@oxy.so/core 1.10.0 → 1.12.0

package/dist/types/crypto/deviceBackup.d.ts

@@ -0,0 +1,60 @@
+/**
+ * The device backup of the self-custody identity: a copy that lives OUTSIDE this
+ * app's own keystore, so a keystore wipe cannot take it along with the keys.
+ *
+ * Why it exists (OxyHQ/oxy#1388): on Android every Oxy app shares the Linux UID
+ * `so.oxy.shared`, and the Android Keystore is per UID. Clearing the storage of
+ * ANY sibling app (`pm clear`, or Settings › Apps › Storage › Clear storage)
+ * wipes the Keystore of the whole UID. Every copy the SDK keeps in
+ * expo-secure-store (primary, backup slot, phrase slot) and in the androidx
+ * encrypted prefs (the cross-app shared slot) is wrapped by a key in that
+ * Keystore, so they all die together, and until now the only way back was the
+ * recovery phrase.
+ *
+ * `@oxy.so/core` never imports a native module, so the store is injected by the
+ * app that owns the identity ({@link KeyManager.setDeviceBackupStore}). Commons
+ * registers Android Block Store; every other app registers nothing, which keeps
+ * every code path below a no-op for them. The design and the threat model are in
+ * `docs/identity/device-backup.md`.
+ */
+/**
+ * Where the device backup is kept. Implementations must hold the value outside
+ * the calling app's keystore (that is the whole point) and must never send it
+ * anywhere Oxy can read it.
+ *
+ * `read` resolves `null` when nothing is stored AND when the store cannot be
+ * reached (no Google Play services, an old binary without the native module):
+ * the caller treats both as "no device backup" and falls back to the phrase.
+ */
+export interface IdentityDeviceBackupStore {
+    /** Short name for logs, e.g. `android-block-store`. Never contains secrets. */
+    readonly name: string;
+    read(): Promise<string | null>;
+    write(value: string): Promise<void>;
+    clear(): Promise<void>;
+}
+/** The record format. Bump {@link DEVICE_BACKUP_VERSION} on a breaking change. */
+export declare const DEVICE_BACKUP_VERSION = 1;
+export interface DeviceBackupRecord {
+    version: typeof DEVICE_BACKUP_VERSION;
+    /** Canonical lowercase 64-hex secp256k1 private key. */
+    privateKey: string;
+    /** Canonical lowercase public key. */
+    publicKey: string;
+    /**
+     * The BIP-39 phrase, present only when it was verified to derive
+     * {@link publicKey}. Carried so a restored identity can still reveal its
+     * phrase in Settings and create the phrase-keyed Oxy backup; the phrase is
+     * never more powerful than the private key already in the record.
+     */
+    mnemonic?: string;
+    /** ISO-8601 time of the last write. */
+    updatedAt: string;
+}
+export declare function serializeDeviceBackup(record: DeviceBackupRecord): string;
+/**
+ * Parse a stored record, or `null` for anything that is not a well-formed
+ * version-1 record. Checks SHAPE only; the caller still proves the key pair is
+ * healthy (well-formed, public derives from private) before trusting it.
+ */
+export declare function parseDeviceBackup(raw: string | null | undefined): DeviceBackupRecord | null;

