@oxy.so/core 7.10.1 → 7.10.3

package/dist/cjs/HttpService.js

@@ -58,6 +58,14 @@ function sameTokenSession(left, right) {
     }
     if (!(a.userId || a.id || a.sub) || !(b.userId || b.id || b.sub))
         return false;
+    // A legacy bearer may omit deviceId; empty or non-string values also carry no
+    // usable device. Two known, different devices are distinct local contexts.
+    if (typeof a.deviceId === 'string' &&
+        a.deviceId.length > 0 &&
+        typeof b.deviceId === 'string' &&
+        b.deviceId.length > 0 &&
+        a.deviceId !== b.deviceId)
+        return false;
     // A refresh may rotate exp/iat/jti while preserving its account and session.
     // Opaque/malformed context fields cannot establish that equivalence.
     return [
@@ -71,6 +79,13 @@ function sameTokenSession(left, right) {
         'authMethodId',
     ].every((key) => (a[key] === undefined || typeof a[key] === 'string') && a[key] === b[key]);
 }
+/** Extract a known device for local ownership checks, never authorization. */
+function knownTokenDeviceId(token) {
+    const claims = (0, tokenClaims_1.decodeTokenClaims)(token);
+    return claims?.type !== 'service' && typeof claims?.deviceId === 'string' && claims.deviceId
+        ? claims.deviceId
+        : null;
+}
 /** Discard an unused body even when a platform's stream shim lacks cancel. */
 function discardResponseBody(response) {
     try {
@@ -328,6 +343,8 @@ class HttpService {
          * bearer — and through the token listeners, the account — back.
          */
         this.sessionEpoch = 0;
+        /** Preserve a known device across legacy rotations which omit the claim. */
+        this.sessionDeviceId = null;
         /**
          * Set by {@link endSession}, cleared by the next {@link setTokens}. Read by the
          * native Commons-identity re-mint arm: after a sign-out a 401 is the expected
@@ -566,8 +583,12 @@ class HttpService {
         const authHeader = usesSessionAuth
             ? await (0, requestSignal_1.awaitRequestSignal)(this.getAuthHeader(), signal)
             : null;
-        const isOriginalSession = () => this.sessionEpoch === contextEpoch &&
-            sameTokenSession(contextToken, this.syncAccessTokenFromProvider());
+        const isOriginalSession = () => {
+            if (this.sessionEpoch !== contextEpoch)
+                return false;
+            const currentToken = this.syncAccessTokenFromProvider();
+            return this.sessionEpoch === contextEpoch && sameTokenSession(contextToken, currentToken);
+        };
         const newerRequestToken = () => {
             if (!contextToken || !authHeader?.startsWith('Bearer '))
                 return null;
@@ -770,6 +791,7 @@ class HttpService {
                             if (this.tokenStore.getAccessToken())
                                 this.sessionEpoch += 1;
                             this.tokenStore.clearTokens();
+                            this.sessionDeviceId = null;
                             selfClearedEpoch = this.sessionEpoch;
                             this.notifyTokenChange();
                         }
@@ -1653,8 +1675,13 @@ class HttpService {
     // Token management
     setTokens(accessToken) {
         const current = this.tokenStore.getAccessToken();
-        if (current && !sameTokenSession(current, accessToken))
+        const deviceId = knownTokenDeviceId(accessToken);
+        const changed = current !== null &&
+            (!sameTokenSession(current, accessToken) ||
+                (this.sessionDeviceId !== null && deviceId !== null && this.sessionDeviceId !== deviceId));
+        if (changed)
             this.sessionEpoch += 1;
+        this.sessionDeviceId = !current || changed ? deviceId : (deviceId ?? this.sessionDeviceId);
         this.sessionEnded = false;
         this.tokenStore.setTokens(accessToken);
         this.notifyTokenChange();
@@ -1673,8 +1700,8 @@ class HttpService {
         this.clearTokens();
     }
     /**
-     * The current context epoch: account/session switches and bearer removal
-     * invalidate pending work; rotation within the same context preserves it.
+     * The current context epoch: account/session switches, known device changes,
+     * and bearer removal invalidate pending work; same-context rotation preserves it.
      * A re-mint lane that
      * plants tokens itself (the device-secret arm) compares it across its awaits.
      */
@@ -1705,6 +1732,7 @@ class HttpService {
         if (this.tokenStore.getAccessToken())
             this.sessionEpoch += 1;
         this.tokenStore.clearTokens();
+        this.sessionDeviceId = null;
         // Drop the response cache on logout. The cache is identity-scoped, so a
         // different user could never read these entries, but a logged-out client
         // must not keep the previous session's personalized data resident in
@@ -1864,6 +1892,7 @@ class HttpService {
     __resetTokensForTests() {
         this.sessionEnded = false;
         this.tokenStore.clearTokens();
+        this.sessionDeviceId = null;
     }
 }
 exports.HttpService = HttpService;

