@oxy.so/core 4.5.0-oxy-one.1 → 4.6.0

package/dist/esm/server/trafficNodeHttp.js

@@ -2,9 +2,11 @@ import http from 'node:http';
 import https from 'node:https';
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { syncBuiltinESMExports } from 'node:module';
-import { normalizeInfrastructureRegion, trafficType } from '@oxy.so/telemetry/collector';
+import { normalizeInfrastructureRegion, trafficType, } from '@oxy.so/telemetry/collector';
 const suppressed = new AsyncLocalStorage();
-export function withoutNodeHttpObservation(callback) { return suppressed.run(true, callback); }
+export function withoutNodeHttpObservation(callback) {
+    return suppressed.run(true, callback);
+}
 /** Node and Bun share the HTTP facade; Bun does not emit Node's HTTP diagnostic channels. */
 export function observeNodeHttp(collector, service, region, resolveEndpoint) {
     const seen = new WeakSet();
@@ -22,11 +24,23 @@ export function observeNodeHttp(collector, service, region, resolveEndpoint) {
         const peer = resolveEndpoint(url);
         if (peer && !request.headersSent)
             request.setHeader('X-Oxy-Source-Region', region);
-        const flow = { service, region, activityType: trafficType(url.pathname), scope: peer ? 'internal' : 'external', direction: 'outbound', sourceRegion: region, sourceService: service, targetService: peer?.service };
+        const flow = {
+            service,
+            region,
+            activityType: trafficType(url.pathname),
+            scope: peer ? 'internal' : 'external',
+            direction: 'outbound',
+            sourceRegion: region,
+            sourceService: service,
+            targetService: peer?.service,
+        };
         const emit = request.emit;
         let recorded = false;
-        const restore = () => { if (request.emit === observedEmit)
-            request.emit = emit; restoreRequests.delete(restore); };
+        const restore = () => {
+            if (request.emit === observedEmit)
+                request.emit = emit;
+            restoreRequests.delete(restore);
+        };
         // Intercept notifications without adding an 'error' listener: observation
         // must not turn an unhandled application error into a swallowed error.
         const observedEmit = function (event, ...args) {
@@ -34,16 +48,27 @@ export function observeNodeHttp(collector, service, region, resolveEndpoint) {
                 if (!recorded && event === 'response') {
                     recorded = true;
                     const response = args[0];
-                    const targetRegion = peer ? normalizeInfrastructureRegion(response.headers['x-oxy-region']) : undefined;
+                    const targetRegion = peer
+                        ? normalizeInfrastructureRegion(response.headers['x-oxy-region'])
+                        : undefined;
                     collector.record({ ...flow, targetRegion });
-                    collector.record({ ...flow, direction: 'inbound', sourceRegion: targetRegion, targetRegion: region, sourceService: peer?.service, targetService: service });
+                    collector.record({
+                        ...flow,
+                        direction: 'inbound',
+                        sourceRegion: targetRegion,
+                        targetRegion: region,
+                        sourceService: peer?.service,
+                        targetService: service,
+                    });
                 }
                 else if (!recorded && (event === 'error' || event === 'close')) {
                     recorded = true;
                     collector.record(flow);
                 }
             }
-            catch { /* A metrics failure cannot change a request's behavior. */ }
+            catch {
+                /* A metrics failure cannot change a request's behavior. */
+            }
             if (event === 'close')
                 restore();
             return emit.call(this, event, ...args);
@@ -60,7 +85,7 @@ export function observeNodeHttp(collector, service, region, resolveEndpoint) {
             return request;
         }
     };
-    const patches = [http, https].map(module => {
+    const patches = [http, https].map((module) => {
         const request = module.request;
         const get = module.get;
         const wrappedRequest = ((...args) => safelyObserve(request.apply(module, args)));