package/dist/types/crypto/keyManager.d.ts

@@ -5,6 +5,7 @@
  * Private keys are stored securely using expo-secure-store and never leave the device.
  */
 import { type IdentityMarker } from './identityMarker';
+import { type IdentityDeviceBackupStore } from './deviceBackup';
 /**
  * Thrown when an identity-mutating operation (createIdentity / importKeyPair)
  * is invoked while a valid identity already exists on the device.
@@ -79,10 +80,14 @@ export type IdentityStatus = {
  * which independent, `key_v1`-surviving source restored the identity. On failure
  * `reason` distinguishes "wasn't lost", "no surviving source", "a source held a
  * DIFFERENT account" (never silently switched), and "storage unavailable".
+ *
+ * `device-backup` is the copy held outside this app's keystore (Android Block
+ * Store in Commons, see {@link KeyManager.setDeviceBackupStore}); it is the only
+ * source that survives a wipe of the whole shared-UID keystore.
  */
 export type IdentityRecoveryResult = {
     recovered: true;
-    source: 'backup' | 'shared';
+    source: 'backup' | 'shared' | 'device-backup';
     publicKey: string;
 } | {
     recovered: false;
@@ -114,6 +119,23 @@ export declare class KeyManager {
      */
     private static slotMigrationPromise;
     private static slotMigrationResult;
+    /**
+     * The keystore-independent device backup, registered by the app that owns the
+     * identity (Commons). `null` in every other app, which makes every device
+     * backup path a no-op there. See `./deviceBackup`.
+     */
+    private static deviceBackupStore;
+    /**
+     * Register (or, with `null`, unregister) where the identity's device backup is
+     * kept. Call once at startup, before the first identity read, ONLY from the
+     * app that holds the self-custody identity: the backup is a full copy of the
+     * private key, and it belongs to exactly one app.
+     *
+     * From then on every create, import, rotation and restore refreshes the
+     * backup, a forced delete clears it, and {@link attemptIdentityRecovery}
+     * restores from it when the keystore copies are gone.
+     */
+    static setDeviceBackupStore(store: IdentityDeviceBackupStore | null): void;
     /**
      * Invalidate cached identity state
      * Called internally when identity is created/deleted/imported
@@ -347,6 +369,33 @@ export declare class KeyManager {
      * @internal
      */
     private static _persistIdentityAtomic;
+    /**
+     * Write the device backup for `(privateKey, publicKey)`, keeping the phrase an
+     * existing record already carries for the SAME identity. `mnemonic` replaces
+     * it, and must already be verified against `publicKey` by the caller.
+     * Best-effort: never throws, returns whether the store now holds this pair.
+     *
+     * @internal
+     */
+    private static _writeDeviceBackup;
+    /** Remove the device backup. Best-effort: never throws. @internal */
+    private static _clearDeviceBackup;
+    /** True when `phrase` is a valid BIP-39 phrase that derives `publicKey`. @internal */
+    private static _phraseDerivesPublicKey;
+    /** The primary pair when it reads back healthy, else `null`. Never throws. @internal */
+    private static _readHealthyPrimary;
+    /**
+     * Make sure the device backup holds the identity on this device, writing it
+     * when it is missing or stale. Commons calls this once per launch once the
+     * identity reads back healthy: it backfills identities created before the
+     * device backup existed, and repairs a backup whose last write failed (a
+     * failed write after a key rotation would otherwise leave the OLD key there).
+     *
+     * Carries the stored recovery phrase along only when it provably derives the
+     * current key. Resolves `true` when the backup is current, `false` when there
+     * is no store, no healthy identity, or the write failed. Never throws.
+     */
+    static ensureDeviceBackup(): Promise<boolean>;
     /**
      * Write/refresh the identity marker after a successful persist. A same-identity
      * re-persist (e.g. backup refresh, idempotent re-import) preserves `createdAt`
@@ -534,25 +583,43 @@ export declare class KeyManager {
      */
     static restoreIdentityFromBackup(): Promise<boolean>;
     /**
-     * Recovery ladder — restore a `lost` identity from an independent,
-     * `key_v1`-surviving source WITHOUT the user re-entering their recovery phrase.
+     * Recovery ladder — restore an identity whose keys are gone from an
+     * independent source WITHOUT the user re-entering their recovery phrase.
      *
-     * Gated on {@link getIdentityStatus} being `lost` (marker present, keys empty):
-     *   - `present` / `absent` → `not-lost` (nothing to recover / nothing lost)
-     *   - `unavailable`        → `unavailable` (keychain locked; retry later)
-     *
-     * Rungs, tried in order, each fully validated (well-formed + derive-match +
-     * `publicKey === marker.publicKey`, so a source holding a DIFFERENT account is
-     * SKIPPED, never restored):
-     *   1. the v2 backup slot (independent keychain key from the primary), then
+     * For a `lost` verdict (marker present, keys empty) the rungs are tried in
+     * order, each fully validated (well-formed + derive-match + `publicKey ===
+     * marker.publicKey`, so a source holding a DIFFERENT account is SKIPPED, never
+     * restored):
+     *   1. the v2 backup slot (independent keychain key from the primary),
      *   2. the cross-app shared slot (Android bridge `getShared` / iOS keychain
-     *      group) — the copy that survives a primary+backup `key_v1` death.
+     *      group) — the copy that survives a primary+backup `key_v1` death,
+     *   3. the device backup ({@link setDeviceBackupStore}; Android Block Store in
+     *      Commons) — the only copy that survives a wipe of the whole shared-UID
+     *      Android Keystore, which takes rungs 1 and 2 with it (oxy#1388).
+     *
+     * For an `absent` verdict (no keys AND no marker: this app's own data was
+     * cleared, or it was reinstalled) only rung 3 applies: a device backup there
+     * means an identity lived on this device and was never deleted (every delete
+     * clears the backup), so it is restored instead of letting onboarding create a
+     * new identity over it. Without a registered store the result stays
+     * `not-lost`, exactly as before.
+     *
+     * `present` → `not-lost`; `unavailable` (keychain locked) → `unavailable`.
+     * Everything here is on-device: no network, so it works offline.
      *
      * On success it re-persists via {@link _persistIdentityAtomic} (origin
      * `'restore'`) and invalidates the cache so routing re-reads `present`. When no
      * rung matches, the UI proceeds to recovery-phrase entry.
      */
     static attemptIdentityRecovery(): Promise<IdentityRecoveryResult>;
+    /** Read the device backup as a healthy, canonical candidate, or null. Never throws. @internal */
+    private static _readDeviceBackupCandidate;
+    /**
+     * Persist a device-backup candidate, then put its phrase back in the
+     * re-reveal slot (which died with the keystore) when it derives the key.
+     * @internal
+     */
+    private static _commitDeviceBackupRecovery;
     /** Read the active-layout backup slot as a healthy candidate, or null. @internal */
     private static _readBackupCandidate;
     /** Read the cross-app shared slot as a healthy candidate, or null. @internal */

