@oxy.so/core 1.12.1 → 1.16.0

package/dist/esm/i18n/locales/locales/zh-CN.json

@@ -1,53 +1,48 @@
 {
   "signin": {
     "title": "登录",
-    "subtitle": "登录以继续",
-    "addAccountTitle": "添加另一个账户",
+    "subtitle": "使用你的 Oxy 账号",
+    "addAccountTitle": "添加其他账号",
     "addAccountSubtitle": "使用另一个账户登录",
     "username": {
       "label": "用户名",
-      "placeholder": "输入您的用户名",
-      "helper": "3-30个字符，仅字母和数字",
-      "required": "请输入您的用户名。",
-      "minLength": "用户名必须至少包含3个字符。"
-    },
-    "password": {
-      "label": "密码",
-      "placeholder": "输入您的密码",
-      "required": "请输入您的密码。",
-      "hint": "输入您的密码以登录"
+      "placeholder": "yourname",
+      "required": "请输入您的用户名。"
     },
     "actions": {
       "continue": "继续",
-      "back": "返回",
-      "signIn": "登录",
-      "verify": "验证",
-      "openAccountSwitcher": "切换到另一个账户",
-      "openAccountSwitcherSubtitle": "{{count}}个其他账户可用",
-      "openAccountSwitcherSubtitle_singular": "1个其他账户可用",
-      "openAccountSwitcherSubtitle_zero": "查看您保存的账户",
-      "manageAccounts": "管理保存的账户",
-      "manageAccountsSubtitle": "查看会话、删除或登出",
-      "loadingOtherAccounts": "加载其他账户中…",
-      "switchAccountFailed": "无法切换账户。请重试。"
-    },
-    "forgotPrompt": "忘记密码？",
-    "security": {
-      "dataSecure": "您的数据已加密且安全"
+      "back": "返回"
     },
-    "currentlySignedInAs": "当前登录为",
-    "alreadySignedInWith": "已登录",
-    "alreadySignedIn": "已登录",
-    "alreadySignedInMessage": "此账户已登录。继续使用此账户？",
-    "continueWithAccount": "继续",
-    "currentAccount": "当前",
-    "or": "或",
-    "viewAllAccounts": "查看更多{{count}}个",
     "createAccountLink": "初次使用 Oxy？创建账户",
     "status": {
-      "accountSwitched": "正在使用{{name}}",
       "signingIn": "正在登录…"
-    }
+    },
+    "subtitleToApp": "以继续前往 {{app}}",
+    "orContinueWith": "或使用以下方式继续",
+    "qr": {
+      "caption": "使用 Commons 扫码登录",
+      "renew": "显示新的二维码"
+    },
+    "methods": {
+      "passkey": "使用通行密钥登录"
+    },
+    "errors": {
+      "rateLimited": "尝试次数过多。请在 {{seconds}} 秒后重试。",
+      "passkeyCancelled": "通行密钥提示已关闭。准备好后请重试。",
+      "passkeyFailed": "无法完成通行密钥验证。请重试。"
+    },
+    "chooser": {
+      "subtitleToApp": "以继续前往 {{app}}"
+    },
+    "terms": {
+      "before": "继续即表示你同意我们的",
+      "termsLink": "服务条款",
+      "and": "和",
+      "privacyLink": "隐私政策"
+    },
+    "noAccount": "还没有账号？",
+    "createAccount": "创建账号",
+    "recoverLink": "丢失了通行密钥？恢复你的账号"
   },
   "signup": {
     "title": "创建您的账户",
@@ -55,56 +50,9 @@
     "createInCommons": "在 Commons 中创建您的身份",
     "createAccount": "创建账户",
     "backToSignInLink": "已有账户？登录",
-    "welcome": {
-      "title": "欢迎使用Oxy！",
-      "subtitle": "只需几步即可创建您的账户",
-      "haveAccount": "已有账户？",
-      "signInCta": "登录"
-    },
-    "identity": {
-      "title": "您是谁？",
-      "subtitle": "选择您的用户名并输入您的电子邮件"
-    },
-    "username": {
-      "helper": "3-30个字符，仅字母和数字",
-      "required": "请输入用户名",
-      "minLength": "用户名必须至少包含3个字符"
-    },
-    "email": {
-      "required": "请输入电子邮件地址",
-      "invalid": "请输入有效的电子邮件地址",
-      "helper": "我们绝不会分享您的电子邮件"
-    },
-    "security": {
-      "title": "保护您的账户",
