@oxy.so/core 1.13.0 → 1.18.0

package/dist/types/crypto/identityLink.d.ts

@@ -0,0 +1,8 @@
+/**
+ * The code both screens show while Commons is being linked to a passkey
+ * account (ADR 0029 D3): 6 digits derived from the link request and the key
+ * Commons signed with. auth.oxy.so derives it from the key the API relayed,
+ * Commons from its own; the person checks they match before the passkey is
+ * asserted, so a photographed QR cannot slip another key in.
+ */
+export declare function deriveIdentityLinkCode(linkId: string, publicKey: string): string;

package/dist/types/index.d.ts

@@ -72,14 +72,11 @@ export { hkdfSha256 } from './crypto/kdf';
 export { encryptAead, decryptAead, AEAD_KEY_LENGTH, AEAD_NONCE_LENGTH, } from './crypto/aead';
 export type { AeadResult } from './crypto/aead';
 export { deriveSharedSecret } from './crypto/ecdh';
-export { WEB_IDENTITY_PRF_INPUT, WebIdentityUnlockError, WEB_IDENTITY_PRF_OUTPUT_LENGTH, addWrap, deriveIdentityFromMnemonic, deriveIdentityFromPrivateKey, deriveIdentityFromRecoveryMaterial, deriveKeyEncryptionKey, generateDataKey, generateWebIdentity, isUsablePrfOutput, markWrapVerified, normalizeMnemonic, openWebIdentity, parseRecoveryMaterial, removeWrap, sealWebIdentity, unlockWebIdentity, unwrapDataKey, wipeBytes, wipeOpenedIdentity, } from './crypto/webIdentityCarrier';
-export type { OpenedMnemonicIdentity, OpenedRawKeyIdentity, OpenedWebIdentity, WebIdentityRecoveryMaterial, WebIdentityUnlockFailure, WrapInput, } from './crypto/webIdentityCarrier';
 export { digestIdentityPayload, signIdentityProof } from './crypto/identityProof';
-export { buildMoveQrPayload, createMoveCommitment, deriveMoveKey, deriveMoveSas, digestMoveCiphertext, generateMoveEphemeralKeyPair, openMovedIdentity, parseMoveQrPayload, sealIdentityForMove, signMoveReceipt, verifyMoveCommitment, verifyMoveReceipt, } from './crypto/identityMove';
-export type { MoveReceiptClaims } from './crypto/identityMove';
+export { deriveIdentityLinkCode } from './crypto/identityLink';
 export { DeviceManager } from './utils/deviceManager';
 export type { DeviceFingerprint, StoredDeviceInfo } from './utils/deviceManager';
-export type { OxyConfig, PrivacySettings, NotificationPreferences, UserPreferences, User, LoginResponse, Notification, Wallet, Transaction, BlockedUser, RestrictedUser, TransferFundsRequest, PurchaseRequest, WithdrawalRequest, TransactionResponse, PaginationInfo, SearchProfilesResponse, ApiError, PaymentMethod, PaymentRequest, PaymentResponse, AnalyticsData, FollowerDetails, ContentViewer, FileMetadata, FileUploadResponse, FileListResponse, FileUpdateRequest, FileDeleteResponse, RNFileDescriptor, AssetUploadInput, FileVisibility, AssetLink, AssetMetadata, AssetVariant, Asset, AssetInitRequest, AssetInitResponse, AssetCompleteRequest, AssetLinkRequest, AssetUnlinkRequest, AssetUrlResponse, BatchFileAccessEntry, BatchFileAccessResponse, AssetDeleteSummary, AssetUpdateVisibilityRequest, AssetUpdateVisibilityResponse, ServiceAssetMetadata, ServiceAssetMetadataBySha, AccountStorageCategoryUsage, AccountStorageUsageResponse, SecurityEventType, SecurityEventSeverity, SecurityActivity, SecurityActivityResponse, AssetUploadProgress, DeviceLinkedSession, DeviceLinkedSessionsResponse, DeviceLinkedSessionLogoutResponse, UpdateDeviceNameResponse, } from './models/interfaces';
+export type { OxyConfig, PrivacySettings, NotificationPreferences, UserPreferences, User, LoginResponse, Notification, NotificationActor, NotificationPage, Wallet, Transaction, BlockedUser, RestrictedUser, TransferFundsRequest, PurchaseRequest, WithdrawalRequest, TransactionResponse, PaginationInfo, SearchProfilesResponse, ApiError, PaymentMethod, PaymentRequest, PaymentResponse, AnalyticsData, FollowerDetails, ContentViewer, FileMetadata, FileUploadResponse, FileListResponse, FileUpdateRequest, FileDeleteResponse, RNFileDescriptor, AssetUploadInput, FileVisibility, AssetLink, AssetMetadata, AssetVariant, Asset, AssetInitRequest, AssetInitResponse, AssetCompleteRequest, AssetLinkRequest, AssetUnlinkRequest, AssetUrlResponse, BatchFileAccessEntry, BatchFileAccessResponse, AssetDeleteSummary, AssetUpdateVisibilityRequest, AssetUpdateVisibilityResponse, ServiceAssetMetadata, ServiceAssetMetadataBySha, AccountStorageCategoryUsage, AccountStorageUsageResponse, SecurityEventType, SecurityEventSeverity, SecurityActivity, SecurityActivityResponse, AssetUploadProgress, DeviceLinkedSession, DeviceLinkedSessionsResponse, DeviceLinkedSessionLogoutResponse, UpdateDeviceNameResponse, } from './models/interfaces';
