@oxy.so/core 7.9.2 → 7.10.1

package/dist/cjs/api/storeInstaller.js

@@ -0,0 +1,46 @@
+"use strict";
+/**
+ * The store's installer: how a store installs, opens and updates an application on a machine
+ * that installs applications, beside `oxy.store`, which reads the catalogue.
+ *
+ * `oxy.store` says what the store lists; an installer says what the machine can do with a
+ * listing. A runtime that installs applications registers one (OxyOS's Bloom host registers one
+ * backed by the system's install service before the application's code runs, OxyOS ADR 0030
+ * decision 9; ADR 0053 here). Where none is registered — the web, iOS, Android — there is
+ * nothing to install, and a store shows what it shows without one. An application never asks
+ * which platform it runs on: it asks whether there is an installer.
+ *
+ * The installer is the store's hands, never its judge. It is given a listing's slug and nothing
+ * else: the machine resolves slug → package → release from the store's signed metadata, verifies
+ * it, and asks the person in a sheet of its own that no application can draw or press. The store
+ * learns the outcome and nothing of the sheet. Its errors say whether the machine already told the
+ * person (`told`), so a store never repeats what the system said.
+ *
+ * React-free and dependency-free, as everything in `@oxy.so/core`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StoreInstallerError = void 0;
+exports.setStoreInstaller = setStoreInstaller;
+exports.getStoreInstaller = getStoreInstaller;
+/** A failure of an installer's request. */
+class StoreInstallerError extends Error {
+    constructor(reason, options = {}) {
+        super(options.message ?? reason);
+        this.name = 'StoreInstallerError';
+        this.reason = reason;
+        this.told = options.told ?? false;
+    }
+}
+exports.StoreInstallerError = StoreInstallerError;
+let installer = null;
+/**
+ * Registers the machine's installer, or removes it with null. A runtime calls it once, before
+ * the application's code runs; nothing else should.
+ */
+function setStoreInstaller(next) {
+    installer = next;
+}
+/** The machine's installer, or null where nothing installs applications. */
+function getStoreInstaller() {
+    return installer;
+}

package/dist/cjs/index.js

@@ -21,10 +21,10 @@
  * If a symbol does not appear here, it is NOT part of the public API.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getLanguageMetadata = exports.isSupportedLocale = exports.normalizeLocale = exports.getBaseLanguage = exports.FALLBACK_LOCALE = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.commonsDeliveryPlatform = exports.pushTargetsFromDelivery = exports.selectCommonsDelivery = exports.parseCommonsApprovalExpiresAt = exports.getCommonsApprovalBlockingReason = exports.OxyAppDataIdentifierError = exports.AccountNotOnDeviceError = exports.REPUTATION_CACHE_PREFIX = exports.kindAcceptsAccountCategories = exports.isSelectableAccountCategoryId = exports.SELECTABLE_ACCOUNT_CATEGORY_IDS = exports.MAX_ACCOUNT_CATEGORIES = exports.ACCOUNT_CATEGORY_IDS = exports.buildUserDid = exports.DirectUploadInterruptedError = exports.MAX_UPLOAD_BYTES = exports.assetUrlCacheTTL = exports.ASSET_MULTIPART_UPLOAD_MAX_BYTES = exports.ServiceAssetMetadataError = exports.AssetUrlResolutionError = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.OxyApiError = exports.OXY_CLOUD_URL = exports.OXY_API_URL = exports.OxyServices = void 0;
-exports.accountCategoryLabel = exports.getLocalesVersion = exports.subscribeLocales = exports.isLocaleLoaded = exports.loadLocale = exports.translate = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.coerceToSupportedLocale = exports.getPrimaryLanguage = exports.getUserLanguages = exports.isRTLLocale = exports.getNativeLanguageName = exports.getLanguageName = void 0;
-exports.configureLogger = exports.createLogger = exports.logger = exports.normalizeMultilineText = exports.normalizeInlineText = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE = exports.DISPLAY_NAME_ORPHANED_MARK_SOURCE = exports.DISPLAY_NAME_DISALLOWED_SOURCE = exports.DISPLAY_NAME_ALLOWED_SCRIPTS = exports.accountNameInvalidKey = exports.accountNameInvalidMessage = exports.accountNameMaxLength = exports.isValidAccountName = exports.isValidDisplayName = exports.isValidPassword = exports.isValidEmail = exports.ACCOUNT_TITLE_INVALID_MESSAGE = exports.DISPLAY_NAME_INVALID_MESSAGE = exports.MAX_DISPLAY_NAME_LENGTH = exports.PASSWORD_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.parseHttpErrorBody = exports.isHttpRequestError = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.buildQueryParams = exports.trustTierLabel = exports.reputationCategoryLabel = exports.accountRoleLabel = void 0;
