@oxy.so/core 7.11.0 → 7.12.0

package/README.md

@@ -225,3 +225,11 @@ optional/platform-specific modules.
 ## `verifyChallenge` Token Planting
 
 `OxyServices.verifyChallenge()` plants the freshly-minted access token internally before returning. Callers do not need to plant tokens manually after `verifyChallenge` — the SDK handles it.
+
+The optional `@oxy.so/core/server/aws` entry requires the optional
+`@aws-sdk/credential-provider-node` peer. Explicit profiles additionally require
+`@aws-sdk/credential-provider-ini`, loaded lazily only when resolving that profile.
+`createAwsWorkloadCredentialProvider({ profile })` resolves only that explicit profile
+and fails if it cannot be resolved; it never falls back to an ambient identity. Omitting
+`profile` retains the default AWS credential chain. Both paths require unexpired
+temporary credentials with a session token.

package/dist/cjs/HttpService.js

@@ -39,6 +39,9 @@ const REQUESTER_PROOF_HEADERS = new Set([
     'x-oxy-presented-requester-context',
     'x-oxy-presented-service-token',
 ]);
+function newCredentialGeneration() {
+    return Object.freeze({});
+}
 /** Comparison only fences local async work; it never validates token authority. */
 function sameTokenSession(left, right) {
     if (left === right)
@@ -249,14 +252,25 @@ const CACHE_SIZE_WARNING_THROTTLE_MS = 60000;
 class TokenStore {
     constructor() {
         this.accessToken = null;
+        this.generation = newCredentialGeneration();
     }
     setTokens(accessToken) {
+        this.generation = newCredentialGeneration();
         this.accessToken = accessToken;
     }
+    /** The identity of the bearer's current installation, never of its bytes. */
+    getGeneration() {
+        return this.generation;
+    }
+    /** Retire the current generation without touching the bearer (provider swaps). */
+    invalidateGeneration() {
+        this.generation = newCredentialGeneration();
+    }
     getAccessToken() {
         return this.accessToken;
     }
     clearTokens() {
+        this.generation = newCredentialGeneration();
         this.accessToken = null;
     }
     hasAccessToken() {
@@ -307,7 +321,7 @@ function linkAbort(parent, child) {
  * Uses native fetch instead of axios for smaller bundle size.
  */
 class HttpService {
-    constructor(config) {
+    constructor(config, credentialSource = null) {
         // Only active calls retain a lease. Invalidation detaches matching leases,
         // so late results cannot warm the cache or attract new deduplicated callers.
         this.readLeases = new Map();
@@ -404,6 +418,7 @@ class HttpService {
             averageResponseTime: 0,
         };
         this.config = config;
+        this.credentialSource = credentialSource;
         this.baseURL = config.baseURL;
         this.tokenStore = new TokenStore();
         this.logger = new requestUtils_1.SimpleLogger(config.enableLogging || false, config.logLevel || 'error', 'HttpService');
@@ -520,6 +535,17 @@ class HttpService {
     async request(config) {
         if (config.signal?.aborted)
             throw (0, errorUtils_1.createCancelledError)('Request cancelled before it was sent');
+        if (config.expectedCredentialGeneration) {
+            // The prototype is deliberately limited to writes; it does not
+            // yet define leases for cached/deduplicated reads or raw response paths.
+            if (!['POST', 'PUT', 'PATCH', 'DELETE'].includes(config.method) ||
+                config.skipAuth ||
+                Object.keys(config.headers ?? {}).some((key) => key.toLowerCase() === 'authorization')) {
+                throw new Error('A credential generation requires an implicitly authenticated write');
+            }
+            (this.credentialSource ?? this).assertCredentialGeneration(config.expectedCredentialGeneration);
+            config = { ...config, cache: false, deduplicate: false, retry: false };
+        }
         // The provider can change independently of the last request. Synchronize
         // before deriving the cache and deduplication identity, including hits.
         const explicitAuthorization = Object.keys(config.headers ?? {}).some((key) => key.toLowerCase() === 'authorization');
@@ -609,6 +635,12 @@ class HttpService {
         const authHeader = usesSessionAuth
             ? await (0, requestSignal_1.awaitRequestSignal)(this.getAuthHeader(), signal)
             : null;
+        const assertExpectedCredential = () => {
+            if (config.expectedCredentialGeneration) {
+                (this.credentialSource ?? this).assertCredentialGeneration(config.expectedCredentialGeneration, authHeader);
+            }
+        };
+        assertExpectedCredential();
         const isOriginalSession = () => {
             if (this.sessionEpoch !== contextEpoch)
                 return false;
@@ -658,6 +690,7 @@ class HttpService {
             if (usesSessionAuth && !isOriginalSession()) {
