Module identity 

Structs

AccountKeyVerifyResult

What account.key.verify answers: { valid: false, error } when validation failed, otherwise every field but error (the same keys the handler sent).

AccountOAuthStartResult

What account.oauth.start answers: { sessionId, status }, or { error }.

DeleteIdentityAccountResult

What deleteidentityaccount answers.

OAuthSessionReq

OAuthStartReq 🔒

Request for account.oauth.start. clientId/clientSecret are BYO OAuth app credentials (optional; required for secret-mandatory providers).

VerifyKeyReq 🔒

Request for account.key.verify (account key flow). The api_key field is a secret — never log this struct.

Functions

merge_json_object 🔒

Shallow-merge the keys of overlay (if both are JSON objects) into base.

oauth_status_wire 🔒

Serialize an OAuthStatus to the frontend wire shape.

register

reject_ambient_home_dir_binding 🔒

Refuses to persist an OAuth account bound directly to its provider’s ambient home dir (e.g. ~/.claude) — nothing downstream validates secret_ref.dir, and a real, currently-live account configured exactly this way was found in this repo’s own data (docs/status/STATUS_IDENTITY_ISOLATION_GATE_NOT_ENFORCING_2026_08_20.md §8). Split out of the upsertidentityaccount handler closure so it’s directly unit-testable without spinning up the RPC engine. See docs/specs/SPEC_BLOCK_AMBIENT_HOME_DIR_IDENTITY_BINDING_2026_08_25.md.