 export { SECURITY_EVENT_SEVERITY_MAP } from './models/interfaces';
 export { TopicType, TopicSource } from './models/Topic';
 export type { TopicData, TopicTranslation, TopicListResult } from './models/Topic';
@@ -111,12 +108,12 @@ export { updateAvatarVisibility } from './utils/avatarUtils';
 export { buildAccountsArray, createQuickAccount, getAccountDisplayName, getAccountFallbackHandle, formatPublicKeyHandle, getAccountColor, } from './utils/accountUtils';
 export type { QuickAccount, DisplayNameUserShape } from './utils/accountUtils';
 export { registrableApex } from './utils/registrableApex';
-export { CENTRAL_IDP_APEX, IDENTITY_WEB_ORIGIN } from './utils/authWebUrl';
+export { AUTH_WEB_ORIGIN, CENTRAL_IDP_APEX } from './utils/authWebUrl';
 export { isOxyRpOrigin } from './utils/webauthnOrigin';
 export { runColdBoot } from './utils/coldBoot';
 export type { ColdBootStep, ColdBootStepResult, ColdBootSession, ColdBootSkip, ColdBootOutcome, RunColdBootOptions, } from './utils/coldBoot';
 export { buildOAuthAuthorizeUrl, computeCodeChallenge, generateOAuthState, generatePkcePair, DEFAULT_OAUTH_SCOPE, OXY_AUTHORIZE_URL, OXY_OAUTH_STATE_STORAGE_KEY, OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY, OXY_OAUTH_REDIRECT_URI_STORAGE_KEY, OXY_OAUTH_RETURN_PATH_STORAGE_KEY, normalizeOAuthRedirectUri, canonicalizeOAuthRedirectUri, persistOAuthHandshake, readOAuthHandshake, clearOAuthHandshake, persistOAuthReturnPath, consumeOAuthReturnPath, } from './utils/oauthPkce';
-export type { PkcePair, BuildOAuthAuthorizeUrlParams } from './utils/oauthPkce';
+export type { PkcePair, BuildOAuthAuthorizeUrlParams, OxyAuthScreen } from './utils/oauthPkce';
 export { isLoopbackOrigin, isOfficialWebOrigin, isAllowedDeviceJoinOrigin, } from './utils/officialOrigins';
 export { SessionClient } from './session/SessionClient';
 export type { TokenTransport, SessionClientHost, SessionClientOptions, DeviceCredential, SessionStateOrigin } from './session/SessionClient';
@@ -132,7 +129,7 @@ export { isSwitchTargetAccount, canSwitchIntoAccount, } from './session/accountS
 export { resolveAccountDelegationAccess } from './session/accountDelegationAccess';
 export type { AccountDelegationAccess, AccountDelegationNode, } from './session/accountDelegationAccess';
 export { AccountDialogController, createAccountDialogController, } from './session/accountDialogController';
-export type { AccountDialogControllerOptions, AccountDialogSnapshot, AccountDialogView, CommonsAvailability, ContextChoiceOutcome, PopupWindowHandle, SignInFailureReason, SignInFlowPhase, SignInFlowState, SignInProgress, } from './session/accountDialogController';
+export type { AccountDialogControllerOptions, AccountDialogSnapshot, AccountDialogView, CommonsAvailability, ContextChoiceOutcome, SignInFailureReason, SignInFlowPhase, SignInFlowState, SignInProgress, } from './session/accountDialogController';
 export { createWebAuthStateStore, createNativeAuthStateStore, createMemoryAuthStateStore, AUTH_STATE_STORAGE_KEY, } from './session/authStateStore';
 export type { PersistedAuthState, AuthStateStore, NativeKeyValueStorage, } from './session/authStateStore';
 export { createSharedMirroringAuthStateStore, decideSharedDeviceJoin, decideSharedDevicePublish, normalizeSharedDeviceSessionRead, publishProvenDeviceCredential, readLocalDeviceCredential, } from './session/sharedDeviceCredential';

