@oxy.so/core 1.0.1 → 1.1.0

package/src/mixins/OxyServices.agency.ts

@@ -0,0 +1,277 @@
+/**
+ * Native Alia and digital-agent authority.
+ *
+ * These methods manage Oxy-owned delegation grants, account autonomy policy,
+ * execution authorizations and their audit trail. They deliberately use the
+ * signed-in account session: capability tickets and app service credentials
+ * stay on the server and are never exposed to Settings clients.
+ */
+import type {
+  AppCapabilityCatalog,
+  AuditEvent,
+  AutonomyLevel,
+  CapabilityCatalogBinding,
+  CapabilityPackage,
+  DelegationGrant,
+  GrantLimit,
+  ResourceRef,
+  ToolGrantOverride,
+} from '@oxy.so/contracts';
+import type { OxyServicesBase } from '../OxyServices.base';
+import { CACHE_TIMES } from './mixinHelpers';
+
+export type DelegationCatalogBinding = CapabilityCatalogBinding;
+export type DelegationGrantView = DelegationGrant;
+
+export interface CreateDelegationGrantInput {
+  ownerAccountId: string;
+  actorAccountId: string;
+  resource: ResourceRef;
+  capabilityPackages: CapabilityPackage[];
+  capabilities: string[];
+  toolOverrides?: ToolGrantOverride[];
+  limits?: GrantLimit[];
+  maximumAutonomy: AutonomyLevel;
+  canRedelegate?: boolean;
+  expiresAt?: string | null;
+}
+
+export type UpdateDelegationGrantInput = Pick<
+  CreateDelegationGrantInput,
+  | 'capabilityPackages'
+  | 'capabilities'
+  | 'toolOverrides'
+  | 'limits'
+  | 'maximumAutonomy'
+  | 'canRedelegate'
+  | 'expiresAt'
+>;
+
+export interface AvailableCapabilityCatalog {
+  id: string;
+  appId: string;
+  version: string;
+  digest: string;
+  audience: string;
+  catalog: AppCapabilityCatalog;
+}
+
+export interface AccountCapabilityPolicy {
+  id: string;
+  accountId: string;
+  appSlug: string;
+  maximumAutonomy: AutonomyLevel;
+  deniedCapabilities: string[];
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface PutAccountCapabilityPolicyInput {
+  accountId: string;
+  maximumAutonomy: AutonomyLevel;
+  deniedCapabilities: string[];
+}
+
+export interface CapabilityExecutionAuthorization {
+  id: string;
+  kind: 'direct_request' | 'automation';
+  requesterAccountId: string;
+  ownerAccountId: string;
+  coordinatorApplicationId: string;
+  coordinatorCredentialId: string;
+  actorType: 'alia' | 'agent';
+  actorAccountId: string | null;
+  resourceApp: string;
+  effectiveAccountId: string;
+  resourceType: string;
+  resourceKey: string;
+  tool: string;
+  runId: string | null;
+  stepId: string | null;
+  automationId: string | null;
+  maximumAutonomy: AutonomyLevel;
+  limits: GrantLimit[];
+  expiresAt: string;
+  revokedAt: string | null;
+  createdAt: string;
+  updatedAt: string;
+}
+
+function query(path: string, key: string, value: string): string {
+  return `${path}?${key}=${encodeURIComponent(value)}`;
+}
+
+export function OxyServicesAgencyMixin<T extends typeof OxyServicesBase>(Base: T) {
+  return class extends Base {
+    async listAvailableCapabilityCatalogs(accountId: string): Promise<AvailableCapabilityCatalog[]> {
+      try {
+        const response = await this.makeRequest<{ catalogs: AvailableCapabilityCatalog[] }>(
+          'GET',
+          query('/capabilities/catalogs/available', 'accountId', accountId),
+          undefined,
+          { cache: true, cacheTTL: CACHE_TIMES.MEDIUM },
+        );
+        return response.catalogs;
+      } catch (error) {
+        throw this.handleError(error);
+      }
+    }
+
+    async listDelegationGrants(ownerAccountId: string): Promise<DelegationGrantView[]> {
+      try {
+        const response = await this.makeRequest<{ grants: DelegationGrantView[] }>(
+          'GET',
+          query('/capabilities/grants', 'ownerAccountId', ownerAccountId),
+          undefined,
+          { cache: true, cacheTTL: CACHE_TIMES.SHORT },
+        );
+        return response.grants;
+      } catch (error) {
+        throw this.handleError(error);
+      }
+    }
+
+    async createDelegationGrant(input: CreateDelegationGrantInput): Promise<DelegationGrantView> {
+      try {
+        const response = await this.makeRequest<{ grant: DelegationGrantView }>(
+          'POST',
+          '/capabilities/grants',
+          input,
+          { cache: false },
+        );
+        this.clearCacheEntry(`GET:/capabilities/grants?ownerAccountId=${encodeURIComponent(input.ownerAccountId)}`);
+        return response.grant;
+      } catch (error) {
+        throw this.handleError(error);