                 throw new OxyServices_errors_1.OxyAuthenticationError('The request session changed', 'AUTH_SESSION_CHANGED');
             }
+            assertExpectedCredential();
             /**
              * Whether OUR timer fired, so a timeout can be told apart from a
              * cancellation. Both reach us from `fetch` as an indistinguishable
@@ -754,6 +787,9 @@ class HttpService {
                     Object.keys(headers).some((key) => REQUESTER_PROOF_HEADERS.has(key.toLowerCase()))) {
                     throw new Error('Requester proofs require a transport that rejects redirects');
                 }
+                // Header and source generation are checked together in this synchronous
+                // dispatch segment, after the preflight and any queue wait.
+                assertExpectedCredential();
                 const response = useXhrForUpload
                     ? await this.uploadViaXHR(fullUrl, method, headers, bodyValue, controller.signal, timeout, false)
                     : await fetch(fullUrl, {
@@ -768,6 +804,13 @@ class HttpService {
                 // it, including on every throw between here and there.
                 if (timeoutId)
                     clearTimeout(timeoutId);
+                try {
+                    assertExpectedCredential();
+                }
+                catch (error) {
+                    void discardResponseBody(response);
+                    throw error;
+                }
                 if (usesSessionAuth && !isOriginalSession()) {
                     void discardResponseBody(response);
                     throw new OxyServices_errors_1.OxyAuthenticationError('The request session changed', 'AUTH_SESSION_CHANGED');
@@ -778,6 +821,7 @@ class HttpService {
                     // once before giving up. HttpService deliberately does not know any
                     // session routes; the refresh handler owns session rotation.
                     if (response.status === 401 &&
+                        !config.expectedCredentialGeneration &&
                         !config._isAuthRetry &&
                         usesSessionAuth &&
                         isOriginalSession()) {
@@ -913,12 +957,14 @@ class HttpService {
                 if (usesSessionAuth && !isOriginalSession()) {
                     throw new OxyServices_errors_1.OxyAuthenticationError('The request session changed', 'AUTH_SESSION_CHANGED');
                 }
+                assertExpectedCredential();
                 const duration = Date.now() - startTime;
                 this.updateMetrics(true, duration);
                 this.config.onRequestEnd?.(url, method, duration, true);
                 return responseData;
             }
             catch (error) {
+                assertExpectedCredential();
                 const duration = Date.now() - startTime;
                 this.updateMetrics(false, duration);
                 // A body reader can reject or finish parsing an error after the viewer
@@ -1030,6 +1076,7 @@ class HttpService {
         if (usesSessionAuth && !isOriginalSession()) {
             throw new OxyServices_errors_1.OxyAuthenticationError('The request session changed', 'AUTH_SESSION_CHANGED');
         }
+        assertExpectedCredential();
         // Cache the result if caching is enabled
         if (cache && cacheKey && lease.valid && result) {
             this.cache.set(cacheKey, result, cacheTTL);
@@ -1755,6 +1802,27 @@ class HttpService {
     getSessionEpoch() {
         return this.sessionEpoch;
     }
+    /** Capture only the local generation; the caller must separately bind authority. */
+    captureCredentialGeneration() {
+        // A pull-only provider can change A→B→A between reads without notifying us.
+        if (this.accessTokenProvider)
+            return null;
+        return this.tokenStore.getAccessToken() ? this.tokenStore.getGeneration() : null;
+    }
+    isCredentialGenerationCurrent(generation) {
+        return (!this.accessTokenProvider &&
+            this.tokenStore.getAccessToken() !== null &&
+            generation === this.tokenStore.getGeneration());
+    }
+    assertCredentialGeneration(generation, selectedHeader) {
+        const token = this.tokenStore.getAccessToken();
+        if (this.accessTokenProvider ||
+            !token ||
+            generation !== this.tokenStore.getGeneration() ||
+            (selectedHeader !== undefined && selectedHeader !== `Bearer ${token}`)) {
+            throw new OxyServices_errors_1.OxyAuthenticationError('The request credential changed', 'AUTH_SESSION_CHANGED');
+        }
+    }
     /** Whether {@link endSession} ran and no token has been planted since. */
     hasSessionEnded() {
         return this.sessionEnded;
@@ -1763,6 +1831,7 @@ class HttpService {
         this.authRefreshHandler = handler;
     }
     setAccessTokenProvider(provider) {
+        this.tokenStore.invalidateGeneration();
         this.accessTokenProvider = provider;
     }
     /**

