@oxy.so/core 1.0.0

package/dist/types/crypto/recoveryPhrase.d.ts

@@ -0,0 +1,173 @@
+/**
+ * Recovery Phrase Service - BIP39 Mnemonic Generation
+ *
+ * Handles generation and restoration of recovery phrases (mnemonic seeds)
+ * for backing up and restoring user identities.
+ *
+ * Note: This module requires the polyfill to be loaded first (done via crypto/index.ts)
+ *
+ * Oxy recovery phrases are English-only, so the English wordlist is imported by
+ * its own subpath. Never reach for a package that exposes its wordlists through
+ * a barrel: `bip39`'s `_wordlists` hard-requires all ten languages, which put
+ * ~265 KB of unreachable wordlists into the initial chunk of every consuming
+ * app. Adding another language means one more subpath import, ideally lazy.
+ */
+/**
+ * HKDF context tag for the encrypted-backup key schedule (b3 Feature 1). Used as
+ * the HKDF `salt`; distinct from any other Oxy key-derivation salt so the backup
+ * key schedule is independent. Versioned so a future scheme change is a new tag.
+ */
+export declare const BACKUP_KDF_SALT = "oxy-identity-backup-v1";
+/** HKDF `info` label that derives the symmetric AEAD key from the seed. */
+export declare const BACKUP_KDF_ENCRYPTION_INFO = "oxy-backup-encryption-key";
+/** HKDF `info` label that derives the (server-hashed) backup locator from the seed. */
+export declare const BACKUP_KDF_LOOKUP_INFO = "oxy-backup-lookup-id";
+/** Byte length of both the derived backup key and the derived lookup id (256-bit). */
+export declare const BACKUP_MATERIAL_LENGTH = 32;
+/**
+ * The two pieces of key material derived from a recovery phrase for the
+ * encrypted off-device backup, kept strictly separate by HKDF domain separation.
+ */
+export interface BackupMaterial {
+    /**
+     * The 32-byte symmetric key handed to `encryptAead`/`decryptAead`. NEVER
+     * leaves the device — the server sees only ciphertext produced with it.
+     */
+    backupKey: Uint8Array;
+    /**
+     * The 256-bit backup locator, hex. Sent to the server, which stores ONLY
+     * `sha256(lookupId)` — so possession of this value (which itself requires the
+     * full seed to compute) is what locates a backup, and the server can never
+     * recompute it from what it stores.
+     */
+    lookupId: string;
+}
+export interface RecoveryPhraseResult {
+    phrase: string;
+    words: string[];
+    publicKey: string;
+}
+/**
+ * A freshly-derived identity that has NOT been persisted to secure storage.
+ *
+ * Unlike {@link RecoveryPhraseResult} this also exposes the `privateKey`, because
+ * the caller must be able to sign with (or later persist) the material itself —
+ * the whole point of a "pending" identity is that nothing is committed until an
+ * external step (e.g. a server-confirmed key rotation) succeeds.
+ */
+export interface PendingIdentityResult {
+    phrase: string;
+    words: string[];
+    privateKey: string;
+    publicKey: string;
+}
+export interface GenerateIdentityOptions {
+    /**
+     * Pass `true` to allow overwriting an existing on-device identity.
+     *
+     * Defaults to `false`. When false, this method throws
+     * `IdentityAlreadyExistsError` if a complete identity already exists,
+     * preventing accidental account loss. UI flows MUST only set this to
+     * `true` after explicitly confirming the user has saved their previous
+     * recovery phrase (or has otherwise been warned).
+     */
+    overwrite?: boolean;
+}
+export declare class RecoveryPhraseService {
+    /**
+     * Generate a new identity with a recovery phrase.
+     * The mnemonic phrase MUST be shown to the user exactly once after this
+     * call resolves — if it is lost, the account becomes unrecoverable.
+     *
+     * Refuses to overwrite an existing identity unless `options.overwrite === true`.
+     *
+     * @throws IdentityAlreadyExistsError if an identity already exists and overwrite is not set
+     */
+    static generateIdentityWithRecovery(options?: GenerateIdentityOptions): Promise<RecoveryPhraseResult>;