package/dist/esm/server/userInvalidation.js

@@ -51,7 +51,7 @@
  * Node-only; exported solely from `@oxy.so/core/server`.
  */
 import { OXY_USER_INVALIDATION_CHANNEL, isPublishedOxyUserChangeReason, oxyUserInvalidationEventSchema, } from '@oxy.so/contracts';
-import { evictOxyIdentityCache, } from '../utils/identityCacheSweep.js';
+import { evictOxyIdentityCache } from '../utils/identityCacheSweep.js';
 /**
  * Broadcast that an Oxy user's record changed.
  *

package/dist/esm/server/workloadIdentity.client.js

@@ -5,3 +5,6 @@ export function canAttestWorkloadIdentity() {
 export async function requestWorkloadServiceToken(_options) {
     throw new Error('Workload identity is only available on a Node host');
 }
+export async function attestWorkloadIdentity(_options) {
+    throw new Error('Workload identity is only available on a Node host');
+}

package/dist/esm/server/workloadIdentity.js

@@ -81,7 +81,10 @@ function sha256Hex(value) {
  * does not cover can be swapped by whoever captured the attestation.
  */
 function signGetCallerIdentity(credentials, nonce, now) {
-    const amzDate = now.toISOString().replace(/[-:]/g, '').replace(/\.\d{3}/, '');
+    const amzDate = now
+        .toISOString()
+        .replace(/[-:]/g, '')
+        .replace(/\.\d{3}/, '');
     const dateStamp = amzDate.slice(0, 8);
     const headers = {
         host: STS_HOST,
@@ -116,6 +119,29 @@ async function awsContainerAttestation(fetchImpl, nonce) {
     const credentials = await containerCredentials(fetchImpl);
     return { headers: signGetCallerIdentity(credentials, nonce, new Date()) };
 }
+/**
+ * Signs this process's identity proof over a nonce the CALLER chose, and sends
+ * it nowhere.
+ *
+ * {@link requestWorkloadServiceToken} is the ordinary consumer: Oxy issues the
+ * nonce and replays the proof. This exists for the one host that is its own
+ * verifier — Oxy's API acting as an application it hosts (Inbox) needs to learn
+ * which role it runs as, and the honest way to learn that is the way it learns
+ * anyone else's: sign `GetCallerIdentity` and let STS say whose signature it is.
+ * Reading a role name out of configuration would be the process's own word for
+ * what it is, which is what ADR 0026 refuses from every other caller.
+ *
+ * The same signer, so the two can never disagree about the shape the verifier
+ * accepts. Throws exactly as the token path does when there is no identity here.
+ */
+export async function attestWorkloadIdentity(options) {
+    if (!options.nonce)
+        throw new Error('A workload attestation needs a nonce to sign.');
+    return {
+        provider: 'aws-iam',
+        attestation: await awsContainerAttestation(options.fetch ?? fetch, options.nonce),
+    };
+}
 /**
  * Exchanges this process's identity for an Oxy service token.
  *

