@oxy.so/core 4.5.0-oxy-one.1 → 4.6.0

package/src/session/accountDialogController.ts

@@ -807,10 +807,18 @@ export class AccountDialogController {
       // unexpected — surface it, and keep whatever directory is already held so
       // an outage degrades rather than blanks the switcher.
       if (extractErrorStatus(error) === 401) {
-        logger.debug('[AccountDialogController] directory unauthorized (signed out)', { component: 'AccountDialogController' }, error);
+        logger.debug(
+          '[AccountDialogController] directory unauthorized (signed out)',
+          { component: 'AccountDialogController' },
+          error,
+        );
       } else {
         failure = errorMessage(error);
-        logger.warn('[AccountDialogController] directory refresh failed', { component: 'AccountDialogController' }, error);
+        logger.warn(
+          '[AccountDialogController] directory refresh failed',
+          { component: 'AccountDialogController' },
+          error,
+        );
       }
     }
     // Superseded by a newer refresh: that read owns `error` and `loading`, so an
@@ -1041,7 +1049,11 @@ export class AccountDialogController {
       if (!this.isCurrentAttempt(attempt)) return;
       // The identity mint failed — log and fall through to the QR handoff rather
       // than dead-ending the sign-in.
-      logger.warn('[AccountDialogController] signInWithCommonsIdentity failed', { component: 'AccountDialogController' }, error);
+      logger.warn(
+        '[AccountDialogController] signInWithCommonsIdentity failed',
+        { component: 'AccountDialogController' },
+        error,
+      );
     }
     await this.startDeviceFlowSession(attempt, { deliver: true });
   }
@@ -1127,7 +1139,10 @@ export class AccountDialogController {
   ): Promise<CommonsSignInHandle | null> {
     if (!this.isCurrentAttempt(attempt)) return null;
     if (!this.clientId) {
-      this.failSignIn('not-configured', 'This app is not configured for sign-in (missing clientId).');
+      this.failSignIn(
+        'not-configured',
+        'This app is not configured for sign-in (missing clientId).',
+      );
       return null;
     }
     this.setSignIn({ ...IDLE_SIGN_IN_FACTS, phase: 'starting' });
@@ -1235,7 +1250,10 @@ export class AccountDialogController {
    *    surfaced as an error: there is nothing the user did wrong and nothing for
    *    them to fix.
    */
-  private async deliverToKnownCommons(authorizeCode: string, commonsAvailable: boolean): Promise<number> {
+  private async deliverToKnownCommons(
+    authorizeCode: string,
+    commonsAvailable: boolean,
+  ): Promise<number> {
     // Route 1 (mobile with a verified local Commons link) reaches the identity
     // on this very device — pushing as well would notify a second surface for a
     // request the user is about to confirm here.
@@ -1397,12 +1415,16 @@ export class AccountDialogController {
         // recording it before the terminal branches means a poll that also
         // carries the approval still leaves an honest trail behind it.
         this.recordDeliveryProgress(status.pushSentAt, status.openedAt);
-        const purpose = status.purpose === 'oauth_authorization' ? 'oauth_authorization' : 'device_sign_in';
+        const purpose =
+          status.purpose === 'oauth_authorization' ? 'oauth_authorization' : 'device_sign_in';
         if (status.authorized && purpose === 'oauth_authorization') {
           // OAuth-bound sessions mint no sessionId on approval — they finalize
           // into an authorization code. The account dialog only starts device
           // sign-in today; stop rather than poll until expiry.
-          this.failSignIn('unsupported-flow', 'This sign-in flow cannot be completed here. Use the app\'s OAuth sign-in instead.');
+          this.failSignIn(
+            'unsupported-flow',
+            "This sign-in flow cannot be completed here. Use the app's OAuth sign-in instead.",
+          );
           return;
         }
         if (status.authorized && status.sessionId) {
@@ -1420,7 +1442,11 @@ export class AccountDialogController {
         }
       } catch (error) {
         // Transient poll error — the next tick retries. Logged, never thrown.
-        logger.debug('[AccountDialogController] poll error (will retry)', { component: 'AccountDialogController' }, error);
+        logger.debug(
+          '[AccountDialogController] poll error (will retry)',
+          { component: 'AccountDialogController' },
+          error,
+        );
       }
       if (this.signInToken === sessionToken) {
         this.scheduleNextPoll(sessionToken);
@@ -1445,7 +1471,11 @@ export class AccountDialogController {
     this.patchSignIn({ pushSentAt: nextPushSentAt, openedAt: nextOpenedAt });
   }
 