package/dist/cjs/OxyServices.js

@@ -117,7 +117,7 @@ class OxyServices {
      * Query). Pass `enableCache: true` to opt in.
      */
     createLinkedClient(config) {
-        const client = new HttpService_1.HttpService({ ...config, enableCache: config.enableCache ?? false });
+        const client = new HttpService_1.HttpService({ ...config, enableCache: config.enableCache ?? false }, this.http);
         const syncToken = (accessToken) => {
             const current = client.getAccessToken();
             if (accessToken) {

package/dist/cjs/api/holderEvidence.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sameHolderIdentity = sameHolderIdentity;
+/** The one comparison that decides whether two observations name the same viewer context. */
+function sameHolderIdentity(a, b) {
+    return (a.deviceId === b.deviceId &&
+        a.deviceSessionId === b.deviceSessionId &&
+        a.contextId === b.contextId &&
+        a.actorId === b.actorId &&
+        a.accountId === b.accountId &&
+        a.sessionId === b.sessionId);
+}

package/dist/cjs/api/session.js

@@ -11,12 +11,21 @@ exports.SessionApi = void 0;
 const jwt_decode_1 = require("jwt-decode");
 const userIdentity_1 = require("../utils/userIdentity");
 const OxyServices_errors_1 = require("../OxyServices.errors");
+const client_1 = require("@oxy.so/contracts/client");
+/** How long a refusal (disabled, rate limited, unreachable) is remembered per installation. */
+const EVIDENCE_REFUSAL_MS = 5000;
+const unavailable = (reason) => ({
+    status: 'unavailable',
+    reason,
+});
 class SessionApi {
     constructor(ctx) {
         this.ctx = ctx;
         this.deviceCredentialProvider = null;
         this.decodedFor = null;
         this.decoded = null;
+        /** One server round trip per installed bearer; the key is the opaque generation. */
+        this.evidence = new WeakMap();
     }
     // ── Local state ──────────────────────────────────────────────────────────
     /** The current access token, or `null` when signed out. */
@@ -121,6 +130,115 @@ class SessionApi {
             return null;
         }
     }
+    // ── Holder-context evidence (ADR 0053) ───────────────────────────────────
+    /**
+     * Ask the server which shared-device context the INSTALLED bearer belongs to,
+     * and bind the answer to that exact installation.
+     *
+     * The result is honored only if the credential generation captured before
+     * the request is still current when the answer is committed, so a refresh,
+     * setter, account or actor switch, cross-tab change, restore or A to B to A
+     * during the request yields `changed`. The answer must also agree with the
+     * claims of the bearer that was captured; a disagreement is
+     * `binding_unavailable`. Nothing here refreshes, clears or mints a credential,
+     * and no outcome is a revocation verdict: callers keep their existing checks.
+     * Concurrent callers share one request per installation.
+     */
+    observeHolderEvidence() {
+        const generation = this.ctx.http.captureCredentialGeneration();
+        const token = this.ctx.http.getAccessToken();
+        if (!generation || !token)
+            return Promise.resolve(unavailable('no_credential'));
+        const known = this.evidence.get(generation);
+        if (known) {
+            const refused = known.settledAt !== undefined;
+            if (!refused || Date.now() - known.settledAt < EVIDENCE_REFUSAL_MS) {
+                return known.result.then((result) => result.status === 'ok' && result.evidence.expiresAtMs <= Date.now()
+                    ? this.refreshEvidence(generation, token)
+                    : result);
+            }
+        }
+        return this.refreshEvidence(generation, token);
+    }
+    /** Whether evidence still names the installed bearer and has not expired. */
+    isHolderEvidenceCurrent(evidence) {
+        return (Date.now() < evidence.expiresAtMs &&
+            this.ctx.http.isCredentialGenerationCurrent(evidence.generation));
+    }
+    refreshEvidence(generation, token) {
+        const entry = {
+            result: this.acquireEvidence(generation, token).then((result) => {
+                if (result.status !== 'ok')
+                    entry.settledAt = Date.now();
+                return result;
+            }),
+        };
+        this.evidence.set(generation, entry);
+        return entry.result;
+    }
+    async acquireEvidence(generation, token) {
+        let claims;