+    /**
+     * Generate a 24-word recovery phrase for higher security.
+     *
+     * Same overwrite-protection semantics as `generateIdentityWithRecovery`.
+     */
+    static generateIdentityWithRecovery24(options?: GenerateIdentityOptions): Promise<RecoveryPhraseResult>;
+    /**
+     * Derive a brand-new identity + recovery phrase WITHOUT persisting anything.
+     *
+     * Pure: same derivation as {@link generateIdentityWithRecovery} (128-bit
+     * mnemonic → seed → first 32 bytes as the secp256k1 private key) but it stops
+     * BEFORE `KeyManager.importKeyPair`, so no on-device identity is touched. The
+     * caller decides if/when to commit the material (e.g. only after a server
+     * confirms a key rotation). Works on web too — it never reads or writes secure
+     * storage.
+     *
+     * The 12-word `phrase` MUST be shown to the user before the identity is
+     * committed anywhere — if it is lost the account becomes unrecoverable.
+     */
+    static derivePendingIdentity(): Promise<PendingIdentityResult>;
+    /**
+     * Derive the private key from a recovery phrase WITHOUT storing it.
+     *
+     * The private-key counterpart of {@link derivePublicKeyFromPhrase}. Used to
+     * re-derive a key in memory (e.g. to sign a rotation proof with the current
+     * key when the device has no SecureStore copy). Never persists — the returned
+     * material lives only in the caller's memory.
+     */
+    static derivePrivateKeyFromPhrase(phrase: string): Promise<string>;
+    /**
+     * Derive the encrypted-backup key material from a recovery phrase (b3 Feature
+     * 1). PURE and additive — it does NOT touch the frozen phrase→privateKey
+     * derivation ({@link derivePrivateKeyFromPhrase} slices the first 32 seed
+     * bytes) and never reads or writes secure storage.
+     *
+     * Both outputs are derived from the FULL 64-byte BIP-39 seed via HKDF-SHA256
+     * with domain-separated `info` labels, so the domain separation is real: a
+     * device compromise that leaks only the raw 32-byte private key can compute
+     * NEITHER the backup key nor the lookup id (both need the whole seed). Locating
+     * AND decrypting a backup therefore requires the recovery phrase.
+     *
+     * @param phrase - The BIP-39 recovery phrase (validated + normalized here).
+     * @returns `{ backupKey, lookupId }` — the AEAD key (kept local) and the hex
+     *   locator (uploaded; server stores only its hash).
+     * @throws if the phrase is not a valid BIP-39 mnemonic.
+     */
+    static deriveBackupMaterial(phrase: string): Promise<BackupMaterial>;
+    /**
+     * Restore an identity from a recovery phrase.
+     *
+     * Refuses to overwrite a DIFFERENT existing identity unless
+     * `options.overwrite === true`. Re-importing the same phrase that
+     * matches the current identity is always allowed (it's a no-op refresh
+     * of the backup record).
+     */
+    static restoreFromPhrase(phrase: string, options?: GenerateIdentityOptions): Promise<string>;
+    /**
+     * Validate a recovery phrase without importing it
+     */
+    static validatePhrase(phrase: string): boolean;
+    /**
+     * Get the word list for autocomplete/validation
+     */
+    static getWordList(): string[];
+    /**
+     * Check if a word is valid in the BIP39 word list
+     */
+    static isValidWord(word: string): boolean;
+    /**
+     * Get suggestions for a partial word
+     */
+    static getSuggestions(partial: string, limit?: number): string[];
+    /**
+     * Derive the public key from a phrase without storing
+     * Useful for verification before importing
+     */
+    static derivePublicKeyFromPhrase(phrase: string): Promise<string>;
+    /**
+     * Convert a phrase to its word array
+     */
+    static phraseToWords(phrase: string): string[];
+    /**
+     * Convert a word array to a phrase string
+     */
+    static wordsToPhrase(words: string[]): string;
+}
+export default RecoveryPhraseService;