package/dist/esm/session/SessionClient.js

@@ -249,7 +249,8 @@ export class SessionClient {
         // otherwise, so a mismatch always resolves to "mint".
         const needsMintBeforeNotify = transport != null &&
             next.accounts.length > 0 &&
-            (activeAccountId === null || computeIdentityTag(this.host.getAccessToken()) !== activeAccountId);
+            (activeAccountId === null ||
+                computeIdentityTag(this.host.getAccessToken()) !== activeAccountId);
         const publish = () => {
             if (generation !== this.lifecycleGeneration || this.state !== next)
                 return;
@@ -291,13 +292,20 @@ export class SessionClient {
         // Warm cold boot may fetch authoritative empty state before it ever had a
         // local projection. Its authenticated holder is history too. Decoding only
         // identifies local history; authority remains the validated REST response.
-        const warmHolderEnded = previousState === null && origin === 'request' &&
-            typeof bearerAccount === 'string' && bearerAccount.length > 0 &&
+        const warmHolderEnded = previousState === null &&
+            origin === 'request' &&
+            typeof bearerAccount === 'string' &&
+            bearerAccount.length > 0 &&
             this.host.getDeviceCredential()?.deviceId === next.deviceId;
-        if (((previousState?.deviceId === next.deviceId && previousState.accounts.length > 0) || warmHolderEnded) &&
-            next.accounts.length === 0 && pinnedAccountId === null && this.options.onFullExplicitSignOut) {
+        if (((previousState?.deviceId === next.deviceId && previousState.accounts.length > 0) ||
+            warmHolderEnded) &&
+            next.accounts.length === 0 &&
+            pinnedAccountId === null &&
+            this.options.onFullExplicitSignOut) {
             try {
-                void this.persistFullSignOut().then(finishApply).catch((error) => {
+                void this.persistFullSignOut()
+                    .then(finishApply)
+                    .catch((error) => {
                     logger.error('[SessionClient] failed to persist received full sign-out', error);
                     finishApply();
                 });
@@ -309,7 +317,10 @@ export class SessionClient {
             return true;
         }
         if (needsMintBeforeNotify) {
-            void transport.ensureActiveToken(next).then(finishApply).catch((error) => {
+            void transport
+                .ensureActiveToken(next)
+                .then(finishApply)
+                .catch((error) => {
                 if (generation !== this.lifecycleGeneration)
                     return;
                 logger.warn('[SessionClient] ensureActiveToken failed — reverting session state', { component: 'SessionClient' }, error);
@@ -345,10 +356,19 @@ export class SessionClient {
             const issues = parsed.success
                 ? []
                 : parsed.error.issues.map((issue) => issue.code === 'invalid_type'
-                    ? { path: issue.path.join('.'), code: issue.code, expected: issue.expected, received: issue.received }
+                    ? {
+                        path: issue.path.join('.'),
+                        code: issue.code,
+                        expected: issue.expected,
+                        received: issue.received,
+                    }
                     : { path: issue.path.join('.'), code: issue.code });
             const keys = raw && typeof raw === 'object' ? Object.keys(raw) : [];
-            logger.warn('[SessionClient] discarded invalid session sync', { component: 'SessionClient', issues, keys });
+            logger.warn('[SessionClient] discarded invalid session sync', {
+                component: 'SessionClient',
+                issues,
+                keys,
+            });
             return;
         }
         this.commitSync(sync);
@@ -431,7 +451,9 @@ export class SessionClient {
     }
     /** `GET /session/device/directory` → {@link applyDirectory}. No notify. */
     async fetchDirectory() {
-        const res = await this.requestDevice('GET', '/session/device/directory', undefined, { cache: false });
+        const res = await this.requestDevice('GET', '/session/device/directory', undefined, {
+            cache: false,
+        });
         return this.applyDirectory(res);
     }
     /**
@@ -540,7 +562,9 @@ export class SessionClient {
         }
     }
     async bootstrap() {
-        const res = await this.requestDevice('GET', '/session/device/state', undefined, { cache: false });
+        const res = await this.requestDevice('GET', '/session/device/state', undefined, {
+            cache: false,
+        });
         await this.applySync(res);
     }
     /**
@@ -626,7 +650,9 @@ export class SessionClient {
      * {@link signOutPrincipal} for the two that can tell those apart.
      */
     async signOut(target) {
-        const res = await this.requestDevice('POST', '/session/device/signout', target, { cache: false });
+        const res = await this.requestDevice('POST', '/session/device/signout', target, {
+            cache: false,
+        });
         await this.applySync(res);
         this.postCommitPing();
         if (this.state?.accounts.length === 0)
@@ -669,14 +695,19 @@ export class SessionClient {
      * applied this revision.
      */
     async removeFromDevice(target) {
-        const res = await this.requestDevice('POST', '/session/device/signout', target, { cache: false });
+        const res = await this.requestDevice('POST', '/session/device/signout', target, {
+            cache: false,
+        });
         const removal = safeParseContract(deviceDirectorySyncSchema, res);
         if (!removal) {
             logger.warn('[SessionClient] discarded invalid device removal response');
             return;
         }
         const directoryApplied = this.applyDirectory(removal.directory);
-        const stateApplied = this.commitSync({ state: removal.state, activeToken: removal.activeToken });
+        const stateApplied = this.commitSync({
+            state: removal.state,
+            activeToken: removal.activeToken,
+        });
         if (this.fullSignOutPersistence?.state === this.state)
             await this.fullSignOutPersistence.pending;
         // `commitSync` publishes whenever the flat state moved. When only the
@@ -690,7 +721,9 @@ export class SessionClient {
             await this.persistFullSignOut();
     }
     async addCurrentAccount() {
-        const res = await this.requestDevice('POST', '/session/device/add', undefined, { cache: false });
+        const res = await this.requestDevice('POST', '/session/device/add', undefined, {
+            cache: false,
+        });
         await this.applySync(res);
         this.postCommitPing();
     }
@@ -784,7 +817,9 @@ export class SessionClient {
         // if THAT yields nothing — only when no factory was injected.
         const io = this.options.socketFactory ?? (await getSocketIO());
         if (!io) {
-            logger.warn('[SessionClient] no socket.io-client; running REST-only (no realtime sync)', { component: 'SessionClient' });
+            logger.warn('[SessionClient] no socket.io-client; running REST-only (no realtime sync)', {
+                component: 'SessionClient',
+            });
             return;
         }
         if (!this.started)
@@ -869,7 +904,9 @@ export class SessionClient {
     onSessionAccountsChanged(payload) {
         const event = safeParseContract(sessionAccountsChangedEventSchema, payload);
         if (!event) {
-            logger.warn('[SessionClient] discarded invalid session_accounts_changed', { component: 'SessionClient' });
+            logger.warn('[SessionClient] discarded invalid session_accounts_changed', {
+                component: 'SessionClient',
+            });
             return;
         }
         // The socket is in `user:<activeUserId>` for the planted bearer, so this should