-      "subtitle": "创建强密码以保护您的账户"
-    },
-    "password": {
-      "helper": "至少8个字符",
-      "required": "请输入密码",
-      "minLength": "密码必须至少包含8个字符",
-      "confirmRequired": "请确认您的密码",
-      "mismatch": "密码不匹配",
-      "confirmHint": "重新输入您的密码以确认"
-    },
-    "summary": {
-      "title": "快完成了！",
-      "subtitle": "查看您的信息并创建账户",
-      "sectionTitle": "账户信息",
-      "fields": {
-        "username": "用户名",
-        "email": "电子邮件",
-        "password": "密码"
-      },
-      "notSet": "未设置",
-      "securityTip": "为了更强的安全性，创建账户后，请在账户设置中启用生物识别身份验证。",
-      "legalReminder": "创建账户即表示您同意我们的服务条款和隐私政策。"
-    }
+    "webSubtitle": "无需密码。你的设备会创建通行密钥，你的账号会获得一个只有你保管的恢复短语。"
   },
   "accountSwitcher": {
-    "sections": {
-      "yourAccounts": "你的账户"
-    },
     "loading": "正在加载账户...",
     "qrHeadline": "使用您的 Oxy 身份登录",
     "signInWithOxy": "使用 Oxy 登录",
@@ -136,10 +84,7 @@
       "claimFailed": "登录已获批准，但未能完成。请重试。",
       "generic": "登录失败，请重试。"
     },
-    "linkOpenFailed": "无法打开链接，请重试。",
-    "continueWithPasskey": "继续",
-    "passkeyHint": "使用指纹、面容或设备 PIN 码。",
-    "otherDeviceCommons": "账号在其他设备上？用 Commons 扫码"
+    "linkOpenFailed": "无法打开链接，请重试。"
   },
   "common": {
     "actions": {

package/dist/esm/i18n/locales/pt-PT.json

@@ -1,53 +1,48 @@
 {
     "signin": {
         "title": "Iniciar sessão",
-        "subtitle": "Inicie sessão para continuar",
+        "subtitle": "Usa a tua conta Oxy",
         "addAccountTitle": "Adicionar outra conta",
         "addAccountSubtitle": "Iniciar sessão com outra conta",
         "username": {
             "label": "Nome de utilizador",
-            "placeholder": "Introduza o seu nome de utilizador",
-            "helper": "3-30 caracteres, apenas letras e números",
-            "required": "Por favor, introduza o seu nome de utilizador.",
-            "minLength": "O nome de utilizador deve ter pelo menos 3 caracteres."
-        },
-        "password": {
-            "label": "Palavra-passe",
-            "placeholder": "Introduza a sua palavra-passe",
-            "required": "Por favor, introduza a sua palavra-passe.",
-            "hint": "Introduza a sua palavra-passe para iniciar sessão"
+            "placeholder": "oteunome",
+            "required": "Por favor, introduza o seu nome de utilizador."
         },
         "actions": {
             "continue": "Continuar",
-            "back": "Voltar",
-            "signIn": "Iniciar sessão",
-            "verify": "Verificar",
-            "openAccountSwitcher": "Mudar para outra conta",
-            "openAccountSwitcherSubtitle": "{{count}} outras contas disponíveis",
-            "openAccountSwitcherSubtitle_singular": "1 outra conta disponível",
-            "openAccountSwitcherSubtitle_zero": "Revise as suas contas guardadas",
-            "manageAccounts": "Gerir contas guardadas",
-            "manageAccountsSubtitle": "Rever sessões, remover ou terminar sessão",
-            "loadingOtherAccounts": "A carregar outras contas…",
-            "switchAccountFailed": "Não foi possível mudar de conta. Por favor, tente novamente."