-exports.packageInfo = exports.consumeOAuthReturnPath = exports.persistOAuthReturnPath = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.canonicalizeOAuthRedirectUri = exports.normalizeOAuthRedirectUri = exports.OXY_OAUTH_RETURN_PATH_STORAGE_KEY = exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.CENTRAL_IDP_APEX = exports.AUTH_WEB_ORIGIN = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.isDev = exports.consoleSink = exports.resetLoggerConfig = exports.getLoggerConfig = void 0;
+exports.getBaseLanguage = exports.FALLBACK_LOCALE = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.commonsDeliveryPlatform = exports.pushTargetsFromDelivery = exports.selectCommonsDelivery = exports.parseCommonsApprovalExpiresAt = exports.getCommonsApprovalBlockingReason = exports.OxyAppDataIdentifierError = exports.AccountNotOnDeviceError = exports.REPUTATION_CACHE_PREFIX = exports.StoreInstallerError = exports.setStoreInstaller = exports.getStoreInstaller = exports.kindAcceptsAccountCategories = exports.isSelectableAccountCategoryId = exports.SELECTABLE_ACCOUNT_CATEGORY_IDS = exports.MAX_ACCOUNT_CATEGORIES = exports.ACCOUNT_CATEGORY_IDS = exports.buildUserDid = exports.DirectUploadInterruptedError = exports.MAX_UPLOAD_BYTES = exports.assetUrlCacheTTL = exports.ASSET_MULTIPART_UPLOAD_MAX_BYTES = exports.ServiceAssetMetadataError = exports.AssetUrlResolutionError = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.OxyApiError = exports.OXY_CLOUD_URL = exports.OXY_API_URL = exports.OxyServices = void 0;
+exports.isLocaleLoaded = exports.loadLocale = exports.translate = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.coerceToSupportedLocale = exports.getPrimaryLanguage = exports.getUserLanguages = exports.isRTLLocale = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.isSupportedLocale = exports.normalizeLocale = void 0;
+exports.normalizeMultilineText = exports.normalizeInlineText = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE = exports.DISPLAY_NAME_ORPHANED_MARK_SOURCE = exports.DISPLAY_NAME_DISALLOWED_SOURCE = exports.DISPLAY_NAME_ALLOWED_SCRIPTS = exports.accountNameInvalidKey = exports.accountNameInvalidMessage = exports.accountNameMaxLength = exports.isValidAccountName = exports.isValidDisplayName = exports.isValidPassword = exports.isValidEmail = exports.ACCOUNT_TITLE_INVALID_MESSAGE = exports.DISPLAY_NAME_INVALID_MESSAGE = exports.MAX_DISPLAY_NAME_LENGTH = exports.PASSWORD_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.parseHttpErrorBody = exports.isHttpRequestError = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.buildQueryParams = exports.trustTierLabel = exports.reputationCategoryLabel = exports.accountRoleLabel = exports.accountCategoryLabel = exports.getLocalesVersion = exports.subscribeLocales = void 0;
+exports.packageInfo = exports.consumeOAuthReturnPath = exports.persistOAuthReturnPath = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.canonicalizeOAuthRedirectUri = exports.normalizeOAuthRedirectUri = exports.OXY_OAUTH_RETURN_PATH_STORAGE_KEY = exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.CENTRAL_IDP_APEX = exports.AUTH_WEB_ORIGIN = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.isDev = exports.consoleSink = exports.resetLoggerConfig = exports.getLoggerConfig = exports.configureLogger = exports.createLogger = exports.logger = void 0;
 // The crypto shim MUST stay the first import. The root itself ships no crypto
 // library (`__tests__/rootEntryGraph.test.ts`), but `@oxy.so/protocol`'s root
 // entry (reached by the OAuth/PKCE and device helpers) does, and Metro does not
@@ -58,6 +58,12 @@ Object.defineProperty(exports, "MAX_ACCOUNT_CATEGORIES", { enumerable: true, get
 Object.defineProperty(exports, "SELECTABLE_ACCOUNT_CATEGORY_IDS", { enumerable: true, get: function () { return accounts_1.SELECTABLE_ACCOUNT_CATEGORY_IDS; } });
 Object.defineProperty(exports, "isSelectableAccountCategoryId", { enumerable: true, get: function () { return accounts_1.isSelectableAccountCategoryId; } });
 Object.defineProperty(exports, "kindAcceptsAccountCategories", { enumerable: true, get: function () { return accounts_1.kindAcceptsAccountCategories; } });
+// The store's installer (ADR 0053): what a runtime that installs applications registers beside
+// `oxy.store`, and what a store asks it.