+      }
+    }
+
+    async revokeDelegationGrant(grantId: string, ownerAccountId: string): Promise<void> {
+      try {
+        await this.makeRequest<void>(
+          'DELETE',
+          `/capabilities/grants/${encodeURIComponent(grantId)}`,
+          undefined,
+          { cache: false },
+        );
+        this.clearCacheEntry(`GET:/capabilities/grants?ownerAccountId=${encodeURIComponent(ownerAccountId)}`);
+      } catch (error) {
+        throw this.handleError(error);
+      }
+    }
+
+    async updateDelegationGrant(
+      grantId: string,
+      ownerAccountId: string,
+      input: UpdateDelegationGrantInput,
+    ): Promise<DelegationGrantView> {
+      try {
+        const response = await this.makeRequest<{ grant: DelegationGrantView }>(
+          'PUT',
+          `/capabilities/grants/${encodeURIComponent(grantId)}`,
+          input,
+          { cache: false },
+        );
+        this.clearCacheEntry(`GET:/capabilities/grants?ownerAccountId=${encodeURIComponent(ownerAccountId)}`);
+        return response.grant;
+      } catch (error) {
+        throw this.handleError(error);
+      }
+    }
+
+    async listAccountCapabilityPolicies(accountId: string): Promise<AccountCapabilityPolicy[]> {
+      try {
+        const response = await this.makeRequest<{ policies: AccountCapabilityPolicy[] }>(
+          'GET',
+          query('/capabilities/account-policies', 'accountId', accountId),
+          undefined,
+          { cache: true, cacheTTL: CACHE_TIMES.SHORT },
+        );
+        return response.policies;
+      } catch (error) {
+        throw this.handleError(error);
+      }
+    }
+
+    async putAccountCapabilityPolicy(
+      appId: string,
+      input: PutAccountCapabilityPolicyInput,
+    ): Promise<AccountCapabilityPolicy> {
+      try {
+        const response = await this.makeRequest<{ policy: AccountCapabilityPolicy }>(
+          'PUT',
+          `/capabilities/account-policies/${encodeURIComponent(appId)}`,
+          input,
+          { cache: false },
+        );
+        this.clearCacheEntry(`GET:/capabilities/account-policies?accountId=${encodeURIComponent(input.accountId)}`);
+        return response.policy;
+      } catch (error) {
+        throw this.handleError(error);
+      }
+    }
+
+    async deleteAccountCapabilityPolicy(appId: string, accountId: string): Promise<void> {
+      try {
+        await this.makeRequest<void>(
+          'DELETE',
+          `/capabilities/account-policies/${encodeURIComponent(appId)}?accountId=${encodeURIComponent(accountId)}`,
+          undefined,
+          { cache: false },
+        );
+        this.clearCacheEntry(`GET:/capabilities/account-policies?accountId=${encodeURIComponent(accountId)}`);
+      } catch (error) {
+        throw this.handleError(error);
+      }
+    }
+
+    async listCapabilityExecutionAuthorizations(
+      ownerAccountId: string,
+    ): Promise<CapabilityExecutionAuthorization[]> {
+      try {
+        const response = await this.makeRequest<{ authorizations: CapabilityExecutionAuthorization[] }>(
+          'GET',
+          query('/capabilities/execution-authorizations', 'ownerAccountId', ownerAccountId),
+          undefined,
+          { cache: true, cacheTTL: CACHE_TIMES.SHORT },
+        );
+        return response.authorizations;
+      } catch (error) {
+        throw this.handleError(error);
+      }
+    }
+
+    async revokeCapabilityExecutionAuthorization(
+      authorizationId: string,
+      ownerAccountId: string,
+    ): Promise<void> {
+      try {
+        await this.makeRequest<void>(
+          'DELETE',
+          `/capabilities/execution-authorizations/${encodeURIComponent(authorizationId)}`,
+          undefined,
+          { cache: false },
+        );
+        this.clearCacheEntry(
+          `GET:/capabilities/execution-authorizations?ownerAccountId=${encodeURIComponent(ownerAccountId)}`,
+        );
+      } catch (error) {
+        throw this.handleError(error);
+      }
+    }
+
+    async listCapabilityAuditEvents(accountId: string): Promise<AuditEvent[]> {
+      try {
+        const response = await this.makeRequest<{ events: AuditEvent[] }>(
+          'GET',
+          query('/capabilities/audit', 'accountId', accountId),
+          undefined,
+          { cache: true, cacheTTL: CACHE_TIMES.SHORT },
+        );
+        return response.events;
+      } catch (error) {
+        throw this.handleError(error);
+      }
+    }
+  };
+}

