@oxy.so/core 1.0.0

package/dist/cjs/index.js

@@ -0,0 +1,498 @@
+"use strict";
+/**
+ * @oxy.so/core — OxyHQ SDK Foundation
+ *
+ * Platform-agnostic core providing API client, authentication,
+ * cryptographic identity, and shared utilities.
+ *
+ * Works in Node.js, Browser, and React Native.
+ *
+ * @example
+ * ```ts
+ * import { OxyServices, oxyClient } from '@oxy.so/core';
+ *
+ * const user = await oxyClient.getCurrentUser();
+ * ```
+ *
+ * Every export below is NOMINAL — no `export *`, no barrels, no compat shims.
+ * If a symbol does not appear here, it is NOT part of the public API.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AEAD_KEY_LENGTH = exports.decryptAead = exports.encryptAead = exports.hkdfSha256 = exports.RecoveryPhraseService = exports.SignatureService = exports.updateIdentityMarker = exports.readIdentityMarker = exports.IdentityUnavailableError = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.verifyPublicCardAttestation = exports.parseAttestPayload = exports.parseIdPayload = exports.buildUserDid = exports.kindAcceptsAccountCategories = exports.isSelectableAccountCategoryId = exports.SELECTABLE_ACCOUNT_CATEGORY_IDS = exports.MAX_ACCOUNT_CATEGORIES = exports.ACCOUNT_CATEGORY_IDS = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.commonsDeliveryPlatform = exports.pushTargetsFromDelivery = exports.selectCommonsDelivery = exports.parseCommonsApprovalExpiresAt = exports.getCommonsApprovalBlockingReason = exports.ServiceCredentialMismatchError = exports.oxyClient = exports.OXY_CLOUD_URL = exports.ServiceAssetMetadataError = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.AssetUrlResolutionError = exports.OxyServices = void 0;
+exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.getPrimaryLanguage = exports.getUserLanguages = exports.isRTLLocale = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.isSupportedLocale = exports.normalizeLocale = exports.getBaseLanguage = exports.FALLBACK_LOCALE = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.deriveSharedSecret = exports.AEAD_NONCE_LENGTH = void 0;
+exports.logger = exports.normalizeMultilineText = exports.normalizeInlineText = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE = exports.DISPLAY_NAME_ORPHANED_MARK_SOURCE = exports.DISPLAY_NAME_DISALLOWED_SOURCE = exports.DISPLAY_NAME_ALLOWED_SCRIPTS = exports.isValidDisplayName = exports.isValidPassword = exports.isValidEmail = exports.DISPLAY_NAME_INVALID_MESSAGE = exports.MAX_DISPLAY_NAME_LENGTH = exports.PASSWORD_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.parseHttpErrorBody = exports.isHttpRequestError = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.buildQueryParams = exports.trustTierLabel = exports.reputationCategoryLabel = exports.accountRoleLabel = exports.accountCategoryLabel = exports.translate = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = void 0;
+exports.resolveDeviceContext = exports.resolveActiveContext = exports.projectDevicePrincipals = exports.directoryHandle = exports.directoryDisplayName = exports.canActivateContext = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isLoopbackOrigin = exports.consumeOAuthReturnPath = exports.persistOAuthReturnPath = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.canonicalizeOAuthRedirectUri = exports.normalizeOAuthRedirectUri = exports.OXY_OAUTH_RETURN_PATH_STORAGE_KEY = exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.runColdBoot = exports.isOxyRpOrigin = exports.CENTRAL_IDP_APEX = exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.isDev = exports.consoleSink = exports.resetLoggerConfig = exports.getLoggerConfig = exports.configureLogger = exports.createLogger = void 0;
+exports.packageInfo = exports.runSessionColdBoot = exports.OXY_INFERENCE_BASE_URL = exports.OxyInferenceProtocolError = exports.OxyInferenceError = exports.OxyInferenceClient = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.AccountNotOnDeviceError = exports.establishIdentitySession = exports.resolveIdentityPin = exports.IDENTITY_PIN_STORAGE_KEY = exports.identityPinMatches = exports.createMemoryIdentityPinStore = exports.createNativeIdentityPinStore = exports.createWebIdentityPinStore = exports.readLocalDeviceCredential = exports.publishProvenDeviceCredential = exports.normalizeSharedDeviceSessionRead = exports.decideSharedDevicePublish = exports.decideSharedDeviceJoin = exports.createSharedMirroringAuthStateStore = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.resolveAccountDelegationAccess = exports.canSwitchIntoAccount = exports.isSwitchTargetAccount = exports.showsPrincipalHeaders = exports.buildSwitcherRows = void 0;
+// Ensure crypto polyfills are loaded before anything else
+require("./crypto/polyfill");
+// ---------------------------------------------------------------------------
+// API client
+// ---------------------------------------------------------------------------
+var OxyServices_1 = require("./OxyServices");
+Object.defineProperty(exports, "OxyServices", { enumerable: true, get: function () { return OxyServices_1.OxyServices; } });
+Object.defineProperty(exports, "AssetUrlResolutionError", { enumerable: true, get: function () { return OxyServices_1.AssetUrlResolutionError; } });
+Object.defineProperty(exports, "OxyAuthenticationError", { enumerable: true, get: function () { return OxyServices_1.OxyAuthenticationError; } });
+Object.defineProperty(exports, "OxyAuthenticationTimeoutError", { enumerable: true, get: function () { return OxyServices_1.OxyAuthenticationTimeoutError; } });
+Object.defineProperty(exports, "ServiceAssetMetadataError", { enumerable: true, get: function () { return OxyServices_1.ServiceAssetMetadataError; } });
+var OxyServices_2 = require("./OxyServices");
+Object.defineProperty(exports, "OXY_CLOUD_URL", { enumerable: true, get: function () { return OxyServices_2.OXY_CLOUD_URL; } });
+Object.defineProperty(exports, "oxyClient", { enumerable: true, get: function () { return OxyServices_2.oxyClient; } });
+// ---------------------------------------------------------------------------
+// Authentication
+// ---------------------------------------------------------------------------
+var OxyServices_auth_1 = require("./mixins/OxyServices.auth");
+Object.defineProperty(exports, "ServiceCredentialMismatchError", { enumerable: true, get: function () { return OxyServices_auth_1.ServiceCredentialMismatchError; } });
+var commonsApproval_1 = require("./utils/commonsApproval");
+Object.defineProperty(exports, "getCommonsApprovalBlockingReason", { enumerable: true, get: function () { return commonsApproval_1.getCommonsApprovalBlockingReason; } });
+Object.defineProperty(exports, "parseCommonsApprovalExpiresAt", { enumerable: true, get: function () { return commonsApproval_1.parseCommonsApprovalExpiresAt; } });
+// Automatic "Sign in with Oxy" delivery selection — ONE pure decision that maps
+// the caller's facts onto exactly one primary route (open Commons / await push / QR).
