@oxy.so/core 7.30.0 → 7.32.0

package/dist/cjs/crypto/organizationKeys.js

@@ -46,6 +46,7 @@ const keychainAccessGroups_1 = require("../utils/keychainAccessGroups");
 const platform_1 = require("../utils/platform");
 const identitySigner_1 = require("./identitySigner");
 const keychainGroupMigration_1 = require("./keychainGroupMigration");
+const retiredKeys_1 = require("./retiredKeys");
 const keychainItems_1 = require("./keychainItems");
 Object.defineProperty(exports, "isOrganizationAccountId", { enumerable: true, get: function () { return keychainItems_1.isOrganizationAccountId; } });
 const ORGANIZATION_PHRASE_WORDS = 24;
@@ -115,9 +116,7 @@ async function organizationKeyFromPhrase(phrase) {
 async function secureStore(item) {
     const raw = await (0, protocol_1.loadSecureStore)();
     const access = await (0, keychainAccessGroups_1.resolveKeychainAccess)();
-    if (access.mode === 'grouped' && access.role === 'holder') {
-        await (0, keychainGroupMigration_1.ensureKeychainGroupsMigrated)();
-    }
+    await (0, keychainGroupMigration_1.prepareKeychainAccess)(access);
     return (0, keychainAccessGroups_1.groupedKeychainStore)(raw, access, item);
 }
 const pairStore = () => secureStore('spending-key');
@@ -208,8 +207,10 @@ async function readLocalPair(accountId) {
  * it; on iOS only Commons holds the groups it writes (any other app throws).
  *
  * Refuses a pair whose public key does not derive from its private key, and a
- * phrase that does not derive the pair. Overwrites whatever this device held for
- * the organization (a replaced key is the caller's decision, ADR 0061 D7).
+ * phrase that does not derive the pair. A DIFFERENT key this device already
+ * held for the organization is first kept in the organization's retired ring
+ * (ADR 0061 D7 as amended; R4-12): coins under it still need it. When that
+ * cannot be confirmed nothing is overwritten and this throws.
  */
 async function storeOrganizationKey(accountId, key) {
     assertAccountId(accountId);
@@ -231,6 +232,18 @@ async function storeOrganizationKey(accountId, key) {
         throw new Error('On Android only Commons holds organization keys; this app has no identity signer store for them.');
     }
     const store = await pairStore();
+    const previous = await heldPrivateKey(store, accountId);
+    if (previous) {
+        const previousPublic = (0, secp256k1_1.deriveSecp256k1PublicKey)(previous);
+        if (previousPublic !== publicKey) {
+            try {
+                await (0, retiredKeys_1.retireIdentityKey)({ privateKey: previous, publicKey: previousPublic }, { accountId });
+            }
+            catch (error) {
+                throw new Error(`organization key: the key this device held could not be kept as a previous key, so it was not replaced (${error instanceof Error ? error.message : 'unknown'})`);
+            }
+        }
+    }
     await store.setItemAsync((0, keychainItems_1.organizationPrivateKeyName)(accountId), privateKey, pairOptions(store, true));
     await store.setItemAsync((0, keychainItems_1.organizationPublicKeyName)(accountId), publicKey, pairOptions(store, false));
     if (signer?.writeOrganization &&
@@ -311,6 +324,21 @@ async function listOrganizationKeys() {
         return [];
     return readIndex(await indexStore());
 }
+/**
+ * The private key this device holds for `accountId`, whatever its public half
+ * says (an unhealthy pair is still a key coins may sit under): the slot, then
+ * on Android the signer store's copy. `null` when there is none.