package/dist/types/index.d.ts

@@ -61,6 +61,7 @@ export { KeyManager, IdentityAlreadyExistsError, IdentityPersistError, IdentityU
 export type { KeyPair, IdentityStatus, IdentityRecoveryResult } from './crypto/keyManager';
 export { readIdentityMarker, updateIdentityMarker, } from './crypto/identityMarker';
 export type { IdentityMarker } from './crypto/identityMarker';
+export type { IdentityDeviceBackupStore } from './crypto/deviceBackup';
 export { SignatureService } from './crypto/signatureService';
 export type { SignedMessage, AuthChallenge } from './crypto/signatureService';
 export { RecoveryPhraseService } from './crypto/recoveryPhrase';
@@ -129,7 +130,7 @@ export { isSwitchTargetAccount, canSwitchIntoAccount, } from './session/accountS
 export { resolveAccountDelegationAccess } from './session/accountDelegationAccess';
 export type { AccountDelegationAccess, AccountDelegationNode, } from './session/accountDelegationAccess';
 export { AccountDialogController, createAccountDialogController, } from './session/accountDialogController';
-export type { AccountDialogControllerOptions, AccountDialogSnapshot, AccountDialogView, CommonsAvailability, PopupWindowHandle, SignInFailureReason, SignInFlowPhase, SignInFlowState, SignInProgress, } from './session/accountDialogController';
+export type { AccountDialogControllerOptions, AccountDialogSnapshot, AccountDialogView, CommonsAvailability, ContextChoiceOutcome, PopupWindowHandle, SignInFailureReason, SignInFlowPhase, SignInFlowState, SignInProgress, } from './session/accountDialogController';
 export { createWebAuthStateStore, createNativeAuthStateStore, createMemoryAuthStateStore, AUTH_STATE_STORAGE_KEY, } from './session/authStateStore';
 export type { PersistedAuthState, AuthStateStore, NativeKeyValueStorage, } from './session/authStateStore';
 export { createSharedMirroringAuthStateStore, decideSharedDeviceJoin, decideSharedDevicePublish, normalizeSharedDeviceSessionRead, publishProvenDeviceCredential, readLocalDeviceCredential, } from './session/sharedDeviceCredential';