package/dist/esm/HttpService.js

@@ -55,6 +55,14 @@ function sameTokenSession(left, right) {
     }
     if (!(a.userId || a.id || a.sub) || !(b.userId || b.id || b.sub))
         return false;
+    // A legacy bearer may omit deviceId; empty or non-string values also carry no
+    // usable device. Two known, different devices are distinct local contexts.
+    if (typeof a.deviceId === 'string' &&
+        a.deviceId.length > 0 &&
+        typeof b.deviceId === 'string' &&
+        b.deviceId.length > 0 &&
+        a.deviceId !== b.deviceId)
+        return false;
     // A refresh may rotate exp/iat/jti while preserving its account and session.
     // Opaque/malformed context fields cannot establish that equivalence.
     return [
@@ -68,6 +76,13 @@ function sameTokenSession(left, right) {
         'authMethodId',
     ].every((key) => (a[key] === undefined || typeof a[key] === 'string') && a[key] === b[key]);
 }
+/** Extract a known device for local ownership checks, never authorization. */
+function knownTokenDeviceId(token) {
+    const claims = decodeTokenClaims(token);
+    return claims?.type !== 'service' && typeof claims?.deviceId === 'string' && claims.deviceId
+        ? claims.deviceId
+        : null;
+}
 /** Discard an unused body even when a platform's stream shim lacks cancel. */
 function discardResponseBody(response) {
     try {
@@ -325,6 +340,8 @@ export class HttpService {
          * bearer — and through the token listeners, the account — back.
          */
         this.sessionEpoch = 0;
+        /** Preserve a known device across legacy rotations which omit the claim. */
+        this.sessionDeviceId = null;
         /**
          * Set by {@link endSession}, cleared by the next {@link setTokens}. Read by the
          * native Commons-identity re-mint arm: after a sign-out a 401 is the expected
@@ -563,8 +580,12 @@ export class HttpService {
         const authHeader = usesSessionAuth
             ? await awaitRequestSignal(this.getAuthHeader(), signal)
             : null;
-        const isOriginalSession = () => this.sessionEpoch === contextEpoch &&
-            sameTokenSession(contextToken, this.syncAccessTokenFromProvider());
+        const isOriginalSession = () => {
+            if (this.sessionEpoch !== contextEpoch)
+                return false;
+            const currentToken = this.syncAccessTokenFromProvider();
+            return this.sessionEpoch === contextEpoch && sameTokenSession(contextToken, currentToken);
+        };
         const newerRequestToken = () => {
             if (!contextToken || !authHeader?.startsWith('Bearer '))
                 return null;
@@ -767,6 +788,7 @@ export class HttpService {
                             if (this.tokenStore.getAccessToken())
                                 this.sessionEpoch += 1;
                             this.tokenStore.clearTokens();
+                            this.sessionDeviceId = null;
                             selfClearedEpoch = this.sessionEpoch;
                             this.notifyTokenChange();
                         }
@@ -1650,8 +1672,13 @@ export class HttpService {
     // Token management
     setTokens(accessToken) {
         const current = this.tokenStore.getAccessToken();
-        if (current && !sameTokenSession(current, accessToken))
+        const deviceId = knownTokenDeviceId(accessToken);
+        const changed = current !== null &&
+            (!sameTokenSession(current, accessToken) ||
+                (this.sessionDeviceId !== null && deviceId !== null && this.sessionDeviceId !== deviceId));
+        if (changed)
             this.sessionEpoch += 1;
+        this.sessionDeviceId = !current || changed ? deviceId : (deviceId ?? this.sessionDeviceId);
         this.sessionEnded = false;
         this.tokenStore.setTokens(accessToken);
         this.notifyTokenChange();
@@ -1670,8 +1697,8 @@ export class HttpService {
         this.clearTokens();
     }
     /**
-     * The current context epoch: account/session switches and bearer removal
-     * invalidate pending work; rotation within the same context preserves it.
+     * The current context epoch: account/session switches, known device changes,
+     * and bearer removal invalidate pending work; same-context rotation preserves it.
      * A re-mint lane that
      * plants tokens itself (the device-secret arm) compares it across its awaits.
      */
@@ -1702,6 +1729,7 @@ export class HttpService {
         if (this.tokenStore.getAccessToken())
             this.sessionEpoch += 1;
         this.tokenStore.clearTokens();
+        this.sessionDeviceId = null;
         // Drop the response cache on logout. The cache is identity-scoped, so a
         // different user could never read these entries, but a logged-out client
         // must not keep the previous session's personalized data resident in
@@ -1861,6 +1889,7 @@ export class HttpService {
     __resetTokensForTests() {
         this.sessionEnded = false;
         this.tokenStore.clearTokens();
+        this.sessionDeviceId = null;
     }
 }
 /**