+            "back": "Voltar"
         },
-        "forgotPrompt": "Esqueceu-se da palavra-passe?",
-        "security": {
-            "dataSecure": "Os seus dados estão encriptados e seguros"
-        },
-        "currentlySignedInAs": "Atualmente com sessão iniciada como",
-        "alreadySignedInWith": "Já tem sessão iniciada com",
-        "alreadySignedIn": "Já tem sessão iniciada",
-        "alreadySignedInMessage": "Esta conta já tem sessão iniciada. Continuar com esta conta?",
-        "continueWithAccount": "Continuar",
-        "currentAccount": "Atual",
-        "or": "ou",
-        "viewAllAccounts": "Ver mais {{count}}",
         "createAccountLink": "Novo no Oxy? Crie uma conta",
         "status": {
-            "accountSwitched": "Agora a usar {{name}}",
             "signingIn": "A iniciar sessão…"
-        }
+        },
+        "subtitleToApp": "para continuar para {{app}}",
+        "orContinueWith": "ou continua com",
+        "qr": {
+            "caption": "Lê com o Commons para entrar",
+            "renew": "Mostrar um código novo"
+        },
+        "methods": {
+            "passkey": "Entrar com uma chave de acesso"
+        },
+        "errors": {
+            "rateLimited": "Demasiadas tentativas. Tenta novamente dentro de {{seconds}} s.",
+            "passkeyCancelled": "Fechaste o pedido da chave de acesso. Tenta novamente quando quiseres.",
+            "passkeyFailed": "Não foi possível concluir a chave de acesso. Tenta novamente."
+        },
+        "chooser": {
+            "subtitleToApp": "para continuar para {{app}}"
+        },
+        "terms": {
+            "before": "Ao continuar, aceitas os nossos",
+            "termsLink": "Termos de serviço",
+            "and": "e a",
+            "privacyLink": "Política de privacidade"
+        },
+        "noAccount": "Não tens conta?",
+        "createAccount": "Criar conta",
+        "recoverLink": "Perdeste a chave de acesso? Recupera a tua conta"
     },
     "signup": {
         "title": "Crie a sua conta",
@@ -55,56 +50,9 @@
         "createInCommons": "Crie a sua identidade no Commons",
         "createAccount": "Criar conta",
         "backToSignInLink": "Já tem uma conta? Inicie sessão",
-        "welcome": {
-            "title": "Bem-vindo ao Oxy!",
-            "subtitle": "Crie a sua conta em poucos passos",
-            "haveAccount": "Já tem uma conta?",
-            "signInCta": "Iniciar sessão"
-        },
-        "identity": {
-            "title": "Quem é?",
-            "subtitle": "Escolha o seu nome de utilizador e introduza o seu email"
-        },
-        "username": {
-            "helper": "3-30 caracteres, apenas letras e números",
-            "required": "Por favor, introduza um nome de utilizador",
-            "minLength": "O nome de utilizador deve ter pelo menos 3 caracteres"
-        },
-        "email": {
-            "required": "Por favor, introduza um endereço de email",
-            "invalid": "Por favor, introduza um endereço de email válido",
-            "helper": "Nunca partilharemos o seu email"
-        },
-        "security": {
-            "title": "Proteja a sua conta",
-            "subtitle": "Crie uma palavra-passe forte para proteger a sua conta"
-        },
-        "password": {
-            "helper": "Pelo menos 8 caracteres",
-            "required": "Por favor, introduza uma palavra-passe",
-            "minLength": "A palavra-passe deve ter pelo menos 8 caracteres",
-            "confirmRequired": "Por favor, confirme a sua palavra-passe",
-            "mismatch": "As palavras-passe não coincidem",
-            "confirmHint": "Reintroduza a sua palavra-passe para confirmar"
-        },
-        "summary": {
-            "title": "Quase lá!",
-            "subtitle": "Revise as suas informações e crie a sua conta",
-            "sectionTitle": "Informações da conta",
-            "fields": {
-                "username": "Nome de utilizador",
-                "email": "Email",
-                "password": "Palavra-passe"
-            },
-            "notSet": "Não definido",
-            "securityTip": "Para maior segurança, ative a autenticação biométrica nas Definições da conta após criar a sua conta.",
-            "legalReminder": "Ao criar uma conta, concorda com os nossos Termos de Serviço e Política de Privacidade."