-  private async claimAndComplete(attempt: number, sessionId: string, sessionToken: string): Promise<void> {
+  private async claimAndComplete(
+    attempt: number,
+    sessionId: string,
+    sessionToken: string,
+  ): Promise<void> {
     this.patchSignIn({ phase: 'authorized' });
     let claimed: {
       accessToken: string;
@@ -1466,7 +1496,10 @@ export class AccountDialogController {
     }
     if (!this.isCurrentAttempt(attempt)) return;
     if (!claimed?.accessToken || !claimed.user) {
-      this.failSignIn('claim-failed', 'Authorization succeeded but the session could not be claimed. Please try again.');
+      this.failSignIn(
+        'claim-failed',
+        'Authorization succeeded but the session could not be claimed. Please try again.',
+      );
       return;
     }
     // `SessionLoginResponse.user` is the minimal session-carried shape; the claim
@@ -1541,7 +1574,7 @@ export class AccountDialogController {
       this.signInToken = null;
       this.clearPollTimer();
       this.closeAuthSessionSocket();
-        // Terminal SUCCESS, not idle: the surface gets one honest frame to show
+      // Terminal SUCCESS, not idle: the surface gets one honest frame to show
       // "Identity confirmed" before it closes. Cleared on the next view change.
       this.signIn = this.stampSignIn(COMPLETED_SIGN_IN_FACTS);
       this.view = 'accounts';
@@ -1617,7 +1650,11 @@ export class AccountDialogController {
       });
     } catch (error) {
       // Socket unavailable — the fallback poll still completes the flow.
-      logger.debug('[AccountDialogController] auth-session socket create failed (poll fallback)', { component: 'AccountDialogController' }, error);
+      logger.debug(
+        '[AccountDialogController] auth-session socket create failed (poll fallback)',
+        { component: 'AccountDialogController' },
+        error,
+      );
       return;
     }
     const join = (): void => {
@@ -1625,7 +1662,11 @@ export class AccountDialogController {
       try {
         socket.emit('join', sessionToken);
       } catch (error) {
-        logger.debug('[AccountDialogController] auth-session join failed', { component: 'AccountDialogController' }, error);
+        logger.debug(
+          '[AccountDialogController] auth-session join failed',
+          { component: 'AccountDialogController' },
+          error,
+        );
       }
     };
     socket.on('connect', join);
@@ -1648,7 +1689,11 @@ export class AccountDialogController {
       socket.off('connect');
       socket.disconnect();
     } catch (error) {
-      logger.debug('[AccountDialogController] auth-session socket close failed', { component: 'AccountDialogController' }, error);
+      logger.debug(
+        '[AccountDialogController] auth-session socket close failed',
+        { component: 'AccountDialogController' },
+        error,
+      );
     }
   }
 

package/src/session/accountSwitchTargets.ts

@@ -17,11 +17,7 @@
  */
 
 import { isOperatorSwitchTargetKind } from '@oxy.so/contracts';
-import type {
-  AccountRelationship,
-  AccountKind,
-  AccountMember,
-} from '../api/accounts';
+import type { AccountRelationship, AccountKind, AccountMember } from '../api/accounts';
 
 /**
  * Whether the caller can BECOME this account — the one question every account
@@ -55,9 +51,10 @@ import type {
  * Takes a structural subset rather than a whole {@link AccountNode} so a caller
  * holding an already-projected row can ask it too.
  */
-export function isSwitchTargetAccount(
-  node: { kind?: AccountKind | null; relationship?: AccountRelationship },
-): boolean {
+export function isSwitchTargetAccount(node: {
+  kind?: AccountKind | null;
+  relationship?: AccountRelationship;
+}): boolean {
   return node.relationship === 'self' || isOperatorSwitchTargetKind(node.kind);
 }
 
@@ -72,13 +69,11 @@ export function isSwitchTargetAccount(
  * API always resolves effective permissions for owned accounts, but test
  * fixtures and stale rows may omit the membership blob.
  */
-export function canSwitchIntoAccount(
-  node: {
-    kind?: AccountKind | null;
-    relationship?: AccountRelationship;
-    callerMembership?: AccountMember | null;
-  },
-): boolean {
+export function canSwitchIntoAccount(node: {
+  kind?: AccountKind | null;
+  relationship?: AccountRelationship;
+  callerMembership?: AccountMember | null;
+}): boolean {
   if (node.relationship === 'self') {
     return true;
   }