package/dist/esm/session/accountDelegationAccess.js

@@ -13,7 +13,7 @@
  * (or the structural subset below), so the SDK and every agent runtime read the
  * API's already-resolved relationship and effective permissions identically.
  */
-import { isDelegatedActAsEligibleKind } from "@oxy.so/contracts";
+import { isDelegatedActAsEligibleKind } from '@oxy.so/contracts';
 /**
  * Resolve standing and delegated act-as authority from one account-graph node.
  *
@@ -28,18 +28,16 @@ import { isDelegatedActAsEligibleKind } from "@oxy.so/contracts";
  */
 export function resolveAccountDelegationAccess(node) {
     const membership = node.callerMembership;
-    const activeMembership = membership?.status === "active";
-    const hasStanding = node.relationship === "self" ||
-        node.relationship === "owner" ||
-        activeMembership;
+    const activeMembership = membership?.status === 'active';
+    const hasStanding = node.relationship === 'self' || node.relationship === 'owner' || activeMembership;
     if (!hasStanding || !isDelegatedActAsEligibleKind(node.kind)) {
         return { hasStanding, canActAs: false };
     }
     if (membership !== null && membership !== undefined) {
         return {
             hasStanding,
-            canActAs: activeMembership && membership.permissions.includes("account:act_as"),
+            canActAs: activeMembership && membership.permissions.includes('account:act_as'),
         };
     }
-    return { hasStanding, canActAs: node.relationship === "owner" };
+    return { hasStanding, canActAs: node.relationship === 'owner' };
 }

package/dist/esm/session/accountDialogController.js

@@ -980,7 +980,7 @@ export class AccountDialogController {
                     // OAuth-bound sessions mint no sessionId on approval — they finalize
                     // into an authorization code. The account dialog only starts device
                     // sign-in today; stop rather than poll until expiry.
-                    this.failSignIn('unsupported-flow', 'This sign-in flow cannot be completed here. Use the app\'s OAuth sign-in instead.');
+                    this.failSignIn('unsupported-flow', "This sign-in flow cannot be completed here. Use the app's OAuth sign-in instead.");
                     return;
                 }
                 if (status.authorized && status.sessionId) {