package/src/mixins/OxyServices.assets.ts

@@ -1,8 +1,8 @@
-import type { AccountStorageUsageResponse, AssetUploadInput, AssetUrlResponse, AssetVariant, BatchFileAccessResponse, RNFileDescriptor, ServiceAssetMetadata, ServiceAssetMetadataBySha } from '../models/interfaces';
+import type { AccountStorageUsageResponse, AssetUploadInput, AssetUrlResponse, AssetVariant, BatchFileAccessResponse, RNFileDescriptor, ServiceAssetMetadata, ServiceAssetMetadataBySha, ServiceLinkedDownloadUrl } from '../models/interfaces';
 import type { OxyServicesBase } from '../OxyServices.base';
 import { isReactNative } from '@oxy.so/protocol';
 import { logger } from '../logger';
-import { AssetUrlResolutionError, ServiceAssetMetadataError } from '../OxyServices.errors';
+import { AssetUrlResolutionError, ServiceAssetMetadataError, ServiceLinkedDownloadUrlError } from '../OxyServices.errors';
 import { extractErrorStatus } from '../utils/errorUtils';
 import { redactUrlQuery } from '../utils/redactUrl';
 
@@ -22,6 +22,14 @@ const SERVICE_ASSET_METADATA_CHUNK_SIZE = 100;
  */
 const SERVICE_ASSET_METADATA_BY_SHA_CHUNK_SIZE = 100;
 
+/**
+ * Maximum number of ids sent per `POST /assets/service/linked-url` request.
+ * Matches that route's own cap, which is a QUARTER of the metadata routes' —
+ * see `MAX_ASSETS_LINKED_URL` in the API for why minting download credentials is
+ * budgeted more tightly than projecting rows.
+ */
+const SERVICE_LINKED_DOWNLOAD_URL_CHUNK_SIZE = 25;
+
 /**
  * Lowercase hex SHA-256 digest matcher (exactly 64 hex chars). The reverse
  * lookup drops non-conforming hashes client-side so a single malformed value
@@ -426,6 +434,101 @@ export function OxyServicesAssetsMixin<T extends typeof OxyServicesBase>(Base: T
       return settled.flat();
     }
 