package/dist/types/mixins/OxyServices.linkedAccounts.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Linked Accounts Methods Mixin
+ *
+ * External accounts (any Mastodon-API server, Bluesky) the current user has
+ * PROVEN they own by completing an OAuth authorization there. Oxy uses that
+ * authorization only to learn which account granted it and then discards the
+ * token — nothing here ever carries a third-party token.
+ *
+ * The flow is a top-level browser navigation: {@link startLinkedAccount} returns
+ * the other network's `authorizeUrl`; open it (a new tab, or
+ * `expo-web-browser`'s auth session on native); the network sends the browser
+ * to Oxy's callback, and Oxy sends it to `returnTo` with `?link_code=<code>` or
+ * `?link_error=<code>`. Pass the code to {@link completeLinkedAccount} with the
+ * same user signed in: that call, not the callback, creates the link, so an
+ * authorization someone else started can never link to them. `returnTo` must
+ * be a redirect URI registered on the first-party application `clientId` names.
+ *
+ * Wire types live in `@oxy.so/contracts` (`linkedAccounts.ts`).
+ */
+import type { LinkedAccount, LinkedAccountNetwork, ServiceLinkedAccountListResponse, StartLinkedAccountRequest, StartLinkedAccountResponse } from '@oxy.so/contracts';
+import type { OxyServicesBase } from '../OxyServices.base';
+export declare function OxyServicesLinkedAccountsMixin<T extends typeof OxyServicesBase>(Base: T): {
+    new (...args: any[]): {
+        /** Inherited from the auth mixin at runtime. */
+        makeServiceRequest: <R = unknown>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: unknown, userId?: string) => Promise<R>;
+        /**
+         * Begin linking an external account for the current user.
+         *
+         * @param network - `'activitypub'` (any Mastodon-API server) or `'atproto'` (Bluesky).
+         * @param options - `instance` for ActivityPub (`mastodon.social`, or
+         *   `@user@mastodon.social`), `handle` for atproto; `clientId` + `returnTo`
+         *   to be sent back to your app afterwards.
+         * @returns The URL to open, and when the attempt expires (ten minutes).
+         */
+        startLinkedAccount(network: LinkedAccountNetwork, options: StartLinkedAccountRequest): Promise<StartLinkedAccountResponse>;
+        /**
+         * Finish a link with the `link_code` the callback appended to `returnTo`.
+         * Must be the user who started the flow: for anyone else the API answers
+         * 403 and burns the code. 409 when the account is already someone else's
+         * link. Repeating it within the code's five minutes returns the same link.
+         */
+        completeLinkedAccount(code: string): Promise<LinkedAccount>;
+        /** The current user's live linked accounts, oldest first. */
+        listLinkedAccounts(): Promise<LinkedAccount[]>;
+        /**
+         * Unlink one of the current user's accounts. An ActivityPub link stops being
+         * published as an `alsoKnownAs` alias, and the external account can then be
+         * linked to another Oxy account.
+         */
+        revokeLinkedAccount(linkedAccountId: string): Promise<void>;
+        /**
+         * SERVICE: a user's live linked accounts, each with the federated shadow
+         * user Oxy already holds for it (`federatedUserId`). Requires a service
+         * credential whose application holds the privileged `linked-accounts:read`.
+         */
+        getLinkedAccountsForUser(userId: string): Promise<ServiceLinkedAccountListResponse>;
+        httpService: import("../HttpService").HttpService;
+        cloudURL: string;
+        config: import("../OxyServices.base").OxyConfig;
+        __resetTokensForTests(): void;
+        makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
+        getBaseURL(): string;
+        getClient(): import("../HttpService").HttpService;
+        createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
+        getMetrics(): {
+            totalRequests: number;
+            successfulRequests: number;
+            failedRequests: number;
+            cacheHits: number;
+            cacheMisses: number;
+            averageResponseTime: number;
+        };
+        clearCache(): void;
+        clearCacheEntry(key: string): void;
+        clearCacheByPrefix(prefix: string): number;
+        getCacheStats(): {
+            size: number;
+            hits: number;
+            misses: number;
+            hitRate: number;
+        };
+        getCloudURL(): string;
+        setTokens(accessToken: string): void;
+        clearTokens(): void;
+        onTokensChanged(listener: (accessToken: string | null) => void): () => void;
+        _cachedUserId: string | null | undefined;
+        _cachedAccessToken: string | null;
+        getCurrentUserId(): string | null;
+        hasValidToken(): boolean;
+        getAccessToken(): string | null;
+        getAccessTokenExpiry(): number | null;
+        waitForAuth(timeoutMs?: number): Promise<boolean>;
+        withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
+            maxRetries?: number;
+            retryDelay?: number;
+            authTimeoutMs?: number;
+        }): Promise<T_1>;
+        validate(): Promise<boolean>;
+        handleError(error: unknown): Error;
+        healthCheck(): Promise<{
+            status: string;
+            users?: number;
+            timestamp?: string;
+            [key: string]: any;
+        }>;
+    };
+} & T;