+ */
+async function heldPrivateKey(store, accountId) {
+    const local = await store.getItemAsync((0, keychainItems_1.organizationPrivateKeyName)(accountId), pairOptions(store, false));
+    if (local && (0, secp256k1_1.isValidSecp256k1PrivateKey)(local))
+        return (0, secp256k1_1.normalizeSecp256k1PrivateKey)(local);
+    const signer = (0, platform_1.isAndroid)() ? (0, identitySigner_1.registeredIdentitySignerStore)() : null;
+    const mirrored = (await signer?.readOrganization?.(accountId)) ?? null;
+    return mirrored && (0, secp256k1_1.isValidSecp256k1PrivateKey)(mirrored.privateKey)
+        ? (0, secp256k1_1.normalizeSecp256k1PrivateKey)(mirrored.privateKey)
+        : null;
+}
 /** Forget an organization key on this device: its pair, its phrase, its signer copy and its index entry. */
 async function deleteOrganizationKey(accountId) {
     assertAccountId(accountId);

package/dist/cjs/crypto/retiredKeys.js

@@ -45,11 +45,14 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.retiredKeyScope = retiredKeyScope;
 exports.retireIdentityKey = retireIdentityKey;
+exports.retireIdentityKeyDuringMigration = retireIdentityKeyDuringMigration;
 exports.listRetiredIdentityKeys = listRetiredIdentityKeys;
 exports.getRetiredPrivateKey = getRetiredPrivateKey;
 exports.forgetRetiredIdentityKey = forgetRetiredIdentityKey;
 exports.forgetRetiredIdentityKeys = forgetRetiredIdentityKeys;
 exports.syncRetiredKeys = syncRetiredKeys;
+exports.exportRetiredIdentityKeys = exportRetiredIdentityKeys;
+exports.retiredKeyFromPrivateKey = retiredKeyFromPrivateKey;
 exports.retiredKeyFromPhrase = retiredKeyFromPhrase;
 const bip39_1 = require("@scure/bip39");
 const english_js_1 = require("@scure/bip39/wordlists/english.js");
@@ -59,8 +62,8 @@ const logger_1 = require("../logger");
 const keychainAccessGroups_1 = require("../utils/keychainAccessGroups");
 const platform_1 = require("../utils/platform");
 const identitySigner_1 = require("./identitySigner");
+const keychainItems_1 = require("./keychainItems");
 const keychainGroupMigration_1 = require("./keychainGroupMigration");
-const organizationKeys_1 = require("./organizationKeys");
 const PERSONAL_SCOPE = 'personal';
 /** Android, Commons-local: its own Keystore-backed slot, shared with no other key. */
 const ANDROID_KEYCHAIN_SERVICE = 'oxy_retired_identity';
@@ -71,15 +74,15 @@ const PUBLIC_KEY = /^04[0-9a-f]{128}$/;
  * The secure store for the ring. On iOS every item is a `spending-key`
  * (ADR 0062): the private keys AND the index live in the wallet group, which
  * only Commons and the Peable wallet can read, never the shared one. In
- * Commons every access first awaits the access-group migration. On Android
- * the grouping is a no-op and Commons' own services below apply.
+ * Commons every access first awaits the access-group migration (`gate: false`
+ * is the migration itself, keeping a pre-split copy). On Android the grouping
+ * is a no-op and Commons' own services below apply.
  */
-async function ringStore() {
+async function ringStore(gate = true) {
     const raw = await (0, protocol_1.loadSecureStore)();
     const access = await (0, keychainAccessGroups_1.resolveKeychainAccess)();
-    if (access.mode === 'grouped' && access.role === 'holder') {
-        await (0, keychainGroupMigration_1.ensureKeychainGroupsMigrated)();
-    }
+    if (gate)
+        await (0, keychainGroupMigration_1.prepareKeychainAccess)(access);
     return (0, keychainAccessGroups_1.groupedKeychainStore)(raw, access, 'spending-key');
 }
 /** The ring a selector names: `personal`, or the organization's account id. */
@@ -87,7 +90,7 @@ function retiredKeyScope(selector) {
     const accountId = selector?.accountId;
     if (accountId === undefined)
         return PERSONAL_SCOPE;
-    return (0, organizationKeys_1.isOrganizationAccountId)(accountId) ? accountId : null;
+    return (0, keychainItems_1.isOrganizationAccountId)(accountId) ? accountId : null;
 }
 function canonicalPublicKey(publicKey) {
     try {
@@ -134,7 +137,7 @@ function isIndexEntry(value) {
         return false;
     const entry = value;
     return (typeof entry.scope === 'string' &&
-        (entry.scope === PERSONAL_SCOPE || (0, organizationKeys_1.isOrganizationAccountId)(entry.scope)) &&
+        (entry.scope === PERSONAL_SCOPE || (0, keychainItems_1.isOrganizationAccountId)(entry.scope)) &&
         typeof entry.publicKey === 'string' &&
         PUBLIC_KEY.test(entry.publicKey) &&
         typeof entry.retiredAt === 'number' &&
@@ -171,13 +174,24 @@ function toListed(entry) {
         ? { publicKey: entry.publicKey, retiredAt: entry.retiredAt }
         : { publicKey: entry.publicKey, accountId: entry.scope, retiredAt: entry.retiredAt };
 }
-/** Whether this app writes the ring: Commons (Android: the signer store it registers; iOS: native). */
-function assertMayWrite() {
+/**
+ * Whether this app writes the ring: Commons only (Android: the signer store it
+ * registers; iOS: the keychain role `holder`). The Peable wallet holds the
+ * wallet group too, but only reads, derives and signs: a key the wallet could
+ * add to the ring is a key it could choose (R4-14).