package/dist/types/mixins/OxyServices.auth.d.ts

@@ -5,7 +5,7 @@
  */
 import type { User } from '../models/interfaces';
 import type { LoginResult, CommonsDenyReason } from '@oxy.so/contracts';
-import { type IdentityProof, type WebIdentityEnvelope } from '@oxy.so/contracts';
+import { type EmailVerificationConfirmResponse, type EmailVerificationStartRequest, type EmailVerificationStartResponse } from '@oxy.so/contracts';
 import type { SessionLoginResponse } from '../models/session';
 import type { OxyServicesBase } from '../OxyServices.base';
 import type { PublicApplication } from './OxyServices.connectedApps';
@@ -790,50 +790,60 @@ export declare function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(B
             message: string;
         }>;
         /**
-         * Check email availability
+         * Send a 6-digit code to an email (ADR 0029 D3): the recovery email of a
+         * new passkey account (`purpose: 'signup'`), or — named by username or
+         * email — the recovery email of an account being recovered
+         * (`purpose: 'recovery'`). The answer is the same whether or not an
+         * account exists; nothing is revealed about who has one.
          */
-        checkEmailAvailability(email: string): Promise<{
-            available: boolean;
-            message: string;
-        }>;
+        startEmailVerification(request: EmailVerificationStartRequest): Promise<EmailVerificationStartResponse>;
+        /**
+         * Confirm the code {@link startEmailVerification} sent. Resolves to a
+         * short-lived one-use ticket: a sign-up passes it (with the email) to
+         * {@link webauthnRegisterVerify}; a recovery passes it as `recoveryTicket`
+         * to {@link webauthnRegisterOptions} and {@link webauthnRegisterVerify}.
+         */
+        confirmEmailVerification(verificationId: string, code: string): Promise<EmailVerificationConfirmResponse>;
         /**
          * Begin a WebAuthn / passkey REGISTRATION ceremony. Requests the
          * `PublicKeyCredentialCreationOptions` the browser's `navigator.credentials
          * .create()` (or `@simplewebauthn/browser`'s `startRegistration`) needs.
          *
-         * With a bearer token planted this links a passkey to the signed-in account
-         * (`username` ignored); without one it is a prospective signup and `username`
-         * is the desired handle. The returned options are OPAQUE — Oxy does not own
-         * their shape (the browser / `@simplewebauthn` does), so they pass through
-         * as `unknown` for the caller to hand straight to the ceremony.
+         * With a bearer token planted this adds a passkey to the signed-in account.
+         * Without one, `username` is a prospective sign-up's handle, and
+         * `recoveryTicket` a recovery's new passkey for the account it names. The
+         * returned options are OPAQUE — Oxy does not own their shape (the browser /
+         * `@simplewebauthn` does), so they pass through as `unknown` for the caller
+         * to hand straight to the ceremony.
          */
-        webauthnRegisterOptions(username?: string): Promise<unknown>;
+        webauthnRegisterOptions(request?: {
+            username?: string;
+            recoveryTicket?: string;
+        }): Promise<unknown>;
         /**
          * Finish a WebAuthn / passkey REGISTRATION ceremony. Forwards the opaque
          * browser `RegistrationResponseJSON` (`response`) alongside the Oxy envelope
          * (desired `username` for signup + the device-session naming fields).
          *
-         * Two server branches, disambiguated by the response shape:
-         *  - **Signup** (no bearer): the account is created and a session minted —
-         *    the response carries `sessionId`, is the SAME {@link LoginResult}
-         *    contract as `POST /auth/verify`, and its access token is planted here.
+         * Server branches, disambiguated by the response shape:
+         *  - **Sign-up** (no bearer; `username`, `email`, `emailTicket`) and
+         *    **recovery** (no bearer; `recoveryTicket`): the account is created, or
+         *    gains the passkey, and a session is minted — the response carries
+         *    `sessionId`, is the SAME {@link LoginResult} contract as
+         *    `POST /auth/verify`, and its access token is planted here.
          *  - **Link** (bearer present): the passkey is attached to the signed-in
          *    account and the server returns `{ success, message }` with no session,
          *    which is returned verbatim (no token planting).
          */
         webauthnRegisterVerify(response: unknown, envelope?: {
             username?: string;
+            /** Sign-up: the recovery email, confirmed with `emailTicket`. */
+            email?: string;
+            emailTicket?: string;
+            /** Recovery: the ticket {@link confirmEmailVerification} returned. */
+            recoveryTicket?: string;
             deviceName?: string;
             deviceFingerprint?: string;
-            /**
-             * Sign-up only: the root created on the holder before this call, sealed
-             * under the passkey being registered, plus its `enroll_identity` proof
-             * (ADR 0024 D4). The account is created WITH it or not at all.
-             */
-            identity?: {
-                envelope: WebIdentityEnvelope;
-                proof: IdentityProof;
-            };
         }): Promise<{
             success: true;
             message: string;