package/dist/types/crypto/signatureService.d.ts

@@ -0,0 +1,136 @@
+/**
+ * Signature Service - ECDSA Digital Signatures (device-key bound)
+ *
+ * Handles signing and verification of messages with the user's DEVICE identity
+ * key (read from {@link KeyManager} / secure storage). All cryptography itself —
+ * canonical signing input, SHA-256, secp256k1 sign/verify, envelope assembly —
+ * is delegated to `@oxy.so/protocol`; this service only resolves the key from
+ * storage and orchestrates the protocol primitives.
+ */
+import type { SignedRecordEnvelope } from '@oxy.so/contracts';
+export interface SignedMessage {
+    message: string;
+    signature: string;
+    publicKey: string;
+    timestamp: number;
+}
+export interface AuthChallenge {
+    challenge: string;
+    publicKey: string;
+    timestamp: number;
+}
+export declare class SignatureService {
+    /**
+     * Generate a random challenge string (for offline use)
+     * Uses expo-crypto in React Native, crypto.randomBytes in Node.js
+     */
+    static generateChallenge(): Promise<string>;
+    /**
+     * Hash a message using SHA-256
+     */
+    static hashMessage(message: string): Promise<string>;
+    /**
+     * Sign a message using the stored device private key
+     * Returns the signature in DER format (hex encoded)
+     */
+    static sign(message: string): Promise<string>;
+    /**
+     * Create a signed message object with metadata
+     */
+    static createSignedMessage(message: string): Promise<SignedMessage>;
+    /**
+     * Verify a signed message object
+     * Checks both signature validity and timestamp freshness
+     */
+    static verifySignedMessage(signedMessage: SignedMessage, maxAgeMs?: number): Promise<boolean>;
+    /**
+     * Create a signed authentication challenge response
+     * Used for challenge-response authentication
+     */
+    static signChallenge(challenge: string): Promise<AuthChallenge>;
+    /**
+     * Create a signed authentication challenge response using the SHARED identity
+     * key (the cross-app `group.so.oxy.shared` keychain key), not the primary
+     * device key.
+     *
+     * Mirrors {@link signChallenge} exactly — same message format
+     * (`auth:${publicKey}:${challenge}:${timestamp}`) so the server verification
+     * path is unchanged — but sources the shared public/private key from
+     * `KeyManager` and signs with the protocol's explicit-key {@link signMessage}.
+     * Used by "Sign in with Oxy" same-device shared-keychain SSO (Mechanism A): a
+     * sibling native app proves control of the shared identity to mint its own
+     * session.
+     *
+     * Throws if no shared identity exists (native-only; the shared keychain is
+     * unavailable on web).
+     */
+    static signChallengeWithSharedKey(challenge: string): Promise<AuthChallenge>;
+    /**
+     * Verify a challenge response
+     */
+    static verifyChallengeResponse(originalChallenge: string, response: AuthChallenge, maxAgeMs?: number): Promise<boolean>;
+    /**
+     * Create a registration signature
+     * Used when registering a new identity with the server
+     * Format matches server expectation: oxy:register:{publicKey}:{timestamp}
+     */
+    static createRegistrationSignature(): Promise<{
+        signature: string;
+        publicKey: string;
+        timestamp: number;
+    }>;
+    /**
+     * Sign arbitrary data for API requests
+     * Creates a canonical string representation and signs it
+     */
+    static signRequestData(data: Record<string, unknown>): Promise<{
+        signature: string;
+        publicKey: string;
+        timestamp: number;
+    }>;
+    /**
+     * Build a signed-record envelope for a self-issued identity/profile record.
+     *
+     * The envelope is self-issued: `issuer` equals `subject` (the signer's DID).
+     * The signature covers the canonical JSON of every field EXCEPT `publicKey`
+     * and `signature`; `alg` is `ES256K-DER-SHA256` (secp256k1 over the SHA-256 of
+     * the canonical bytes, DER-encoded). The cryptography is delegated to the
+     * protocol's {@link signEnvelope}, which derives the (uncompressed-hex)
+     * `publicKey` from the stored device key — identical to the registered
+     * verification method.
+     *
+     * Requires a stored identity (native secure storage); throws if none exists.
+     *
+     * @param type - The record category (`'identity'` or `'profile'`).
+     * @param subject - The subject DID the record is about (also the issuer).
+     * @param record - The arbitrary record payload to attest to.
+     */
+    static signRecord(type: SignedRecordEnvelope['type'], subject: string, record: Record<string, unknown>): Promise<SignedRecordEnvelope>;
+    /**
+     * Build a signed-record envelope (v2) carrying the per-subject hash-chain
+     * fields.
+     *
+     * Identical to {@link signRecord} (self-issued: `issuer === subject`; same
+     * `ES256K-DER-SHA256` scheme) but `version` is `2` and the signed bytes
+     * additionally cover the chain fields:
+     *
+     * @param type - The record category.
+     * @param subject - The subject DID the record is about (also the issuer).
+     * @param record - The arbitrary record payload to attest to.
+     * @param chain - The hash-chain coordinates:
+     *   - `seq` — strictly-increasing sequence number for this subject's chain.
+     *   - `prev` — the `recordId` of the previous record, or `null` at genesis.
+     *   - `collection` + `rkey` — the AtProto-style record key.
+     *
+     * The caller is responsible for fetching the current chain head (so `seq` /
+     * `prev` are correct) before signing. Requires a stored identity; throws if
+     * none exists.
+     */
+    static signRecordV2(type: SignedRecordEnvelope['type'], subject: string, record: Record<string, unknown>, chain: {
+        seq: number;
+        prev: string | null;
+        collection: string;
+        rkey: string;
+    }): Promise<SignedRecordEnvelope>;
+}
+export default SignatureService;