package/dist/esm/session/authStateStore.js

@@ -20,9 +20,12 @@ import { logger } from '../logger/index.js';
 export function matchesAuthState(actual, expected) {
     if (!actual || !expected)
         return actual === expected;
-    return actual.deviceId === expected.deviceId && actual.deviceSecret === expected.deviceSecret &&
-        actual.sessionId === expected.sessionId && actual.userId === expected.userId &&
-        actual.accessToken === expected.accessToken && actual.expiresAt === expected.expiresAt;
+    return (actual.deviceId === expected.deviceId &&
+        actual.deviceSecret === expected.deviceSecret &&
+        actual.sessionId === expected.sessionId &&
+        actual.userId === expected.userId &&
+        actual.accessToken === expected.accessToken &&
+        actual.expiresAt === expected.expiresAt);
 }
 /**
  * Versioned DURABLE storage key. Holds ONLY the small, re-mint-critical fields
@@ -350,7 +353,8 @@ export function createNativeAuthStateStore(storage) {
         if (sessionMirror !== undefined)
             return sessionMirror;
         const [durable, warm] = await Promise.all([
-            storage.getItem(AUTH_STATE_STORAGE_KEY), storage.getItem(AUTH_STATE_TOKEN_STORAGE_KEY),
+            storage.getItem(AUTH_STATE_STORAGE_KEY),
+            storage.getItem(AUTH_STATE_TOKEN_STORAGE_KEY),
         ]);
         return composeState(durable, warm);
     };
@@ -409,7 +413,8 @@ export function createNativeAuthStateStore(storage) {
                 if (current === undefined) {
                     try {
                         const [durable, warm] = await Promise.all([
-                            storage.getItem(AUTH_STATE_STORAGE_KEY), storage.getItem(AUTH_STATE_TOKEN_STORAGE_KEY),
+                            storage.getItem(AUTH_STATE_STORAGE_KEY),
+                            storage.getItem(AUTH_STATE_TOKEN_STORAGE_KEY),
                         ]);
                         current = composeState(durable, warm);
                     }
@@ -419,10 +424,14 @@ export function createNativeAuthStateStore(storage) {
                     }
                 }
                 const expected = guard.expectedState;
-                if (!guard.isCurrent() || !current ||
-                    current.deviceId !== expected.deviceId || current.deviceSecret !== expected.deviceSecret ||
-                    current.sessionId !== expected.sessionId || current.userId !== expected.userId ||
-                    current.accessToken !== expected.accessToken || current.expiresAt !== expected.expiresAt)
+                if (!guard.isCurrent() ||
+                    !current ||
+                    current.deviceId !== expected.deviceId ||
+                    current.deviceSecret !== expected.deviceSecret ||
+                    current.sessionId !== expected.sessionId ||
+                    current.userId !== expected.userId ||
+                    current.accessToken !== expected.accessToken ||
+                    current.expiresAt !== expected.expiresAt)
                     return false;
             }
             suppressedMirror = suppressed;

package/dist/esm/session/identityPin.js

@@ -167,7 +167,9 @@ export function createWebIdentityPinStore() {
         save: async (pin) => {
             const json = serialize(pin);
             if (!json) {
-                logger.error('[identityPin] refusing to persist a malformed identity pin', undefined, { component: 'identityPin' });
+                logger.error('[identityPin] refusing to persist a malformed identity pin', undefined, {
+                    component: 'identityPin',
+                });
                 return false;
             }
             sessionMirror = { publicKey: pin.publicKey.toLowerCase(), accountId: pin.accountId };
@@ -217,7 +219,9 @@ export function createNativeIdentityPinStore(storage) {
         save: async (pin) => {
             const json = serialize(pin);
             if (!json) {
-                logger.error('[identityPin] refusing to persist a malformed identity pin', undefined, { component: 'identityPin' });
+                logger.error('[identityPin] refusing to persist a malformed identity pin', undefined, {
+                    component: 'identityPin',
+                });
                 return false;
             }
             sessionMirror = { publicKey: pin.publicKey.toLowerCase(), accountId: pin.accountId };