package/dist/types/mixins/OxyServices.identity.d.ts

@@ -1,29 +1,4 @@
-/**
- * Identity Methods Mixin (self-sovereign identity layer)
- *
- * Provides typed access to Oxy's AtProto/Bluesky-flavoured identity &
- * portability layer:
- *  - DID resolution (`did:web:oxy.so:u:<userId>`, derived on demand by the API).
- *  - The auth-method ↔ DID verification-method mapping (`GET /auth/methods`) and
- *    passkey removal. A root is linked by the holder flows (ADR 0024) and never
- *    unlinked; it is replaced by rotation.
- *  - Signed records: clients sign an envelope with their own cryptographic key
- *    (`SignatureService.signRecord` + the shared `canonicalize`) and publish it;
- *    anyone can fetch and verify it.
- *  - The signed data-export ("credible exit") bundle.
- *  - Verified-domain badges (prove ownership of `nate.com`).
- *
- * Wire shapes come from `@oxy.so/contracts` (`DidDocument`,
- * `SignedRecordEnvelope`, `AuthMethodsResponse`, `VerifiedDomain`,
- * `DomainVerificationInstructions`, `ExportBundle`) — the single source of truth
- * the API validates its output against, so producer and consumer cannot drift.
- *
- * Identity signing is NATIVE-ONLY: the private key lives in native secure
- * storage, so `signRecord` and `publishRecord` require an
- * on-device identity and throw on web (where `KeyManager.getPublicKey()` is
- * always `null`).
- */
-import type { AuthMethodsResponse, IdentityRootStatus, DidDocument, DomainVerificationInstructions, ExportBundle, OxySignedRecordType, SignedRecordEnvelope, VerifiedDomain } from '@oxy.so/contracts';
+import type { AuthMethodsResponse, IdentityLinkCreateResponse, IdentityLinkState, IdentityRootStatus, DidDocument, DomainVerificationInstructions, ExportBundle, OxySignedRecordType, SignedRecordEnvelope, VerifiedDomain } from '@oxy.so/contracts';
 import type { OxyServicesBase } from '../OxyServices.base';
 import { type PendingIdentityResult } from '../crypto/recoveryPhrase';
 /**
@@ -140,22 +115,47 @@ export declare function OxyServicesIdentityMixin<T extends typeof OxyServicesBas
          */
         listAuthMethods(): Promise<AuthMethodsResponse>;
         /**
-         * The signed-in account's root readiness (ADR 0024 D5): whether a root is
-         * linked, how many passkeys can open the web holder, whether the root has a
-         * phrase and whether it is saved and was shown to recover it. Metadata only —
-         * nothing here can open the root — so any first-party surface may show a
-         * "save your recovery phrase" reminder from it.
+         * How the signed-in account is kept (ADR 0029 D3): whether Commons' root is
+         * linked (self-custody), or the recovery email of a passkey account. Any
+         * first-party surface may read it to recommend linking Commons.
          */
         getIdentityRootStatus(): Promise<IdentityRootStatus>;
+        /**
+         * Open a request to link Commons to the signed-in passkey account (ADR 0029
+         * D3). auth.oxy.so shows its `qrPayload`; Commons scans it and signs with
+         * {@link signIdentityLink}.
+         */
+        createIdentityLink(): Promise<IdentityLinkCreateResponse>;
+        /** Where a link request stands. Both devices poll it; it needs no session. */
+        getIdentityLink(linkId: string): Promise<IdentityLinkState>;
+        /**
+         * Commons' half: sign the scanned request's `link_identity` proof with THIS
+         * device's identity key and post it. NATIVE-ONLY (the key lives in native
+         * secure storage). Resolves to the key and the 6-digit code auth.oxy.so will
+         * show for it, for the person to compare.
+         */
+        signIdentityLink(linkId: string, challenge: string): Promise<{
+            publicKey: string;
+            code: string;
+            username: string | null;
+        }>;
+        /** WebAuthn request options over the account's passkeys, whose challenge is the link's. Opaque. */
+        getIdentityLinkAssertionOptions(linkId: string, challenge: string): Promise<unknown>;
+        /**
+         * auth.oxy.so's half: the passkey assertion over the link's challenge. The
+         * account gains Commons' root and loses its recovery email.
+         */
+        completeIdentityLink(linkId: string, assertion: unknown): Promise<{
+            success: true;
+        }>;
+        /** Withdraw a link request that has not completed. */
+        cancelIdentityLink(linkId: string): Promise<void>;
         /**
          * Remove ONE passkey (WebAuthn credential) from the current account.
          *
          * Passkeys are per-credential, so this targets a specific credential id.
          * The server refuses to remove the last remaining auth method (the account
          * would become inaccessible) and deletes the stored `WebauthnCredential`.
-         * A passkey that also opens the account's root on the web takes its wrap with
-         * it, and the ONLY such passkey is refused with
-         * `code: 'IDENTITY_LAST_WEB_HOLDER'` (ADR 0024 D6).
          *
          * @param credentialId - The passkey's public credential id
          *   (`AuthMethodEntry.credentialId`).