+ */
+async function assertMayWrite() {
     if ((0, platform_1.isWeb)())
         throw new Error('retired key: only a native device holds one');
     if ((0, platform_1.isAndroid)() && !(0, identitySigner_1.registeredIdentitySignerStore)()?.writeRetired) {
         throw new Error('On Android only Commons holds retired keys; this app has no identity signer store for them.');
     }
+    if ((0, platform_1.isIOS)()) {
+        const access = await (0, keychainAccessGroups_1.resolveKeychainAccess)();
+        if (access.mode === 'grouped' && access.role !== 'holder') {
+            throw new Error('On iOS only Commons writes retired keys; this app may only read them.');
+        }
+    }
 }
 /**
  * Keep `key` in the ring of `selector`'s account. Commons only. Idempotent: a
@@ -187,16 +201,27 @@ function assertMayWrite() {
  * caller about to replace the key can stop before anything is lost.
  */
 async function retireIdentityKey(key, selector) {
+    await keepRetired(key, selector, true);
+}
+/**
+ * {@link retireIdentityKey} from inside the iOS access-group migration, which
+ * keeps a replaced pre-split copy before deleting it from the shared group and
+ * cannot await itself. @internal
+ */
+async function retireIdentityKeyDuringMigration(key, selector) {
+    await keepRetired(key, selector, false);
+}
+async function keepRetired(key, selector, gate) {
     const scope = retiredKeyScope(selector);
     if (!scope)
         throw new Error('retired key: accountId must be a 24-hex or uuid account id');
-    assertMayWrite();
+    await assertMayWrite();
     if (!isHealthyPair(key.privateKey, key.publicKey)) {
         throw new Error('retired key: the public key does not derive from the private key');
     }
     const privateKey = (0, secp256k1_1.normalizeSecp256k1PrivateKey)(key.privateKey);
     const publicKey = (0, secp256k1_1.normalizeSecp256k1PublicKey)(key.publicKey);
-    const store = await ringStore();
+    const store = await ringStore(gate);
     await store.setItemAsync(privateKeyName(scope, publicKey), privateKey, privateOptions(store, true));
     const readBack = await store.getItemAsync(privateKeyName(scope, publicKey), privateOptions(store, false));
     if (readBack !== privateKey) {
@@ -294,7 +319,7 @@ async function forgetRetiredIdentityKey(publicKey, selector) {
     const canonical = canonicalPublicKey(publicKey);
     if (!scope || !canonical)
         throw new Error('retired key: invalid selector or public key');
-    assertMayWrite();
+    await assertMayWrite();
     const store = await ringStore();
     await store.deleteItemAsync(privateKeyName(scope, canonical), privateOptions(store, false));
     const signer = (0, platform_1.isAndroid)() ? (0, identitySigner_1.registeredIdentitySignerStore)() : null;
@@ -302,10 +327,12 @@ async function forgetRetiredIdentityKey(publicKey, selector) {
     await writeIndex(store, (await readIndex(store)).filter((entry) => !(entry.scope === scope && entry.publicKey === canonical)));
 }
 /**
- * Forget every retired key of one ring (the person's, or an organization's):
- * called when the identity itself is deleted from this device, so a phone
- * handed on keeps none of the person's old keys. Commons only. Resolves how
- * many it removed.
+ * Forget every retired key of one ring (the person's, or an organization's).
+ * Commons only, and only when the person deletes their Oxy ACCOUNT (Commons'
+ * delete-account flow), which tells them the coins go with it. Deleting the
+ * identity from this device — "Start over", a forced delete — never calls it:
+ * the ring is money, and the same person restoring their identity later must
+ * find it (R4-4). Resolves how many it removed.