+var commonsDelivery_1 = require("./utils/commonsDelivery");
+Object.defineProperty(exports, "selectCommonsDelivery", { enumerable: true, get: function () { return commonsDelivery_1.selectCommonsDelivery; } });
+Object.defineProperty(exports, "pushTargetsFromDelivery", { enumerable: true, get: function () { return commonsDelivery_1.pushTargetsFromDelivery; } });
+Object.defineProperty(exports, "commonsDeliveryPlatform", { enumerable: true, get: function () { return commonsDelivery_1.commonsDeliveryPlatform; } });
+var OxyServices_appData_1 = require("./mixins/OxyServices.appData");
+Object.defineProperty(exports, "OxyAppDataIdentifierError", { enumerable: true, get: function () { return OxyServices_appData_1.OxyAppDataIdentifierError; } });
+// ---------------------------------------------------------------------------
+// User identity and handles
+// ---------------------------------------------------------------------------
+var userIdentity_1 = require("./utils/userIdentity");
+Object.defineProperty(exports, "getNormalizedUserId", { enumerable: true, get: function () { return userIdentity_1.getNormalizedUserId; } });
+Object.defineProperty(exports, "normalizeUserIdentity", { enumerable: true, get: function () { return userIdentity_1.normalizeUserIdentity; } });
+Object.defineProperty(exports, "normalizeUserIdentityOrNull", { enumerable: true, get: function () { return userIdentity_1.normalizeUserIdentityOrNull; } });
+var userHandle_1 = require("./utils/userHandle");
+Object.defineProperty(exports, "getCanonicalUserHandle", { enumerable: true, get: function () { return userHandle_1.getCanonicalUserHandle; } });
+Object.defineProperty(exports, "getNormalizedUserHandle", { enumerable: true, get: function () { return userHandle_1.getNormalizedUserHandle; } });
+var profileLinks_1 = require("./utils/profileLinks");
+Object.defineProperty(exports, "normalizeProfileLinks", { enumerable: true, get: function () { return profileLinks_1.normalizeProfileLinks; } });
+var OxyServices_accounts_1 = require("./mixins/OxyServices.accounts");
+Object.defineProperty(exports, "ACCOUNT_CATEGORY_IDS", { enumerable: true, get: function () { return OxyServices_accounts_1.ACCOUNT_CATEGORY_IDS; } });
+Object.defineProperty(exports, "MAX_ACCOUNT_CATEGORIES", { enumerable: true, get: function () { return OxyServices_accounts_1.MAX_ACCOUNT_CATEGORIES; } });
+Object.defineProperty(exports, "SELECTABLE_ACCOUNT_CATEGORY_IDS", { enumerable: true, get: function () { return OxyServices_accounts_1.SELECTABLE_ACCOUNT_CATEGORY_IDS; } });
+Object.defineProperty(exports, "isSelectableAccountCategoryId", { enumerable: true, get: function () { return OxyServices_accounts_1.isSelectableAccountCategoryId; } });
+Object.defineProperty(exports, "kindAcceptsAccountCategories", { enumerable: true, get: function () { return OxyServices_accounts_1.kindAcceptsAccountCategories; } });
+// ---------------------------------------------------------------------------
+// Reputation (Oxy Trust: ledger, balances, disputes, rules, influence).
+// The whole type family — the closed value sets, the two balance views and the
+// `isFullReputationBalance` narrowing guard, the ledger/dispute/rule/leaderboard
+// shapes, and the write-endpoint inputs — is owned by `@oxy.so/contracts`, which
+// the API's serializers are validated against. Import them from there.
+// ---------------------------------------------------------------------------
+// ---------------------------------------------------------------------------
+// Self-sovereign identity (DID, signed records, auth-method ↔ VM mapping,
+// verified domains). Wire shapes (DidDocument, SignedRecordEnvelope,
+// AuthMethodsResponse, VerifiedDomain, DomainVerificationInstructions,
+// ExportBundle) live in `@oxy.so/contracts` — import them directly from there.
+// ---------------------------------------------------------------------------
+var OxyServices_identity_1 = require("./mixins/OxyServices.identity");
+Object.defineProperty(exports, "buildUserDid", { enumerable: true, get: function () { return OxyServices_identity_1.buildUserDid; } });
+// ---------------------------------------------------------------------------
+// Civic / Commons "Oxy ID" (public signed cards + Oxy ID QR payload) and Fase 2
+// anti-gaming (real-life attestation QR + validator/jury). Wire shapes
+// (PublicCard, SignedPublicCard, RealLifeAttestationResult,
+// ValidationRequestSummary, ValidationVoteResult, ValidationVerdict, …) live in
+// `@oxy.so/contracts` — import them from there. The SDK adds the client verdict
+// wrapper, the QR payload parsers/builders, and the submit inputs/results.