package/dist/types/HttpService.d.ts

@@ -228,6 +228,8 @@ export declare class HttpService {
      * bearer — and through the token listeners, the account — back.
      */
     private sessionEpoch;
+    /** Preserve a known device across legacy rotations which omit the claim. */
+    private sessionDeviceId;
     /**
      * Set by {@link endSession}, cleared by the next {@link setTokens}. Read by the
      * native Commons-identity re-mint arm: after a sign-out a 401 is the expected
@@ -509,8 +511,8 @@ export declare class HttpService {
      */
     endSession(): void;
     /**
-     * The current context epoch: account/session switches and bearer removal
-     * invalidate pending work; rotation within the same context preserves it.
+     * The current context epoch: account/session switches, known device changes,
+     * and bearer removal invalidate pending work; same-context rotation preserves it.
      * A re-mint lane that
      * plants tokens itself (the device-secret arm) compares it across its awaits.
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/core",
-  "version": "7.10.1",
+  "version": "7.10.3",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -181,7 +181,7 @@
   "dependencies": {
     "@noble/ciphers": "^1.3.0",
     "@noble/hashes": "^1.8.0",
-    "@oxy.so/contracts": "6.1.0",
+    "@oxy.so/contracts": "6.2.0",
     "@oxy.so/protocol": "^1.5.1",
     "@oxy.so/telemetry": "^2.1.0",
     "@scure/bip39": "^1.6.0",

package/src/HttpService.ts

@@ -74,6 +74,16 @@ function sameTokenSession(left: string | null, right: string | null): boolean {
     );
   }
   if (!(a.userId || a.id || a.sub) || !(b.userId || b.id || b.sub)) return false;
+  // A legacy bearer may omit deviceId; empty or non-string values also carry no
+  // usable device. Two known, different devices are distinct local contexts.
+  if (
+    typeof a.deviceId === 'string' &&
+    a.deviceId.length > 0 &&
+    typeof b.deviceId === 'string' &&
+    b.deviceId.length > 0 &&
+    a.deviceId !== b.deviceId
+  )
+    return false;
   // A refresh may rotate exp/iat/jti while preserving its account and session.
   // Opaque/malformed context fields cannot establish that equivalence.
   return [
@@ -88,6 +98,14 @@ function sameTokenSession(left: string | null, right: string | null): boolean {
   ].every((key) => (a[key] === undefined || typeof a[key] === 'string') && a[key] === b[key]);
 }
 