package/dist/types/mixins/OxyServices.user.d.ts

@@ -2,7 +2,7 @@
  * User Management Methods Mixin
  */
 import type { CreateOxyNotificationRequest } from '@oxy.so/contracts';
-import type { User, Notification, NotificationPreferences, UserPreferences, SearchProfilesResponse, PrivacySettings } from '../models/interfaces';
+import type { User, Notification, NotificationPage, NotificationPreferences, UserPreferences, SearchProfilesResponse, PrivacySettings } from '../models/interfaces';
 import type { UserNameResponse, UserProfileUpdate, RecommendationRequest, RecommendationItem, ThemePreference } from '@oxy.so/contracts';
 import type { OxyServicesBase } from '../OxyServices.base';
 import { type PaginationParams, type FollowGraphParams } from '../utils/apiUtils';
@@ -350,6 +350,23 @@ export declare function OxyServicesUserMixin<T extends typeof OxyServicesBase>(B
         deleteAccount(confirmText: string): Promise<{
             message: string;
         }>;
+        /**
+         * WebAuthn request options to delete a PASSKEY account (ADR 0029 D3): its own
+         * passkeys, user verification required, and a challenge bound to it. Opaque —
+         * hand them to the browser's authentication ceremony, on auth.oxy.so. An
+         * account with a Commons key deletes with {@link deleteAccount} instead.
+         */
+        getAccountDeletionOptions(): Promise<unknown>;
+        /**
+         * Delete a PASSKEY account permanently, with an assertion by one of its
+         * passkeys over {@link getAccountDeletionOptions}' challenge.
+         *
+         * @param confirmText - Must equal the user's username (verified server-side)
+         * @param assertion - The ceremony's opaque `AuthenticationResponseJSON`
+         */
+        deleteAccountWithPasskey(confirmText: string, assertion: unknown): Promise<{
+            message: string;
+        }>;
         /**
          * Invalidate every cached read a follow/unfollow write invalidates.
          *
@@ -497,9 +514,13 @@ export declare function OxyServicesUserMixin<T extends typeof OxyServicesBase>(B
          */
         getViewerGraph(): Promise<ViewerGraph>;
         /**
-         * Get notifications
+         * One page of the signed-in user's Oxy notifications, newest first
+         * (`GET /notifications`), with the unread count across all pages.
          */
-        getNotifications(): Promise<Notification[]>;
+        getNotifications(params?: {
+            page?: number;
+            limit?: number;
+        }): Promise<NotificationPage>;
         /**
          * Get unread notification count
          */
@@ -511,11 +532,13 @@ export declare function OxyServicesUserMixin<T extends typeof OxyServicesBase>(B
          * from an Oxy service about the recipient's own account, with the recipient
          * as actor and their profile as the entity.
          */
-        createNotification(data: CreateOxyNotificationRequest | Partial<Notification>): Promise<Notification>;
+        createNotification(data: CreateOxyNotificationRequest): Promise<Notification>;
         /**
-         * Mark notification as read
+         * Mark one of the signed-in user's notifications read and return it as
+         * stored. Scoped to the recipient server-side, so it is also the
+         * authoritative read of a notification by id: a foreign or unknown id 404s.
          */
-        markNotificationAsRead(notificationId: string): Promise<void>;
+        markNotificationAsRead(notificationId: string): Promise<Notification>;
         /**
          * Mark all notifications as read
          */