+// ---------------------------------------------------------------------------
+var OxyServices_civic_1 = require("./mixins/OxyServices.civic");
+Object.defineProperty(exports, "parseIdPayload", { enumerable: true, get: function () { return OxyServices_civic_1.parseIdPayload; } });
+Object.defineProperty(exports, "parseAttestPayload", { enumerable: true, get: function () { return OxyServices_civic_1.parseAttestPayload; } });
+Object.defineProperty(exports, "verifyPublicCardAttestation", { enumerable: true, get: function () { return OxyServices_civic_1.verifyPublicCardAttestation; } });
+// ---------------------------------------------------------------------------
+// Auth helpers (token refresh, error normalisation, retry policies)
+// ---------------------------------------------------------------------------
+var authHelpers_1 = require("./utils/authHelpers");
+Object.defineProperty(exports, "SessionSyncRequiredError", { enumerable: true, get: function () { return authHelpers_1.SessionSyncRequiredError; } });
+Object.defineProperty(exports, "AuthenticationFailedError", { enumerable: true, get: function () { return authHelpers_1.AuthenticationFailedError; } });
+Object.defineProperty(exports, "ensureValidToken", { enumerable: true, get: function () { return authHelpers_1.ensureValidToken; } });
+Object.defineProperty(exports, "isAuthenticationError", { enumerable: true, get: function () { return authHelpers_1.isAuthenticationError; } });
+Object.defineProperty(exports, "withAuthErrorHandling", { enumerable: true, get: function () { return authHelpers_1.withAuthErrorHandling; } });
+Object.defineProperty(exports, "authenticatedApiCall", { enumerable: true, get: function () { return authHelpers_1.authenticatedApiCall; } });
+// ---------------------------------------------------------------------------
+// Sessions
+// ---------------------------------------------------------------------------
+var sessionUtils_1 = require("./utils/sessionUtils");
+Object.defineProperty(exports, "mergeSessions", { enumerable: true, get: function () { return sessionUtils_1.mergeSessions; } });
+Object.defineProperty(exports, "normalizeAndSortSessions", { enumerable: true, get: function () { return sessionUtils_1.normalizeAndSortSessions; } });
+Object.defineProperty(exports, "sessionsArraysEqual", { enumerable: true, get: function () { return sessionUtils_1.sessionsArraysEqual; } });
+// ---------------------------------------------------------------------------
+// Crypto / identity
+// ---------------------------------------------------------------------------
+var keyManager_1 = require("./crypto/keyManager");
+Object.defineProperty(exports, "KeyManager", { enumerable: true, get: function () { return keyManager_1.KeyManager; } });
+Object.defineProperty(exports, "IdentityAlreadyExistsError", { enumerable: true, get: function () { return keyManager_1.IdentityAlreadyExistsError; } });
+Object.defineProperty(exports, "IdentityPersistError", { enumerable: true, get: function () { return keyManager_1.IdentityPersistError; } });
+Object.defineProperty(exports, "IdentityUnavailableError", { enumerable: true, get: function () { return keyManager_1.IdentityUnavailableError; } });
+var identityMarker_1 = require("./crypto/identityMarker");
+Object.defineProperty(exports, "readIdentityMarker", { enumerable: true, get: function () { return identityMarker_1.readIdentityMarker; } });
+Object.defineProperty(exports, "updateIdentityMarker", { enumerable: true, get: function () { return identityMarker_1.updateIdentityMarker; } });
+var signatureService_1 = require("./crypto/signatureService");
+Object.defineProperty(exports, "SignatureService", { enumerable: true, get: function () { return signatureService_1.SignatureService; } });
+var recoveryPhrase_1 = require("./crypto/recoveryPhrase");
+Object.defineProperty(exports, "RecoveryPhraseService", { enumerable: true, get: function () { return recoveryPhrase_1.RecoveryPhraseService; } });
+// Low-level crypto primitives (b3 Phase 0 — encrypted backup + device transfer)
+var kdf_1 = require("./crypto/kdf");
+Object.defineProperty(exports, "hkdfSha256", { enumerable: true, get: function () { return kdf_1.hkdfSha256; } });
+var aead_1 = require("./crypto/aead");
+Object.defineProperty(exports, "encryptAead", { enumerable: true, get: function () { return aead_1.encryptAead; } });
+Object.defineProperty(exports, "decryptAead", { enumerable: true, get: function () { return aead_1.decryptAead; } });
+Object.defineProperty(exports, "AEAD_KEY_LENGTH", { enumerable: true, get: function () { return aead_1.AEAD_KEY_LENGTH; } });
+Object.defineProperty(exports, "AEAD_NONCE_LENGTH", { enumerable: true, get: function () { return aead_1.AEAD_NONCE_LENGTH; } });
+var ecdh_1 = require("./crypto/ecdh");
+Object.defineProperty(exports, "deriveSharedSecret", { enumerable: true, get: function () { return ecdh_1.deriveSharedSecret; } });
+// ---------------------------------------------------------------------------
+// Devices
+// ---------------------------------------------------------------------------
+var deviceManager_1 = require("./utils/deviceManager");
+Object.defineProperty(exports, "DeviceManager", { enumerable: true, get: function () { return deviceManager_1.DeviceManager; } });
+var interfaces_1 = require("./models/interfaces");
+Object.defineProperty(exports, "SECURITY_EVENT_SEVERITY_MAP", { enumerable: true, get: function () { return interfaces_1.SECURITY_EVENT_SEVERITY_MAP; } });
+// Topic enums + type
+var Topic_1 = require("./models/Topic");
+Object.defineProperty(exports, "TopicType", { enumerable: true, get: function () { return Topic_1.TopicType; } });
+Object.defineProperty(exports, "TopicSource", { enumerable: true, get: function () { return Topic_1.TopicSource; } });
+// ---------------------------------------------------------------------------
+// Languages
+// ---------------------------------------------------------------------------
+var languageUtils_1 = require("./utils/languageUtils");
+Object.defineProperty(exports, "SUPPORTED_LANGUAGES", { enumerable: true, get: function () { return languageUtils_1.SUPPORTED_LANGUAGES; } });
+Object.defineProperty(exports, "FALLBACK_LOCALE", { enumerable: true, get: function () { return languageUtils_1.FALLBACK_LOCALE; } });
+Object.defineProperty(exports, "getBaseLanguage", { enumerable: true, get: function () { return languageUtils_1.getBaseLanguage; } });
+Object.defineProperty(exports, "normalizeLocale", { enumerable: true, get: function () { return languageUtils_1.normalizeLocale; } });
+Object.defineProperty(exports, "isSupportedLocale", { enumerable: true, get: function () { return languageUtils_1.isSupportedLocale; } });
+Object.defineProperty(exports, "getLanguageMetadata", { enumerable: true, get: function () { return languageUtils_1.getLanguageMetadata; } });
+Object.defineProperty(exports, "getLanguageName", { enumerable: true, get: function () { return languageUtils_1.getLanguageName; } });
+Object.defineProperty(exports, "getNativeLanguageName", { enumerable: true, get: function () { return languageUtils_1.getNativeLanguageName; } });
+Object.defineProperty(exports, "isRTLLocale", { enumerable: true, get: function () { return languageUtils_1.isRTLLocale; } });
+Object.defineProperty(exports, "getUserLanguages", { enumerable: true, get: function () { return languageUtils_1.getUserLanguages; } });
+Object.defineProperty(exports, "getPrimaryLanguage", { enumerable: true, get: function () { return languageUtils_1.getPrimaryLanguage; } });
+// ---------------------------------------------------------------------------
+// Platform detection
+// ---------------------------------------------------------------------------
+var platform_1 = require("./utils/platform");
+Object.defineProperty(exports, "getPlatformOS", { enumerable: true, get: function () { return platform_1.getPlatformOS; } });