package/dist/types/mixins/OxyServices.user.d.ts

@@ -1,6 +1,7 @@
 /**
  * User Management Methods Mixin
  */
+import type { CreateOxyNotificationRequest } from '@oxy.so/contracts';
 import type { User, Notification, NotificationPreferences, UserPreferences, SearchProfilesResponse, PrivacySettings } from '../models/interfaces';
 import type { UserNameResponse, UserProfileUpdate, RecommendationRequest, RecommendationItem, ThemePreference } from '@oxy.so/contracts';
 import type { OxyServicesBase } from '../OxyServices.base';
@@ -495,9 +496,13 @@ export declare function OxyServicesUserMixin<T extends typeof OxyServicesBase>(B
          */
         getUnreadCount(): Promise<number>;
         /**
-         * Create notification
+         * Create a notification (`POST /notifications`; the API requires a service
+         * token whose application holds `notifications:write`). `type` is one of
+         * `OXY_NOTIFICATION_TYPES` from `@oxy.so/contracts` — `system` for a message
+         * from an Oxy service about the recipient's own account, with the recipient
+         * as actor and their profile as the entity.
          */
-        createNotification(data: Partial<Notification>): Promise<Notification>;
+        createNotification(data: CreateOxyNotificationRequest | Partial<Notification>): Promise<Notification>;
         /**
          * Mark notification as read
          */