package/src/session/authStateStore.ts

@@ -89,11 +89,14 @@ export interface AuthStateStore {
   clear(): Promise<void>;
   /** Durable local intent only: never authority or a mutation of an identity key. */
   isAutomaticIdentitySignInSuppressed?(): Promise<boolean>;
-  setAutomaticIdentitySignInSuppressed?(suppressed: boolean, guard?: {
-    /** Checked inside the native store queue, before mutating logout intent. */
-    expectedState: PersistedAuthState;
-    isCurrent: () => boolean;
-  }): Promise<boolean>;
+  setAutomaticIdentitySignInSuppressed?(
+    suppressed: boolean,
+    guard?: {
+      /** Checked inside the native store queue, before mutating logout intent. */
+      expectedState: PersistedAuthState;
+      isCurrent: () => boolean;
+    },
+  ): Promise<boolean>;
 }
 
 export interface AuthStateWriteGuard {
@@ -101,11 +104,19 @@ export interface AuthStateWriteGuard {
   isCurrent: () => boolean;
 }
 
-export function matchesAuthState(actual: PersistedAuthState | null, expected: PersistedAuthState | null): boolean {
+export function matchesAuthState(
+  actual: PersistedAuthState | null,
+  expected: PersistedAuthState | null,
+): boolean {
   if (!actual || !expected) return actual === expected;
-  return actual.deviceId === expected.deviceId && actual.deviceSecret === expected.deviceSecret &&
-    actual.sessionId === expected.sessionId && actual.userId === expected.userId &&
-    actual.accessToken === expected.accessToken && actual.expiresAt === expected.expiresAt;
+  return (
+    actual.deviceId === expected.deviceId &&
+    actual.deviceSecret === expected.deviceSecret &&
+    actual.sessionId === expected.sessionId &&
+    actual.userId === expected.userId &&
+    actual.accessToken === expected.accessToken &&
+    actual.expiresAt === expected.expiresAt
+  );
 }
 
 /**
@@ -136,7 +147,8 @@ export interface NativeKeyValueStorage {
  * so upgrading users are not signed out; the next `save()` splits them apart.
  */
 export const AUTH_STATE_STORAGE_KEY = 'oxy.auth.v1';
-export const AUTOMATIC_IDENTITY_SIGNIN_SUPPRESSED_KEY = 'oxy.auth.automatic-identity-signin-suppressed.v1';
+export const AUTOMATIC_IDENTITY_SIGNIN_SUPPRESSED_KEY =
+  'oxy.auth.automatic-identity-signin-suppressed.v1';
 