+Object.defineProperty(exports, "setPlatformOS", { enumerable: true, get: function () { return platform_1.setPlatformOS; } });
+Object.defineProperty(exports, "isWeb", { enumerable: true, get: function () { return platform_1.isWeb; } });
+Object.defineProperty(exports, "isNative", { enumerable: true, get: function () { return platform_1.isNative; } });
+Object.defineProperty(exports, "isIOS", { enumerable: true, get: function () { return platform_1.isIOS; } });
+Object.defineProperty(exports, "isAndroid", { enumerable: true, get: function () { return platform_1.isAndroid; } });
+Object.defineProperty(exports, "isWebBrowser", { enumerable: true, get: function () { return platform_1.isWebBrowser; } });
+// ---------------------------------------------------------------------------
+// Colour / theme utilities
+// ---------------------------------------------------------------------------
+var colorUtils_1 = require("./shared/utils/colorUtils");
+Object.defineProperty(exports, "darkenColor", { enumerable: true, get: function () { return colorUtils_1.darkenColor; } });
+Object.defineProperty(exports, "lightenColor", { enumerable: true, get: function () { return colorUtils_1.lightenColor; } });
+Object.defineProperty(exports, "hexToRgb", { enumerable: true, get: function () { return colorUtils_1.hexToRgb; } });
+Object.defineProperty(exports, "rgbToHex", { enumerable: true, get: function () { return colorUtils_1.rgbToHex; } });
+Object.defineProperty(exports, "withOpacity", { enumerable: true, get: function () { return colorUtils_1.withOpacity; } });
+Object.defineProperty(exports, "isLightColor", { enumerable: true, get: function () { return colorUtils_1.isLightColor; } });
+Object.defineProperty(exports, "getContrastTextColor", { enumerable: true, get: function () { return colorUtils_1.getContrastTextColor; } });
+var themeUtils_1 = require("./shared/utils/themeUtils");
+Object.defineProperty(exports, "normalizeTheme", { enumerable: true, get: function () { return themeUtils_1.normalizeTheme; } });
+Object.defineProperty(exports, "normalizeColorScheme", { enumerable: true, get: function () { return themeUtils_1.normalizeColorScheme; } });
+Object.defineProperty(exports, "getOppositeTheme", { enumerable: true, get: function () { return themeUtils_1.getOppositeTheme; } });
+Object.defineProperty(exports, "systemPrefersDarkMode", { enumerable: true, get: function () { return themeUtils_1.systemPrefersDarkMode; } });
+Object.defineProperty(exports, "getSystemColorScheme", { enumerable: true, get: function () { return themeUtils_1.getSystemColorScheme; } });
+// ---------------------------------------------------------------------------
+// HTTP / error / network helpers
+// ---------------------------------------------------------------------------
+var errorUtils_1 = require("./shared/utils/errorUtils");
+Object.defineProperty(exports, "HttpStatus", { enumerable: true, get: function () { return errorUtils_1.HttpStatus; } });
+Object.defineProperty(exports, "getErrorStatus", { enumerable: true, get: function () { return errorUtils_1.getErrorStatus; } });
+Object.defineProperty(exports, "getErrorMessage", { enumerable: true, get: function () { return errorUtils_1.getErrorMessage; } });
+Object.defineProperty(exports, "isAlreadyRegisteredError", { enumerable: true, get: function () { return errorUtils_1.isAlreadyRegisteredError; } });
+Object.defineProperty(exports, "isUnauthorizedError", { enumerable: true, get: function () { return errorUtils_1.isUnauthorizedError; } });
+Object.defineProperty(exports, "isForbiddenError", { enumerable: true, get: function () { return errorUtils_1.isForbiddenError; } });
+Object.defineProperty(exports, "isNotFoundError", { enumerable: true, get: function () { return errorUtils_1.isNotFoundError; } });
+Object.defineProperty(exports, "isRateLimitError", { enumerable: true, get: function () { return errorUtils_1.isRateLimitError; } });
+Object.defineProperty(exports, "isServerError", { enumerable: true, get: function () { return errorUtils_1.isServerError; } });
+Object.defineProperty(exports, "isNetworkError", { enumerable: true, get: function () { return errorUtils_1.isNetworkError; } });
+Object.defineProperty(exports, "isRetryableError", { enumerable: true, get: function () { return errorUtils_1.isRetryableError; } });
+var networkUtils_1 = require("./shared/utils/networkUtils");
+Object.defineProperty(exports, "DEFAULT_CIRCUIT_BREAKER_CONFIG", { enumerable: true, get: function () { return networkUtils_1.DEFAULT_CIRCUIT_BREAKER_CONFIG; } });
+Object.defineProperty(exports, "createCircuitBreakerState", { enumerable: true, get: function () { return networkUtils_1.createCircuitBreakerState; } });
+Object.defineProperty(exports, "calculateBackoffInterval", { enumerable: true, get: function () { return networkUtils_1.calculateBackoffInterval; } });
+Object.defineProperty(exports, "recordFailure", { enumerable: true, get: function () { return networkUtils_1.recordFailure; } });
+Object.defineProperty(exports, "recordSuccess", { enumerable: true, get: function () { return networkUtils_1.recordSuccess; } });
+Object.defineProperty(exports, "shouldAllowRequest", { enumerable: true, get: function () { return networkUtils_1.shouldAllowRequest; } });
+Object.defineProperty(exports, "delay", { enumerable: true, get: function () { return networkUtils_1.delay; } });
+Object.defineProperty(exports, "withRetry", { enumerable: true, get: function () { return networkUtils_1.withRetry; } });
+// ---------------------------------------------------------------------------
+// i18n
+// ---------------------------------------------------------------------------
+var i18n_1 = require("./i18n");
+Object.defineProperty(exports, "translate", { enumerable: true, get: function () { return i18n_1.translate; } });
+var accountCategoryLabels_1 = require("./i18n/accountCategoryLabels");
+Object.defineProperty(exports, "accountCategoryLabel", { enumerable: true, get: function () { return accountCategoryLabels_1.accountCategoryLabel; } });
+var accountRoleLabels_1 = require("./i18n/accountRoleLabels");
+Object.defineProperty(exports, "accountRoleLabel", { enumerable: true, get: function () { return accountRoleLabels_1.accountRoleLabel; } });
+var reputationCategoryLabels_1 = require("./i18n/reputationCategoryLabels");
+Object.defineProperty(exports, "reputationCategoryLabel", { enumerable: true, get: function () { return reputationCategoryLabels_1.reputationCategoryLabel; } });
+var trustTierLabels_1 = require("./i18n/trustTierLabels");
+Object.defineProperty(exports, "trustTierLabel", { enumerable: true, get: function () { return trustTierLabels_1.trustTierLabel; } });
+// ---------------------------------------------------------------------------
+// API request / URL helpers
+// ---------------------------------------------------------------------------
+var apiUtils_1 = require("./utils/apiUtils");
+Object.defineProperty(exports, "buildQueryParams", { enumerable: true, get: function () { return apiUtils_1.buildQueryParams; } });
+Object.defineProperty(exports, "buildSearchParams", { enumerable: true, get: function () { return apiUtils_1.buildSearchParams; } });
+Object.defineProperty(exports, "buildUrl", { enumerable: true, get: function () { return apiUtils_1.buildUrl; } });
+Object.defineProperty(exports, "buildPaginationParams", { enumerable: true, get: function () { return apiUtils_1.buildPaginationParams; } });
+Object.defineProperty(exports, "safeJsonParse", { enumerable: true, get: function () { return apiUtils_1.safeJsonParse; } });
+var errorUtils_2 = require("./utils/errorUtils");
+Object.defineProperty(exports, "ErrorCodes", { enumerable: true, get: function () { return errorUtils_2.ErrorCodes; } });
+Object.defineProperty(exports, "createApiError", { enumerable: true, get: function () { return errorUtils_2.createApiError; } });