package/dist/types/i18n/accountCategoryLabels.d.ts

@@ -0,0 +1,34 @@
+import type { AccountCategoryId } from '@oxy.so/contracts';
+/**
+ * Every account category's English name, keyed by its stable id.
+ *
+ * **The annotation is the point.** The vocabulary lives in `@oxy.so/contracts`
+ * and the names live in `locales/en-US.json`, so they are two lists that must
+ * agree and nothing but a type can make them. Declaring the JSON node as a
+ * TOTAL `Record<AccountCategoryId, string>` turns "somebody added a category at
+ * Oxy and nobody wrote its English" into a `TS2741` naming the missing id, at
+ * build time, instead of a picker row that paints `accounts.accountCategory.<id>`
+ * at a user trying to choose one.
+ *
+ * That failure is not hypothetical. The screen previously wrote `t(key) || id`,
+ * whose author believed an unnamed id would degrade to its raw slug. It cannot:
+ * {@link translate} echoes the KEY when it resolves nothing, and a non-empty
+ * string is never falsy, so the `|| id` arm was unreachable and the output was
+ * the dotted key. A runtime fallback that cannot run is worse than none,
+ * because it reads as protection.
+ *
+ * Totality is over `ACCOUNT_CATEGORY_IDS`, which RETAINS withdrawn ids, so an
+ * account still carrying a retired category keeps rendering its name while no
+ * picker offers it again. Retired and unknown are different cases: only an id
+ * outside the union is unnameable, which is why this is keyed by
+ * `AccountCategoryId` and not by `string`.
+ */
+/**
+ * Module-scoped, NOT re-exported from the package index: the annotation is the
+ * whole job, and it does that job without being public API. It carries no
+ * `Object.freeze` and no `Readonly<>` for the same reason — those existed only
+ * to make an exported reference safe from a consumer's stray write, and there
+ * is no such consumer. Exported from the MODULE so its own test can name it.
+ */
+export declare const EN_ACCOUNT_CATEGORY_LABELS: Record<AccountCategoryId, string>;
+export declare function accountCategoryLabel(locale: string | undefined, id: AccountCategoryId): string;

package/dist/types/i18n/accountRoleLabels.d.ts

@@ -0,0 +1,10 @@
+import type { AccountRole } from '../mixins/OxyServices.accounts';
+/**
+ * Every account member role's English name, keyed by its stable id.
+ *
+ * Totality is over the closed `AccountRole` union so a new role without an
+ * English label is a build error, not a members row that paints
+ * `accounts.roles.<role>.label`.
+ */
+export declare const EN_ACCOUNT_ROLE_LABELS: Record<AccountRole, string>;
+export declare function accountRoleLabel(locale: string | undefined, role: AccountRole): string;

package/dist/types/i18n/index.d.ts

@@ -0,0 +1,3 @@
+export type LocaleDict = Record<string, any>;
+export declare function translate(locale: string | undefined, key: string, vars?: Record<string, string | number>): string;
+export declare function hasKey(locale: string | undefined, key: string): boolean;

package/dist/types/i18n/reputationCategoryLabels.d.ts

@@ -0,0 +1,10 @@
+import type { ReputationCategory } from '@oxy.so/contracts';
+/**
+ * Every reputation rule category's English name, keyed by its stable id.
+ *
+ * Totality is over `REPUTATION_CATEGORIES` from `@oxy.so/contracts` so a new
+ * category added server-side without an English label is a build error, not a
+ * Trust Rules section title that paints `trust.rules.categories.<id>`.
+ */
+export declare const EN_REPUTATION_CATEGORY_LABELS: Record<ReputationCategory, string>;
+export declare function reputationCategoryLabel(locale: string | undefined, id: ReputationCategory): string;

package/dist/types/i18n/trustTierLabels.d.ts

@@ -0,0 +1,9 @@
+import type { TrustTier } from '@oxy.so/contracts';
+/**
+ * Every trust tier's English name, keyed by its stable id.
+ *
+ * Totality is over `TRUST_TIERS` from `@oxy.so/contracts` so a new tier without
+ * an English label is a build error, not a chip that paints `trust.tiers.<id>`.
+ */
+export declare const EN_TRUST_TIER_LABELS: Record<TrustTier, string>;
+export declare function trustTierLabel(locale: string | undefined, tier: TrustTier): string;