+var storeInstaller_1 = require("./api/storeInstaller");
+Object.defineProperty(exports, "getStoreInstaller", { enumerable: true, get: function () { return storeInstaller_1.getStoreInstaller; } });
+Object.defineProperty(exports, "setStoreInstaller", { enumerable: true, get: function () { return storeInstaller_1.setStoreInstaller; } });
+Object.defineProperty(exports, "StoreInstallerError", { enumerable: true, get: function () { return storeInstaller_1.StoreInstallerError; } });
 var reputation_1 = require("./api/reputation");
 Object.defineProperty(exports, "REPUTATION_CACHE_PREFIX", { enumerable: true, get: function () { return reputation_1.REPUTATION_CACHE_PREFIX; } });
 var devices_1 = require("./api/devices");

package/dist/cjs/session/SessionClient.js

@@ -39,6 +39,8 @@ class SessionClient {
         this.tokenUnsub = null;
         this.started = false;
         this.lifecycleGeneration = 0;
+        /** Changes whenever the locally projected device changes, including ABA. */
+        this.deviceGeneration = 0;
         this.fullSignOutPersistence = null;
         /** Same-origin cross-tab state-propagation channel; null on platforms without BroadcastChannel. */
         this.channel = null;
@@ -68,6 +70,25 @@ class SessionClient {
             throw new Error('Device session request was superseded');
         return response;
     }
+    /** Capture the local device before a request, including device ABA. */
+    captureDeviceRequest() {
+        return { generation: this.deviceGeneration, initialDevice: this.state?.deviceId ?? null };
+    }
+    isCurrentDeviceRequest(request, response) {
+        if (request.generation === this.deviceGeneration)
+            return true;
+        if (request.initialDevice !== null || this.deviceGeneration !== request.generation + 1)
+            return false;
+        if (response === null || typeof response !== 'object')
+            return false;
+        const record = response;
+        const deviceId = record.state?.deviceId ?? record.directory?.deviceId ?? record.deviceId;
+        return typeof deviceId === 'string' && deviceId === this.state?.deviceId;
+    }
+    assertCurrentDeviceRequest(request, response) {
+        if (!this.isCurrentDeviceRequest(request, response))
+            throw new Error('Device session request was superseded');
+    }
     /** Stop and discard only this client's local device projection; no server revocation. */
     resetLocalState() {
         this.lifecycleGeneration += 1;
@@ -216,6 +237,8 @@ class SessionClient {
             return false;
         }
         const previousState = this.state;
+        if (previousState?.deviceId !== next.deviceId)
+            this.deviceGeneration += 1;
         this.state = next;
         if (next.accounts.length === 0) {
             // A device with nobody signed in has no principals either. The directory
@@ -324,11 +347,13 @@ class SessionClient {
                 .ensureActiveToken(next)
                 .then(finishApply)
                 .catch((error) => {
-                if (generation !== this.lifecycleGeneration)
+                if (generation !== this.lifecycleGeneration || this.state !== next)
                     return;
                 logger_1.logger.warn('[SessionClient] ensureActiveToken failed — reverting session state', { component: 'SessionClient' }, error);
                 // Do NOT notify under a mismatched bearer. Revert to the last applied
                 // state so subscribers keep observing the account whose token is planted.