 /**
  * Versioned BEST-EFFORT warm-token storage key. Holds the short-lived
@@ -277,7 +289,10 @@ function serializeWarmToken(state: PersistedAuthState): string | null {
  * present; when the warm key is ABSENT the token fields fall back to whatever
  * the durable blob carried — the pre-split combined `oxy.auth.v1` blob (BACK-COMPAT).
  */
-function composeState(durableRaw: string | null, warmRaw: string | null): PersistedAuthState | null {
+function composeState(
+  durableRaw: string | null,
+  warmRaw: string | null,
+): PersistedAuthState | null {
   const state = deserialize(durableRaw);
   if (!state) {
     return null;
@@ -459,13 +474,17 @@ export function createNativeAuthStateStore(storage: NativeKeyValueStorage): Auth
   let pending: Promise<void> = Promise.resolve();
   const serialize = <T>(operation: () => Promise<T>): Promise<T> => {
     const result = pending.then(operation);
-    pending = result.then(() => undefined, () => undefined);
+    pending = result.then(
+      () => undefined,
+      () => undefined,
+    );
     return result;
   };
   const readCurrent = async (): Promise<PersistedAuthState | null> => {
     if (sessionMirror !== undefined) return sessionMirror;
     const [durable, warm] = await Promise.all([
-      storage.getItem(AUTH_STATE_STORAGE_KEY), storage.getItem(AUTH_STATE_TOKEN_STORAGE_KEY),
+      storage.getItem(AUTH_STATE_STORAGE_KEY),
+      storage.getItem(AUTH_STATE_TOKEN_STORAGE_KEY),
     ]);
     return composeState(durable, warm);
   };
@@ -513,75 +532,96 @@ export function createNativeAuthStateStore(storage: NativeKeyValueStorage): Auth
     return durablePersisted;
   };
   return {
-    isAutomaticIdentitySignInSuppressed: () => serialize(async () => {
-      if (suppressedMirror !== undefined) return suppressedMirror;
-      try {
-        return (await storage.getItem(AUTOMATIC_IDENTITY_SIGNIN_SUPPRESSED_KEY)) !== null;
-      } catch {
-        return true; // Unknown storage must not start a new key sign-in.
-      }
-    }),
-    setAutomaticIdentitySignInSuppressed: (suppressed, guard) => serialize(async () => {
-      if (guard) {
-        let current = sessionMirror;
-        if (current === undefined) {
-          try {
-            const [durable, warm] = await Promise.all([
-              storage.getItem(AUTH_STATE_STORAGE_KEY), storage.getItem(AUTH_STATE_TOKEN_STORAGE_KEY),
-            ]);
-            current = composeState(durable, warm);
-          } catch { suppressedMirror = true; return false; }
+    isAutomaticIdentitySignInSuppressed: () =>
+      serialize(async () => {
+        if (suppressedMirror !== undefined) return suppressedMirror;
+        try {
+          return (await storage.getItem(AUTOMATIC_IDENTITY_SIGNIN_SUPPRESSED_KEY)) !== null;
+        } catch {
+          return true; // Unknown storage must not start a new key sign-in.
         }
-        const expected = guard.expectedState;
-        if (!guard.isCurrent() || !current ||
-          current.deviceId !== expected.deviceId || current.deviceSecret !== expected.deviceSecret ||
-          current.sessionId !== expected.sessionId || current.userId !== expected.userId ||
-          current.accessToken !== expected.accessToken || current.expiresAt !== expected.expiresAt) return false;
-      }
-      suppressedMirror = suppressed;
-      try {
-        if (suppressed) await storage.setItem(AUTOMATIC_IDENTITY_SIGNIN_SUPPRESSED_KEY, '1');
-        else await storage.removeItem(AUTOMATIC_IDENTITY_SIGNIN_SUPPRESSED_KEY);
-        const actual = await storage.getItem(AUTOMATIC_IDENTITY_SIGNIN_SUPPRESSED_KEY);
-        const verified = suppressed ? actual === '1' : actual === null;
-        if (!verified) suppressedMirror = true;
-        return verified;
-      } catch { suppressedMirror = true; return false; }
-    }),
-    load: () => serialize(async () => {
-      if (sessionMirror !== undefined) {
-        return sessionMirror;
-      }
-      try {
-        const [durableRaw, warmRaw] = await Promise.all([
-          storage.getItem(AUTH_STATE_STORAGE_KEY),
-          storage.getItem(AUTH_STATE_TOKEN_STORAGE_KEY),
-        ]);
-        return composeState(durableRaw, warmRaw);
-      } catch {
-        return null;
-      }
-    }),
+      }),
+    setAutomaticIdentitySignInSuppressed: (suppressed, guard) =>
+      serialize(async () => {
+        if (guard) {
+          let current = sessionMirror;
+          if (current === undefined) {
+            try {
+              const [durable, warm] = await Promise.all([
+                storage.getItem(AUTH_STATE_STORAGE_KEY),
+                storage.getItem(AUTH_STATE_TOKEN_STORAGE_KEY),
+              ]);
+              current = composeState(durable, warm);
+            } catch {
+              suppressedMirror = true;
+              return false;
+            }
+          }
+          const expected = guard.expectedState;
+          if (
+            !guard.isCurrent() ||
+            !current ||
+            current.deviceId !== expected.deviceId ||
+            current.deviceSecret !== expected.deviceSecret ||
+            current.sessionId !== expected.sessionId ||
+            current.userId !== expected.userId ||
+            current.accessToken !== expected.accessToken ||
+            current.expiresAt !== expected.expiresAt
+          )
+            return false;
+        }
+        suppressedMirror = suppressed;
+        try {
+          if (suppressed) await storage.setItem(AUTOMATIC_IDENTITY_SIGNIN_SUPPRESSED_KEY, '1');
+          else await storage.removeItem(AUTOMATIC_IDENTITY_SIGNIN_SUPPRESSED_KEY);
+          const actual = await storage.getItem(AUTOMATIC_IDENTITY_SIGNIN_SUPPRESSED_KEY);
+          const verified = suppressed ? actual === '1' : actual === null;
+          if (!verified) suppressedMirror = true;
+          return verified;
+        } catch {
+          suppressedMirror = true;
+          return false;
+        }
+      }),
+    load: () =>
+      serialize(async () => {
+        if (sessionMirror !== undefined) {
+          return sessionMirror;
+        }
+        try {
+          const [durableRaw, warmRaw] = await Promise.all([
+            storage.getItem(AUTH_STATE_STORAGE_KEY),
+            storage.getItem(AUTH_STATE_TOKEN_STORAGE_KEY),
+          ]);
+          return composeState(durableRaw, warmRaw);
+        } catch {
+          return null;
+        }
+      }),
     save: (state) => serialize(() => persistState(state)),
-    saveIfCurrent: (state, guard) => serialize(async () => {
-      try {
-        const current = await readCurrent();
-        if (!guard.isCurrent() || !matchesAuthState(current, guard.expectedState)) return false;
-      } catch { return false; }
-      return persistState(state);
-    }),
-    clear: () => serialize(async () => {
-      sessionMirror = null;
-      try {
-        await storage.removeItem(AUTH_STATE_STORAGE_KEY);
-      } catch {
-        // Non-fatal.
-      }
-      try {
-        await storage.removeItem(AUTH_STATE_TOKEN_STORAGE_KEY);
-      } catch {
-        // Non-fatal.
-      }
-    }),
+    saveIfCurrent: (state, guard) =>
+      serialize(async () => {
+        try {
+          const current = await readCurrent();
+          if (!guard.isCurrent() || !matchesAuthState(current, guard.expectedState)) return false;
+        } catch {
+          return false;
+        }
+        return persistState(state);
+      }),
+    clear: () =>
+      serialize(async () => {
+        sessionMirror = null;
+        try {
+          await storage.removeItem(AUTH_STATE_STORAGE_KEY);
+        } catch {
+          // Non-fatal.
+        }
+        try {
+          await storage.removeItem(AUTH_STATE_TOKEN_STORAGE_KEY);
+        } catch {
+          // Non-fatal.
+        }
+      }),
   };
 }