+    /**
+     * Mint short-lived direct download URLs for files the calling application's
+     * own users attached to it, via `POST /assets/service/linked-url`.
+     *
+     * This is the ONLY path in this SDK by which a service token reaches file
+     * BYTES. {@link getServiceAssetMetadataByIds} is metadata-only, and every
+     * other download helper here — {@link getFileDownloadUrl},
+     * {@link getFileDownloadUrlAsync}, {@link getBatchFileAccess} — resolves a URL
+     * for the CURRENT USER through `makeRequest`, which is a different question: a
+     * relying service holds no user session, and the buyer whose entitlement it is
+     * enforcing is not a viewer Oxy knows anything about.
+     *
+     * **Service-token auth (required), plus the `files:linked:read` scope**, which
+     * is NOT implied by `files:read`. The calling client must be service-configured
+     * (`configureServiceAuth(apiKey, apiSecret)`); a user-session request is
+     * rejected by the route's service-auth guard.
+     *
+     * **What the server will and will not give you.** A URL comes back only for a
+     * file whose OWN OWNER linked it to this application (`file_links.created_by =
+     * files.owner_user_id`). Every other id is omitted: unknown, deleted,
+     * system-owned, linked by somebody else, or not linked here at all. So the
+     * result is routinely shorter than the input and must be mapped by `id`.
+     *
+     * ABSENCE IS A REFUSAL, NOT A FACT ABOUT THE FILE, and the caller is the only
+     * party that can tell the difference. The route deliberately cannot — it
+     * answers identically for "no such file" and "not yours" so it leaks nothing —
+     * which means a service must decide what to tell its user from its OWN
+     * entitlement record, never from this response. Do not surface "file not
+     * found" on the strength of an omission.
+     *
+     * FAILURE IS NOT ABSENCE EITHER, and here it cannot be opted out of: a failed
+     * chunk throws {@link ServiceLinkedDownloadUrlError} carrying its ids, with no
+     * `{ partial: true }` mode. Swallowing a 429 would tell a user who paid for a
+     * file that it is not there. An empty input resolves to `[]` with no network
+     * call.
+     *
+     * Never cached at the SDK layer, and that is a stronger statement than the
+     * sibling methods' "low hit rate": each entry is a live credential for the
+     * bytes, so caching one keeps it usable after the service has decided the
+     * caller's entitlement ended.
+     */
+    async getServiceLinkedDownloadUrls(ids: string[]): Promise<ServiceLinkedDownloadUrl[]> {
+      const uniqueIds = Array.from(
+        new Set(ids.filter((id): id is string => typeof id === 'string' && id.trim().length > 0)),
+      );
+      if (uniqueIds.length === 0) {
+        return [];
+      }
+
+      const chunks: string[][] = [];
+      for (let i = 0; i < uniqueIds.length; i += SERVICE_LINKED_DOWNLOAD_URL_CHUNK_SIZE) {
+        chunks.push(uniqueIds.slice(i, i + SERVICE_LINKED_DOWNLOAD_URL_CHUNK_SIZE));
+      }
+
+      // Chunks stay independent so one failure never cancels work already in
+      // flight; the failures are collected and re-raised together below, exactly
+      // as in the metadata sibling.
+      const unresolvedIds: string[] = [];
+      const statuses: number[] = [];
+      let firstError: unknown;
+
+      const settled = await Promise.all(
+        chunks.map(async (chunk): Promise<ServiceLinkedDownloadUrl[]> => {
+          try {
+            const entries = await this.makeServiceRequest<ServiceLinkedDownloadUrl[]>(
+              'POST',
+              '/assets/service/linked-url',
+              { ids: chunk },
+            );
+            return Array.isArray(entries) ? entries : [];
+          } catch (error: unknown) {
+            const status = extractErrorStatus(error);
+            // `chunkSize` and `status`, never the ids and never a `url`: a minted
+            // URL in a log line is a credential in a log line.
+            logger.warn('getServiceLinkedDownloadUrls: chunk failed', {
+              method: 'getServiceLinkedDownloadUrls',
+              chunkSize: chunk.length,
+              status,
+              error: error instanceof Error ? error.message : String(error),
+            });
+            unresolvedIds.push(...chunk);
+            if (typeof status === 'number') statuses.push(status);
+            firstError ??= error;
+            return [];
+          }
+        }),
+      );
+
+      if (unresolvedIds.length > 0) {
+        throw new ServiceLinkedDownloadUrlError(unresolvedIds, statuses, firstError);
+      }
+
+      return settled.flat();
+    }
+
     /**
      * Reverse content-address lookup: resolve many content `sha256` digests to
      * the servable Oxy asset holding each, in one round-trip per chunk via

package/src/mixins/OxyServices.connectedApps.ts

@@ -83,12 +83,20 @@ export interface ConnectedApp {
   lastUsedAt: string;
 }
 
+/** An external MCP client authorized for one exact app resource and account. */
+export interface ConnectedMcpClient {
+  id: string;
+  appSlug: string;
+  resource: string;
+  scopes: string[];
+  clientId: string;
+  clientName: string;
+  createdAt: string;
+  lastUsedAt: string;
+}
+
 export function OxyServicesConnectedAppsMixin<T extends typeof OxyServicesBase>(Base: T) {
   return class extends Base {
-    constructor(...args: any[]) {
-      super(...(args as [any]));
-    }
-
     /**
      * Resolve an OAuth client identifier to the owning application's PUBLIC
      * identity. No authentication required — the API returns only sanitized,
@@ -170,5 +178,35 @@ export function OxyServicesConnectedAppsMixin<T extends typeof OxyServicesBase>(
         throw this.handleError(error);
       }
     }
+
+    /** List resource-bound external MCP connections for the active Oxy account. */
+    async listConnectedMcpClients(): Promise<ConnectedMcpClient[]> {
+      try {
+        const response = await this.makeRequest<{ grants: ConnectedMcpClient[] }>(
+          'GET',
+          '/auth/mcp/oauth/grants',
+          undefined,
+          { cache: true, cacheTTL: CACHE_TIMES.SHORT },
+        );
+        return response.grants;
+      } catch (error) {
+        throw this.handleError(error);
+      }
+    }
+
+    /** Revoke one external MCP connection and every token in its family. */
+    async revokeConnectedMcpClient(grantId: string): Promise<void> {
+      try {
+        await this.makeRequest<void>(
+          'DELETE',
+          `/auth/mcp/oauth/grants/${encodeURIComponent(grantId)}`,
+          undefined,
+          { cache: false },
+        );
+        this.clearCacheEntry('GET:/auth/mcp/oauth/grants');
+      } catch (error) {
+        throw this.handleError(error);
+      }
+    }
   };
 }