+                if (this.state?.deviceId !== previousState?.deviceId)
+                    this.deviceGeneration += 1;
                 this.state = previousState ?? null;
             });
         }
@@ -378,6 +403,21 @@ class SessionClient {
         if (this.fullSignOutPersistence?.state === this.state)
             await this.fullSignOutPersistence.pending;
     }
+    /** Keep mutation callers from reporting success after a device change during persistence. */
+    async applySyncForMutation(raw) {
+        const before = this.captureDeviceRequest();
+        const lifecycle = this.lifecycleGeneration;
+        const checked = (0, client_1.deviceSessionSyncCheck)(raw, []);
+        const responseDevice = checked.ok ? checked.value.state.deviceId : before.initialDevice;
+        const expectedGeneration = before.generation + (responseDevice === before.initialDevice ? 0 : 1);
+        const pending = this.applySync(raw);
+        const generation = this.deviceGeneration;
+        await pending;
+        if (generation !== expectedGeneration ||
+            generation !== this.deviceGeneration ||
+            lifecycle !== this.lifecycleGeneration)
+            throw new Error('Device session request was superseded');
+    }
     /**
      * The apply + token-plant half of {@link applySync}, on an ALREADY-VALIDATED
      * sync. Split out so the context-aware removal lane — whose response is a
@@ -397,14 +437,15 @@ class SessionClient {
         const applied = this.applyState(sync.state, 'request', sync.activeToken?.accessToken);
         // Equal-revision restate (this revision was already applied by a preceding
         // socket push): `applyState` no-ops without planting, but the token still
-        // needs planting. Guard on the sync's active account STILL being the current
-        // active account so a stale response cannot adopt a token for an account a
-        // newer state already switched away from — and, when pinned, on that account
-        // being the PINNED one (same rule as the applied path in `applyState`).
+        // needs planting. Only the exact same device revision is an equal-revision
+        // restate: an older response may identify a different operator of the same
+        // account. Also require the current account and the identity pin to match.
         const pinnedAccountId = this.pinnedAccountId();
         if (!applied &&
             sync.activeToken &&
             this.state &&
+            sync.state.deviceId === this.state.deviceId &&
+            sync.state.revision === this.state.revision &&
             sync.state.activeAccountId !== null &&
             sync.state.activeAccountId === this.state.activeAccountId &&
             (pinnedAccountId === null || sync.state.activeAccountId === pinnedAccountId) &&
@@ -454,9 +495,12 @@ class SessionClient {
     }
     /** `GET /session/device/directory` → {@link applyDirectory}. No notify. */
     async fetchDirectory() {
+        const request = this.captureDeviceRequest();
         const res = await this.requestDevice('GET', '/session/device/directory', undefined, {
             cache: false,
         });
+        if (!this.isCurrentDeviceRequest(request, res))
+            return false;
         return this.applyDirectory(res);
     }
     /**
@@ -518,14 +562,13 @@ class SessionClient {
         if (!accessToken) {
             return;
         }
+        const pinnedAccountId = this.pinnedAccountId();
         const subjectAccountId = (0, deviceDirectory_1.resolveActiveContext)(directory)?.subject.accountId ?? null;
         if (subjectAccountId === null) {
             return;
         }
-        const pinnedAccountId = this.pinnedAccountId();
-        if (pinnedAccountId !== null && subjectAccountId !== pinnedAccountId) {
+        if (pinnedAccountId !== null && subjectAccountId !== pinnedAccountId)
             return;
-        }
         if (accessToken === this.host.getAccessToken()) {
             return;
         }
@@ -565,9 +608,12 @@ class SessionClient {
         }
     }
     async bootstrap() {
+        const request = this.captureDeviceRequest();
         const res = await this.requestDevice('GET', '/session/device/state', undefined, {
             cache: false,
         });
+        if (!this.isCurrentDeviceRequest(request, res))
+            return;
         await this.applySync(res);
     }
     /**
@@ -611,13 +657,41 @@ class SessionClient {
      * compatibility path for callers still keyed on account ids.
      */
     async activateContext(contextId) {
+        const request = this.captureDeviceRequest();
         const res = await this.requestDevice('POST', '/session/device/activate', { contextId }, { cache: false });
+        this.assertCurrentDeviceRequest(request, res);
         const activation = (0, client_1.checkContract)(client_1.deviceActivateResponseCheck, res);
         if (!activation) {
             logger_1.logger.warn('[SessionClient] discarded invalid activation response');
             return;
         }
+        if (this.pinnedAccountId() === null) {
+            const active = (0, deviceDirectory_1.resolveActiveContext)(activation.directory);
+            if (!active || activation.directory.activeContextId !== contextId)
+                throw new Error('Device session request was superseded');
+            const claims = activation.activeToken?.accessToken
+                ? (0, tokenClaims_1.decodeTokenClaims)(activation.activeToken.accessToken)
+                : null;
+            const contextClaim = claims?.device_context_id;
+            const actor = claims?.act;
+            const actorClaim = actor !== null && typeof actor === 'object' ? actor.sub : undefined;
+            const subjectClaim = claims?.userId ?? claims?.id ?? claims?.sub;
+            // Decoded claims are only a consistency check, never authorization.