package/dist/types/index.d.ts

@@ -0,0 +1,145 @@
+/**
+ * @oxy.so/core — OxyHQ SDK Foundation
+ *
+ * Platform-agnostic core providing API client, authentication,
+ * cryptographic identity, and shared utilities.
+ *
+ * Works in Node.js, Browser, and React Native.
+ *
+ * @example
+ * ```ts
+ * import { OxyServices, oxyClient } from '@oxy.so/core';
+ *
+ * const user = await oxyClient.getCurrentUser();
+ * ```
+ *
+ * Every export below is NOMINAL — no `export *`, no barrels, no compat shims.
+ * If a symbol does not appear here, it is NOT part of the public API.
+ */
+import './crypto/polyfill';
+export { OxyServices, AssetUrlResolutionError, OxyAuthenticationError, OxyAuthenticationTimeoutError, ServiceAssetMetadataError } from './OxyServices';
+export { OXY_CLOUD_URL, oxyClient } from './OxyServices';
+export type { LinkedHttpClient } from './OxyServices.base';
+export type { AuthenticatedResponseRequest, AuthRefreshReason, AuthRefreshHandler, } from './HttpService';
+export { ServiceCredentialMismatchError, } from './mixins/OxyServices.auth';
+export { getCommonsApprovalBlockingReason, parseCommonsApprovalExpiresAt, } from './utils/commonsApproval';
+export { selectCommonsDelivery, pushTargetsFromDelivery, commonsDeliveryPlatform } from './utils/commonsDelivery';
+export type { CommonsDeliveryFacts, CommonsDeliveryPlatform, CommonsDeliveryRoute, } from './utils/commonsDelivery';
+export type { ServiceTokenResponse, OAuthUserInfoResponse, OAuthTokenExchangeResult, } from './mixins/OxyServices.auth';
+export type { CommonsSignInHandle, CommonsSignInStatus, CommonsSignInPurpose, CommonsOAuthContext, CommonsApprovalInfo, CommonsApprovalSubjectAccount, CommonsSignInActionResult, CommonsOAuthFinalizeResult, CommonsDeliveryResult, } from './mixins/OxyServices.auth';
+export type { PushTokenPlatform, RegisterPushTokenInput, } from './mixins/OxyServices.notifications';
+export type { ServiceApp, ServiceActingAsVerification } from './mixins/OxyServices.utility';
+export type { ContactDiscoveryMatch, ContactDiscoveryResponse, } from './mixins/OxyServices.contacts';
+export type { InitDeviceTransferResult, DeviceTransferOutcome, } from './mixins/OxyServices.deviceTransfer';
+export type { BulkFollowEntry, BulkFollowResult, BulkUnfollowEntry, BulkUnfollowResult, FollowMutationResult, ViewerGraph, } from './mixins/OxyServices.user';
+export { OxyAppDataIdentifierError } from './mixins/OxyServices.appData';
+export { getNormalizedUserId, normalizeUserIdentity, normalizeUserIdentityOrNull, } from './utils/userIdentity';
+export { getCanonicalUserHandle, getNormalizedUserHandle, } from './utils/userHandle';
+export type { CanonicalUserHandleInput, UserHandleInput } from './utils/userHandle';
+export { normalizeProfileLinks } from './utils/profileLinks';
+export type { ProfileLink, ProfileLinkMetadata } from './utils/profileLinks';
+export type { PublicApplication, ConnectedApp, } from './mixins/OxyServices.connectedApps';
+export type { StoreCategory, StoreRating, StoreListingSummary, StoreListingDetail, StoreScreenshot, StoreScreenshotPlatform, StoreReview, StoreOwnReview, WriteStoreReviewInput, StoreListingStatus, PublisherListing, WriteListingInput, AddScreenshotInput, UpdateScreenshotInput, StorePage, StorePageOptions, StoreReviewsOptions, } from './mixins/OxyServices.store';
+export type { AccountKind, AccountCategoryId, AccountRelationship, AccountRole, AccountMemberStatus, AccountMemberSource, AccountMember, AccountNode, ListAccountsOptions, CreateAccountInput, UpdateAccountInput, ProvisionChannelInput, ProvisionChannelMemberInput, ProvisionChannelResult, InviteAccountMemberInput, UpdateAccountMemberInput, TransferAccountOwnershipInput, AccountSuccessResult, SwitchAccountResult, Application, ApplicationType, ApplicationStatus, ApplicationCredential, ApplicationCredentialType, ApplicationCredentialStatus, ApplicationEnvironment, CreateApplicationInput, UpdateApplicationInput, CreateApplicationCredentialInput, RotateApplicationCredentialInput, ApplicationCredentialWithSecret, RotateApplicationCredentialResult, ApplicationUsagePeriod, ApplicationUsageSummary, ApplicationUsageByDay, ApplicationUsageByEndpoint, ApplicationUsageStats, } from './mixins/OxyServices.accounts';
