@oxy.so/core 1.13.0 → 1.18.0

package/dist/cjs/i18n/locales/zh-CN.json

@@ -1,53 +1,48 @@
 {
     "signin": {
         "title": "登录",
-        "subtitle": "登录以继续",
-        "addAccountTitle": "添加另一个账户",
+        "subtitle": "使用你的 Oxy 账号",
+        "addAccountTitle": "添加其他账号",
         "addAccountSubtitle": "使用另一个账户登录",
         "username": {
             "label": "用户名",
-            "placeholder": "输入您的用户名",
-            "helper": "3-30个字符，仅字母和数字",
-            "required": "请输入您的用户名。",
-            "minLength": "用户名必须至少包含3个字符。"
-        },
-        "password": {
-            "label": "密码",
-            "placeholder": "输入您的密码",
-            "required": "请输入您的密码。",
-            "hint": "输入您的密码以登录"
+            "placeholder": "yourname",
+            "required": "请输入您的用户名。"
         },
         "actions": {
             "continue": "继续",
-            "back": "返回",
-            "signIn": "登录",
-            "verify": "验证",
-            "openAccountSwitcher": "切换到另一个账户",
-            "openAccountSwitcherSubtitle": "{{count}}个其他账户可用",
-            "openAccountSwitcherSubtitle_singular": "1个其他账户可用",
-            "openAccountSwitcherSubtitle_zero": "查看您保存的账户",
-            "manageAccounts": "管理保存的账户",
-            "manageAccountsSubtitle": "查看会话、删除或登出",
-            "loadingOtherAccounts": "加载其他账户中…",
-            "switchAccountFailed": "无法切换账户。请重试。"
+            "back": "返回"
         },
-        "forgotPrompt": "忘记密码？",
-        "security": {
-            "dataSecure": "您的数据已加密且安全"
-        },
-        "currentlySignedInAs": "当前登录为",
-        "alreadySignedInWith": "已登录",
-        "alreadySignedIn": "已登录",
-        "alreadySignedInMessage": "此账户已登录。继续使用此账户？",
-        "continueWithAccount": "继续",
-        "currentAccount": "当前",
-        "or": "或",
-        "viewAllAccounts": "查看更多{{count}}个",
         "createAccountLink": "初次使用 Oxy？创建账户",
         "status": {
-            "accountSwitched": "正在使用{{name}}",
             "signingIn": "正在登录…"
-        }
+        },
+        "subtitleToApp": "以继续前往 {{app}}",
+        "orContinueWith": "或使用以下方式继续",
+        "qr": {
+            "caption": "使用 Commons 扫码登录",
+            "renew": "显示新的二维码"
+        },
+        "methods": {
+            "passkey": "使用通行密钥登录"
+        },
+        "errors": {
+            "rateLimited": "尝试次数过多。请在 {{seconds}} 秒后重试。",
+            "passkeyCancelled": "通行密钥提示已关闭。准备好后请重试。",
+            "passkeyFailed": "无法完成通行密钥验证。请重试。"
+        },
+        "chooser": {
+            "subtitleToApp": "以继续前往 {{app}}"
+        },
+        "terms": {
+            "before": "继续即表示你同意我们的",
+            "termsLink": "服务条款",
+            "and": "和",
+            "privacyLink": "隐私政策"
+        },
+        "noAccount": "还没有账号？",
+        "createAccount": "创建账号",
+        "recoverLink": "丢失了通行密钥？恢复你的账号"
     },
     "signup": {
         "title": "创建您的账户",
@@ -55,56 +50,28 @@
         "createInCommons": "在 Commons 中创建您的身份",
         "createAccount": "创建账户",
         "backToSignInLink": "已有账户？登录",
-        "welcome": {
-            "title": "欢迎使用Oxy！",
-            "subtitle": "只需几步即可创建您的账户",
-            "haveAccount": "已有账户？",
-            "signInCta": "登录"
-        },
-        "identity": {
-            "title": "您是谁？",
-            "subtitle": "选择您的用户名并输入您的电子邮件"
-        },
+        "webSubtitle": "无需密码：你的设备会创建一个通行密钥，丢失时可通过恢复邮箱重新进入。",
         "username": {
-            "helper": "3-30个字符，仅字母和数字",
-            "required": "请输入用户名",
-            "minLength": "用户名必须至少包含3个字符"
+            "label": "用户名",
+            "placeholder": "yourname",
+            "required": "请选择用户名。",
+            "taken": "该用户名已被占用。"
         },
         "email": {
-            "required": "请输入电子邮件地址",
-            "invalid": "请输入有效的电子邮件地址",
-            "helper": "我们绝不会分享您的电子邮件"
-        },
-        "security": {
-            "title": "保护您的账户",
-            "subtitle": "创建强密码以保护您的账户"
+            "title": "你的恢复邮箱",
+            "subtitle": "如果你丢失了通行密钥，我们会向这里发送验证码让你重新进入。它不作其他用途。",
+            "label": "邮箱",
+            "placeholder": "you@example.com",
+            "invalid": "请输入有效的邮箱地址。"
         },
-        "password": {
-            "helper": "至少8个字符",
-            "required": "请输入密码",
-            "minLength": "密码必须至少包含8个字符",
-            "confirmRequired": "请确认您的密码",
-            "mismatch": "密码不匹配",
-            "confirmHint": "重新输入您的密码以确认"
+        "passkey": {
+            "title": "创建你的通行密钥",
+            "subtitle": "用指纹、面容或屏幕锁登录，无需记住任何东西。",
+            "action": "创建通行密钥"
         },
-        "summary": {