+            // Legacy and opaque bearers may omit these claims entirely.
+            if ((typeof contextClaim === 'string' && contextClaim !== active.contextId) ||
+                (typeof actorClaim === 'string' && actorClaim !== active.actor.userId) ||
+                (typeof subjectClaim === 'string' && subjectClaim !== active.subject.accountId))
+                throw new Error('Device session request was superseded');
+        }
         const known = this.knownRevisionFor(activation.directory.deviceId);
+        if (known !== null && activation.directory.revision < known)
+            throw new Error('Device session request was superseded');
+        const held = this.directory;
+        if (this.pinnedAccountId() === null &&
+            held?.deviceId === activation.directory.deviceId &&
+            held.revision === activation.directory.revision &&
+            held.activeContextId !== activation.directory.activeContextId)
+            throw new Error('Device session request was superseded');
         const moved = known === null || activation.directory.revision > known;
         this.plantActiveContextToken(activation.directory, activation.activeToken?.accessToken);
         // Applied BEFORE the reconcile, and only then: the reconcile's own
@@ -627,8 +701,21 @@ class SessionClient {
         // already holding in hand.
         const applied = this.applyDirectory(activation.directory);
         if (moved) {
+            const beforeReconcile = this.captureDeviceRequest();
+            const lifecycle = this.lifecycleGeneration;
             await this.reconcileFlatState(activation.directory);
+            const landedOnTarget = beforeReconcile.initialDevice !== activation.directory.deviceId &&
+                this.deviceGeneration === beforeReconcile.generation + 1 &&
+                this.state?.deviceId === activation.directory.deviceId;
+            if (lifecycle !== this.lifecycleGeneration ||
+                (this.deviceGeneration !== beforeReconcile.generation && !landedOnTarget))
+                throw new Error('Device session request was superseded');
         }
+        if (this.pinnedAccountId() === null &&
+            (this.knownRevisionFor(activation.directory.deviceId) !== activation.directory.revision ||
+                this.directory?.deviceId !== activation.directory.deviceId ||
+                this.directory.activeContextId !== contextId))
+            throw new Error('Device session request was superseded');
         if (applied) {
             this.notify();
         }
@@ -637,8 +724,18 @@ class SessionClient {
         }
     }
     async switchAccount(accountId) {
+        const request = this.captureDeviceRequest();
         const res = await this.requestDevice('POST', '/session/device/switch', { accountId }, { cache: false });
-        await this.applySync(res);
+        this.assertCurrentDeviceRequest(request, res);
+        const checked = (0, client_1.deviceSessionSyncCheck)(res, []);
+        const isStale = () => checked.ok &&
+            this.state?.deviceId === checked.value.state.deviceId &&
+            this.state.revision > checked.value.state.revision;
+        if (isStale())
+            throw new Error('Device session request was superseded');
+        await this.applySyncForMutation(res);
+        if (isStale())
+            throw new Error('Device session request was superseded');
         this.postCommitPing();
     }
     /**
@@ -653,10 +750,12 @@ class SessionClient {
      * {@link signOutPrincipal} for the two that can tell those apart.
      */
     async signOut(target) {
+        const request = this.captureDeviceRequest();
         const res = await this.requestDevice('POST', '/session/device/signout', target, {
             cache: false,
         });
-        await this.applySync(res);
+        this.assertCurrentDeviceRequest(request, res);
+        await this.applySyncForMutation(res);
         this.postCommitPing();
         if (this.state?.accounts.length === 0)
             await this.persistFullSignOut();
@@ -698,21 +797,34 @@ class SessionClient {
      * applied this revision.