+Object.defineProperty(exports, "handleHttpError", { enumerable: true, get: function () { return errorUtils_2.handleHttpError; } });
+Object.defineProperty(exports, "isHttpRequestError", { enumerable: true, get: function () { return errorUtils_2.isHttpRequestError; } });
+Object.defineProperty(exports, "parseHttpErrorBody", { enumerable: true, get: function () { return errorUtils_2.parseHttpErrorBody; } });
+Object.defineProperty(exports, "validateRequiredFields", { enumerable: true, get: function () { return errorUtils_2.validateRequiredFields; } });
+var asyncUtils_1 = require("./utils/asyncUtils");
+Object.defineProperty(exports, "retryAsync", { enumerable: true, get: function () { return asyncUtils_1.retryAsync; } });
+// ---------------------------------------------------------------------------
+// Validation
+// ---------------------------------------------------------------------------
+var validationUtils_1 = require("./utils/validationUtils");
+Object.defineProperty(exports, "EMAIL_REGEX", { enumerable: true, get: function () { return validationUtils_1.EMAIL_REGEX; } });
+Object.defineProperty(exports, "PASSWORD_REGEX", { enumerable: true, get: function () { return validationUtils_1.PASSWORD_REGEX; } });
+Object.defineProperty(exports, "MAX_DISPLAY_NAME_LENGTH", { enumerable: true, get: function () { return validationUtils_1.MAX_DISPLAY_NAME_LENGTH; } });
+Object.defineProperty(exports, "DISPLAY_NAME_INVALID_MESSAGE", { enumerable: true, get: function () { return validationUtils_1.DISPLAY_NAME_INVALID_MESSAGE; } });
+Object.defineProperty(exports, "isValidEmail", { enumerable: true, get: function () { return validationUtils_1.isValidEmail; } });
+Object.defineProperty(exports, "isValidPassword", { enumerable: true, get: function () { return validationUtils_1.isValidPassword; } });
+Object.defineProperty(exports, "isValidDisplayName", { enumerable: true, get: function () { return validationUtils_1.isValidDisplayName; } });
+Object.defineProperty(exports, "DISPLAY_NAME_ALLOWED_SCRIPTS", { enumerable: true, get: function () { return validationUtils_1.DISPLAY_NAME_ALLOWED_SCRIPTS; } });
+Object.defineProperty(exports, "DISPLAY_NAME_DISALLOWED_SOURCE", { enumerable: true, get: function () { return validationUtils_1.DISPLAY_NAME_DISALLOWED_SOURCE; } });
+Object.defineProperty(exports, "DISPLAY_NAME_ORPHANED_MARK_SOURCE", { enumerable: true, get: function () { return validationUtils_1.DISPLAY_NAME_ORPHANED_MARK_SOURCE; } });
+Object.defineProperty(exports, "DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE", { enumerable: true, get: function () { return validationUtils_1.DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE; } });
+Object.defineProperty(exports, "isRequiredString", { enumerable: true, get: function () { return validationUtils_1.isRequiredString; } });
+Object.defineProperty(exports, "isRequiredNumber", { enumerable: true, get: function () { return validationUtils_1.isRequiredNumber; } });
+Object.defineProperty(exports, "isRequiredBoolean", { enumerable: true, get: function () { return validationUtils_1.isRequiredBoolean; } });
+Object.defineProperty(exports, "isValidArray", { enumerable: true, get: function () { return validationUtils_1.isValidArray; } });
+Object.defineProperty(exports, "isValidObject", { enumerable: true, get: function () { return validationUtils_1.isValidObject; } });
+Object.defineProperty(exports, "isValidUUID", { enumerable: true, get: function () { return validationUtils_1.isValidUUID; } });
+Object.defineProperty(exports, "isValidURL", { enumerable: true, get: function () { return validationUtils_1.isValidURL; } });
+Object.defineProperty(exports, "isValidDate", { enumerable: true, get: function () { return validationUtils_1.isValidDate; } });
+Object.defineProperty(exports, "isValidFileSize", { enumerable: true, get: function () { return validationUtils_1.isValidFileSize; } });
+Object.defineProperty(exports, "isValidFileType", { enumerable: true, get: function () { return validationUtils_1.isValidFileType; } });
+Object.defineProperty(exports, "sanitizeString", { enumerable: true, get: function () { return validationUtils_1.sanitizeString; } });
+Object.defineProperty(exports, "sanitizeHTML", { enumerable: true, get: function () { return validationUtils_1.sanitizeHTML; } });
+Object.defineProperty(exports, "isValidObjectId", { enumerable: true, get: function () { return validationUtils_1.isValidObjectId; } });
+Object.defineProperty(exports, "validateAndSanitizeUserInput", { enumerable: true, get: function () { return validationUtils_1.validateAndSanitizeUserInput; } });
+// ---------------------------------------------------------------------------
+// Text normalization
+// ---------------------------------------------------------------------------
+var textNormalization_1 = require("./utils/textNormalization");
+Object.defineProperty(exports, "normalizeInlineText", { enumerable: true, get: function () { return textNormalization_1.normalizeInlineText; } });
+Object.defineProperty(exports, "normalizeMultilineText", { enumerable: true, get: function () { return textNormalization_1.normalizeMultilineText; } });
+// ---------------------------------------------------------------------------
+// Logging — the ecosystem-wide chokepoint (also at subpath `@oxy.so/core/logger`)
+// ---------------------------------------------------------------------------
+var logger_1 = require("./logger");
+Object.defineProperty(exports, "logger", { enumerable: true, get: function () { return logger_1.logger; } });
+Object.defineProperty(exports, "createLogger", { enumerable: true, get: function () { return logger_1.createLogger; } });
+Object.defineProperty(exports, "configureLogger", { enumerable: true, get: function () { return logger_1.configureLogger; } });
+Object.defineProperty(exports, "getLoggerConfig", { enumerable: true, get: function () { return logger_1.getLoggerConfig; } });
+Object.defineProperty(exports, "resetLoggerConfig", { enumerable: true, get: function () { return logger_1.resetLoggerConfig; } });
+Object.defineProperty(exports, "consoleSink", { enumerable: true, get: function () { return logger_1.consoleSink; } });
+Object.defineProperty(exports, "isDev", { enumerable: true, get: function () { return logger_1.isDev; } });
+// ---------------------------------------------------------------------------
+// Avatars
+// ---------------------------------------------------------------------------
+var avatarUtils_1 = require("./utils/avatarUtils");
+Object.defineProperty(exports, "updateAvatarVisibility", { enumerable: true, get: function () { return avatarUtils_1.updateAvatarVisibility; } });
+// ---------------------------------------------------------------------------
+// Accounts
+// ---------------------------------------------------------------------------
+var accountUtils_1 = require("./utils/accountUtils");
+Object.defineProperty(exports, "buildAccountsArray", { enumerable: true, get: function () { return accountUtils_1.buildAccountsArray; } });
+Object.defineProperty(exports, "createQuickAccount", { enumerable: true, get: function () { return accountUtils_1.createQuickAccount; } });
+Object.defineProperty(exports, "getAccountDisplayName", { enumerable: true, get: function () { return accountUtils_1.getAccountDisplayName; } });
+Object.defineProperty(exports, "getAccountFallbackHandle", { enumerable: true, get: function () { return accountUtils_1.getAccountFallbackHandle; } });
+Object.defineProperty(exports, "formatPublicKeyHandle", { enumerable: true, get: function () { return accountUtils_1.formatPublicKeyHandle; } });
+Object.defineProperty(exports, "getAccountColor", { enumerable: true, get: function () { return accountUtils_1.getAccountColor; } });
+// ---------------------------------------------------------------------------
+// Registrable-domain + central-IdP-apex helpers.