package/dist/types/models/interfaces.d.ts

@@ -1,4 +1,4 @@
-import type { AccountKind, AccountCategoryId, UserNameResponse, UserRelationship, ThemePreference } from '@oxy.so/contracts';
+import type { AccountKind, AccountCategoryId, UserNameResponse, UserRelationship, ThemePreference, OxyNotificationEntityType, OxyNotificationType } from '@oxy.so/contracts';
 export interface OxyConfig {
     baseURL: string;
     cloudURL?: string;
@@ -241,25 +241,58 @@ export interface LoginResponse {
     user: User;
     message?: string;
 }
+/**
+ * The actor of a notification as `GET /notifications` populates it — the raw
+ * stored name, not a composed display name.
+ */
+export interface NotificationActor {
+    _id: string;
+    username?: string;
+    name?: {
+        first: string;
+        last: string;
+    };
+    avatar?: string;
+}
+/**
+ * One Oxy notification exactly as the API serializes it
+ * (`packages/api/src/controllers/notification.controller.ts`). `_id` — not
+ * `id` — is the key every notification endpoint addresses it by.
+ */
 export interface Notification {
-    id: string;
-    message: string;
+    _id: string;
+    recipientId: string;
+    /** Populated on a list read; the bare id on a create or a mark-read. */
+    actorId: string | NotificationActor;
     /** One of `OXY_NOTIFICATION_TYPES` (`@oxy.so/contracts`). */
-    type?: string;
+    type: OxyNotificationType;
+    /**
+     * What `entityId` names: `post` | `reply` | `profile`, or `app` — an opaque id
+     * in the notifying application's namespace (`system` notifications only).
+     */
+    entityType: OxyNotificationEntityType;
+    entityId: string;
     /**
-     * `system` notifications only (with `message`): the text an Oxy service sent
-     * about the recipient's own account. Render these two instead of composing a
-     * sentence from actor + entity.
+     * `system` notifications only: the text an Oxy service sent about the
+     * recipient's own account. Render these instead of composing a sentence from
+     * actor + entity.
      */
     title?: string;
+    message?: string;
     /** `system` notifications only: an optional deep link (https or the sending app's scheme). */
     url?: string;
-    /**
-     * What `entityId` names: `post` | `reply` | `profile`, or `app` — an opaque id
-     * in the notifying application's namespace (`system` notifications only).
-     */
-    entityType?: string;
-    entityId?: string;
+    read: boolean;
+    createdAt: string;
+    updatedAt: string;
+}
+/** One page of `GET /notifications`, newest first. */
+export interface NotificationPage {
+    notifications: Notification[];
+    /** Unread notifications across ALL pages. */
+    unreadCount: number;
+    hasMore: boolean;
+    page: number;
+    limit: number;
 }
 export interface Wallet {
     id: string;

package/dist/types/server/securityHeaders.d.ts

@@ -166,6 +166,15 @@ export interface OxyPagesHeadersOptions {
      * injecting the beacon at all — otherwise every page load logs a CSP
      * violation for a script we never asked for. The rest of the value is Pages'
      * own default, so caching is unchanged.
+     *
+     * And, because this origin is where a web account is created, recovered and
+     * deleted and every Oxy passkey is asserted (ADR 0028, ADR 0029) — the rest
+     * of the holder policy: no `<base>` and no form posts (`base-uri` /
+     * `form-action 'none'`), no Referer to anyone, passkeys for this origin only
+     * with every other powerful feature off (`Permissions-Policy`), and its
+     * responses readable by no other origin (`Cross-Origin-Resource-Policy`).
+     * Never `Cross-Origin-Opener-Policy`: the third-party OAuth popup reports
+     * its code to the app that opened it, and COOP severs `window.opener`.
      */
     sensitive?: boolean;
     /**
@@ -184,18 +193,6 @@ export interface OxyPagesHeadersOptions {
      */
     html?: readonly string[];
 }
-/**
- * Build a Cloudflare Pages `_headers` block for an Oxy HTML origin. Uses the
- * same CSP resolution as {@link createOxySecurityHeaders} plus the non-CSP
- * hardening headers Helmet would add on an Express HTML backend.
- *
- * Adding a hash to `script-src` does not narrow it: per CSP Level 3 a hash is
- * an additional source, so `'self'` and the beacon host keep matching external
- * scripts. (It WOULD neutralize `'unsafe-inline'` in the same directive — which
- * is why this hashes scripts only. `style-src` keeps `'unsafe-inline'` for
- * react-native-web's runtime stylesheet, and a style hash would silently switch
- * that off and render every Oxy web app unstyled.)
- */
 export declare function buildOxyPagesHeaders(options?: OxyPagesHeadersOptions): string;
 export interface OxySecurityHeadersOptions {
     /**