package/dist/types/mixins/index.d.ts

@@ -34,6 +34,7 @@ import { OxyServicesNodesMixin } from './OxyServices.nodes';
 import { OxyServicesFollowGraphMixin } from './OxyServices.followGraph';
 import { OxyServicesInferenceMixin } from './OxyServices.inference';
 import { OxyServicesDeviceBootMixin } from './OxyServices.deviceBoot';
+import { OxyServicesLinkedAccountsMixin } from './OxyServices.linkedAccounts';
 /**
  * Instance shape of every mixin in the pipeline, intersected. The runtime
  * `composeOxyServices()` produces a class whose instances expose all of
@@ -43,7 +44,7 @@ import { OxyServicesDeviceBootMixin } from './OxyServices.deviceBoot';
  * If you add a new mixin to `MIXIN_PIPELINE`, add it here too so its methods
  * are visible without a cast.
  */
-type AllMixinInstances = InstanceType<ReturnType<typeof OxyServicesAuthMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesUserMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesIdentityMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesIdentityBackupMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesPrivacyMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLanguageMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesPaymentMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesReputationMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAssetsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAccountsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesConnectedAppsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAgencyMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesStoreMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLocationMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAnalyticsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesDevicesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesSecurityMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesFeaturesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesTopicsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesContactsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesNotificationsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAppDataMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesCivicMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesChainsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesNodesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesFollowGraphMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesInferenceMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesDeviceBootMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesUtilityMixin<typeof OxyServicesBase>>>;
+type AllMixinInstances = InstanceType<ReturnType<typeof OxyServicesAuthMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesUserMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesIdentityMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesIdentityBackupMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesPrivacyMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLanguageMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesPaymentMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesReputationMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAssetsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAccountsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesConnectedAppsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAgencyMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesStoreMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLocationMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAnalyticsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesDevicesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesSecurityMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesFeaturesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesTopicsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesContactsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesNotificationsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAppDataMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesCivicMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesChainsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesNodesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesFollowGraphMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesInferenceMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesDeviceBootMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLinkedAccountsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesUtilityMixin<typeof OxyServicesBase>>>;
 /**
  * Constructor type for the fully composed mixin pipeline. Each mixin returns
  * a new constructor that augments its input; reducing across the pipeline

package/dist/types/models/interfaces.d.ts

@@ -99,6 +99,13 @@ export interface User {
      * lists, profile search) — the two are separate fields on the User document.
      */
     description?: string;
+    /**
+     * ActivityPub actor URIs this account is also known as — its live,
+     * OAuth-proven linked Mastodon-API accounts. Emitted by
+     * `GET /profiles/username/:username`; a relying app passes it to the shared
+     * actor builder (`@oxy.so/federation`) so its actor publishes it.
+     */
+    alsoKnownAs?: string[];
     phone?: string;
     address?: string;
     /** Legacy free-text birthday, kept for backward compatibility. Prefer `dateOfBirth`. */
@@ -237,6 +244,22 @@ export interface LoginResponse {
 export interface Notification {
     id: string;
     message: string;
+    /** One of `OXY_NOTIFICATION_TYPES` (`@oxy.so/contracts`). */
+    type?: string;
+    /**
+     * `system` notifications only (with `message`): the text an Oxy service sent
+     * about the recipient's own account. Render these two instead of composing a
+     * sentence from actor + entity.
+     */
+    title?: string;
+    /** `system` notifications only: an optional deep link (https or the sending app's scheme). */
+    url?: string;
+    /**
+     * What `entityId` names: `post` | `reply` | `profile`, or `app` — an opaque id
+     * in the notifying application's namespace (`system` notifications only).
+     */
+    entityType?: string;
+    entityId?: string;
 }
 export interface Wallet {
     id: string;
@@ -594,6 +617,13 @@ export interface ServiceAssetMetadata {
      * play. Treat absence as "no adaptive stream, play the progressive original".
      */
     hlsReadyAt?: string;
+    /**
+     * The Oxy user who owns the file (`null` for a system-owned file such as the
+     * federated media cache). PRESENT ONLY for Oxy's own applications (service
+     * tokens with `tier: 'internal'`), so a first-party service can check that an
+     * asset a user attached is really that user's. Absent for every other caller.
+     */
+    ownerUserId?: string | null;
 }
 /**
  * Reverse-lookup asset metadata returned by `POST /assets/service/by-sha256`.