+//
+// `registrableApex` (eTLD+1) is consumed via the `@oxy.so/core/server`
+// re-export by `packages/api/src/utils/sameSite.ts` for same-site origin
+// checks; `CENTRAL_IDP_APEX` by `server/cors.ts`'s `createOxyCors` (auto-allows
+// `*.oxy.so`).
+// ---------------------------------------------------------------------------
+var registrableApex_1 = require("./utils/registrableApex");
+Object.defineProperty(exports, "registrableApex", { enumerable: true, get: function () { return registrableApex_1.registrableApex; } });
+var authWebUrl_1 = require("./utils/authWebUrl");
+Object.defineProperty(exports, "CENTRAL_IDP_APEX", { enumerable: true, get: function () { return authWebUrl_1.CENTRAL_IDP_APEX; } });
+// WebAuthn relying-party origin guard (client side). Mirrors the server's
+// `isOxyApexOrigin` so consumers can decide whether to offer passkey UI on the
+// current page (first-party Oxy origin / loopback only).
+var webauthnOrigin_1 = require("./utils/webauthnOrigin");
+Object.defineProperty(exports, "isOxyRpOrigin", { enumerable: true, get: function () { return webauthnOrigin_1.isOxyRpOrigin; } });
+var coldBoot_1 = require("./utils/coldBoot");
+Object.defineProperty(exports, "runColdBoot", { enumerable: true, get: function () { return coldBoot_1.runColdBoot; } });
+// ---------------------------------------------------------------------------
+// OAuth 2.0 Authorization Code + PKCE helpers ("Sign in with Oxy" third party).
+// Standard OAuth against auth.oxy.so/authorize — no FedCM/cookies/SSO bounce.
+// ---------------------------------------------------------------------------
+var oauthPkce_1 = require("./utils/oauthPkce");
+Object.defineProperty(exports, "buildOAuthAuthorizeUrl", { enumerable: true, get: function () { return oauthPkce_1.buildOAuthAuthorizeUrl; } });
+Object.defineProperty(exports, "computeCodeChallenge", { enumerable: true, get: function () { return oauthPkce_1.computeCodeChallenge; } });
+Object.defineProperty(exports, "generateOAuthState", { enumerable: true, get: function () { return oauthPkce_1.generateOAuthState; } });
+Object.defineProperty(exports, "generatePkcePair", { enumerable: true, get: function () { return oauthPkce_1.generatePkcePair; } });
+Object.defineProperty(exports, "DEFAULT_OAUTH_SCOPE", { enumerable: true, get: function () { return oauthPkce_1.DEFAULT_OAUTH_SCOPE; } });
+Object.defineProperty(exports, "OXY_AUTHORIZE_URL", { enumerable: true, get: function () { return oauthPkce_1.OXY_AUTHORIZE_URL; } });
+Object.defineProperty(exports, "OXY_OAUTH_STATE_STORAGE_KEY", { enumerable: true, get: function () { return oauthPkce_1.OXY_OAUTH_STATE_STORAGE_KEY; } });
+Object.defineProperty(exports, "OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY", { enumerable: true, get: function () { return oauthPkce_1.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY; } });
+Object.defineProperty(exports, "OXY_OAUTH_REDIRECT_URI_STORAGE_KEY", { enumerable: true, get: function () { return oauthPkce_1.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY; } });
+Object.defineProperty(exports, "OXY_OAUTH_RETURN_PATH_STORAGE_KEY", { enumerable: true, get: function () { return oauthPkce_1.OXY_OAUTH_RETURN_PATH_STORAGE_KEY; } });
+Object.defineProperty(exports, "normalizeOAuthRedirectUri", { enumerable: true, get: function () { return oauthPkce_1.normalizeOAuthRedirectUri; } });
+Object.defineProperty(exports, "canonicalizeOAuthRedirectUri", { enumerable: true, get: function () { return oauthPkce_1.canonicalizeOAuthRedirectUri; } });
+Object.defineProperty(exports, "persistOAuthHandshake", { enumerable: true, get: function () { return oauthPkce_1.persistOAuthHandshake; } });
+Object.defineProperty(exports, "readOAuthHandshake", { enumerable: true, get: function () { return oauthPkce_1.readOAuthHandshake; } });
+Object.defineProperty(exports, "clearOAuthHandshake", { enumerable: true, get: function () { return oauthPkce_1.clearOAuthHandshake; } });
+Object.defineProperty(exports, "persistOAuthReturnPath", { enumerable: true, get: function () { return oauthPkce_1.persistOAuthReturnPath; } });
+Object.defineProperty(exports, "consumeOAuthReturnPath", { enumerable: true, get: function () { return oauthPkce_1.consumeOAuthReturnPath; } });
+var officialOrigins_1 = require("./utils/officialOrigins");
+Object.defineProperty(exports, "isLoopbackOrigin", { enumerable: true, get: function () { return officialOrigins_1.isLoopbackOrigin; } });
+Object.defineProperty(exports, "isOfficialWebOrigin", { enumerable: true, get: function () { return officialOrigins_1.isOfficialWebOrigin; } });
+Object.defineProperty(exports, "isAllowedDeviceJoinOrigin", { enumerable: true, get: function () { return officialOrigins_1.isAllowedDeviceJoinOrigin; } });
+// ---------------------------------------------------------------------------
+// Session sync (device-scoped multi-account session client)
+// ---------------------------------------------------------------------------
+var SessionClient_1 = require("./session/SessionClient");
+Object.defineProperty(exports, "SessionClient", { enumerable: true, get: function () { return SessionClient_1.SessionClient; } });
+// Shared SessionClient integration layer: the host adapter, the pure
+// DeviceSessionState projection helpers, and the client factory are defined
+// ONCE here so every `@oxy.so/services` platform variant reuses them instead of
+// duplicating a local copy. Each consumer supplies its own `TokenTransport`
+// (native vs. web mint strategies differ) to `createSessionClient`.