package/dist/types/session/accountDialogController.d.ts

@@ -36,12 +36,6 @@
  *   - `commonsAvailability` — whether Commons is installed on this device
  *     (native only, via the injected `canOpenApp` probe), so the QR view can
  *     offer a "Get Commons" fallback instead of a same-device dead end.
- *   - `startPasskeyHubSignIn` — on a non-Oxy web origin (where a WebAuthn
- *     ceremony can't run locally, the RP-ID is bound to oxy.so), open a popup
- *     at the auth.oxy.so passkey hub instead, scoped to the SAME device-flow
- *     session `showQr` creates, and complete it via the SAME poll/socket/claim
- *     engine. Falls back to `showQr`'s plain QR rendering if the popup is
- *     blocked.
  *
  * Sign-in is passkey (WebAuthn) or the Commons QR / shared-keychain handoff —
  * password, social login, and 2FA were removed ecosystem-wide. Account
@@ -114,8 +108,6 @@ export type SignInProgress = 'idle' | 'preparing' | 'awaiting-approval' | 'deliv
  * WHY a sign-in attempt ended in `'error'` — a machine-readable reason the UI
  * turns into localized copy (the controller ships no user-facing prose).
  *
- *  - `'cancelled'` — the USER walked away (closed the passkey hub popup). A
- *    voluntary outcome, not a failure to report.
  *  - `'denied'` — the approver declined the request in Commons.
  *  - `'expired'` — the request outlived its server-authoritative expiry.
  *  - `'network'` — Oxy could not be reached (no response, timeout).
@@ -124,22 +116,7 @@ export type SignInProgress = 'idle' | 'preparing' | 'awaiting-approval' | 'deliv
  *  - `'claim-failed'` — the request WAS approved, but the session could not be claimed.
  *  - `'unknown'` — anything else; the raw message stays on `error` for logs.
  */
-export type SignInFailureReason = 'cancelled' | 'denied' | 'expired' | 'network' | 'not-configured' | 'unsupported-flow' | 'claim-failed' | 'unknown';
-/**
- * Minimal structural handle over a popup `Window` — just enough for the
- * cross-origin passkey hub flow ({@link AccountDialogController.startPasskeyHubSignIn}):
- * navigate it once the device-flow session's `authorizeCode` is known, detect
- * the user closing it early (`closed`), and close it programmatically on
- * completion/failure. Satisfied directly by `window.open()`'s return value on
- * web; native has no popup concept and never injects an opener.
- */
-export interface PopupWindowHandle {
-    readonly closed: boolean;
-    close(): void;
-    location: {
-        href: string;
-    };
-}
+export type SignInFailureReason = 'denied' | 'expired' | 'network' | 'not-configured' | 'unsupported-flow' | 'claim-failed' | 'unknown';
 /**
  * State of the "Sign in with Oxy" (shared-key / QR) device flow.
  *
@@ -217,6 +194,14 @@ export interface SignInFlowState {
      * attempt failing with the same message is).
      */
     attempt: number;
+    /**
+     * `true` when this attempt is the sign-in entry's EMBEDDED QR
+     * ({@link AccountDialogController.startInlineQr}): a request the surface
+     * started on its own, not one the person asked for. Its failures (an expired
+     * code, above all) belong to that QR, which renews itself, and are not news
+     * to report.
+     */
+    inline: boolean;
 }
 /** Immutable snapshot consumed by `useSyncExternalStore`. */
 export interface AccountDialogSnapshot {
@@ -343,28 +328,6 @@ export interface AccountDialogControllerOptions {
      * `showQr` behaves exactly as before (render QR only).
      */
     canOpenApp?: (url: string) => Promise<boolean>;
-    /**
-     * Open a new, empty popup window SYNCHRONOUSLY (before any `await`) so the
-     * browser attributes it to the click gesture that triggered it, returning a
-     * handle to navigate once the device-flow session is known — or `null` if
-     * the popup was blocked. Injected by the provider (web only:
-     * `window.open('', ...)`; absent on native, where the hub-popup flow does
-     * not apply). Used by {@link AccountDialogController.startPasskeyHubSignIn}.
-     */
-    openPopup?: () => PopupWindowHandle | null;
-    /**
-     * Origin of the web identity carrier (default `IDENTITY_WEB_ORIGIN`,
-     * `https://id.oxy.so`) — where a passkey sign-in or sign-up runs
-     * and the account's identity is kept sealed under the passkey. The popup opens
-     * `<identityOrigin>/continue?code=…`. Overridable for local/staging testing.
-     */
-    identityOrigin?: string;
-    /**
-     * @deprecated Alias of {@link identityOrigin}, kept for existing
-     * configuration. The popup used to open `auth.oxy.so/hub-passkey`; it now opens
-     * the identity origin's `/continue`, so a value here must be that origin.
-     */
-    hubBaseUrl?: string;
     /**