-        }
+        "webSubtitle": "Sem palavra-passe. O teu dispositivo cria uma chave de acesso e a tua conta recebe uma frase de recuperação que só tu guardas."
     },
     "accountSwitcher": {
-        "sections": {
-            "yourAccounts": "As suas contas"
-        },
         "loading": "A carregar contas...",
         "qrHeadline": "Inicie sessão com a sua identidade Oxy",
         "signInWithOxy": "Iniciar sessão com Oxy",
@@ -136,10 +84,7 @@
             "claimFailed": "O início de sessão foi aprovado, mas não conseguimos concluí-lo. Tente novamente.",
             "generic": "Não foi possível iniciar sessão. Tente novamente."
         },
-        "linkOpenFailed": "Não foi possível abrir a ligação. Tente novamente.",
-        "continueWithPasskey": "Continuar",
-        "passkeyHint": "Use a impressão digital, o rosto ou o PIN do dispositivo.",
-        "otherDeviceCommons": "Conta noutro dispositivo? Digitalize com o Commons"
+        "linkOpenFailed": "Não foi possível abrir a ligação. Tente novamente."
     },
     "common": {
         "actions": {

package/dist/esm/i18n/locales/zh-CN.json

@@ -1,53 +1,48 @@
 {
     "signin": {
         "title": "登录",
-        "subtitle": "登录以继续",
-        "addAccountTitle": "添加另一个账户",
+        "subtitle": "使用你的 Oxy 账号",
+        "addAccountTitle": "添加其他账号",
         "addAccountSubtitle": "使用另一个账户登录",
         "username": {
             "label": "用户名",
-            "placeholder": "输入您的用户名",
-            "helper": "3-30个字符，仅字母和数字",
-            "required": "请输入您的用户名。",
-            "minLength": "用户名必须至少包含3个字符。"
-        },
-        "password": {
-            "label": "密码",
-            "placeholder": "输入您的密码",
-            "required": "请输入您的密码。",
-            "hint": "输入您的密码以登录"
+            "placeholder": "yourname",
+            "required": "请输入您的用户名。"
         },
         "actions": {
             "continue": "继续",
-            "back": "返回",
-            "signIn": "登录",
-            "verify": "验证",
-            "openAccountSwitcher": "切换到另一个账户",
-            "openAccountSwitcherSubtitle": "{{count}}个其他账户可用",
-            "openAccountSwitcherSubtitle_singular": "1个其他账户可用",
-            "openAccountSwitcherSubtitle_zero": "查看您保存的账户",
-            "manageAccounts": "管理保存的账户",
-            "manageAccountsSubtitle": "查看会话、删除或登出",
-            "loadingOtherAccounts": "加载其他账户中…",
-            "switchAccountFailed": "无法切换账户。请重试。"
-        },
-        "forgotPrompt": "忘记密码？",
-        "security": {
-            "dataSecure": "您的数据已加密且安全"
+            "back": "返回"
         },
-        "currentlySignedInAs": "当前登录为",
-        "alreadySignedInWith": "已登录",
-        "alreadySignedIn": "已登录",
-        "alreadySignedInMessage": "此账户已登录。继续使用此账户？",
-        "continueWithAccount": "继续",
-        "currentAccount": "当前",
-        "or": "或",
-        "viewAllAccounts": "查看更多{{count}}个",
         "createAccountLink": "初次使用 Oxy？创建账户",
         "status": {
-            "accountSwitched": "正在使用{{name}}",
             "signingIn": "正在登录…"
-        }
+        },
+        "subtitleToApp": "以继续前往 {{app}}",
+        "orContinueWith": "或使用以下方式继续",
+        "qr": {
+            "caption": "使用 Commons 扫码登录",
+            "renew": "显示新的二维码"
+        },
+        "methods": {
+            "passkey": "使用通行密钥登录"
+        },
+        "errors": {
+            "rateLimited": "尝试次数过多。请在 {{seconds}} 秒后重试。",
+            "passkeyCancelled": "通行密钥提示已关闭。准备好后请重试。",
+            "passkeyFailed": "无法完成通行密钥验证。请重试。"