  */
 async function forgetRetiredIdentityKeys(selector) {
     const scope = retiredKeyScope(selector);
@@ -352,6 +379,41 @@ async function syncRetiredKeys() {
     }
     return mirrored;
 }
+/**
+ * Every retired key of `selector`'s ring WITH its private half, for the
+ * encrypted identity backup (`oxy.identity.backup.create`), which carries them
+ * under the CURRENT phrase so a lost phone costs no more than the current
+ * phrase does (R4-4). Commons only; an entry whose private half is missing or
+ * does not derive its public key is left out. Never log or transmit the result
+ * except inside that encrypted envelope.
+ */
+async function exportRetiredIdentityKeys(selector) {
+    const scope = retiredKeyScope(selector);
+    if (!scope || (0, platform_1.isWeb)())
+        return [];
+    await assertMayWrite();
+    const out = [];
+    for (const entry of await listRetiredIdentityKeys(selector)) {
+        const privateKey = await getRetiredPrivateKey(entry.publicKey, selector);
+        if (privateKey)
+            out.push({ privateKey, publicKey: entry.publicKey, retiredAt: entry.retiredAt });
+    }
+    return out;
+}
+/**
+ * The pair a previous key's raw PRIVATE KEY gives (64 hex, an optional `0x`),
+ * for a person whose old identity was imported as a private key and so has no
+ * phrase to re-enter. Stores nothing: the caller checks the public key against
+ * the account's key history and only then calls {@link retireIdentityKey}.
+ */
+function retiredKeyFromPrivateKey(privateKeyHex) {
+    const trimmed = privateKeyHex.trim().toLowerCase().replace(/^0x/, '');
+    if (!/^[0-9a-f]{64}$/.test(trimmed) || !(0, secp256k1_1.isValidSecp256k1PrivateKey)(trimmed)) {
+        throw new Error('retired key: not a valid private key');
+    }
+    const privateKey = (0, secp256k1_1.normalizeSecp256k1PrivateKey)(trimmed);
+    return { privateKey, publicKey: publicKeyOf(privateKey) };
+}
 /**
  * The pair a previous recovery phrase derives (`seed[0:32]`, the personal-root
  * and organization-key derivation; 12–24 words). Stores nothing: the caller

package/dist/cjs/session/authStateStore.js

@@ -20,6 +20,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AUTH_STATE_TOKEN_STORAGE_KEY = exports.AUTOMATIC_IDENTITY_SIGNIN_SUPPRESSED_KEY = exports.AUTH_STATE_STORAGE_KEY = void 0;
 exports.matchesAuthState = matchesAuthState;
+exports.nativeSessionItemNames = nativeSessionItemNames;
 exports.createMemoryAuthStateStore = createMemoryAuthStateStore;
 exports.createWebAuthStateStore = createWebAuthStateStore;
 exports.createNativeAuthStateStore = createNativeAuthStateStore;
@@ -53,6 +54,18 @@ function matchesAuthState(actual, expected) {
  */
 exports.AUTH_STATE_STORAGE_KEY = 'oxy.auth.v1';
 exports.AUTOMATIC_IDENTITY_SIGNIN_SUPPRESSED_KEY = 'oxy.auth.automatic-identity-signin-suppressed.v1';
+/**
+ * What `ownKeychainItemPlan` (ADR 0062 D6) must know about a key a native
+ * session store keeps — this module's three and the identity pin: every Oxy app
+ * writes it under the same name, so on iOS a copy in the shared group may be
+ * another app's session and is never read as this app's. The sign-out marker
+ * can only withhold, so a shared copy of it still counts.