+var sessionClientHost_1 = require("./session/sessionClientHost");
+Object.defineProperty(exports, "createSessionClientHost", { enumerable: true, get: function () { return sessionClientHost_1.createSessionClientHost; } });
+var createSessionClient_1 = require("./session/createSessionClient");
+Object.defineProperty(exports, "createSessionClient", { enumerable: true, get: function () { return createSessionClient_1.createSessionClient; } });
+var projectSessionState_1 = require("./session/projectSessionState");
+Object.defineProperty(exports, "deviceStateToClientSessions", { enumerable: true, get: function () { return projectSessionState_1.deviceStateToClientSessions; } });
+Object.defineProperty(exports, "activeSessionIdOf", { enumerable: true, get: function () { return projectSessionState_1.activeSessionIdOf; } });
+Object.defineProperty(exports, "activeUserOf", { enumerable: true, get: function () { return projectSessionState_1.activeUserOf; } });
+Object.defineProperty(exports, "accountIdsOf", { enumerable: true, get: function () { return projectSessionState_1.accountIdsOf; } });
+// Pure projections over the device DIRECTORY (`GET /session/device/directory`,
+// ADR 0002) — the read model that keeps the actor (the human who authenticated)
+// and the subject (the account being acted as) apart. The flat
+// `DeviceSessionState` collapses them into one row, so it can neither tell
+// "signed in as an org" from "a person operating that org" nor hold two people
+// reaching the same org on one device.
+// `canActivateContext` is the switchability question — `available` alone, never
+// composed with `onDevice`, which is a different fact in both directions.
+// `projectDevicePrincipals` is the switcher's shape: people, each with what
+// they may become. Grouped rather than flat because the same organization
+// reached through two people is TWO rows under two humans, which a list keyed
+// by account cannot say.
+var deviceDirectory_1 = require("./session/deviceDirectory");
+Object.defineProperty(exports, "canActivateContext", { enumerable: true, get: function () { return deviceDirectory_1.canActivateContext; } });
+Object.defineProperty(exports, "directoryDisplayName", { enumerable: true, get: function () { return deviceDirectory_1.directoryDisplayName; } });
+Object.defineProperty(exports, "directoryHandle", { enumerable: true, get: function () { return deviceDirectory_1.directoryHandle; } });
+Object.defineProperty(exports, "projectDevicePrincipals", { enumerable: true, get: function () { return deviceDirectory_1.projectDevicePrincipals; } });
+Object.defineProperty(exports, "resolveActiveContext", { enumerable: true, get: function () { return deviceDirectory_1.resolveActiveContext; } });
+Object.defineProperty(exports, "resolveDeviceContext", { enumerable: true, get: function () { return deviceDirectory_1.resolveDeviceContext; } });
+// The switcher's RENDER model over that projection — names, handles and avatar
+// URLs resolved once. Shared by `@oxy.so/services`' account dialog and the
+// auth.oxy.so chooser so the two cannot drift, the same reason the flat
+// projection lived here before it.
+var deviceSwitcherRows_1 = require("./session/deviceSwitcherRows");
+Object.defineProperty(exports, "buildSwitcherRows", { enumerable: true, get: function () { return deviceSwitcherRows_1.buildSwitcherRows; } });
+Object.defineProperty(exports, "showsPrincipalHeaders", { enumerable: true, get: function () { return deviceSwitcherRows_1.showsPrincipalHeaders; } });
+// The switch-target predicates over the account GRAPH — a list of accounts to
+// manage, not the device's list of identities to become (that is the directory
+// above). `isSwitchTargetAccount` is the structural half ("is this kind
+// switchable at all?"); `canSwitchIntoAccount` adds the caller's
+// `account:act_as` permission. Exported so the surfaces that render
+// `AccountNode`s — the Console workspace switcher, managed-accounts rows — ask
+// the SAME questions instead of testing a kind literal.
+var accountSwitchTargets_1 = require("./session/accountSwitchTargets");
+Object.defineProperty(exports, "isSwitchTargetAccount", { enumerable: true, get: function () { return accountSwitchTargets_1.isSwitchTargetAccount; } });
+Object.defineProperty(exports, "canSwitchIntoAccount", { enumerable: true, get: function () { return accountSwitchTargets_1.canSwitchIntoAccount; } });
+// The service/agent counterpart to the human switch predicates above. Kept on
+// its own semantic seam because `bot` is delegable but never human-switchable.
+var accountDelegationAccess_1 = require("./session/accountDelegationAccess");
+Object.defineProperty(exports, "resolveAccountDelegationAccess", { enumerable: true, get: function () { return accountDelegationAccess_1.resolveAccountDelegationAccess; } });
+// Headless controller for the unified account dialog. Framework-agnostic
+// state machine + subscribe/getSnapshot store (bind via `useSyncExternalStore`)
+// — sign-in is passkey (WebAuthn) or the Commons QR / shared-keychain handoff;
+// password, social login, and 2FA were removed ecosystem-wide. Reuses
+// `SessionClient.switchAccount` / `oxyServices.switchToAccount` for the uniform
+// switch and the existing device-flow methods for sign-in.
+var accountDialogController_1 = require("./session/accountDialogController");
+Object.defineProperty(exports, "AccountDialogController", { enumerable: true, get: function () { return accountDialogController_1.AccountDialogController; } });
+Object.defineProperty(exports, "createAccountDialogController", { enumerable: true, get: function () { return accountDialogController_1.createAccountDialogController; } });
+// ---------------------------------------------------------------------------
+// Device-first session machinery (zero-cookie transport).
+// Persisted auth-state store, the unified re-mint handler + scheduler, and the
+// cold-boot runner. Built ON the `runColdBoot` primitive + `SessionClient`. The
+// device credential is `deviceId` + `deviceSecret`; the access token is re-minted
+// via `POST /session/device/token`.