+export { ACCOUNT_CATEGORY_IDS, MAX_ACCOUNT_CATEGORIES, SELECTABLE_ACCOUNT_CATEGORY_IDS, isSelectableAccountCategoryId, kindAcceptsAccountCategories, } from './mixins/OxyServices.accounts';
+export { buildUserDid } from './mixins/OxyServices.identity';
+export type { IdentityRecordType, UnlinkableAuthMethodType, LinkAuthMethodResult, PublishRecordResult, VerifyRecordResult, VerifyDomainResult, RemoveDomainResult, RotateKeyProof, RotateKeyOptions, RotateKeyResult, } from './mixins/OxyServices.identity';
+export { parseIdPayload, parseAttestPayload, verifyPublicCardAttestation, } from './mixins/OxyServices.civic';
+export type { CivicCardResult, IdCardRef, AttestQrPayload, ParsedAttestPayload, SubmitRealLifeAttestationInput, DenyValidationResult, VouchForPersonInput, WithdrawVouchResult, IssueCredentialInput, RevokeCredentialResult, } from './mixins/OxyServices.civic';
+export type { UserNodeStatus, UserNodeMode, UserNodeController, UserNodeLivenessStatus, RegisterNodeInput, RemoveNodeResult } from './mixins/OxyServices.nodes';
+/**
+ * Chains — the shared per-person record log. `ChainRecord` is generic over the
+ * app's own lexicon payload, so a consumer types its records without Oxy
+ * knowing any app's schema.
+ */
+export type { ChainRecord, ChainRecordPage, AppendedChainRecord } from './mixins/OxyServices.chains';
+export { SessionSyncRequiredError, AuthenticationFailedError, ensureValidToken, isAuthenticationError, withAuthErrorHandling, authenticatedApiCall, } from './utils/authHelpers';
+export type { HandleApiErrorOptions } from './utils/authHelpers';
+export { mergeSessions, normalizeAndSortSessions, sessionsArraysEqual, } from './utils/sessionUtils';
+export type { ClientSession, StorageKeys, MinimalUserData, SessionLoginResponse, } from './models/session';
+export { KeyManager, IdentityAlreadyExistsError, IdentityPersistError, IdentityUnavailableError, } from './crypto/keyManager';
+export type { KeyPair, IdentityStatus, IdentityRecoveryResult } from './crypto/keyManager';
+export { readIdentityMarker, updateIdentityMarker, } from './crypto/identityMarker';
+export type { IdentityMarker } from './crypto/identityMarker';
+export { SignatureService } from './crypto/signatureService';
+export type { SignedMessage, AuthChallenge } from './crypto/signatureService';
+export { RecoveryPhraseService } from './crypto/recoveryPhrase';
+export type { RecoveryPhraseResult, PendingIdentityResult, BackupMaterial } from './crypto/recoveryPhrase';
+export { hkdfSha256 } from './crypto/kdf';
+export { encryptAead, decryptAead, AEAD_KEY_LENGTH, AEAD_NONCE_LENGTH, } from './crypto/aead';
+export type { AeadResult } from './crypto/aead';
+export { deriveSharedSecret } from './crypto/ecdh';
+export { DeviceManager } from './utils/deviceManager';
+export type { DeviceFingerprint, StoredDeviceInfo } from './utils/deviceManager';
+export type { OxyConfig, PrivacySettings, NotificationPreferences, UserPreferences, User, LoginResponse, Notification, Wallet, Transaction, BlockedUser, RestrictedUser, TransferFundsRequest, PurchaseRequest, WithdrawalRequest, TransactionResponse, PaginationInfo, SearchProfilesResponse, ApiError, PaymentMethod, PaymentRequest, PaymentResponse, AnalyticsData, FollowerDetails, ContentViewer, FileMetadata, FileUploadResponse, FileListResponse, FileUpdateRequest, FileDeleteResponse, RNFileDescriptor, AssetUploadInput, FileVisibility, AssetLink, AssetMetadata, AssetVariant, Asset, AssetInitRequest, AssetInitResponse, AssetCompleteRequest, AssetLinkRequest, AssetUnlinkRequest, AssetUrlResponse, BatchFileAccessEntry, BatchFileAccessResponse, AssetDeleteSummary, AssetUpdateVisibilityRequest, AssetUpdateVisibilityResponse, ServiceAssetMetadata, ServiceAssetMetadataBySha, AccountStorageCategoryUsage, AccountStorageUsageResponse, SecurityEventType, SecurityEventSeverity, SecurityActivity, SecurityActivityResponse, AssetUploadProgress, DeviceLinkedSession, DeviceLinkedSessionsResponse, DeviceLinkedSessionLogoutResponse, UpdateDeviceNameResponse, } from './models/interfaces';
+export { SECURITY_EVENT_SEVERITY_MAP } from './models/interfaces';
+export { TopicType, TopicSource } from './models/Topic';