+ */
+function nativeSessionItemNames(key) {
+    return key === exports.AUTOMATIC_IDENTITY_SIGNIN_SUPPRESSED_KEY
+        ? 'every-oxy-app-withholding'
+        : 'every-oxy-app';
+}
 /**
  * Versioned BEST-EFFORT warm-token storage key. Holds the short-lived
  * `{ accessToken, expiresAt }` pair only. Its write is genuinely non-fatal — a

package/dist/cjs/session/index.js

@@ -8,8 +8,8 @@
  * the API with a token it already has never needs it.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.establishIdentitySession = exports.resolveIdentityPin = exports.IDENTITY_PIN_STORAGE_KEY = exports.identityPinMatches = exports.createMemoryIdentityPinStore = exports.createNativeIdentityPinStore = exports.createWebIdentityPinStore = exports.resolveKeychainAccess = exports.deleteThroughPlan = exports.readThroughPlan = exports.ownKeychainItemPlan = exports.keychainAccessGroupValue = exports.KeychainAccessUnavailableError = exports.readLocalDeviceCredential = exports.publishProvenDeviceCredential = exports.normalizeSharedDeviceSessionRead = exports.decideSharedDevicePublish = exports.decideSharedDeviceJoin = exports.createSharedMirroringAuthStateStore = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.resolveAccountDelegationAccess = exports.canSwitchIntoAccount = exports.isSwitchTargetAccount = exports.deviceComparisonCode = exports.showsPrincipalHeaders = exports.buildSwitcherRows = exports.resolveDeviceContext = exports.resolveActiveContext = exports.projectDevicePrincipals = exports.directoryHandle = exports.directoryDisplayName = exports.canActivateContext = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.DeviceManager = void 0;
-exports.runColdBoot = exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = void 0;
+exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.establishIdentitySession = exports.resolveIdentityPin = exports.IDENTITY_PIN_STORAGE_KEY = exports.identityPinMatches = exports.createMemoryIdentityPinStore = exports.createNativeIdentityPinStore = exports.createWebIdentityPinStore = exports.resolveKeychainAccess = exports.deleteThroughPlan = exports.readThroughPlan = exports.ownKeychainItemPlan = exports.keychainAccessGroupValue = exports.KeychainAccessUnavailableError = exports.readLocalDeviceCredential = exports.publishProvenDeviceCredential = exports.normalizeSharedDeviceSessionRead = exports.decideSharedDevicePublish = exports.decideSharedDeviceJoin = exports.createSharedMirroringAuthStateStore = exports.AUTOMATIC_IDENTITY_SIGNIN_SUPPRESSED_KEY = exports.AUTH_STATE_TOKEN_STORAGE_KEY = exports.AUTH_STATE_STORAGE_KEY = exports.nativeSessionItemNames = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.resolveAccountDelegationAccess = exports.canSwitchIntoAccount = exports.isSwitchTargetAccount = exports.deviceComparisonCode = exports.showsPrincipalHeaders = exports.buildSwitcherRows = exports.resolveDeviceContext = exports.resolveActiveContext = exports.projectDevicePrincipals = exports.directoryHandle = exports.directoryDisplayName = exports.canActivateContext = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.DeviceManager = void 0;
+exports.runColdBoot = exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = void 0;
 // Session code reaches the identity key (identity-bound sessions), so the
 // crypto shim goes first — see `../crypto/polyfill`.
 require("../crypto/polyfill");
@@ -95,7 +95,10 @@ var authStateStore_1 = require("./authStateStore");
 Object.defineProperty(exports, "createWebAuthStateStore", { enumerable: true, get: function () { return authStateStore_1.createWebAuthStateStore; } });
 Object.defineProperty(exports, "createNativeAuthStateStore", { enumerable: true, get: function () { return authStateStore_1.createNativeAuthStateStore; } });
 Object.defineProperty(exports, "createMemoryAuthStateStore", { enumerable: true, get: function () { return authStateStore_1.createMemoryAuthStateStore; } });
+Object.defineProperty(exports, "nativeSessionItemNames", { enumerable: true, get: function () { return authStateStore_1.nativeSessionItemNames; } });
 Object.defineProperty(exports, "AUTH_STATE_STORAGE_KEY", { enumerable: true, get: function () { return authStateStore_1.AUTH_STATE_STORAGE_KEY; } });
+Object.defineProperty(exports, "AUTH_STATE_TOKEN_STORAGE_KEY", { enumerable: true, get: function () { return authStateStore_1.AUTH_STATE_TOKEN_STORAGE_KEY; } });
+Object.defineProperty(exports, "AUTOMATIC_IDENTITY_SIGNIN_SUPPRESSED_KEY", { enumerable: true, get: function () { return authStateStore_1.AUTOMATIC_IDENTITY_SIGNIN_SUPPRESSED_KEY; } });
 // The shared NATIVE DeviceSession credential — how several official apps on one
 // device end up on ONE `DeviceSession` and therefore one active context. It is an
 // ordinary revocable `deviceId` + `deviceSecret`, deliberately NOT the