@oxyhq/core 12.8.0 → 12.10.0

package/dist/esm/index.js

@@ -26,7 +26,8 @@ export { OXY_CLOUD_URL, oxyClient } from './OxyServices.js';
 // ---------------------------------------------------------------------------
 // Authentication
 // ---------------------------------------------------------------------------
-export { ServiceCredentialMismatchError } from './mixins/OxyServices.auth.js';
+export { ServiceCredentialMismatchError, } from './mixins/OxyServices.auth.js';
+export { getCommonsApprovalBlockingReason, parseCommonsApprovalExpiresAt, } from './utils/commonsApproval.js';
 export { OxyAppDataIdentifierError } from './mixins/OxyServices.appData.js';
 // ---------------------------------------------------------------------------
 // User identity and handles
@@ -62,7 +63,8 @@ export { mergeSessions, normalizeAndSortSessions, sessionsArraysEqual, } from '.
 // ---------------------------------------------------------------------------
 // Crypto / identity
 // ---------------------------------------------------------------------------
-export { KeyManager, IdentityAlreadyExistsError, IdentityPersistError, } from './crypto/keyManager.js';
+export { KeyManager, IdentityAlreadyExistsError, IdentityPersistError, IdentityUnavailableError, } from './crypto/keyManager.js';
+export { readIdentityMarker, updateIdentityMarker, } from './crypto/identityMarker.js';
 export { SignatureService } from './crypto/signatureService.js';
 export { RecoveryPhraseService } from './crypto/recoveryPhrase.js';
 // Low-level crypto primitives (b3 Phase 0 — encrypted backup + device transfer)

package/dist/esm/mixins/OxyServices.auth.js

@@ -1,4 +1,5 @@
 import { loginResultSchema, safeParseContract } from '@oxyhq/contracts';
+export { getCommonsApprovalBlockingReason, parseCommonsApprovalExpiresAt, } from '../utils/commonsApproval.js';
 import { OxyAuthenticationError } from '../OxyServices.errors.js';
 import { KeyManager } from '../crypto/keyManager.js';
 import { SignatureService } from '../crypto/signatureService.js';
@@ -293,12 +294,16 @@ export function OxyServicesAuthMixin(Base) {
          * The client must sign this challenge with their private key
          *
          * @param publicKey - The user's public key
+         * @param requestOptions - Optional per-call transport overrides (`retry`,
+         *   `timeout`). Interactive callers omit it (defaults keep retries); the
+         *   cold-boot `shared-key-signin` step passes `{ retry: false }` so a slow
+         *   network cannot multiply boot latency via the inner retry loop.
          */
-        async requestChallenge(publicKey) {
+        async requestChallenge(publicKey, requestOptions) {
             try {
                 return await this.makeRequest('POST', '/auth/challenge', {
                     publicKey,
-                }, { cache: false });
+                }, { cache: false, ...requestOptions });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -313,8 +318,12 @@ export function OxyServicesAuthMixin(Base) {
          * @param timestamp - Timestamp when the signature was created
          * @param deviceName - Optional device name
          * @param deviceFingerprint - Optional device fingerprint
+         * @param requestOptions - Optional per-call transport overrides (`retry`,
+         *   `timeout`). Interactive callers omit it (defaults keep retries); the
+         *   cold-boot `shared-key-signin` step passes `{ retry: false }` so a slow
+         *   network cannot multiply boot latency via the inner retry loop.
          */
-        async verifyChallenge(publicKey, challenge, signature, timestamp, deviceName, deviceFingerprint) {
+        async verifyChallenge(publicKey, challenge, signature, timestamp, deviceName, deviceFingerprint, requestOptions) {
             try {
                 const res = await this.makeRequest('POST', '/auth/verify', {
                     publicKey,
@@ -323,7 +332,7 @@ export function OxyServicesAuthMixin(Base) {
                     timestamp,
                     deviceName,
                     deviceFingerprint,
-                }, { cache: false });
+                }, { cache: false, ...requestOptions });
                 // Plant the freshly-minted tokens, mirroring `claimSessionByToken`.
                 // `/auth/verify` returns the first access token (and refresh token) in
                 // its body, so installing it here means callers get an authenticated
@@ -461,6 +470,13 @@ export function OxyServicesAuthMixin(Base) {
          *
          * The cold-boot wiring that CALLS this lives in `OxyContext`
          * (`@oxyhq/services`); this method just performs the exchange.
+         *
+         * @param opts.requestOptions - Optional per-call transport overrides
+         *   (`retry`, `timeout`) forwarded to BOTH the `requestChallenge` and
+         *   `verifyChallenge` round-trips. Interactive flows omit it (defaults keep
+         *   retries); the cold-boot `shared-key-signin` step passes `{ retry: false }`
+         *   so this network step cannot multiply boot latency via the inner retry
+         *   loop. The token-refresh scheduler / 401 lane still retry later.
          */
         async signInWithSharedIdentity(opts = {}) {
             try {
@@ -474,10 +490,10 @@ export function OxyServicesAuthMixin(Base) {
                 if (!sharedPublicKey) {
                     return null;
                 }
-                const { challenge } = await this.requestChallenge(sharedPublicKey);
+                const { challenge } = await this.requestChallenge(sharedPublicKey, opts.requestOptions);
                 const signed = await SignatureService.signChallengeWithSharedKey(challenge);
                 // `signed.challenge` carries the SIGNATURE (mirrors `signChallenge`).
-                return await this.verifyChallenge(signed.publicKey, challenge, signed.challenge, signed.timestamp, opts.deviceName, opts.deviceFingerprint);
+                return await this.verifyChallenge(signed.publicKey, challenge, signed.challenge, signed.timestamp, opts.deviceName, opts.deviceFingerprint, opts.requestOptions);
             }
             catch (error) {
                 throw this.handleError(error);