      */
     async removeFromDevice(target) {
+        const request = this.captureDeviceRequest();
         const res = await this.requestDevice('POST', '/session/device/signout', target, {
             cache: false,
         });
+        this.assertCurrentDeviceRequest(request, res);
         const removal = (0, client_1.checkContract)(client_1.deviceDirectorySyncCheck, res);
         if (!removal) {
             logger_1.logger.warn('[SessionClient] discarded invalid device removal response');
             return;
         }
         const directoryApplied = this.applyDirectory(removal.directory);
+        const beforeCommit = this.captureDeviceRequest();
+        const commitLifecycle = this.lifecycleGeneration;
+        const expectedGeneration = beforeCommit.generation + (beforeCommit.initialDevice === removal.state.deviceId ? 0 : 1);
         const stateApplied = this.commitSync({
             state: removal.state,
             activeToken: removal.activeToken,
         });
-        if (this.fullSignOutPersistence?.state === this.state)
+        if (expectedGeneration !== this.deviceGeneration ||
+            commitLifecycle !== this.lifecycleGeneration)
+            throw new Error('Device session request was superseded');
+        if (this.fullSignOutPersistence?.state === this.state) {
+            const generation = this.deviceGeneration;
+            const lifecycle = this.lifecycleGeneration;
             await this.fullSignOutPersistence.pending;
+            if (generation !== this.deviceGeneration || lifecycle !== this.lifecycleGeneration)
+                throw new Error('Device session request was superseded');
+        }
         // `commitSync` publishes whenever the flat state moved. When only the
         // directory did — a socket push already applied this revision — the
         // directory half would otherwise never reach a subscriber.
@@ -724,10 +836,12 @@ class SessionClient {
             await this.persistFullSignOut();
     }
     async addCurrentAccount() {
+        const request = this.captureDeviceRequest();
         const res = await this.requestDevice('POST', '/session/device/add', undefined, {
             cache: false,
         });
-        await this.applySync(res);
+        this.assertCurrentDeviceRequest(request, res);
+        await this.applySyncForMutation(res);
         this.postCommitPing();
     }
     /**

package/dist/esm/api/storeInstaller.js

@@ -0,0 +1,40 @@
+/**
+ * The store's installer: how a store installs, opens and updates an application on a machine
+ * that installs applications, beside `oxy.store`, which reads the catalogue.
+ *
+ * `oxy.store` says what the store lists; an installer says what the machine can do with a
+ * listing. A runtime that installs applications registers one (OxyOS's Bloom host registers one
+ * backed by the system's install service before the application's code runs, OxyOS ADR 0030
+ * decision 9; ADR 0053 here). Where none is registered — the web, iOS, Android — there is
+ * nothing to install, and a store shows what it shows without one. An application never asks
+ * which platform it runs on: it asks whether there is an installer.
+ *
+ * The installer is the store's hands, never its judge. It is given a listing's slug and nothing
+ * else: the machine resolves slug → package → release from the store's signed metadata, verifies
+ * it, and asks the person in a sheet of its own that no application can draw or press. The store
+ * learns the outcome and nothing of the sheet. Its errors say whether the machine already told the
+ * person (`told`), so a store never repeats what the system said.
+ *
+ * React-free and dependency-free, as everything in `@oxy.so/core`.
+ */
+/** A failure of an installer's request. */
+export class StoreInstallerError extends Error {
+    constructor(reason, options = {}) {
+        super(options.message ?? reason);
+        this.name = 'StoreInstallerError';
+        this.reason = reason;
+        this.told = options.told ?? false;
+    }
+}
+let installer = null;
+/**
+ * Registers the machine's installer, or removes it with null. A runtime calls it once, before
+ * the application's code runs; nothing else should.
+ */
+export function setStoreInstaller(next) {
+    installer = next;
+}
+/** The machine's installer, or null where nothing installs applications. */
+export function getStoreInstaller() {
+    return installer;
+}

package/dist/esm/index.js

@@ -34,6 +34,9 @@ export { ASSET_MULTIPART_UPLOAD_MAX_BYTES, assetUrlCacheTTL, MAX_UPLOAD_BYTES }
 export { DirectUploadInterruptedError } from './api/directUpload.js';
 export { buildUserDid } from './api/identity.js';
 export { ACCOUNT_CATEGORY_IDS, MAX_ACCOUNT_CATEGORIES, SELECTABLE_ACCOUNT_CATEGORY_IDS, isSelectableAccountCategoryId, kindAcceptsAccountCategories, } from './api/accounts.js';
+// The store's installer (ADR 0053): what a runtime that installs applications registers beside
+// `oxy.store`, and what a store asks it.
+export { getStoreInstaller, setStoreInstaller, StoreInstallerError, } from './api/storeInstaller.js';
 export { REPUTATION_CACHE_PREFIX } from './api/reputation.js';
 export { AccountNotOnDeviceError } from './api/devices.js';
 export { OxyAppDataIdentifierError } from './api/appData.js';