+// ---------------------------------------------------------------------------
+var authStateStore_1 = require("./session/authStateStore");
+Object.defineProperty(exports, "createWebAuthStateStore", { enumerable: true, get: function () { return authStateStore_1.createWebAuthStateStore; } });
+Object.defineProperty(exports, "createNativeAuthStateStore", { enumerable: true, get: function () { return authStateStore_1.createNativeAuthStateStore; } });
+Object.defineProperty(exports, "createMemoryAuthStateStore", { enumerable: true, get: function () { return authStateStore_1.createMemoryAuthStateStore; } });
+Object.defineProperty(exports, "AUTH_STATE_STORAGE_KEY", { enumerable: true, get: function () { return authStateStore_1.AUTH_STATE_STORAGE_KEY; } });
+// The shared NATIVE DeviceSession credential — how several official apps on one
+// device end up on ONE `DeviceSession` and therefore one active context. It is an
+// ordinary rotatable/revocable `deviceId` + `deviceSecret`, deliberately NOT the
+// Commons private identity key: an app that only needs a session must never be
+// handed the key that signs identity approvals.
+var sharedDeviceCredential_1 = require("./session/sharedDeviceCredential");
+Object.defineProperty(exports, "createSharedMirroringAuthStateStore", { enumerable: true, get: function () { return sharedDeviceCredential_1.createSharedMirroringAuthStateStore; } });
+Object.defineProperty(exports, "decideSharedDeviceJoin", { enumerable: true, get: function () { return sharedDeviceCredential_1.decideSharedDeviceJoin; } });
+Object.defineProperty(exports, "decideSharedDevicePublish", { enumerable: true, get: function () { return sharedDeviceCredential_1.decideSharedDevicePublish; } });
+Object.defineProperty(exports, "normalizeSharedDeviceSessionRead", { enumerable: true, get: function () { return sharedDeviceCredential_1.normalizeSharedDeviceSessionRead; } });
+Object.defineProperty(exports, "publishProvenDeviceCredential", { enumerable: true, get: function () { return sharedDeviceCredential_1.publishProvenDeviceCredential; } });
+Object.defineProperty(exports, "readLocalDeviceCredential", { enumerable: true, get: function () { return sharedDeviceCredential_1.readLocalDeviceCredential; } });
+// Identity-bound sessions (the identity vault). The pin is the durable
+// `{publicKey, accountId}` binding between this device's PRIMARY identity key
+// and the account it authenticates as; it is what keeps such a client from
+// following the device's mutable `activeAccountId`.
+var identityPin_1 = require("./session/identityPin");
+Object.defineProperty(exports, "createWebIdentityPinStore", { enumerable: true, get: function () { return identityPin_1.createWebIdentityPinStore; } });
+Object.defineProperty(exports, "createNativeIdentityPinStore", { enumerable: true, get: function () { return identityPin_1.createNativeIdentityPinStore; } });
+Object.defineProperty(exports, "createMemoryIdentityPinStore", { enumerable: true, get: function () { return identityPin_1.createMemoryIdentityPinStore; } });
+Object.defineProperty(exports, "identityPinMatches", { enumerable: true, get: function () { return identityPin_1.identityPinMatches; } });
+Object.defineProperty(exports, "IDENTITY_PIN_STORAGE_KEY", { enumerable: true, get: function () { return identityPin_1.IDENTITY_PIN_STORAGE_KEY; } });
+var identitySession_1 = require("./session/identitySession");
+Object.defineProperty(exports, "resolveIdentityPin", { enumerable: true, get: function () { return identitySession_1.resolveIdentityPin; } });
+Object.defineProperty(exports, "establishIdentitySession", { enumerable: true, get: function () { return identitySession_1.establishIdentitySession; } });
+// The typed `401 account_not_on_device` from a PINNED device-secret mint: the
+// pinned account left this device's session set, so the caller re-establishes
+// the identity session instead of dropping a healthy device credential.
+var OxyServices_deviceBoot_1 = require("./mixins/OxyServices.deviceBoot");
+Object.defineProperty(exports, "AccountNotOnDeviceError", { enumerable: true, get: function () { return OxyServices_deviceBoot_1.AccountNotOnDeviceError; } });
+var refresh_1 = require("./session/refresh");
+Object.defineProperty(exports, "refreshPersistedSession", { enumerable: true, get: function () { return refresh_1.refreshPersistedSession; } });
+Object.defineProperty(exports, "refreshDeviceSecretArm", { enumerable: true, get: function () { return refresh_1.refreshDeviceSecretArm; } });
+Object.defineProperty(exports, "createAuthRefreshHandler", { enumerable: true, get: function () { return refresh_1.createAuthRefreshHandler; } });
+Object.defineProperty(exports, "installAuthRefreshHandler", { enumerable: true, get: function () { return refresh_1.installAuthRefreshHandler; } });
+Object.defineProperty(exports, "startTokenRefreshScheduler", { enumerable: true, get: function () { return refresh_1.startTokenRefreshScheduler; } });
+Object.defineProperty(exports, "TOKEN_REFRESH_LEAD_MS", { enumerable: true, get: function () { return refresh_1.TOKEN_REFRESH_LEAD_MS; } });
+// The inference API. `oxyServices.inference()` binds the session bearer into
+// the same client an external developer constructs with an `oxy_sk_…` machine
+// key — one surface, two credential lanes. See `docs/inference/sdk.md`.
+var OxyInferenceClient_1 = require("./inference/OxyInferenceClient");
+Object.defineProperty(exports, "OxyInferenceClient", { enumerable: true, get: function () { return OxyInferenceClient_1.OxyInferenceClient; } });
+Object.defineProperty(exports, "OxyInferenceError", { enumerable: true, get: function () { return OxyInferenceClient_1.OxyInferenceError; } });
+Object.defineProperty(exports, "OxyInferenceProtocolError", { enumerable: true, get: function () { return OxyInferenceClient_1.OxyInferenceProtocolError; } });
+Object.defineProperty(exports, "OXY_INFERENCE_BASE_URL", { enumerable: true, get: function () { return OxyInferenceClient_1.OXY_INFERENCE_BASE_URL; } });
+var sessionColdBoot_1 = require("./boot/sessionColdBoot");
+Object.defineProperty(exports, "runSessionColdBoot", { enumerable: true, get: function () { return sessionColdBoot_1.runSessionColdBoot; } });
+// API response contracts (request/response Zod schemas + inferred types) live in
+// `@oxy.so/contracts` — the single source of truth shared by the backend and every
+// client SDK. Import them directly from `@oxy.so/contracts`; `@oxy.so/core` does NOT
+// re-export them (no barrel re-exports — clean imports from the owning package).
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+var version_1 = require("./constants/version");
+Object.defineProperty(exports, "packageInfo", { enumerable: true, get: function () { return version_1.packageInfo; } });
+// ---------------------------------------------------------------------------
+// Default export (back-compat — OxyServices is the most common consumer entry)
+// ---------------------------------------------------------------------------
+const OxyServices_3 = require("./OxyServices");
+exports.default = OxyServices_3.OxyServices;