-            "title": "快完成了！",
-            "subtitle": "查看您的信息并创建账户",
-            "sectionTitle": "账户信息",
-            "fields": {
-                "username": "用户名",
-                "email": "电子邮件",
-                "password": "密码"
-            },
-            "notSet": "未设置",
-            "securityTip": "为了更强的安全性，创建账户后，请在账户设置中启用生物识别身份验证。",
-            "legalReminder": "创建账户即表示您同意我们的服务条款和隐私政策。"
-        }
+        "commonsInstead": "想自己保管密钥？改用 Commons"
     },
     "accountSwitcher": {
-        "sections": {
-            "yourAccounts": "你的账户"
-        },
         "loading": "正在加载账户...",
         "qrHeadline": "使用您的 Oxy 身份登录",
         "signInWithOxy": "使用 Oxy 登录",
@@ -136,10 +103,7 @@
             "claimFailed": "登录已获批准，但未能完成。请重试。",
             "generic": "登录失败，请重试。"
         },
-        "linkOpenFailed": "无法打开链接，请重试。",
-        "continueWithPasskey": "继续",
-        "passkeyHint": "使用指纹、面容或设备 PIN 码。",
-        "otherDeviceCommons": "账号在其他设备上？用 Commons 扫码"
+        "linkOpenFailed": "无法打开链接，请重试。"
     },
     "common": {
         "actions": {
@@ -280,7 +244,63 @@
         "help": "帮助与反馈",
         "signOut": "退出登录",
         "privacy": "隐私政策",
-        "terms": "服务条款",
-        "identity": "你的身份"
+        "terms": "服务条款"
+    },
+    "recover": {
+        "title": "恢复你的账户",
+        "subtitle": "输入你的用户名或恢复邮箱。我们会向该账户的恢复邮箱发送验证码。",
+        "identifier": {
+            "label": "用户名或邮箱",
+            "placeholder": "yourname",
+            "required": "请输入用户名或邮箱。"
+        },
+        "commonsNote": "你的账户使用 Commons？请在 Commons 中用恢复短语恢复。",
+        "passkey": {
+            "title": "添加新的通行密钥",
+            "subtitle": "用于 @{{username}}。丢失的通行密钥可稍后在账户安全设置中移除。",
+            "action": "创建通行密钥"
+        },
+        "backToSignIn": "返回登录"
+    },
+    "emailCode": {
+        "title": "查看你的邮箱",
+        "sentTo": "我们已向 {{email}} 发送了 6 位验证码。",
+        "sentIfAccount": "如果该账户有恢复邮箱，我们已向其发送 6 位验证码。",
+        "label": "验证码",
+        "resend": "发送新验证码",
+        "resent": "我们已发送新验证码。",
+        "changeEmail": "使用其他邮箱",
+        "errors": {
+            "codeInvalid": "验证码不正确或已过期。",
+            "tooManyAttempts": "错误次数过多，请重新获取验证码。",
+            "expired": "耗时过长，请重新开始。",
+            "unavailable": "Oxy 暂时无法发送邮件，请稍后再试。",
+            "rateLimited": "验证码请求过多，请稍后再试。"
+        }
+    },
+    "deleteAccount": {
+        "passkey": {
+            "subtitle": "请用通行密钥确认。@{{username}} 及其中的一切将被永久删除。",
+            "action": "用通行密钥删除",
+            "done": "你的账户已删除。",
+            "closeWindow": "你可以关闭此窗口。",
+            "commons": "此账户使用 Commons：请在 Oxy Commons 的“设置 > 删除账户”中用其密钥删除。"
+        }
+    },
+    "linkCommons": {
+        "title": "关联 Commons",
+        "subtitle": "自己保管密钥：关联 Commons 后，此账户只属于你。它的恢复邮箱会被删除，今后用 Commons 中的恢复短语找回账户。",
+        "scan": "在手机上打开 Commons，选择“我在网页上有 Oxy 账户”，然后扫描此码。",
+        "waiting": "正在等待 Commons…",
+        "compareTitle": "核对代码",
+        "compare": "Commons 会显示相同的代码。如果不同，请取消。",
+        "confirm": "是的，关联 Commons",
+        "cancel": "取消",
+        "doneTitle": "Commons 已关联",
+        "done": "此账户现在由你自己保管。它的恢复邮箱已删除：今后用 Commons 中的恢复短语找回账户。",
+        "already": "此账户已在使用 Commons。",
+        "expired": "此代码已过期。",
+        "renew": "显示新代码",
+        "failed": "无法关联 Commons，请重试。"
     }
 }

package/dist/cjs/index.js

@@ -19,11 +19,10 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.encryptAead = exports.hkdfSha256 = exports.RecoveryPhraseService = exports.SignatureService = exports.updateIdentityMarker = exports.readIdentityMarker = exports.IdentityUnavailableError = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.verifyPublicCardAttestation = exports.parseAttestPayload = exports.parseIdPayload = exports.buildUserDid = exports.kindAcceptsAccountCategories = exports.isSelectableAccountCategoryId = exports.SELECTABLE_ACCOUNT_CATEGORY_IDS = exports.MAX_ACCOUNT_CATEGORIES = exports.ACCOUNT_CATEGORY_IDS = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.OXY_ACCOUNT_DELETED_EVENT_URI = exports.OxyAccountEventError = exports.commonsDeliveryPlatform = exports.pushTargetsFromDelivery = exports.selectCommonsDelivery = exports.parseCommonsApprovalExpiresAt = exports.getCommonsApprovalBlockingReason = exports.ServiceCredentialMismatchError = exports.oxyClient = exports.OXY_CLOUD_URL = exports.ServiceAssetMetadataError = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.AssetUrlResolutionError = exports.OxyServices = void 0;