+        },
+        "chooser": {
+            "subtitleToApp": "以继续前往 {{app}}"
+        },
+        "terms": {
+            "before": "继续即表示你同意我们的",
+            "termsLink": "服务条款",
+            "and": "和",
+            "privacyLink": "隐私政策"
+        },
+        "noAccount": "还没有账号？",
+        "createAccount": "创建账号",
+        "recoverLink": "丢失了通行密钥？恢复你的账号"
     },
     "signup": {
         "title": "创建您的账户",
@@ -55,56 +50,9 @@
         "createInCommons": "在 Commons 中创建您的身份",
         "createAccount": "创建账户",
         "backToSignInLink": "已有账户？登录",
-        "welcome": {
-            "title": "欢迎使用Oxy！",
-            "subtitle": "只需几步即可创建您的账户",
-            "haveAccount": "已有账户？",
-            "signInCta": "登录"
-        },
-        "identity": {
-            "title": "您是谁？",
-            "subtitle": "选择您的用户名并输入您的电子邮件"
-        },
-        "username": {
-            "helper": "3-30个字符，仅字母和数字",
-            "required": "请输入用户名",
-            "minLength": "用户名必须至少包含3个字符"
-        },
-        "email": {
-            "required": "请输入电子邮件地址",
-            "invalid": "请输入有效的电子邮件地址",
-            "helper": "我们绝不会分享您的电子邮件"
-        },
-        "security": {
-            "title": "保护您的账户",
-            "subtitle": "创建强密码以保护您的账户"
-        },
-        "password": {
-            "helper": "至少8个字符",
-            "required": "请输入密码",
-            "minLength": "密码必须至少包含8个字符",
-            "confirmRequired": "请确认您的密码",
-            "mismatch": "密码不匹配",
-            "confirmHint": "重新输入您的密码以确认"
-        },
-        "summary": {
-            "title": "快完成了！",
-            "subtitle": "查看您的信息并创建账户",
-            "sectionTitle": "账户信息",
-            "fields": {
-                "username": "用户名",
-                "email": "电子邮件",
-                "password": "密码"
-            },
-            "notSet": "未设置",
-            "securityTip": "为了更强的安全性，创建账户后，请在账户设置中启用生物识别身份验证。",
-            "legalReminder": "创建账户即表示您同意我们的服务条款和隐私政策。"
-        }
+        "webSubtitle": "无需密码。你的设备会创建通行密钥，你的账号会获得一个只有你保管的恢复短语。"
     },
     "accountSwitcher": {
-        "sections": {
-            "yourAccounts": "你的账户"
-        },
         "loading": "正在加载账户...",
         "qrHeadline": "使用您的 Oxy 身份登录",
         "signInWithOxy": "使用 Oxy 登录",
@@ -136,10 +84,7 @@
             "claimFailed": "登录已获批准，但未能完成。请重试。",
             "generic": "登录失败，请重试。"
         },
-        "linkOpenFailed": "无法打开链接，请重试。",
-        "continueWithPasskey": "继续",
-        "passkeyHint": "使用指纹、面容或设备 PIN 码。",
-        "otherDeviceCommons": "账号在其他设备上？用 Commons 扫码"
+        "linkOpenFailed": "无法打开链接，请重试。"
     },
     "common": {
         "actions": {

package/dist/esm/index.js

@@ -34,6 +34,7 @@ export { getCommonsApprovalBlockingReason, parseCommonsApprovalExpiresAt, } from
 // Automatic "Sign in with Oxy" delivery selection — ONE pure decision that maps
 // the caller's facts onto exactly one primary route (open Commons / await push / QR).
 export { selectCommonsDelivery, pushTargetsFromDelivery, commonsDeliveryPlatform } from './utils/commonsDelivery.js';
+export { OxyAccountEventError, OXY_ACCOUNT_DELETED_EVENT_URI } from './mixins/OxyServices.utility.js';
 export { OxyAppDataIdentifierError } from './mixins/OxyServices.appData.js';
 // ---------------------------------------------------------------------------
 // User identity and handles
@@ -157,7 +158,7 @@ export { buildAccountsArray, createQuickAccount, getAccountDisplayName, getAccou
 // `*.oxy.so`).