package/src/mixins/OxyServices.utility.ts

@@ -1,12 +1,10 @@
 /**
  * Utility Methods Mixin
  *
- * Provides utility methods including link metadata fetching
- * and Express.js authentication middleware
+ * Provides utility methods including Express.js authentication middleware.
  */
 import { jwtDecode } from 'jwt-decode';
 import type { JsonWebKey } from 'node:crypto';
-import type { LinkPreview } from '@oxy.so/contracts';
 import type { ApiError, User } from '../models/interfaces';
 import type { OxyServicesBase } from '../OxyServices.base';
 import { loadNodeCrypto } from '@oxy.so/protocol';
@@ -278,29 +276,6 @@ export function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base:
       }
     }
 
-    /**
-     * Fetch link metadata
-     */
-    async fetchLinkMetadata(url: string): Promise<{
-      url: string;
-      title: string;
-      description: string;
-      image?: string;
-    }> {
-      try {
-        const path = buildUrl('/links/preview', { url, wait: 1 });
-        const preview = await this.makeRequest<LinkPreview>('GET', path, undefined, { cache: false });
-        return {
-          url: preview.url,
-          title: preview.title?.trim() || preview.url.replace(/^https?:\/\//, '').replace(/\/$/, ''),
-          description: preview.description?.trim() || 'Link',
-          image: preview.image,
-        };
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
     /**
      * Express.js authentication middleware
      *