-exports.getLanguageName = exports.getLanguageMetadata = exports.isSupportedLocale = exports.normalizeLocale = exports.getBaseLanguage = exports.FALLBACK_LOCALE = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.verifyMoveReceipt = exports.verifyMoveCommitment = exports.signMoveReceipt = exports.sealIdentityForMove = exports.parseMoveQrPayload = exports.openMovedIdentity = exports.generateMoveEphemeralKeyPair = exports.digestMoveCiphertext = exports.deriveMoveSas = exports.deriveMoveKey = exports.createMoveCommitment = exports.buildMoveQrPayload = exports.signIdentityProof = exports.digestIdentityPayload = exports.wipeOpenedIdentity = exports.wipeBytes = exports.unwrapDataKey = exports.unlockWebIdentity = exports.sealWebIdentity = exports.removeWrap = exports.parseRecoveryMaterial = exports.openWebIdentity = exports.normalizeMnemonic = exports.markWrapVerified = exports.isUsablePrfOutput = exports.generateWebIdentity = exports.generateDataKey = exports.deriveKeyEncryptionKey = exports.deriveIdentityFromRecoveryMaterial = exports.deriveIdentityFromPrivateKey = exports.deriveIdentityFromMnemonic = exports.addWrap = exports.WEB_IDENTITY_PRF_OUTPUT_LENGTH = exports.WebIdentityUnlockError = exports.WEB_IDENTITY_PRF_INPUT = exports.deriveSharedSecret = exports.AEAD_NONCE_LENGTH = exports.AEAD_KEY_LENGTH = exports.decryptAead = void 0;
-exports.buildSearchParams = exports.buildQueryParams = exports.trustTierLabel = exports.reputationCategoryLabel = exports.accountRoleLabel = exports.accountCategoryLabel = exports.translate = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.coerceToSupportedLocale = exports.getPrimaryLanguage = exports.getUserLanguages = exports.isRTLLocale = exports.getNativeLanguageName = void 0;
-exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.isDev = exports.consoleSink = exports.resetLoggerConfig = exports.getLoggerConfig = exports.configureLogger = exports.createLogger = exports.logger = exports.normalizeMultilineText = exports.normalizeInlineText = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE = exports.DISPLAY_NAME_ORPHANED_MARK_SOURCE = exports.DISPLAY_NAME_DISALLOWED_SOURCE = exports.DISPLAY_NAME_ALLOWED_SCRIPTS = exports.isValidDisplayName = exports.isValidPassword = exports.isValidEmail = exports.DISPLAY_NAME_INVALID_MESSAGE = exports.MAX_DISPLAY_NAME_LENGTH = exports.PASSWORD_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.parseHttpErrorBody = exports.isHttpRequestError = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = void 0;
-exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.resolveAccountDelegationAccess = exports.canSwitchIntoAccount = exports.isSwitchTargetAccount = exports.showsPrincipalHeaders = exports.buildSwitcherRows = exports.resolveDeviceContext = exports.resolveActiveContext = exports.projectDevicePrincipals = exports.directoryHandle = exports.directoryDisplayName = exports.canActivateContext = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isLoopbackOrigin = exports.consumeOAuthReturnPath = exports.persistOAuthReturnPath = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.canonicalizeOAuthRedirectUri = exports.normalizeOAuthRedirectUri = exports.OXY_OAUTH_RETURN_PATH_STORAGE_KEY = exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.runColdBoot = exports.isOxyRpOrigin = exports.IDENTITY_WEB_ORIGIN = exports.CENTRAL_IDP_APEX = exports.registrableApex = exports.getAccountColor = void 0;
-exports.packageInfo = exports.runSessionColdBoot = exports.OXY_INFERENCE_BASE_URL = exports.OxyInferenceProtocolError = exports.OxyInferenceError = exports.OxyInferenceClient = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.AccountNotOnDeviceError = exports.establishIdentitySession = exports.resolveIdentityPin = exports.IDENTITY_PIN_STORAGE_KEY = exports.identityPinMatches = exports.createMemoryIdentityPinStore = exports.createNativeIdentityPinStore = exports.createWebIdentityPinStore = exports.readLocalDeviceCredential = exports.publishProvenDeviceCredential = exports.normalizeSharedDeviceSessionRead = exports.decideSharedDevicePublish = exports.decideSharedDeviceJoin = exports.createSharedMirroringAuthStateStore = void 0;
+exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.coerceToSupportedLocale = exports.getPrimaryLanguage = exports.getUserLanguages = exports.isRTLLocale = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.isSupportedLocale = exports.normalizeLocale = exports.getBaseLanguage = exports.FALLBACK_LOCALE = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.deriveIdentityLinkCode = exports.signIdentityProof = exports.digestIdentityPayload = exports.deriveSharedSecret = exports.AEAD_NONCE_LENGTH = exports.AEAD_KEY_LENGTH = exports.decryptAead = void 0;
+exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE = exports.DISPLAY_NAME_ORPHANED_MARK_SOURCE = exports.DISPLAY_NAME_DISALLOWED_SOURCE = exports.DISPLAY_NAME_ALLOWED_SCRIPTS = exports.isValidDisplayName = exports.isValidPassword = exports.isValidEmail = exports.DISPLAY_NAME_INVALID_MESSAGE = exports.MAX_DISPLAY_NAME_LENGTH = exports.PASSWORD_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.parseHttpErrorBody = exports.isHttpRequestError = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.buildQueryParams = exports.trustTierLabel = exports.reputationCategoryLabel = exports.accountRoleLabel = exports.accountCategoryLabel = exports.translate = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = void 0;
+exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isLoopbackOrigin = exports.consumeOAuthReturnPath = exports.persistOAuthReturnPath = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.canonicalizeOAuthRedirectUri = exports.normalizeOAuthRedirectUri = exports.OXY_OAUTH_RETURN_PATH_STORAGE_KEY = exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.runColdBoot = exports.isOxyRpOrigin = exports.CENTRAL_IDP_APEX = exports.AUTH_WEB_ORIGIN = exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.isDev = exports.consoleSink = exports.resetLoggerConfig = exports.getLoggerConfig = exports.configureLogger = exports.createLogger = exports.logger = exports.normalizeMultilineText = exports.normalizeInlineText = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = void 0;
+exports.packageInfo = exports.runSessionColdBoot = exports.OXY_INFERENCE_BASE_URL = exports.OxyInferenceProtocolError = exports.OxyInferenceError = exports.OxyInferenceClient = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.AccountNotOnDeviceError = exports.establishIdentitySession = exports.resolveIdentityPin = exports.IDENTITY_PIN_STORAGE_KEY = exports.identityPinMatches = exports.createMemoryIdentityPinStore = exports.createNativeIdentityPinStore = exports.createWebIdentityPinStore = exports.readLocalDeviceCredential = exports.publishProvenDeviceCredential = exports.normalizeSharedDeviceSessionRead = exports.decideSharedDevicePublish = exports.decideSharedDeviceJoin = exports.createSharedMirroringAuthStateStore = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.resolveAccountDelegationAccess = exports.canSwitchIntoAccount = exports.isSwitchTargetAccount = exports.showsPrincipalHeaders = exports.buildSwitcherRows = exports.resolveDeviceContext = exports.resolveActiveContext = exports.projectDevicePrincipals = exports.directoryHandle = exports.directoryDisplayName = exports.canActivateContext = exports.accountIdsOf = void 0;
 // Ensure crypto polyfills are loaded before anything else. This MUST stay the
 // first import: `@noble/hashes` captures `globalThis.crypto` when it is
 // evaluated, so the shim has to exist before any module below reaches it (see
@@ -147,46 +146,14 @@ Object.defineProperty(exports, "AEAD_KEY_LENGTH", { enumerable: true, get: funct
 Object.defineProperty(exports, "AEAD_NONCE_LENGTH", { enumerable: true, get: function () { return aead_1.AEAD_NONCE_LENGTH; } });
 var ecdh_1 = require("./crypto/ecdh");
 Object.defineProperty(exports, "deriveSharedSecret", { enumerable: true, get: function () { return ecdh_1.deriveSharedSecret; } });
-// Web identity holder — the same root as Commons, sealed under a passkey's PRF
-// output; identity proofs; transfer to Commons (docs/adr/0024-one-oxy-account-root-holders.md)
-var webIdentityCarrier_1 = require("./crypto/webIdentityCarrier");
-Object.defineProperty(exports, "WEB_IDENTITY_PRF_INPUT", { enumerable: true, get: function () { return webIdentityCarrier_1.WEB_IDENTITY_PRF_INPUT; } });
-Object.defineProperty(exports, "WebIdentityUnlockError", { enumerable: true, get: function () { return webIdentityCarrier_1.WebIdentityUnlockError; } });
-Object.defineProperty(exports, "WEB_IDENTITY_PRF_OUTPUT_LENGTH", { enumerable: true, get: function () { return webIdentityCarrier_1.WEB_IDENTITY_PRF_OUTPUT_LENGTH; } });
-Object.defineProperty(exports, "addWrap", { enumerable: true, get: function () { return webIdentityCarrier_1.addWrap; } });
-Object.defineProperty(exports, "deriveIdentityFromMnemonic", { enumerable: true, get: function () { return webIdentityCarrier_1.deriveIdentityFromMnemonic; } });
-Object.defineProperty(exports, "deriveIdentityFromPrivateKey", { enumerable: true, get: function () { return webIdentityCarrier_1.deriveIdentityFromPrivateKey; } });