 // ---------------------------------------------------------------------------
 export { registrableApex } from './utils/registrableApex.js';
-export { CENTRAL_IDP_APEX, IDENTITY_WEB_ORIGIN } from './utils/authWebUrl.js';
+export { AUTH_WEB_ORIGIN, CENTRAL_IDP_APEX } from './utils/authWebUrl.js';
 // WebAuthn relying-party origin guard (client side). Mirrors the server's
 // `isOxyApexOrigin` so consumers can decide whether to offer passkey UI on the
 // current page (first-party Oxy origin / loopback only).

package/dist/esm/mixins/OxyServices.utility.js

@@ -7,6 +7,15 @@ import { jwtDecode } from 'jwt-decode';
 import { loadNodeCrypto } from '@oxy.so/protocol';
 import { logger } from '../logger/index.js';
 import { OXY_SERVICE_ENVIRONMENTS } from '../utils/oxyServiceEnvironment.js';
+/** The SET `events` member Oxy uses for an account deletion. */
+export const OXY_ACCOUNT_DELETED_EVENT_URI = 'https://oxy.so/events/account.deleted';
+/** Why an account event token was refused. `message` never contains the token. */
+export class OxyAccountEventError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'OxyAccountEventError';
+    }
+}
 /**
  * Expected JWT audience for tokens issued by the Oxy auth service.
  */
@@ -133,6 +142,135 @@ export function OxyServicesUtilityMixin(Base) {
                 return null;
             }
         }
+        /**
+         * Verify an account event token from Oxy — the body of an account-event
+         * webhook, or an entry's `token` from `listAccountEvents` — and return the
+         * event. Throws {@link OxyAccountEventError} unless the token is an
+         * EdDSA-signed `secevent+jwt` from Oxy's published key set, issued by
+         * `oxy-auth`, addressed to this application, carrying exactly one known
+         * event. A service token (`typ: JWT`) is refused here, as this token is
+         * refused as a service token.
+         *
+         * Node only (it needs `node:crypto`). The caller must still be idempotent on
+         * `eventId`: Oxy delivers at least once, by push and by pull.
+         */
+        async verifyAccountEvent(token, options = {}) {
+            if (typeof token !== 'string' || token.length === 0 || token.length > 16 * 1024) {
+                throw new OxyAccountEventError('Account event token is missing or oversized');
+            }
+            const parts = token.split('.');
+            if (parts.length !== 3 || parts.some((part) => part.length === 0)) {
+                throw new OxyAccountEventError('Account event token is not a compact JWS');
+            }
+            const [headerB64, payloadB64, signatureB64] = parts;
+            let header;
+            let payload;
+            try {
+                header = parseJsonSegment(headerB64);
+                payload = parseJsonSegment(payloadB64);
+            }
+            catch {
+                throw new OxyAccountEventError('Account event token is malformed');
+            }
+            if (Object.keys(header).length !== 3
+                || header.alg !== 'EdDSA'
+                || header.typ !== 'secevent+jwt'
+                || typeof header.kid !== 'string'
+                || !/^[A-Za-z0-9._-]{1,128}$/.test(header.kid)) {
+                throw new OxyAccountEventError('Account event token header is not supported');
+            }
+            const nodeCrypto = await loadNodeCrypto();
+            let jwk;
+            try {
+                jwk = await resolveServiceTokenPublicKey(header.kid, options.jwksUrl ?? new URL('/.well-known/jwks.json', this.getBaseURL()).toString(), this._serviceTokenJwksCache);
+            }
+            catch (error) {
+                throw new OxyAccountEventError(error instanceof Error ? error.message.replace('Service token', 'Account event') : 'Signing key is unavailable');
+            }
+            const signature = Buffer.from(signatureB64, 'base64url');
+            if (signature.toString('base64url') !== signatureB64 || signature.length !== 64) {
+                throw new OxyAccountEventError('Account event token signature is malformed');
+            }
+            let verified = false;
+            try {
+                const publicKey = nodeCrypto.createPublicKey({ key: jwk, format: 'jwk' });