package/src/mixins/__tests__/OxyServices.serviceLinkedDownloadUrl.test.ts

@@ -0,0 +1,139 @@
+/**
+ * `getServiceLinkedDownloadUrls` mixin tests.
+ *
+ * Stubs `makeServiceRequest` (the service-token transport the route's
+ * `serviceAuthMiddleware` + `files:linked:read` scope require) so these run with
+ * no network and no `getServiceToken()` round-trip.
+ *
+ * The contract worth guarding here is not the transport — the metadata sibling
+ * already pins that shape — it is the TWO absences this method has to keep
+ * distinguishable, because conflating them misinforms a person who paid money:
+ *
+ *   - The server OMITS an id it will not mint for, with no way to tell "no such
+ *     file" from "not yours". That is a legitimate short result, and the caller
+ *     has to map by `id`.
+ *   - A FAILED chunk is not that. It throws, with no `{ partial: true }` escape
+ *     hatch, because the sibling's best-effort mode would make a 429
+ *     indistinguishable from the refusal above.
+ */
+
+import type { ServiceLinkedDownloadUrl } from '../../models/interfaces';
+import { OxyServices } from '../../OxyServices';
+import { ServiceLinkedDownloadUrlError } from '../../OxyServices.errors';
+
+const sampleEntry: ServiceLinkedDownloadUrl = {
+  id: 'asset-1',
+  url: 'https://s3.example/private/asset-1.stl?X-Amz-Signature=deadbeef',
+  expiresIn: 300,
+  mime: 'model/stl',
+  size: 4096,
+  sha256: 'a'.repeat(64),
+};
+
+describe('OxyServices.assets — getServiceLinkedDownloadUrls', () => {
+  let oxy: OxyServices;
+  let makeServiceRequestSpy: jest.SpyInstance;
+
+  beforeEach(() => {
+    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
+    makeServiceRequestSpy = jest.spyOn(oxy, 'makeServiceRequest');
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('returns [] and performs no network call for empty / whitespace input', async () => {
+    await expect(oxy.getServiceLinkedDownloadUrls([])).resolves.toEqual([]);
+    await expect(oxy.getServiceLinkedDownloadUrls(['', '   '])).resolves.toEqual([]);
+    expect(makeServiceRequestSpy).not.toHaveBeenCalled();
+  });
+
+  it('POSTs de-duplicated ids to /assets/service/linked-url as { ids }', async () => {
+    makeServiceRequestSpy.mockResolvedValueOnce([sampleEntry]);
+
+    await oxy.getServiceLinkedDownloadUrls(['asset-1', 'asset-1', '  ']);
+
+    expect(makeServiceRequestSpy).toHaveBeenCalledTimes(1);
+    expect(makeServiceRequestSpy).toHaveBeenCalledWith(
+      'POST',
+      '/assets/service/linked-url',
+      { ids: ['asset-1'] },
+    );
+  });
+
+  it('returns entries untouched, so expiresIn and url reach the caller as sent', async () => {
+    makeServiceRequestSpy.mockResolvedValueOnce([sampleEntry]);
+
+    const [entry] = await oxy.getServiceLinkedDownloadUrls(['asset-1']);
+
+    expect(entry).toEqual(sampleEntry);
+  });
+
+  it('chunks at 25, a QUARTER of the metadata route\'s 100', async () => {
+    // The cap is the route's, and the two routes deliberately differ: this one
+    // mints a credential per id. A client chunking at 100 would 400 every call.
+    const ids = Array.from({ length: 26 }, (_, index) => `asset-${index}`);
+    makeServiceRequestSpy.mockResolvedValue([]);
+
+    await oxy.getServiceLinkedDownloadUrls(ids);
+
+    expect(makeServiceRequestSpy).toHaveBeenCalledTimes(2);
+    const sent = makeServiceRequestSpy.mock.calls.map(
+      (call) => (call[2] as { ids: string[] }).ids.length,
+    );
+    expect(sent.sort((a, b) => b - a)).toEqual([25, 1]);
+  });
+
+  it('accepts a SHORT result without complaint — an omitted id is a refusal', async () => {
+    // The server gives no URL for a file the owner did not link here, and says so
+    // by saying nothing. A method that treated a short result as an error would
+    // make the normal case throw.
+    makeServiceRequestSpy.mockResolvedValueOnce([sampleEntry]);
+
+    const entries = await oxy.getServiceLinkedDownloadUrls(['asset-1', 'asset-refused']);
+
+    expect(entries.map((entry) => entry.id)).toEqual(['asset-1']);
+  });
+
+  it('THROWS on a failed chunk, naming its ids', async () => {
+    const failure = Object.assign(new Error('Too Many Requests'), {
+      response: { status: 429 },
+    });
+    makeServiceRequestSpy.mockRejectedValueOnce(failure);
+
+    await expect(oxy.getServiceLinkedDownloadUrls(['asset-1'])).rejects.toThrow(
+      ServiceLinkedDownloadUrlError,
+    );
+
+    makeServiceRequestSpy.mockRejectedValueOnce(failure);
+    const error = await oxy
+      .getServiceLinkedDownloadUrls(['asset-1'])
+      .catch((caught: unknown) => caught as ServiceLinkedDownloadUrlError);
+
+    expect(error.unresolvedIds).toEqual(['asset-1']);
+    expect(error.statuses).toEqual([429]);
+    expect(error.code).toBe('SERVICE_LINKED_DOWNLOAD_URL_UNRESOLVED');
+  });
+
+  it('throws even when OTHER chunks succeeded — a partial answer is not an answer', async () => {
+    // The inverse of the sibling's `{ partial: true }`. Returning the 25 that
+    // worked and dropping the one that did not is exactly how a buyer is told a
+    // file they own is missing, so there is no option to ask for it.
+    const ids = Array.from({ length: 26 }, (_, index) => `asset-${index}`);
+    makeServiceRequestSpy
+      .mockResolvedValueOnce([sampleEntry])
+      .mockRejectedValueOnce(new Error('boom'));
+
+    await expect(oxy.getServiceLinkedDownloadUrls(ids)).rejects.toThrow(
+      ServiceLinkedDownloadUrlError,
+    );
+  });
+
+  it('has no partial option at all', async () => {
+    // Asserted on the ARITY rather than by passing an option and watching it be
+    // ignored: a future signature that quietly accepted `{ partial: true }` would
+    // restore the behaviour this method exists to refuse.
+    expect(oxy.getServiceLinkedDownloadUrls.length).toBe(1);
+  });
+});