+        try {
+            claims = (0, jwt_decode_1.jwtDecode)(token);
+        }
+        catch {
+            return unavailable('unsupported');
+        }
+        const proof = await this.readDeviceProof();
+        if (!proof)
+            return unavailable('no_holder');
+        let response;
+        try {
+            response = await this.ctx.request('POST', '/session/device/context-evidence-v1', proof, {
+                cache: false,
+                retry: false,
+                expectedCredentialGeneration: generation,
+            });
+        }
+        catch (error) {
+            if (error?.code === 'AUTH_SESSION_CHANGED') {
+                return unavailable('changed');
+            }
+            const status = error instanceof OxyServices_errors_1.OxyApiError ? error.status : 0;
+            if (status === 403)
+                return unavailable('unsupported');
+            if (status === 409)
+                return unavailable('binding_unavailable');
+            return unavailable('unavailable');
+        }
+        const parsed = (0, client_1.checkContract)(client_1.holderContextEvidenceV1ResponseCheck, response);
+        if (!parsed)
+            return unavailable('unavailable');
+        // Commit synchronously: nothing may replace the bearer between this check
+        // and the evidence becoming visible to its caller.
+        if (!this.ctx.http.isCredentialGenerationCurrent(generation))
+            return unavailable('changed');
+        const expiresAtMs = Date.parse(parsed.expiresAt);
+        if (parsed.deviceId !== proof.deviceId ||
+            parsed.accountId !== claims.userId ||
+            parsed.sessionId !== claims.sessionId ||
+            (claims.act?.sub !== undefined && parsed.actorId !== claims.act.sub) ||
+            (claims.device_context_id !== undefined && parsed.contextId !== claims.device_context_id)) {
+            return unavailable('binding_unavailable');
+        }
+        if (!Number.isFinite(expiresAtMs) || expiresAtMs <= Date.now()) {
+            return unavailable('unavailable');
+        }
+        const evidence = Object.freeze({
+            generation,
+            identity: Object.freeze({
+                deviceId: parsed.deviceId,
+                deviceSessionId: parsed.deviceSessionId,
+                contextId: parsed.contextId,
+                actorId: parsed.actorId,
+                accountId: parsed.accountId,
+                sessionId: parsed.sessionId,
+            }),
+            deviceRevision: parsed.revision,
+            expiresAtMs,
+        });
+        return { status: 'ok', evidence };
+    }
     // ── The server session ───────────────────────────────────────────────────
     /** Ask the server whether the current access token is valid. */
     async validateToken() {

package/dist/cjs/aws/index.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createAwsWorkloadCredentialProvider = createAwsWorkloadCredentialProvider;
 /** Optional AWS SDK integration. Never re-export this module from another entrypoint. */
@@ -9,8 +42,21 @@ const credential_provider_node_1 = require("@aws-sdk/credential-provider-node");
  * Long-lived IAM user access keys are deliberately not a local service identity.
  */
 function createAwsWorkloadCredentialProvider(options = {}) {
-    const provider = (0, credential_provider_node_1.defaultProvider)(options);
+    // An explicitly selected profile is an authority boundary. defaultProvider
+    // falls through a missing profile to ambient ECS/IMDS credentials, which may
+    // name another application. fromIni resolves only the selected profile and
+    // its declared source chain, or rejects; there is no ambient fallback.
+    if (options.profile !== undefined && !options.profile.trim())
+        throw new Error('An explicit AWS workload profile must not be empty');
+    const ambient = options.profile === undefined ? (0, credential_provider_node_1.defaultProvider)(options) : undefined;
+    const resolveProfile = async () => (await Promise.resolve().then(() => __importStar(require('@aws-sdk/credential-provider-ini')))).fromIni(options);
+    let selectedProfile;
     return async () => {
+        let provider = ambient;
+        if (!provider) {
+            selectedProfile ?? (selectedProfile = resolveProfile());
+            provider = await selectedProfile;
+        }
         const credentials = await provider();
         if (!credentials.sessionToken ||
             !credentials.expiration ||