+                verified = nodeCrypto.verify(null, Buffer.from(`${headerB64}.${payloadB64}`), publicKey, signature);
+            }
+            catch {
+                verified = false;
+            }
+            if (!verified)
+                throw new OxyAccountEventError('Account event token signature is invalid');
+            if (payload.iss !== OXY_JWT_ISSUER) {
+                throw new OxyAccountEventError('Account event token issuer is not Oxy');
+            }
+            const audience = options.audience ?? await this._configuredServiceAppId();
+            if (typeof payload.aud !== 'string' || payload.aud !== audience) {
+                throw new OxyAccountEventError('Account event token is addressed to another application');
+            }
+            if (typeof payload.jti !== 'string' || payload.jti.length === 0 || payload.jti.length > 128) {
+                throw new OxyAccountEventError('Account event token has no event id');
+            }
+            if (typeof payload.iat !== 'number' || !Number.isFinite(payload.iat)) {
+                throw new OxyAccountEventError('Account event token has no issue time');
+            }
+            const events = payload.events;
+            if (typeof events !== 'object' || events === null || Array.isArray(events)) {
+                throw new OxyAccountEventError('Account event token carries no events');
+            }
+            const entries = Object.entries(events);
+            const deleted = events[OXY_ACCOUNT_DELETED_EVENT_URI];
+            if (entries.length !== 1 || typeof deleted !== 'object' || deleted === null || Array.isArray(deleted)) {
+                throw new OxyAccountEventError('Account event token carries an unknown event');
+            }
+            const body = deleted;
+            if (typeof body.userId !== 'string' || body.userId.length === 0 || body.userId.length > 128) {
+                throw new OxyAccountEventError('Account event names no account');
+            }
+            if (typeof body.occurredAt !== 'string' || Number.isNaN(Date.parse(body.occurredAt))) {
+                throw new OxyAccountEventError('Account event has no occurrence time');
+            }
+            if (body.username !== undefined && body.username !== null && typeof body.username !== 'string') {
+                throw new OxyAccountEventError('Account event username is malformed');
+            }
+            return {
+                eventId: payload.jti,
+                type: 'account.deleted',
+                userId: body.userId,
+                username: typeof body.username === 'string' ? body.username : null,
+                occurredAt: body.occurredAt,
+                retained: body.retained === true,
+                applicationId: payload.aud,
+                issuedAt: payload.iat,
+            };
+        }
+        /**
+         * One page of account events addressed to this application, oldest first,
+         * from Oxy's pull feed — the reconciliation path behind the webhook. Needs
+         * the service credential (`configureServiceAuth`). Verify each entry's
+         * `token` with {@link verifyAccountEvent} before acting on it.
+         */
+        async listAccountEvents(options = {}) {
+            const serviceToken = await this.getServiceToken();
+            const query = {};
+            if (options.after)
+                query.after = options.after;
+            if (options.limit !== undefined)
+                query.limit = String(options.limit);
+            return this.makeRequest('GET', '/account-events', query, {
+                cache: false,
+                headers: { Authorization: `Bearer ${serviceToken}` },
+            });
+        }
+        /** @internal The `appId` claim of this client's own service token. */
+        async _configuredServiceAppId() {
+            const serviceToken = await this.getServiceToken();
+            const appId = jwtDecode(serviceToken).appId;
+            if (typeof appId !== 'string' || appId.length === 0) {
+                throw new OxyAccountEventError('No audience given and the service credential names no application');
+            }
+            return appId;
+        }
         /**
          * Express.js authentication middleware
          *