package/dist/esm/session/refresh.js

@@ -1,5 +1,5 @@
 import { matchesAuthState } from './authStateStore.js';
-import { establishIdentitySession, resolveIdentityPin } from './identitySession.js';
+import { establishIdentitySession, resolveIdentityPin, } from './identitySession.js';
 import { isNative } from '../utils/platform.js';
 import { extractErrorStatus } from '../utils/errorUtils.js';
 import { logger } from '../logger/index.js';
@@ -127,9 +127,12 @@ export async function refreshDeviceSecretArm(deps) {
                     // push. Its exact live holder's authoritative empty-device rejection
                     // must suppress automatic key recovery on this and future boots.
                     // A late rejection for a replaced session/local epoch is not current.
-                    if (pin === null && store.setAutomaticIdentitySignInSuppressed && (!invalidSecret || (persisted.sessionId && persisted.userId))) {
+                    if (pin === null &&
+                        store.setAutomaticIdentitySignInSuppressed &&
+                        (!invalidSecret || (persisted.sessionId && persisted.userId))) {
                         const current = await store.load();
-                        if (!isCurrent() || oxy.http.getSessionEpoch() !== epoch ||
+                        if (!isCurrent() ||
+                            oxy.http.getSessionEpoch() !== epoch ||
                             current?.deviceId !== persisted.deviceId ||
                             current.deviceSecret !== persisted.deviceSecret ||
                             current.sessionId !== persisted.sessionId ||
@@ -137,7 +140,8 @@ export async function refreshDeviceSecretArm(deps) {
                             current.accessToken !== persisted.accessToken)
                             return { status: 'session-ended' };
                         if (!(await store.setAutomaticIdentitySignInSuppressed(true, {
-                            expectedState: persisted, isCurrent: () => isCurrent() && oxy.http.getSessionEpoch() === epoch,
+                            expectedState: persisted,
+                            isCurrent: () => isCurrent() && oxy.http.getSessionEpoch() === epoch,
                         })))
                             return { status: 'session-ended' };
                     }
@@ -185,7 +189,10 @@ export async function refreshDeviceSecretArm(deps) {
         // Persist nextDeviceSecret (read-back-verified) BEFORE planting the token.
         // A failed durable persist must NOT plant.
         const persistedOk = store.saveIfCurrent
-            ? await store.saveIfCurrent(next, { expectedState: persisted, isCurrent: () => isCurrent() && oxy.http.getSessionEpoch() === epoch })
+            ? await store.saveIfCurrent(next, {
+                expectedState: persisted,
+                isCurrent: () => isCurrent() && oxy.http.getSessionEpoch() === epoch,
+            })
             : await store.save(next);
         if (!persistedOk) {
             return { status: 'persist-failed' };
@@ -244,22 +251,39 @@ export async function refreshSharedDeviceArm(deps) {
             }
             return { status: 'transient' };
         }
-        const bound = mint.state.accounts.find(account => account.accountId === mint.state.activeAccountId);
-        if (!bound || mint.state.deviceId !== credential.deviceId || !mint.accessToken || !mint.nextDeviceSecret)
+        const bound = mint.state.accounts.find((account) => account.accountId === mint.state.activeAccountId);
+        if (!bound ||
+            mint.state.deviceId !== credential.deviceId ||
+            !mint.accessToken ||
+            !mint.nextDeviceSecret)
             return { status: 'transient' };
-        if (!isCurrent() || oxy.http.getSessionEpoch() !== epoch || !matchesAuthState(await store.load(), before))
+        if (!isCurrent() ||
+            oxy.http.getSessionEpoch() !== epoch ||
+            !matchesAuthState(await store.load(), before))
             return { status: 'session-ended' };
         const next = {
-            deviceId: mint.state.deviceId, deviceSecret: mint.nextDeviceSecret,