package/dist/cjs/index.js

@@ -21,10 +21,10 @@
  * If a symbol does not appear here, it is NOT part of the public API.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getBaseLanguage = exports.FALLBACK_LOCALE = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.commonsDeliveryPlatform = exports.pushTargetsFromDelivery = exports.selectCommonsDelivery = exports.parseCommonsApprovalExpiresAt = exports.getCommonsApprovalBlockingReason = exports.OxyAppDataIdentifierError = exports.AccountNotOnDeviceError = exports.REPUTATION_CACHE_PREFIX = exports.StoreInstallerError = exports.setStoreInstaller = exports.getStoreInstaller = exports.kindAcceptsAccountCategories = exports.isSelectableAccountCategoryId = exports.SELECTABLE_ACCOUNT_CATEGORY_IDS = exports.MAX_ACCOUNT_CATEGORIES = exports.ACCOUNT_CATEGORY_IDS = exports.buildUserDid = exports.DirectUploadInterruptedError = exports.MAX_UPLOAD_BYTES = exports.assetUrlCacheTTL = exports.ASSET_MULTIPART_UPLOAD_MAX_BYTES = exports.ServiceAssetMetadataError = exports.AssetUrlResolutionError = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.OxyApiError = exports.OXY_CLOUD_URL = exports.OXY_API_URL = exports.OxyServices = void 0;
-exports.isLocaleLoaded = exports.loadLocale = exports.translate = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.coerceToSupportedLocale = exports.getPrimaryLanguage = exports.getUserLanguages = exports.isRTLLocale = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.isSupportedLocale = exports.normalizeLocale = void 0;
-exports.normalizeMultilineText = exports.normalizeInlineText = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE = exports.DISPLAY_NAME_ORPHANED_MARK_SOURCE = exports.DISPLAY_NAME_DISALLOWED_SOURCE = exports.DISPLAY_NAME_ALLOWED_SCRIPTS = exports.accountNameInvalidKey = exports.accountNameInvalidMessage = exports.accountNameMaxLength = exports.isValidAccountName = exports.isValidDisplayName = exports.isValidPassword = exports.isValidEmail = exports.ACCOUNT_TITLE_INVALID_MESSAGE = exports.DISPLAY_NAME_INVALID_MESSAGE = exports.MAX_DISPLAY_NAME_LENGTH = exports.PASSWORD_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.parseHttpErrorBody = exports.isHttpRequestError = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.buildQueryParams = exports.trustTierLabel = exports.reputationCategoryLabel = exports.accountRoleLabel = exports.accountCategoryLabel = exports.getLocalesVersion = exports.subscribeLocales = void 0;
-exports.packageInfo = exports.consumeOAuthReturnPath = exports.persistOAuthReturnPath = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.canonicalizeOAuthRedirectUri = exports.normalizeOAuthRedirectUri = exports.OXY_OAUTH_RETURN_PATH_STORAGE_KEY = exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.CENTRAL_IDP_APEX = exports.AUTH_WEB_ORIGIN = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.isDev = exports.consoleSink = exports.resetLoggerConfig = exports.getLoggerConfig = exports.configureLogger = exports.createLogger = exports.logger = void 0;
+exports.FALLBACK_LOCALE = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.commonsDeliveryPlatform = exports.pushTargetsFromDelivery = exports.selectCommonsDelivery = exports.parseCommonsApprovalExpiresAt = exports.getCommonsApprovalBlockingReason = exports.OxyAppDataIdentifierError = exports.AccountNotOnDeviceError = exports.REPUTATION_CACHE_PREFIX = exports.StoreInstallerError = exports.setStoreInstaller = exports.getStoreInstaller = exports.kindAcceptsAccountCategories = exports.isSelectableAccountCategoryId = exports.SELECTABLE_ACCOUNT_CATEGORY_IDS = exports.MAX_ACCOUNT_CATEGORIES = exports.ACCOUNT_CATEGORY_IDS = exports.buildUserDid = exports.DirectUploadInterruptedError = exports.MAX_UPLOAD_BYTES = exports.assetUrlCacheTTL = exports.ASSET_MULTIPART_UPLOAD_MAX_BYTES = exports.sameHolderIdentity = exports.ServiceAssetMetadataError = exports.AssetUrlResolutionError = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.OxyApiError = exports.OXY_CLOUD_URL = exports.OXY_API_URL = exports.OxyServices = void 0;