-Object.defineProperty(exports, "deriveIdentityFromRecoveryMaterial", { enumerable: true, get: function () { return webIdentityCarrier_1.deriveIdentityFromRecoveryMaterial; } });
-Object.defineProperty(exports, "deriveKeyEncryptionKey", { enumerable: true, get: function () { return webIdentityCarrier_1.deriveKeyEncryptionKey; } });
-Object.defineProperty(exports, "generateDataKey", { enumerable: true, get: function () { return webIdentityCarrier_1.generateDataKey; } });
-Object.defineProperty(exports, "generateWebIdentity", { enumerable: true, get: function () { return webIdentityCarrier_1.generateWebIdentity; } });
-Object.defineProperty(exports, "isUsablePrfOutput", { enumerable: true, get: function () { return webIdentityCarrier_1.isUsablePrfOutput; } });
-Object.defineProperty(exports, "markWrapVerified", { enumerable: true, get: function () { return webIdentityCarrier_1.markWrapVerified; } });
-Object.defineProperty(exports, "normalizeMnemonic", { enumerable: true, get: function () { return webIdentityCarrier_1.normalizeMnemonic; } });
-Object.defineProperty(exports, "openWebIdentity", { enumerable: true, get: function () { return webIdentityCarrier_1.openWebIdentity; } });
-Object.defineProperty(exports, "parseRecoveryMaterial", { enumerable: true, get: function () { return webIdentityCarrier_1.parseRecoveryMaterial; } });
-Object.defineProperty(exports, "removeWrap", { enumerable: true, get: function () { return webIdentityCarrier_1.removeWrap; } });
-Object.defineProperty(exports, "sealWebIdentity", { enumerable: true, get: function () { return webIdentityCarrier_1.sealWebIdentity; } });
-Object.defineProperty(exports, "unlockWebIdentity", { enumerable: true, get: function () { return webIdentityCarrier_1.unlockWebIdentity; } });
-Object.defineProperty(exports, "unwrapDataKey", { enumerable: true, get: function () { return webIdentityCarrier_1.unwrapDataKey; } });
-Object.defineProperty(exports, "wipeBytes", { enumerable: true, get: function () { return webIdentityCarrier_1.wipeBytes; } });
-Object.defineProperty(exports, "wipeOpenedIdentity", { enumerable: true, get: function () { return webIdentityCarrier_1.wipeOpenedIdentity; } });
+// Identity proofs — the one signed format for operations on a personal root
+// (docs/adr/0024-one-oxy-account-root-holders.md D7)
 var identityProof_1 = require("./crypto/identityProof");
 Object.defineProperty(exports, "digestIdentityPayload", { enumerable: true, get: function () { return identityProof_1.digestIdentityPayload; } });
 Object.defineProperty(exports, "signIdentityProof", { enumerable: true, get: function () { return identityProof_1.signIdentityProof; } });
-var identityMove_1 = require("./crypto/identityMove");
-Object.defineProperty(exports, "buildMoveQrPayload", { enumerable: true, get: function () { return identityMove_1.buildMoveQrPayload; } });
-Object.defineProperty(exports, "createMoveCommitment", { enumerable: true, get: function () { return identityMove_1.createMoveCommitment; } });
-Object.defineProperty(exports, "deriveMoveKey", { enumerable: true, get: function () { return identityMove_1.deriveMoveKey; } });
-Object.defineProperty(exports, "deriveMoveSas", { enumerable: true, get: function () { return identityMove_1.deriveMoveSas; } });
-Object.defineProperty(exports, "digestMoveCiphertext", { enumerable: true, get: function () { return identityMove_1.digestMoveCiphertext; } });
-Object.defineProperty(exports, "generateMoveEphemeralKeyPair", { enumerable: true, get: function () { return identityMove_1.generateMoveEphemeralKeyPair; } });
-Object.defineProperty(exports, "openMovedIdentity", { enumerable: true, get: function () { return identityMove_1.openMovedIdentity; } });
-Object.defineProperty(exports, "parseMoveQrPayload", { enumerable: true, get: function () { return identityMove_1.parseMoveQrPayload; } });
-Object.defineProperty(exports, "sealIdentityForMove", { enumerable: true, get: function () { return identityMove_1.sealIdentityForMove; } });
-Object.defineProperty(exports, "signMoveReceipt", { enumerable: true, get: function () { return identityMove_1.signMoveReceipt; } });
-Object.defineProperty(exports, "verifyMoveCommitment", { enumerable: true, get: function () { return identityMove_1.verifyMoveCommitment; } });
-Object.defineProperty(exports, "verifyMoveReceipt", { enumerable: true, get: function () { return identityMove_1.verifyMoveReceipt; } });
+// Linking Commons to a passkey account: the code both screens compare (ADR 0029 D3)
