a word array to a phrase string
      */
     static wordsToPhrase(words) {
-        return words.map(w => w.toLowerCase().trim()).join(' ');
+        return words.map((w) => w.toLowerCase().trim()).join(' ');
     }
 }
 export default RecoveryPhraseService;

package/dist/esm/crypto/signatureService.js

@@ -39,7 +39,7 @@ export class SignatureService {
         const bytes = new Uint8Array(32);
         globalThis.crypto.getRandomValues(bytes);
         return Array.from(bytes)
-            .map(b => b.toString(16).padStart(2, '0'))
+            .map((b) => b.toString(16).padStart(2, '0'))
             .join('');
     }
     /**
@@ -81,8 +81,7 @@ export class SignatureService {
      * Verify a signed message object
      * Checks both signature validity and timestamp freshness
      */
-    static async verifySignedMessage(signedMessage, maxAgeMs = 5 * 60 * 1000 // 5 minutes default
-    ) {
+    static async verifySignedMessage(signedMessage, maxAgeMs = 5 * 60 * 1000) {
         const { message, signature, publicKey, timestamp } = signedMessage;
         // Check timestamp freshness
         const now = Date.now();
@@ -185,7 +184,7 @@ export class SignatureService {
         const timestamp = Date.now();
         // Create canonical string representation
         const sortedKeys = Object.keys(data).sort();
-        const canonicalParts = sortedKeys.map(key => `${key}:${JSON.stringify(data[key])}`);
+        const canonicalParts = sortedKeys.map((key) => `${key}:${JSON.stringify(data[key])}`);
         const canonicalString = canonicalParts.join('|');
         const message = `request:${publicKey}:${timestamp}:${canonicalString}`;
         const signature = await SignatureService.sign(message);

package/dist/esm/i18n/index.js

@@ -20,8 +20,17 @@ const LOADERS = {
 };
 /** Base subtag → the dictionary that serves it. */
 const ALIASES = {
-    en: 'en-US', es: 'es-ES', ca: 'ca-ES', fr: 'fr-FR', de: 'de-DE', it: 'it-IT',
-    pt: 'pt-PT', ja: 'ja-JP', ko: 'ko-KR', zh: 'zh-CN', ar: 'ar-SA',
+    en: 'en-US',
+    es: 'es-ES',
+    ca: 'ca-ES',
+    fr: 'fr-FR',
+    de: 'de-DE',
+    it: 'it-IT',
+    pt: 'pt-PT',
+    ja: 'ja-JP',
+    ko: 'ko-KR',
+    zh: 'zh-CN',
+    ar: 'ar-SA',
 };
 const DICTS = { [FALLBACK]: enUS };
 const pending = new Map();
@@ -96,7 +105,11 @@ function resolveLang(locale) {
     return FALLBACK;
 }
 function getNested(obj, path) {
-    return path.split('.').reduce((acc, key) => (acc && typeof acc === 'object' && acc[key] != null ? acc[key] : undefined), obj);
+    return path
+        .split('.')
+        .reduce((acc, key) => acc && typeof acc === 'object' && acc[key] != null
+        ? acc[key]
+        : undefined, obj);
 }
 export function translate(locale, key, vars) {
     const lang = resolveLang(locale);