-            sessionId: bound.sessionId, userId: bound.accountId,
-            accessToken: mint.accessToken, expiresAt: mint.expiresAt,
+            deviceId: mint.state.deviceId,
+            deviceSecret: mint.nextDeviceSecret,
+            sessionId: bound.sessionId,
+            userId: bound.accountId,
+            accessToken: mint.accessToken,
+            expiresAt: mint.expiresAt,
         };
-        if (!(await store.saveIfCurrent(next, { expectedState: before, isCurrent: () => isCurrent() && oxy.http.getSessionEpoch() === epoch })))
+        if (!(await store.saveIfCurrent(next, {
+            expectedState: before,
+            isCurrent: () => isCurrent() && oxy.http.getSessionEpoch() === epoch,
+        })))
             return { status: 'persist-failed' };
         if (!isCurrent() || oxy.http.getSessionEpoch() !== epoch)
             return { status: 'session-ended' };
         oxy.session.setAccessToken(mint.accessToken);
-        return { status: 'ok', token: mint.accessToken, sessionId: bound.sessionId, userId: bound.accountId, state: mint.state };
+        return {
+            status: 'ok',
+            token: mint.accessToken,
+            sessionId: bound.sessionId,
+            userId: bound.accountId,
+            state: mint.state,
+        };
     });
 }
 /**
@@ -293,7 +317,10 @@ export async function refreshPersistedSession(deps) {
         return null;
     const identity = deps.identity ?? null;
     // The shared identity is never an identity-bound client's recovery path.
-    const allowCommonsIdentityFallback = identity ? false : (deps.allowCommonsIdentityFallback ?? isNative()) && !(await store.isAutomaticIdentitySignInSuppressed?.());
+    const allowCommonsIdentityFallback = identity
+        ? false
+        : (deps.allowCommonsIdentityFallback ?? isNative()) &&
+            !(await store.isAutomaticIdentitySignInSuppressed?.());
     const epoch = oxy.http.getSessionEpoch();
     // Resolved per call: a re-established identity session can move the pin, and a
     // replaced/removed local key clears it (in which case arm 1 must NOT mint —
@@ -309,7 +336,10 @@ export async function refreshPersistedSession(deps) {
         case 'session-ended':
             return null;
         case 'transient':
-            logger.debug('Persisted deviceSecret mint failed (transient) — keeping store', { component: 'refresh', method: 'refreshPersistedSession' });
+            logger.debug('Persisted deviceSecret mint failed (transient) — keeping store', {
+                component: 'refresh',
+                method: 'refreshPersistedSession',
+            });
             return null;
         case 'persist-failed':
             // The server rotated the secret but it did not durably persist. Do NOT fall
@@ -321,13 +351,21 @@ export async function refreshPersistedSession(deps) {
         case 'invalid-secret':
         case 'no-session': {
             if (!identity && deps.sharedDeviceCredential) {
-                const joined = await refreshSharedDeviceArm({ oxy, store, shared: deps.sharedDeviceCredential, rejectedLocalHolder: true, isCurrent: deps.isCurrent });
+                const joined = await refreshSharedDeviceArm({
+                    oxy,
+                    store,
+                    shared: deps.sharedDeviceCredential,
+                    rejectedLocalHolder: true,
+                    isCurrent: deps.isCurrent,
+                });
                 if (joined.status === 'ok')
                     return joined.token;
                 if (joined.status === 'session-ended' || joined.status === 'persist-failed')
                     return null;
             }
-            if (!identity && arm1.status === 'invalid-secret' && await store.isAutomaticIdentitySignInSuppressed?.())
+            if (!identity &&
+                arm1.status === 'invalid-secret' &&
+                (await store.isAutomaticIdentitySignInSuppressed?.()))
                 return null;
             if (arm1.status === 'no-session' && !identity) {
                 if (store.setAutomaticIdentitySignInSuppressed)
@@ -337,7 +375,12 @@ export async function refreshPersistedSession(deps) {