+var identityLink_1 = require("./crypto/identityLink");
+Object.defineProperty(exports, "deriveIdentityLinkCode", { enumerable: true, get: function () { return identityLink_1.deriveIdentityLinkCode; } });
 // ---------------------------------------------------------------------------
 // Devices
 // ---------------------------------------------------------------------------
@@ -369,8 +336,8 @@ Object.defineProperty(exports, "getAccountColor", { enumerable: true, get: funct
 var registrableApex_1 = require("./utils/registrableApex");
 Object.defineProperty(exports, "registrableApex", { enumerable: true, get: function () { return registrableApex_1.registrableApex; } });
 var authWebUrl_1 = require("./utils/authWebUrl");
+Object.defineProperty(exports, "AUTH_WEB_ORIGIN", { enumerable: true, get: function () { return authWebUrl_1.AUTH_WEB_ORIGIN; } });
 Object.defineProperty(exports, "CENTRAL_IDP_APEX", { enumerable: true, get: function () { return authWebUrl_1.CENTRAL_IDP_APEX; } });
-Object.defineProperty(exports, "IDENTITY_WEB_ORIGIN", { enumerable: true, get: function () { return authWebUrl_1.IDENTITY_WEB_ORIGIN; } });
 // WebAuthn relying-party origin guard (client side). Mirrors the server's
 // `isOxyApexOrigin` so consumers can decide whether to offer passkey UI on the
 // current page (first-party Oxy origin / loopback only).

package/dist/cjs/mixins/OxyServices.auth.js

@@ -1166,12 +1166,40 @@ function OxyServicesAuthMixin(Base) {
             }
         }
         /**
-         * Check email availability
+         * Send a 6-digit code to an email (ADR 0029 D3): the recovery email of a
+         * new passkey account (`purpose: 'signup'`), or — named by username or
+         * email — the recovery email of an account being recovered
+         * (`purpose: 'recovery'`). The answer is the same whether or not an
+         * account exists; nothing is revealed about who has one.
          */
-        async checkEmailAvailability(email) {
+        async startEmailVerification(request) {
             try {
-                // Public availability lookup (pre-session) — skip the bearer preflight.
-                return await this.makeRequest('GET', `/auth/check-email/${email}`, undefined, { cache: false, skipAuth: true });
+                const res = await this.makeRequest('POST', '/auth/email/verify/start', request, {
+                    cache: false,
+                    skipAuth: true,
+                });
+                const parsed = (0, contracts_1.safeParseContract)(contracts_1.emailVerificationStartResponseSchema, res);
+                if (!parsed)
+                    throw new Error('auth/email/verify/start returned an unexpected response shape');
+                return parsed;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Confirm the code {@link startEmailVerification} sent. Resolves to a
+         * short-lived one-use ticket: a sign-up passes it (with the email) to
+         * {@link webauthnRegisterVerify}; a recovery passes it as `recoveryTicket`
+         * to {@link webauthnRegisterOptions} and {@link webauthnRegisterVerify}.
+         */
+        async confirmEmailVerification(verificationId, code) {
+            try {
+                const res = await this.makeRequest('POST', '/auth/email/verify/confirm', { verificationId, code }, { cache: false, skipAuth: true });
+                const parsed = (0, contracts_1.safeParseContract)(contracts_1.emailVerificationConfirmResponseSchema, res);
+                if (!parsed)
+                    throw new Error('auth/email/verify/confirm returned an unexpected response shape');
+                return parsed;
             }
             catch (error) {
                 throw this.handleError(error);
@@ -1182,15 +1210,20 @@ function OxyServicesAuthMixin(Base) {
          * `PublicKeyCredentialCreationOptions` the browser's `navigator.credentials
          * .create()` (or `@simplewebauthn/browser`'s `startRegistration`) needs.
          *
-         * With a bearer token planted this links a passkey to the signed-in account
-         * (`username` ignored); without one it is a prospective signup and `username`
-         * is the desired handle. The returned options are OPAQUE — Oxy does not own
-         * their shape (the browser / `@simplewebauthn` does), so they pass through
-         * as `unknown` for the caller to hand straight to the ceremony.
+         * With a bearer token planted this adds a passkey to the signed-in account.