package/dist/esm/mixins/OxyServices.deviceBoot.js

@@ -29,11 +29,19 @@ export function OxyServicesDeviceBootMixin(Base) {
          * `no_active_session`) to decide whether to drop the secret and fall back or
          * resolve signed-out.
          *
+         * `retry: false`: the mint is a single logical attempt. The proactive
+         * token-refresh scheduler and the reactive 401 lane already own backoff and
+         * re-arm, so `HttpService`'s inner retry loop here would only multiply the
+         * mint's latency on a slow/black-hole network (3 retries × 5s timeout ≈ 20s
+         * per lane) with no correctness benefit — it is the dominant term in the cold
+         * boot's worst-case time-to-route. A transient failure surfaces once and the
+         * scheduler/401 path retries it later.
+         *
          * @throws if the response does not match {@link deviceTokenMintResponseSchema}.
          */
         async mintFromDeviceSecret(deviceId, deviceSecret) {
             try {
-                const res = await this.makeRequest('POST', '/session/device/token', { deviceId, deviceSecret }, { cache: false, skipAuth: true });
+                const res = await this.makeRequest('POST', '/session/device/token', { deviceId, deviceSecret }, { cache: false, skipAuth: true, retry: false });
                 const parsed = safeParseContract(deviceTokenMintResponseSchema, res);
                 if (!parsed) {
                     throw new Error('session/device/token returned an unexpected response shape');

package/dist/esm/mixins/OxyServices.identityBackup.js

@@ -138,6 +138,17 @@ export function OxyServicesIdentityBackupMixin(Base) {
                 const aad = buildBackupAad(envelope.version, envelope.publicKeyHint);
                 const plaintext = decryptAead(backupKey, fromHex(envelope.nonce), fromHex(envelope.ciphertext), aad);
                 const payload = JSON.parse(new TextDecoder().decode(plaintext));
+                if (!payload.privateKey || !payload.publicKey) {
+                    throw new Error('Backup payload is missing key material');
+                }
+                const derivedFromPhrase = await RecoveryPhraseService.derivePublicKeyFromPhrase(phrase);
+                const derivedFromPrivate = KeyManager.derivePublicKey(payload.privateKey);
+                const phrasePk = derivedFromPhrase.toLowerCase();
+                const payloadPk = payload.publicKey.toLowerCase();
+                const privatePk = derivedFromPrivate.toLowerCase();
+                if (phrasePk !== payloadPk || privatePk !== payloadPk) {
+                    throw new Error('Backup payload does not match the recovery phrase');
+                }
                 // Persist the recovered key. Native-only; refuses to clobber a different
                 // identity unless overwrite — the IdentityAlreadyExistsError propagates.
                 return await KeyManager.importKeyPair(payload.privateKey, {

package/dist/esm/mixins/OxyServices.user.js

@@ -420,6 +420,10 @@ export function OxyServicesUserMixin(Base) {
                 const result = await this.makeRequest('PATCH', `/privacy/${id}/privacy`, settings, {
                     cache: false,
                 });
+                this.clearCacheByPrefix('GET:/session/user/');
+                this.clearCacheByPrefix('GET:/users/me');
+                this.clearCacheByPrefix('GET:/profiles/username/');
+                this.clearCacheEntry(`GET:/users/${id}`);
                 this.clearCacheEntry(`GET:/privacy/${id}/privacy`);
                 return result;
             }

package/dist/esm/utils/commonsApproval.js

@@ -0,0 +1,27 @@
+/**
+ * Returns a user-facing blocking reason when an approval payload must not be
+ * shown as actionable, or `null` when the request is still pending and valid.
+ */
+export function getCommonsApprovalBlockingReason(info) {
+    if (!info.application?.id) {
+        return 'The requesting application could not be resolved.';
+    }
+    if (info.status !== 'pending') {
+        return 'This sign-in request is invalid, already used, or expired.';
+    }
+    const expiresAtMs = parseCommonsApprovalExpiresAt(info.expiresAt);
+    if (expiresAtMs !== null && expiresAtMs < Date.now()) {
+        return 'This sign-in request has expired. Ask for a new QR code.';
+    }
+    return null;
+}
+/** Normalize API `expiresAt` (number or ISO string) to epoch ms. */
+export function parseCommonsApprovalExpiresAt(expiresAt) {
+    if (typeof expiresAt === 'number' && Number.isFinite(expiresAt))
+        return expiresAt;
+    if (typeof expiresAt === 'string') {
+        const ms = Date.parse(expiresAt);
+        return Number.isFinite(ms) ? ms : null;
+    }
+    return null;
+}