package/src/session/deviceDirectory.ts

@@ -179,9 +179,7 @@ export interface DevicePrincipalGroup {
  * and rendering them with nothing under them is how "sign out of this person"
  * stays reachable. Silently omitting them would strand the row.
  */
-export function projectDevicePrincipals(
-  directory: DeviceDirectory | null,
-): DevicePrincipalGroup[] {
+export function projectDevicePrincipals(directory: DeviceDirectory | null): DevicePrincipalGroup[] {
   if (directory === null) {
     return [];
   }

package/src/session/identityPin.ts

@@ -135,7 +135,10 @@ function serialize(pin: IdentityPin): string | null {
  * definitive "no identity here" and therefore never a match — the caller clears
  * the pin rather than binding to an account whose key is gone.
  */
-export function identityPinMatches(pin: IdentityPin | null, localPublicKey: string | null): boolean {
+export function identityPinMatches(
+  pin: IdentityPin | null,
+  localPublicKey: string | null,
+): boolean {
   if (!pin || !localPublicKey) {
     return false;
   }
@@ -208,11 +211,9 @@ export function createWebIdentityPinStore(): IdentityPinStore {
     save: async (pin) => {
       const json = serialize(pin);
       if (!json) {
-        logger.error(
-          '[identityPin] refusing to persist a malformed identity pin',
-          undefined,
-          { component: 'identityPin' },
-        );
+        logger.error('[identityPin] refusing to persist a malformed identity pin', undefined, {
+          component: 'identityPin',
+        });
         return false;
       }
       sessionMirror = { publicKey: pin.publicKey.toLowerCase(), accountId: pin.accountId };
@@ -268,11 +269,9 @@ export function createNativeIdentityPinStore(storage: NativeKeyValueStorage): Id
     save: async (pin) => {
       const json = serialize(pin);
       if (!json) {
-        logger.error(
-          '[identityPin] refusing to persist a malformed identity pin',
-          undefined,
-          { component: 'identityPin' },
-        );
+        logger.error('[identityPin] refusing to persist a malformed identity pin', undefined, {
+          component: 'identityPin',
+        });
         return false;
       }
       sessionMirror = { publicKey: pin.publicKey.toLowerCase(), accountId: pin.accountId };

package/src/session/identitySession.ts

@@ -159,7 +159,9 @@ export async function establishIdentitySession(args: {
     // The signer disagrees with the key we resolved a challenge for — the
     // identity changed mid-flight, or a custom signer was misconfigured. Refuse:
     // verifying under a different key would bind this client to another account.
-    throw new Error('Identity sign-in aborted: the signing key does not match the device identity key');
+    throw new Error(
+      'Identity sign-in aborted: the signing key does not match the device identity key',
+    );
   }
 
   // `signed.challenge` carries the SIGNATURE (mirrors `signChallenge`).