+exports.loadLocale = exports.translate = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.coerceToSupportedLocale = exports.getPrimaryLanguage = exports.getUserLanguages = exports.isRTLLocale = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.isSupportedLocale = exports.normalizeLocale = exports.getBaseLanguage = void 0;
+exports.normalizeInlineText = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE = exports.DISPLAY_NAME_ORPHANED_MARK_SOURCE = exports.DISPLAY_NAME_DISALLOWED_SOURCE = exports.DISPLAY_NAME_ALLOWED_SCRIPTS = exports.accountNameInvalidKey = exports.accountNameInvalidMessage = exports.accountNameMaxLength = exports.isValidAccountName = exports.isValidDisplayName = exports.isValidPassword = exports.isValidEmail = exports.ACCOUNT_TITLE_INVALID_MESSAGE = exports.DISPLAY_NAME_INVALID_MESSAGE = exports.MAX_DISPLAY_NAME_LENGTH = exports.PASSWORD_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.parseHttpErrorBody = exports.isHttpRequestError = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.buildQueryParams = exports.trustTierLabel = exports.reputationCategoryLabel = exports.accountRoleLabel = exports.accountCategoryLabel = exports.getLocalesVersion = exports.subscribeLocales = exports.isLocaleLoaded = void 0;
+exports.packageInfo = exports.consumeOAuthReturnPath = exports.persistOAuthReturnPath = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.canonicalizeOAuthRedirectUri = exports.normalizeOAuthRedirectUri = exports.OXY_OAUTH_RETURN_PATH_STORAGE_KEY = exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.CENTRAL_IDP_APEX = exports.AUTH_WEB_ORIGIN = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.isDev = exports.consoleSink = exports.resetLoggerConfig = exports.getLoggerConfig = exports.configureLogger = exports.createLogger = exports.logger = exports.normalizeMultilineText = void 0;
 // The crypto shim MUST stay the first import. The root itself ships no crypto
 // library (`__tests__/rootEntryGraph.test.ts`), but `@oxy.so/protocol`'s root
 // entry (reached by the OAuth/PKCE and device helpers) does, and Metro does not
@@ -44,6 +44,8 @@ Object.defineProperty(exports, "OxyAuthenticationError", { enumerable: true, get
 Object.defineProperty(exports, "OxyAuthenticationTimeoutError", { enumerable: true, get: function () { return OxyServices_errors_1.OxyAuthenticationTimeoutError; } });
 Object.defineProperty(exports, "AssetUrlResolutionError", { enumerable: true, get: function () { return OxyServices_errors_1.AssetUrlResolutionError; } });
 Object.defineProperty(exports, "ServiceAssetMetadataError", { enumerable: true, get: function () { return OxyServices_errors_1.ServiceAssetMetadataError; } });
+var holderEvidence_1 = require("./api/holderEvidence");
+Object.defineProperty(exports, "sameHolderIdentity", { enumerable: true, get: function () { return holderEvidence_1.sameHolderIdentity; } });
 var assets_1 = require("./api/assets");
 Object.defineProperty(exports, "ASSET_MULTIPART_UPLOAD_MAX_BYTES", { enumerable: true, get: function () { return assets_1.ASSET_MULTIPART_UPLOAD_MAX_BYTES; } });
 Object.defineProperty(exports, "assetUrlCacheTTL", { enumerable: true, get: function () { return assets_1.assetUrlCacheTTL; } });