+         * Without one, `username` is a prospective sign-up's handle, and
+         * `recoveryTicket` a recovery's new passkey for the account it names. The
+         * returned options are OPAQUE — Oxy does not own their shape (the browser /
+         * `@simplewebauthn` does), so they pass through as `unknown` for the caller
+         * to hand straight to the ceremony.
          */
-        async webauthnRegisterOptions(username) {
+        async webauthnRegisterOptions(request = {}) {
+            const signedOut = request.username !== undefined || request.recoveryTicket !== undefined;
             try {
-                return await this.makeRequest('POST', '/auth/webauthn/register/options', { ...(username !== undefined ? { username } : {}) }, { cache: false, ...(username !== undefined ? { skipAuth: true } : {}) });
+                return await this.makeRequest('POST', '/auth/webauthn/register/options', {
+                    ...(request.username !== undefined ? { username: request.username } : {}),
+                    ...(request.recoveryTicket !== undefined ? { recoveryTicket: request.recoveryTicket } : {}),
+                }, { cache: false, ...(signedOut ? { skipAuth: true } : {}) });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -1201,17 +1234,22 @@ function OxyServicesAuthMixin(Base) {
          * browser `RegistrationResponseJSON` (`response`) alongside the Oxy envelope
          * (desired `username` for signup + the device-session naming fields).
          *
-         * Two server branches, disambiguated by the response shape:
-         *  - **Signup** (no bearer): the account is created and a session minted —
-         *    the response carries `sessionId`, is the SAME {@link LoginResult}
-         *    contract as `POST /auth/verify`, and its access token is planted here.
+         * Server branches, disambiguated by the response shape:
+         *  - **Sign-up** (no bearer; `username`, `email`, `emailTicket`) and
+         *    **recovery** (no bearer; `recoveryTicket`): the account is created, or
+         *    gains the passkey, and a session is minted — the response carries
+         *    `sessionId`, is the SAME {@link LoginResult} contract as
+         *    `POST /auth/verify`, and its access token is planted here.
          *  - **Link** (bearer present): the passkey is attached to the signed-in
          *    account and the server returns `{ success, message }` with no session,
          *    which is returned verbatim (no token planting).
          */
         async webauthnRegisterVerify(response, envelope = {}) {
             try {
-                const res = await this.makeRequest('POST', '/auth/webauthn/register/verify', { response, ...envelope }, { cache: false, ...(envelope.username !== undefined ? { skipAuth: true } : {}) });
+                const res = await this.makeRequest('POST', '/auth/webauthn/register/verify', { response, ...envelope }, {
+                    cache: false,
+                    ...(envelope.username !== undefined || envelope.recoveryTicket !== undefined ? { skipAuth: true } : {}),
+                });
                 if (res && typeof res === 'object') {
                     const record = res;
                     // Signup branch: mints a session (LoginSessionResult, carries

package/dist/cjs/mixins/OxyServices.identity.js

@@ -2,8 +2,36 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildUserDid = buildUserDid;
 exports.OxyServicesIdentityMixin = OxyServicesIdentityMixin;
+/**
+ * Identity Methods Mixin (self-sovereign identity layer)
+ *
+ * Provides typed access to Oxy's AtProto/Bluesky-flavoured identity &
+ * portability layer:
+ *  - DID resolution (`did:web:oxy.so:u:<userId>`, derived on demand by the API).
+ *  - The auth-method ↔ DID verification-method mapping (`GET /auth/methods`) and
+ *    passkey removal. A root is linked by the holder flows (ADR 0024) and never
+ *    unlinked; it is replaced by rotation.
+ *  - Signed records: clients sign an envelope with their own cryptographic key
+ *    (`SignatureService.signRecord` + the shared `canonicalize`) and publish it;
+ *    anyone can fetch and verify it.
+ *  - The signed data-export ("credible exit") bundle.
+ *  - Verified-domain badges (prove ownership of `nate.com`).
+ *
+ * Wire shapes come from `@oxy.so/contracts` (`DidDocument`,
+ * `SignedRecordEnvelope`, `AuthMethodsResponse`, `VerifiedDomain`,
+ * `DomainVerificationInstructions`, `ExportBundle`) — the single source of truth
+ * the API validates its output against, so producer and consumer cannot drift.
+ *
+ * Identity signing is NATIVE-ONLY: the private key lives in native secure
+ * storage, so `signRecord` and `publishRecord` require an
+ * on-device identity and throw on web (where `KeyManager.getPublicKey()` is
+ * always `null`).
+ */
+const contracts_1 = require("@oxy.so/contracts");
 const protocol_1 = require("@oxy.so/protocol");
 const keyManager_1 = require("../crypto/keyManager");
+const identityLink_1 = require("../crypto/identityLink");
+const identityProof_1 = require("../crypto/identityProof");
 const signatureService_1 = require("../crypto/signatureService");
 const recoveryPhrase_1 = require("../crypto/recoveryPhrase");
 const platform_1 = require("../utils/platform");
@@ -75,11 +103,9 @@ function OxyServicesIdentityMixin(Base) {
             }
         }
         /**
-         * The signed-in account's root readiness (ADR 0024 D5): whether a root is
-         * linked, how many passkeys can open the web holder, whether the root has a
-         * phrase and whether it is saved and was shown to recover it. Metadata only —
-         * nothing here can open the root — so any first-party surface may show a
-         * "save your recovery phrase" reminder from it.