+export type { TopicData, TopicTranslation, TopicListResult } from './models/Topic';
+export { SUPPORTED_LANGUAGES, FALLBACK_LOCALE, getBaseLanguage, normalizeLocale, isSupportedLocale, getLanguageMetadata, getLanguageName, getNativeLanguageName, isRTLLocale, getUserLanguages, getPrimaryLanguage, } from './utils/languageUtils';
+export type { SupportedLanguage } from './utils/languageUtils';
+export { getPlatformOS, setPlatformOS, isWeb, isNative, isIOS, isAndroid, isWebBrowser, } from './utils/platform';
+export type { PlatformOS } from './utils/platform';
+export { darkenColor, lightenColor, hexToRgb, rgbToHex, withOpacity, isLightColor, getContrastTextColor, } from './shared/utils/colorUtils';
+export { normalizeTheme, normalizeColorScheme, getOppositeTheme, systemPrefersDarkMode, getSystemColorScheme, } from './shared/utils/themeUtils';
+export type { ThemeValue } from './shared/utils/themeUtils';
+export { HttpStatus, getErrorStatus, getErrorMessage, isAlreadyRegisteredError, isUnauthorizedError, isForbiddenError, isNotFoundError, isRateLimitError, isServerError, isNetworkError, isRetryableError, } from './shared/utils/errorUtils';
+export { DEFAULT_CIRCUIT_BREAKER_CONFIG, createCircuitBreakerState, calculateBackoffInterval, recordFailure, recordSuccess, shouldAllowRequest, delay, withRetry, } from './shared/utils/networkUtils';
+export type { CircuitBreakerState, CircuitBreakerConfig } from './shared/utils/networkUtils';
+export { translate } from './i18n';
+export { accountCategoryLabel } from './i18n/accountCategoryLabels';
+export { accountRoleLabel } from './i18n/accountRoleLabels';
+export { reputationCategoryLabel } from './i18n/reputationCategoryLabels';
+export { trustTierLabel } from './i18n/trustTierLabels';
+export { buildQueryParams, buildSearchParams, buildUrl, buildPaginationParams, safeJsonParse, } from './utils/apiUtils';
+export type { PaginationParams, FollowGraphParams, FollowGraphSort, ApiResponse, ErrorResponse, } from './utils/apiUtils';
+export { ErrorCodes, createApiError, handleHttpError, isHttpRequestError, parseHttpErrorBody, validateRequiredFields, } from './utils/errorUtils';
+export type { HttpRequestError, ParsedHttpErrorBody } from './utils/errorUtils';
+export { retryAsync } from './utils/asyncUtils';
+export { EMAIL_REGEX, PASSWORD_REGEX, MAX_DISPLAY_NAME_LENGTH, DISPLAY_NAME_INVALID_MESSAGE, isValidEmail, isValidPassword, isValidDisplayName, DISPLAY_NAME_ALLOWED_SCRIPTS, DISPLAY_NAME_DISALLOWED_SOURCE, DISPLAY_NAME_ORPHANED_MARK_SOURCE, DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE, isRequiredString, isRequiredNumber, isRequiredBoolean, isValidArray, isValidObject, isValidUUID, isValidURL, isValidDate, isValidFileSize, isValidFileType, sanitizeString, sanitizeHTML, isValidObjectId, validateAndSanitizeUserInput, } from './utils/validationUtils';
+export { normalizeInlineText, normalizeMultilineText, } from './utils/textNormalization';
+export { logger, createLogger, configureLogger, getLoggerConfig, resetLoggerConfig, consoleSink, isDev, } from './logger';
+export type { Logger, LogLevel, EmittableLogLevel, LogContext, LogEntry, LogSink, LoggerConfig, } from './logger';
+export { updateAvatarVisibility } from './utils/avatarUtils';
+export { buildAccountsArray, createQuickAccount, getAccountDisplayName, getAccountFallbackHandle, formatPublicKeyHandle, getAccountColor, } from './utils/accountUtils';
+export type { QuickAccount, DisplayNameUserShape } from './utils/accountUtils';
+export { registrableApex } from './utils/registrableApex';
+export { CENTRAL_IDP_APEX } from './utils/authWebUrl';
+export { isOxyRpOrigin } from './utils/webauthnOrigin';
+export { runColdBoot } from './utils/coldBoot';
+export type { ColdBootStep, ColdBootStepResult, ColdBootSession, ColdBootSkip, ColdBootOutcome, RunColdBootOptions, } from './utils/coldBoot';
+export { buildOAuthAuthorizeUrl, computeCodeChallenge, generateOAuthState, generatePkcePair, DEFAULT_OAUTH_SCOPE, OXY_AUTHORIZE_URL, OXY_OAUTH_STATE_STORAGE_KEY, OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY, OXY_OAUTH_REDIRECT_URI_STORAGE_KEY, OXY_OAUTH_RETURN_PATH_STORAGE_KEY, normalizeOAuthRedirectUri, canonicalizeOAuthRedirectUri, persistOAuthHandshake, readOAuthHandshake, clearOAuthHandshake, persistOAuthReturnPath, consumeOAuthReturnPath, } from './utils/oauthPkce';
