@oxyhq/core 17.0.3 → 18.0.0

package/dist/cjs/boot/sessionColdBoot.js

@@ -134,10 +134,9 @@ async function runSessionColdBoot(opts) {
     //    origin persisted a deviceId + deviceSecret, mint a short access token with
     //    a single bearer-less POST (no cookie, no navigation). The mint itself runs
     //    through `refreshDeviceSecretArm`, which acquires the client's PROCESS-WIDE
-    //    single-flight, persists the rotated `nextDeviceSecret` BEFORE planting the
-    //    token, and returns a classified outcome — so this step can never
-    //    double-rotate the server against the scheduler/transport/401 lanes, and
-    //    the durable store always converges on the true `current` secret.
+    //    single-flight, persists `nextDeviceSecret` BEFORE planting the token, and
+    //    returns a classified outcome — so concurrent mint lanes share one in-flight
+    //    request and the durable store always converges on the server's credential.
     steps.push({
         id: 'device-secret-mint',
         // Network step — skip entirely when the caller reports the device offline so
@@ -156,7 +155,7 @@ async function runSessionColdBoot(opts) {
             const result = await (0, refresh_1.refreshDeviceSecretArm)({ oxy, store, pin });
             switch (result.status) {
                 case 'ok':
-                    // The arm persisted the rotated secret and planted the token.
+                    // The arm persisted nextDeviceSecret and planted the token.
                     return {
                         kind: 'session',
                         session: {

package/dist/cjs/mixins/OxyServices.accounts.js

@@ -126,6 +126,42 @@ function OxyServicesAccountsMixin(Base) {
                 throw this.handleError(error);
             }
         }
+        /**
+         * Mint a `channel` account under `ownerUserId` via service auth
+         * (`accounts:provision` scope). Requires `configureServiceAuth` first.
+         */
+        async provisionChannelAccount(data) {
+            try {
+                return await this.makeServiceRequest('POST', '/accounts/service/channels', data);
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Grant membership on a channel account via service auth
+         * (`accounts:provision` scope).
+         */
+        async provisionChannelMember(channelAccountId, data) {
+            try {
+                return await this.makeServiceRequest('POST', `/accounts/service/channels/${encodeURIComponent(channelAccountId)}/members`, data);
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Revoke membership on a channel account via service auth
+         * (`accounts:provision` scope).
+         */
+        async revokeChannelMember(channelAccountId, memberUserId) {
+            try {
+                return await this.makeServiceRequest('DELETE', `/accounts/service/channels/${encodeURIComponent(channelAccountId)}/members/${encodeURIComponent(memberUserId)}`);
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
         /**
          * Update an account's mutable profile fields. Tree placement changes
          * (reparenting) go through the dedicated move endpoint, not here.

package/dist/cjs/mixins/OxyServices.deviceBoot.js

@@ -65,8 +65,9 @@ function OxyServicesDeviceBootMixin(Base) {
          * Zero-cookie mint. Present the first-party `deviceId` + `deviceSecret` to
          * `POST /session/device/token` — NO bearer, NO cookies: possession of the
          * secret IS the device-ownership proof. Returns a fresh short access token
-         * for the device's active account plus `nextDeviceSecret` (rotation-in-use)
-         * and the projected device-session `state`.
+         * for the device's active account plus `nextDeviceSecret` (on mint, the same
+         * proven secret echoed back — rotation happens on sign-in, not mint) and
+         * the projected device-session `state`.
          *
          * `skipAuth`: this call carries no bearer, so a 401 must surface DIRECTLY —
          * never trigger `HttpService`'s 401→refresh→retry dance. The cold boot / re-

package/dist/cjs/session/refresh.js

@@ -40,19 +40,14 @@ const MIN_SCHEDULE_DELAY_MS = 1000;
 const MIN_FAILURE_BACKOFF_MS = 5000;
 const MAX_FAILURE_BACKOFF_MS = 5 * 60000;
 /**
- * Arm 1 — the rotating device-secret mint, run under the owning client's
- * PROCESS-WIDE single-flight (`httpService.runSingleFlightDeviceSecretMint`).
+ * Arm 1 — the device-secret mint, run under the owning client's PROCESS-WIDE
+ * single-flight (`httpService.runSingleFlightDeviceSecretMint`).
  *
- * The server ROTATES the presented `deviceSecret` on every successful mint and
- * the just-presented secret is valid only for a short grace window. If two lanes
- * (cold boot, the proactive scheduler, a request-time preflight, a 401 retry,
- * the socket token transport, or a tab-focus reconcile) minted concurrently they
- * would double-rotate the server and the durable store could converge on the
- * SUPERSEDED secret — after the grace window the next cold boot mint 401s and the
- * user is signed out. Routing EVERY lane through this one single-flight makes
- * concurrent callers await the SAME in-flight mint and all receive its result, so
- * there is exactly one rotation and the store always converges on the true
- * `current` secret.
+ * Concurrent lanes (cold boot, the proactive scheduler, a request-time preflight,
+ * a 401 retry, the socket token transport, or a tab-focus reconcile) must not
+ * each persist a different view of the mint response. Routing EVERY lane through
+ * this one single-flight makes concurrent callers await the SAME in-flight mint
+ * and all receive its result, so the durable store converges on one credential.
  *
  * On success it persists `nextDeviceSecret` (read-back-verified) BEFORE planting
  * the access token; a failed durable persist yields `persist-failed` WITHOUT
@@ -123,8 +118,8 @@ async function refreshDeviceSecretArm(deps) {
             expiresAt: mint.expiresAt,
             ...(bound ? { sessionId: bound.sessionId, userId: bound.accountId } : {}),
         };
-        // Rotation-in-use anti-loss: persist the NEXT secret and read-back-VERIFY it
-        // landed BEFORE planting the token. A failed durable persist must NOT plant.
+        // Persist nextDeviceSecret (read-back-verified) BEFORE planting the token.
+        // A failed durable persist must NOT plant.
         const persistedOk = await store.save(next);
         if (!persistedOk) {
             return { status: 'persist-failed' };