+         * How the signed-in account is kept (ADR 0029 D3): whether Commons' root is
+         * linked (self-custody), or the recovery email of a passkey account. Any
+         * first-party surface may read it to recommend linking Commons.
          */
         async getIdentityRootStatus() {
             try {
@@ -89,15 +115,109 @@ function OxyServicesIdentityMixin(Base) {
                 throw this.handleError(error);
             }
         }
+        /**
+         * Open a request to link Commons to the signed-in passkey account (ADR 0029
+         * D3). auth.oxy.so shows its `qrPayload`; Commons scans it and signs with
+         * {@link signIdentityLink}.
+         */
+        async createIdentityLink() {
+            try {
+                const res = await this.makeRequest('POST', '/identity/link', undefined, { cache: false });
+                const parsed = (0, contracts_1.safeParseContract)(contracts_1.identityLinkCreateResponseSchema, res);
+                if (!parsed)
+                    throw new Error('identity/link returned an unexpected response shape');
+                return parsed;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /** Where a link request stands. Both devices poll it; it needs no session. */
+        async getIdentityLink(linkId) {
+            try {
+                const res = await this.makeRequest('GET', `/identity/link/${encodeURIComponent(linkId)}`, undefined, {
+                    cache: false,
+                    skipAuth: true,
+                });
+                const parsed = (0, contracts_1.safeParseContract)(contracts_1.identityLinkStateSchema, res);
+                if (!parsed)
+                    throw new Error('identity/link returned an unexpected response shape');
+                return parsed;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Commons' half: sign the scanned request's `link_identity` proof with THIS
+         * device's identity key and post it. NATIVE-ONLY (the key lives in native
+         * secure storage). Resolves to the key and the 6-digit code auth.oxy.so will
+         * show for it, for the person to compare.
+         */
+        async signIdentityLink(linkId, challenge) {
+            try {
+                const [privateKey, publicKey] = await Promise.all([keyManager_1.KeyManager.getPrivateKey(), keyManager_1.KeyManager.getPublicKey()]);
+                if (!privateKey || !publicKey) {
+                    throw new Error('No identity on this device to link');
+                }
+                const root = publicKey.trim().toLowerCase();
+                const state = await this.getIdentityLink(linkId);
+                const proof = await (0, identityProof_1.signIdentityProof)({ privateKey, publicKey: root }, {
+                    action: contracts_1.IDENTITY_PROOF_ACTIONS.link,
+                    subject: state.userId,
+                    actor: state.userId,
+                    rootPublicKey: root,
+                    payloadDigest: null,
+                    expectedRevision: null,
+                    audience: state.audience,
+                    challenge,
+                    expiresAt: state.expiresAt,
+                });
+                await this.makeRequest('POST', `/identity/link/${encodeURIComponent(linkId)}/proof`, { publicKey: root, proof }, { cache: false, skipAuth: true });
+                return { publicKey: root, code: (0, identityLink_1.deriveIdentityLinkCode)(linkId, root), username: state.username };
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /** WebAuthn request options over the account's passkeys, whose challenge is the link's. Opaque. */
+        async getIdentityLinkAssertionOptions(linkId, challenge) {
+            try {
+                return await this.makeRequest('POST', `/identity/link/${encodeURIComponent(linkId)}/options`, { challenge }, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * auth.oxy.so's half: the passkey assertion over the link's challenge. The
+         * account gains Commons' root and loses its recovery email.
+         */
+        async completeIdentityLink(linkId, assertion) {
+            try {
+                const result = await this.makeRequest('POST', `/identity/link/${encodeURIComponent(linkId)}/complete`, { assertion }, { cache: false });
+                this._invalidateIdentityCaches(this.getCurrentUserId());
+                return result;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /** Withdraw a link request that has not completed. */
+        async cancelIdentityLink(linkId) {
+            try {
+                await this.makeRequest('DELETE', `/identity/link/${encodeURIComponent(linkId)}`, undefined, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
         /**
          * Remove ONE passkey (WebAuthn credential) from the current account.
          *
          * Passkeys are per-credential, so this targets a specific credential id.
          * The server refuses to remove the last remaining auth method (the account
          * would become inaccessible) and deletes the stored `WebauthnCredential`.
-         * A passkey that also opens the account's root on the web takes its wrap with
-         * it, and the ONLY such passkey is refused with
-         * `code: 'IDENTITY_LAST_WEB_HOLDER'` (ADR 0024 D6).
          *
          * @param credentialId - The passkey's public credential id
          *   (`AuthMethodEntry.credentialId`).