package/dist/esm/HttpService.js

@@ -36,6 +36,9 @@ const REQUESTER_PROOF_HEADERS = new Set([
     'x-oxy-presented-requester-context',
     'x-oxy-presented-service-token',
 ]);
+function newCredentialGeneration() {
+    return Object.freeze({});
+}
 /** Comparison only fences local async work; it never validates token authority. */
 function sameTokenSession(left, right) {
     if (left === right)
@@ -246,14 +249,25 @@ const CACHE_SIZE_WARNING_THROTTLE_MS = 60000;
 class TokenStore {
     constructor() {
         this.accessToken = null;
+        this.generation = newCredentialGeneration();
     }
     setTokens(accessToken) {
+        this.generation = newCredentialGeneration();
         this.accessToken = accessToken;
     }
+    /** The identity of the bearer's current installation, never of its bytes. */
+    getGeneration() {
+        return this.generation;
+    }
+    /** Retire the current generation without touching the bearer (provider swaps). */
+    invalidateGeneration() {
+        this.generation = newCredentialGeneration();
+    }
     getAccessToken() {
         return this.accessToken;
     }
     clearTokens() {
+        this.generation = newCredentialGeneration();
         this.accessToken = null;
     }
     hasAccessToken() {
@@ -304,7 +318,7 @@ function linkAbort(parent, child) {
  * Uses native fetch instead of axios for smaller bundle size.
  */
 export class HttpService {
-    constructor(config) {
+    constructor(config, credentialSource = null) {
         // Only active calls retain a lease. Invalidation detaches matching leases,
         // so late results cannot warm the cache or attract new deduplicated callers.
         this.readLeases = new Map();
@@ -401,6 +415,7 @@ export class HttpService {
             averageResponseTime: 0,
         };
         this.config = config;
+        this.credentialSource = credentialSource;
         this.baseURL = config.baseURL;
         this.tokenStore = new TokenStore();
         this.logger = new SimpleLogger(config.enableLogging || false, config.logLevel || 'error', 'HttpService');
@@ -517,6 +532,17 @@ export class HttpService {
     async request(config) {
         if (config.signal?.aborted)
             throw createCancelledError('Request cancelled before it was sent');
+        if (config.expectedCredentialGeneration) {
+            // The prototype is deliberately limited to writes; it does not
+            // yet define leases for cached/deduplicated reads or raw response paths.
+            if (!['POST', 'PUT', 'PATCH', 'DELETE'].includes(config.method) ||
+                config.skipAuth ||
+                Object.keys(config.headers ?? {}).some((key) => key.toLowerCase() === 'authorization')) {
+                throw new Error('A credential generation requires an implicitly authenticated write');
+            }
+            (this.credentialSource ?? this).assertCredentialGeneration(config.expectedCredentialGeneration);
+            config = { ...config, cache: false, deduplicate: false, retry: false };
+        }
         // The provider can change independently of the last request. Synchronize
         // before deriving the cache and deduplication identity, including hits.
         const explicitAuthorization = Object.keys(config.headers ?? {}).some((key) => key.toLowerCase() === 'authorization');
@@ -606,6 +632,12 @@ export class HttpService {
         const authHeader = usesSessionAuth
             ? await awaitRequestSignal(this.getAuthHeader(), signal)
             : null;
+        const assertExpectedCredential = () => {
+            if (config.expectedCredentialGeneration) {
+                (this.credentialSource ?? this).assertCredentialGeneration(config.expectedCredentialGeneration, authHeader);
+            }
+        };
+        assertExpectedCredential();
         const isOriginalSession = () => {
             if (this.sessionEpoch !== contextEpoch)
                 return false;
@@ -655,6 +687,7 @@ export class HttpService {
             if (usesSessionAuth && !isOriginalSession()) {
                 throw new OxyAuthenticationError('The request session changed', 'AUTH_SESSION_CHANGED');
             }
+            assertExpectedCredential();
             /**
              * Whether OUR timer fired, so a timeout can be told apart from a
              * cancellation. Both reach us from `fetch` as an indistinguishable
@@ -751,6 +784,9 @@ export class HttpService {
                     Object.keys(headers).some((key) => REQUESTER_PROOF_HEADERS.has(key.toLowerCase()))) {
                     throw new Error('Requester proofs require a transport that rejects redirects');
                 }
+                // Header and source generation are checked together in this synchronous
+                // dispatch segment, after the preflight and any queue wait.
+                assertExpectedCredential();
                 const response = useXhrForUpload
                     ? await this.uploadViaXHR(fullUrl, method, headers, bodyValue, controller.signal, timeout, false)