package/dist/types/server/securityHeaders.d.ts

@@ -161,6 +161,11 @@ export interface OxyPagesHeadersOptions {
      * the app — is REMOVED from `script-src` and `connect-src`, so third-party
      * measurement cannot run there even when the zone has Web Analytics enabled.
      * A structural block in the policy the page is served with, not a build flag.
+     *
+     * It also sends `Cache-Control: no-transform`, which stops the edge from
+     * injecting the beacon at all — otherwise every page load logs a CSP
+     * violation for a script we never asked for. The rest of the value is Pages'
+     * own default, so caching is unchanged.
      */
     sensitive?: boolean;
     /**

package/dist/types/session/accountDialogController.d.ts

@@ -233,6 +233,16 @@ export interface AccountDialogSnapshot {
      * table of their own.
      */
     backView: AccountDialogView | null;
+    /**
+     * Whether THIS client is signed in: a bearer is planted.
+     *
+     * Not the same question as "does the directory list anyone". The directory is
+     * the DEVICE's, and a device can go on listing a shared identity (Commons, or a
+     * sibling app) after this app signed out. A host names its sign-in entry, and
+     * whether a listed account reads as the current one, from this — never from
+     * the directory's size.
+     */
+    hasSession: boolean;
     /**
      * The server-authoritative device directory — principals and the contexts
      * each may act as (ADR 0002) — or `null` before the first read.
@@ -259,6 +269,20 @@ export interface AccountDialogSnapshot {
     /** Whether Commons is installed on this device. See {@link CommonsAvailability}. */
     commonsAvailability: CommonsAvailability;
 }
+/**
+ * What {@link AccountDialogController.chooseContext} did with a chosen row.
+ *
+ * - `'current'` — the row is already the active account; nothing to do.
+ * - `'switched'` — the switch to the row happened (signed in; or signed out,
+ *   after the silent sign-in landed on a different pair and the chosen one was
+ *   then activated).
+ * - `'signing-in'` — signed out: the row started "Continue with Oxy", and the
+ *   sign-in flow (its own view, its own completion) owns what happens next —
+ *   including closing the dialog, through `onSignedIn`.
+ * - `'failed'` — the switch was attempted and failed (the reason is `error`).
+ * - `'busy'` — another device mutation is in flight; the press was dropped.
+ */
+export type ContextChoiceOutcome = 'current' | 'switched' | 'signing-in' | 'failed' | 'busy';
 /** Construction options for {@link AccountDialogController}. */
 export interface AccountDialogControllerOptions {
     /** The API client. Source of graph accounts, profiles, and the sign-in methods. */
@@ -525,6 +549,27 @@ export declare class AccountDialogController {
      * device mutation is in flight ({@link isDeviceMutationInFlight}).
      */
     activateContext(contextId: string): Promise<boolean>;
+    /**
+     * A device account row was chosen — the one entry point for "use this
+     * account", whether or not anybody is signed in here.
+     *
+     * Signed in, it is a switch: the active row is already the answer
+     * (`'current'`), any other row is {@link activateContext}.
+     *
+     * Signed out, it is NOT a switch. The row is on the list because the DEVICE
+     * still holds that identity (Commons' shared identity, or a sibling app's
+     * session), not because this app does, so there is no bearer to activate a
+     * context with — and the active-row short-circuit used to read that stale
+     * "active" as "already signed in" and close the sheet on a signed-out app
+     * (OxyHQ/oxy#1375 item 20). Choosing the row is "Continue as @handle": the
+     * same {@link signInWithOxy} path as the "Continue with Oxy" button, which
+     * mints silently from the shared identity and otherwise falls back to the
+     * request. When that silent mint lands on a different pair from the one
+     * chosen (a device holding more than one person, or an organization row), the
+     * chosen row is then activated under the new bearer, so the press ends where
+     * it pointed.
+     */
+    chooseContext(contextId: string): Promise<ContextChoiceOutcome>;
     /**
      * Remove ONE `principal → account` pair, and only that pair.
      *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/core",
-  "version": "1.10.0",
+  "version": "1.12.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -118,7 +118,7 @@
     "@oxy.so/telemetry": "^1.1.1",
     "@noble/ciphers": "^1.3.0",
     "@noble/hashes": "^1.8.0",
-    "@oxy.so/contracts": "^1.4.0",
+    "@oxy.so/contracts": "^1.5.0",
     "@oxy.so/protocol": "^1.1.1",
     "@scure/bip39": "^1.6.0",
     "buffer": "^6.0.3",