                 // to turn this signed-out verdict into a new account session.
                 const persisted = await store.load();
                 if (persisted?.deviceId && persisted.deviceSecret) {
-                    await store.save({ sessionId: '', userId: '', deviceId: persisted.deviceId, deviceSecret: persisted.deviceSecret });
+                    await store.save({
+                        sessionId: '',
+                        userId: '',
+                        deviceId: persisted.deviceId,
+                        deviceSecret: persisted.deviceSecret,
+                    });
                 }
                 return null;
             }
@@ -364,10 +407,17 @@ export async function refreshPersistedSession(deps) {
             break;
         case 'no-secret':
             if (!identity && deps.sharedDeviceCredential) {
-                const joined = await refreshSharedDeviceArm({ oxy, store, shared: deps.sharedDeviceCredential, isCurrent: deps.isCurrent });
+                const joined = await refreshSharedDeviceArm({
+                    oxy,
+                    store,
+                    shared: deps.sharedDeviceCredential,
+                    isCurrent: deps.isCurrent,
+                });
                 if (joined.status === 'ok')
                     return joined.token;
-                if (joined.status === 'session-ended' || joined.status === 'persist-failed' || joined.status === 'transient')
+                if (joined.status === 'session-ended' ||
+                    joined.status === 'persist-failed' ||
+                    joined.status === 'transient')
                     return null;
             }
             break;
@@ -377,14 +427,19 @@ export async function refreshPersistedSession(deps) {
     }
     // Never after a sign-out: the shared identity is a KEY, not a session, and
     // proving it here would sign the user straight back in.
-    if (allowCommonsIdentityFallback && (deps.isCurrent?.() ?? true) && !oxy.http.hasSessionEnded() && !(await store.isAutomaticIdentitySignInSuppressed?.())) {
+    if (allowCommonsIdentityFallback &&
+        (deps.isCurrent?.() ?? true) &&
+        !oxy.http.hasSessionEnded() &&
+        !(await store.isAutomaticIdentitySignInSuppressed?.())) {
         try {
             // Planted here, not by the sign-in: a sign-out that lands while the
             // challenge round-trips must win, or the identity proof signs the user
             // straight back in.
             const session = await oxy.auth.signInWithCommonsIdentity({ plantTokens: false });
             if (session?.accessToken) {
-                if (!(deps.isCurrent?.() ?? true) || oxy.http.getSessionEpoch() !== epoch || await store.isAutomaticIdentitySignInSuppressed?.()) {
+                if (!(deps.isCurrent?.() ?? true) ||
+                    oxy.http.getSessionEpoch() !== epoch ||
+                    (await store.isAutomaticIdentitySignInSuppressed?.())) {
                     return null;
                 }
                 // Repopulate the fast device-secret lane from the identity re-mint.
@@ -398,7 +453,9 @@ export async function refreshPersistedSession(deps) {
                         expiresAt: session.expiresAt,
                     });
                 }
-                if (!(deps.isCurrent?.() ?? true) || oxy.http.getSessionEpoch() !== epoch || await store.isAutomaticIdentitySignInSuppressed?.()) {
+                if (!(deps.isCurrent?.() ?? true) ||
+                    oxy.http.getSessionEpoch() !== epoch ||
+                    (await store.isAutomaticIdentitySignInSuppressed?.())) {
                     return null;
                 }
                 oxy.session.setAccessToken(session.accessToken);
@@ -519,7 +576,8 @@ export function startTokenRefreshScheduler(oxy) {
             scheduleFromExpiry();
             return;
         }
-        void oxy.http.refreshAccessToken('preflight')
+        void oxy.http
+            .refreshAccessToken('preflight')
             .then((token) => Boolean(token))
             .catch(() => false)
             .then((ok) => {