+/** Extract a known device for local ownership checks, never authorization. */
+function knownTokenDeviceId(token: string): string | null {
+  const claims = decodeTokenClaims(token);
+  return claims?.type !== 'service' && typeof claims?.deviceId === 'string' && claims.deviceId
+    ? claims.deviceId
+    : null;
+}
+
 /** Discard an unused body even when a platform's stream shim lacks cancel. */
 function discardResponseBody(response: Response): Promise<void> {
   try {
@@ -529,6 +547,8 @@ export class HttpService {
    * bearer — and through the token listeners, the account — back.
    */
   private sessionEpoch = 0;
+  /** Preserve a known device across legacy rotations which omit the claim. */
+  private sessionDeviceId: string | null = null;
   /**
    * Set by {@link endSession}, cleared by the next {@link setTokens}. Read by the
    * native Commons-identity re-mint arm: after a sign-out a 401 is the expected
@@ -825,9 +845,11 @@ export class HttpService {
     const authHeader = usesSessionAuth
       ? await awaitRequestSignal(this.getAuthHeader(), signal)
       : null;
-    const isOriginalSession = () =>
-      this.sessionEpoch === contextEpoch &&
-      sameTokenSession(contextToken, this.syncAccessTokenFromProvider());
+    const isOriginalSession = () => {
+      if (this.sessionEpoch !== contextEpoch) return false;
+      const currentToken = this.syncAccessTokenFromProvider();
+      return this.sessionEpoch === contextEpoch && sameTokenSession(contextToken, currentToken);
+    };
     const newerRequestToken = () => {
       if (!contextToken || !authHeader?.startsWith('Bearer ')) return null;
       const requestToken = authHeader.slice('Bearer '.length);
@@ -1060,6 +1082,7 @@ export class HttpService {
             if (isOriginalSession()) {
               if (this.tokenStore.getAccessToken()) this.sessionEpoch += 1;
               this.tokenStore.clearTokens();
+              this.sessionDeviceId = null;
               selfClearedEpoch = this.sessionEpoch;
               this.notifyTokenChange();
             }
@@ -2080,7 +2103,13 @@ export class HttpService {
   // Token management
   setTokens(accessToken: string): void {
     const current = this.tokenStore.getAccessToken();
-    if (current && !sameTokenSession(current, accessToken)) this.sessionEpoch += 1;
+    const deviceId = knownTokenDeviceId(accessToken);
+    const changed =
+      current !== null &&
+      (!sameTokenSession(current, accessToken) ||
+        (this.sessionDeviceId !== null && deviceId !== null && this.sessionDeviceId !== deviceId));
+    if (changed) this.sessionEpoch += 1;
+    this.sessionDeviceId = !current || changed ? deviceId : (deviceId ?? this.sessionDeviceId);
     this.sessionEnded = false;
     this.tokenStore.setTokens(accessToken);
     this.notifyTokenChange();
@@ -2100,8 +2129,8 @@ export class HttpService {
   }
 
   /**
-   * The current context epoch: account/session switches and bearer removal
-   * invalidate pending work; rotation within the same context preserves it.
+   * The current context epoch: account/session switches, known device changes,
+   * and bearer removal invalidate pending work; same-context rotation preserves it.
    * A re-mint lane that
    * plants tokens itself (the device-secret arm) compares it across its awaits.
    */
@@ -2136,6 +2165,7 @@ export class HttpService {
   clearTokens(): void {
     if (this.tokenStore.getAccessToken()) this.sessionEpoch += 1;
     this.tokenStore.clearTokens();
+    this.sessionDeviceId = null;
     // Drop the response cache on logout. The cache is identity-scoped, so a
     // different user could never read these entries, but a logged-out client
     // must not keep the previous session's personalized data resident in
@@ -2309,5 +2339,6 @@ export class HttpService {
   __resetTokensForTests(): void {
     this.sessionEnded = false;
     this.tokenStore.clearTokens();
+    this.sessionDeviceId = null;
   }
 }