                     : await fetch(fullUrl, {
@@ -765,6 +801,13 @@ export class HttpService {
                 // it, including on every throw between here and there.
                 if (timeoutId)
                     clearTimeout(timeoutId);
+                try {
+                    assertExpectedCredential();
+                }
+                catch (error) {
+                    void discardResponseBody(response);
+                    throw error;
+                }
                 if (usesSessionAuth && !isOriginalSession()) {
                     void discardResponseBody(response);
                     throw new OxyAuthenticationError('The request session changed', 'AUTH_SESSION_CHANGED');
@@ -775,6 +818,7 @@ export class HttpService {
                     // once before giving up. HttpService deliberately does not know any
                     // session routes; the refresh handler owns session rotation.
                     if (response.status === 401 &&
+                        !config.expectedCredentialGeneration &&
                         !config._isAuthRetry &&
                         usesSessionAuth &&
                         isOriginalSession()) {
@@ -910,12 +954,14 @@ export class HttpService {
                 if (usesSessionAuth && !isOriginalSession()) {
                     throw new OxyAuthenticationError('The request session changed', 'AUTH_SESSION_CHANGED');
                 }
+                assertExpectedCredential();
                 const duration = Date.now() - startTime;
                 this.updateMetrics(true, duration);
                 this.config.onRequestEnd?.(url, method, duration, true);
                 return responseData;
             }
             catch (error) {
+                assertExpectedCredential();
                 const duration = Date.now() - startTime;
                 this.updateMetrics(false, duration);
                 // A body reader can reject or finish parsing an error after the viewer
@@ -1027,6 +1073,7 @@ export class HttpService {
         if (usesSessionAuth && !isOriginalSession()) {
             throw new OxyAuthenticationError('The request session changed', 'AUTH_SESSION_CHANGED');
         }
+        assertExpectedCredential();
         // Cache the result if caching is enabled
         if (cache && cacheKey && lease.valid && result) {
             this.cache.set(cacheKey, result, cacheTTL);
@@ -1752,6 +1799,27 @@ export class HttpService {
     getSessionEpoch() {
         return this.sessionEpoch;
     }
+    /** Capture only the local generation; the caller must separately bind authority. */
+    captureCredentialGeneration() {
+        // A pull-only provider can change A→B→A between reads without notifying us.
+        if (this.accessTokenProvider)
+            return null;
+        return this.tokenStore.getAccessToken() ? this.tokenStore.getGeneration() : null;
+    }
+    isCredentialGenerationCurrent(generation) {
+        return (!this.accessTokenProvider &&
+            this.tokenStore.getAccessToken() !== null &&
+            generation === this.tokenStore.getGeneration());
+    }
+    assertCredentialGeneration(generation, selectedHeader) {
+        const token = this.tokenStore.getAccessToken();
+        if (this.accessTokenProvider ||
+            !token ||
+            generation !== this.tokenStore.getGeneration() ||
+            (selectedHeader !== undefined && selectedHeader !== `Bearer ${token}`)) {
+            throw new OxyAuthenticationError('The request credential changed', 'AUTH_SESSION_CHANGED');
+        }
+    }
     /** Whether {@link endSession} ran and no token has been planted since. */
     hasSessionEnded() {
         return this.sessionEnded;
@@ -1760,6 +1828,7 @@ export class HttpService {
         this.authRefreshHandler = handler;
     }
     setAccessTokenProvider(provider) {
+        this.tokenStore.invalidateGeneration();
         this.accessTokenProvider = provider;
     }
     /**

package/dist/esm/OxyServices.js

@@ -114,7 +114,7 @@ export class OxyServices {
      * Query). Pass `enableCache: true` to opt in.
      */
     createLinkedClient(config) {
-        const client = new HttpService({ ...config, enableCache: config.enableCache ?? false });
+        const client = new HttpService({ ...config, enableCache: config.enableCache ?? false }, this.http);
         const syncToken = (accessToken) => {
             const current = client.getAccessToken();
             if (accessToken) {

package/dist/esm/api/holderEvidence.js

@@ -0,0 +1,9 @@
+/** The one comparison that decides whether two observations name the same viewer context. */
+export function sameHolderIdentity(a, b) {
+    return (a.deviceId === b.deviceId &&
+        a.deviceSessionId === b.deviceSessionId &&
+        a.contextId === b.contextId &&
+        a.actorId === b.actorId &&
+        a.accountId === b.accountId &&
+        a.sessionId === b.sessionId);
+}