+export type { PkcePair, BuildOAuthAuthorizeUrlParams } from './utils/oauthPkce';
+export { isLoopbackOrigin, isOfficialWebOrigin, isAllowedDeviceJoinOrigin, } from './utils/officialOrigins';
+export { SessionClient } from './session/SessionClient';
+export type { TokenTransport, SessionClientHost, SessionClientOptions, DeviceCredential, SessionStateOrigin } from './session/SessionClient';
+export type { SocketIOFactory, MinimalSocket } from './session/socketLoader';
+export { createSessionClientHost } from './session/sessionClientHost';
+export { createSessionClient } from './session/createSessionClient';
+export { deviceStateToClientSessions, activeSessionIdOf, activeUserOf, accountIdsOf, } from './session/projectSessionState';
+export { canActivateContext, directoryDisplayName, directoryHandle, projectDevicePrincipals, resolveActiveContext, resolveDeviceContext, } from './session/deviceDirectory';
+export type { DeviceContext, DeviceContextActor, DeviceContextSubject, DevicePrincipalGroup, } from './session/deviceDirectory';
+export { buildSwitcherRows, showsPrincipalHeaders } from './session/deviceSwitcherRows';
+export type { ResolveAvatarUrl, SwitcherContextRow, SwitcherPrincipalRow, } from './session/deviceSwitcherRows';
+export { isSwitchTargetAccount, canSwitchIntoAccount, } from './session/accountSwitchTargets';
+export { resolveAccountDelegationAccess } from './session/accountDelegationAccess';
+export type { AccountDelegationAccess, AccountDelegationNode, } from './session/accountDelegationAccess';
+export { AccountDialogController, createAccountDialogController, } from './session/accountDialogController';
+export type { AccountDialogControllerOptions, AccountDialogSnapshot, AccountDialogView, CommonsAvailability, PopupWindowHandle, SignInFlowPhase, SignInFlowState, SignInProgress, } from './session/accountDialogController';
+export { createWebAuthStateStore, createNativeAuthStateStore, createMemoryAuthStateStore, AUTH_STATE_STORAGE_KEY, } from './session/authStateStore';
+export type { PersistedAuthState, AuthStateStore, NativeKeyValueStorage, } from './session/authStateStore';
+export { createSharedMirroringAuthStateStore, decideSharedDeviceJoin, decideSharedDevicePublish, normalizeSharedDeviceSessionRead, publishProvenDeviceCredential, readLocalDeviceCredential, } from './session/sharedDeviceCredential';
+export type { SharedDeviceCredential, SharedDeviceCredentialRead, SharedDeviceCredentialStore, SharedDeviceJoinDecision, SharedDeviceJoinSkipReason, SharedDevicePublishDecision, SharedDevicePublishOutcome, SharedDevicePublishSkipReason, } from './session/sharedDeviceCredential';
+export { createWebIdentityPinStore, createNativeIdentityPinStore, createMemoryIdentityPinStore, identityPinMatches, IDENTITY_PIN_STORAGE_KEY, } from './session/identityPin';
+export type { IdentityPin, IdentityPinStore } from './session/identityPin';
+export { resolveIdentityPin, establishIdentitySession, } from './session/identitySession';
+export type { IdentityBinding, IdentityRequestOptions, EstablishedIdentitySession, } from './session/identitySession';
+export { AccountNotOnDeviceError } from './mixins/OxyServices.deviceBoot';
+export { refreshPersistedSession, refreshDeviceSecretArm, createAuthRefreshHandler, installAuthRefreshHandler, startTokenRefreshScheduler, TOKEN_REFRESH_LEAD_MS, } from './session/refresh';
+export type { RefreshDeps, TokenRefreshSchedulerHandle, DeviceSecretMintOutcome } from './session/refresh';
+export { OxyInferenceClient, OxyInferenceError, OxyInferenceProtocolError, OXY_INFERENCE_BASE_URL, } from './inference/OxyInferenceClient';
+export type { OxyInferenceClientOptions, OxyInferenceCredential, OxyInferenceFetch, OxyInferenceRequestOptions, OxyInferenceResponse, OxyGenerationReceipt, OxyResponsesRequest, } from './inference/OxyInferenceClient';
+export { runSessionColdBoot } from './boot/sessionColdBoot';
+export type { RunSessionColdBootOptions, SessionMode, SignedOutReason, DeviceBootSession, } from './boot/sessionColdBoot';
+export { packageInfo } from './constants/version';
+import { OxyServices } from './OxyServices';
+export default OxyServices;