      * Which surface the sign-in is initiated from — a FACT supplied by the
      * consumer, because only the consumer can classify its own environment
@@ -389,8 +352,6 @@ export declare class AccountDialogController {
     private readonly openUrl?;
     private readonly canOpenApp?;
     private readonly socketFactory?;
-    private readonly openPopup?;
-    private readonly identityOrigin;
     private readonly platform;
     private readonly listeners;
     private view;
@@ -433,10 +394,6 @@ export declare class AccountDialogController {
      * ABANDONED request never blocks the next request's first poll.
      */
     private pollInFlightToken;
-    /** The popup opened by {@link startPasskeyHubSignIn}, or `null`. */
-    private activePopup;
-    /** Watches {@link activePopup}'s `closed` state; see {@link watchPopup}. */
-    private popupWatchTimer;
     private unsubscribeSession;
     private unsubscribeTokens;
     /** Last-observed SDK auth readiness (a planted bearer). Drives the fetch edge. */
@@ -642,38 +599,21 @@ export declare class AccountDialogController {
      */
     showQr(): Promise<void>;
     /**
-     * Start a NEW attempt the same way the last one was started — "Try again"
-     * repeats the user's choice rather than silently switching method. A failed
-     * passkey-hub attempt reopens the hub popup; a failed "Sign in with Oxy"
-     * retries that; an explicit QR request shows the QR.
+     * The sign-in entry's EMBEDDED QR: a request whose only route is the QR,
+     * started without leaving the current view.
      *
-     * Call it straight from the press handler: the hub route opens its popup
-     * synchronously, before this method's first `await`, so the browser still
-     * attributes it to the click.
+     * Unlike {@link showQr} it runs no delivery selection. The surface starts it
+     * by itself, on mount, so it must not push to the person's phone or open
+     * Commons — nobody asked for either. Any other sign-in the person then
+     * chooses supersedes it (and withdraws its request) like any new attempt.
      */
-    retrySignIn(): Promise<void>;
+    startInlineQr(): Promise<void>;
     /**
-     * Web-only: sign in (or create an account) with a passkey at the web identity
-     * carrier. The ceremony runs on `id.oxy.so`, never on the calling origin, for
-     * two reasons: a credential minted with `WEBAUTHN_RP_ID=oxy.so` can only be
-     * asserted from `oxy.so`/a subdomain/loopback (a browser-enforced boundary),
-     * and only the identity origin may unseal or create the account's identity
-     * (one identity, two carriers). Opens a popup at `<identityOrigin>/continue`,
-     * scoped to the SAME device-flow
-     * session {@link showQr} would create (same `authorizeCode`/`sessionToken`
-     * pair), and let the SAME poll/socket/claim engine complete it once the hub
-     * authorizes the session (`POST /auth/session/authorize-code/:authorizeCode`,
-     * bearer-authed, server-side — this method never sees or transmits the
-     * secret `sessionToken`).
-     *
-     * The popup MUST be opened synchronously, before any `await`, or the
-     * browser's popup blocker loses the click-gesture attribution and silently
-     * blocks it — so {@link openPopup} is invoked as the very first step, before
-     * the device-flow session (which needs an async call) even exists. If the
-     * popup is blocked (or no `openPopup` was injected), this falls back to
-     * `showQr`'s plain QR rendering — no dead end.
-     */
-    startPasskeyHubSignIn(): Promise<void>;
+     * Start a NEW attempt the same way the last one was started — "Try again"
+     * repeats the user's choice rather than silently switching method: a failed
+     * "Sign in with Oxy" retries that; an explicit QR request shows the QR.
+     */
+    retrySignIn(): Promise<void>;
     /**
      * End whatever attempt is running (withdrawing its request) and begin a new
      * one. Returns the new attempt's identity for the caller to re-check after
@@ -683,9 +623,9 @@ export declare class AccountDialogController {
     /** Whether `attempt` is still the one the surface is waiting on. */
     private isCurrentAttempt;
     /**
-     * Shared device-flow session creation for both {@link showQr} (renders the
-     * QR) and {@link startPasskeyHubSignIn} (also opens the hub popup) — the
-     * same `startCommonsSignIn` → poll/socket wiring either way. Returns the
+     * Shared device-flow session creation for {@link signInWithOxy},
+     * {@link showQr} and {@link startInlineQr} — the same `startCommonsSignIn` →
+     * poll/socket wiring every time. Returns the
      * handle on success (already reflected in `signIn`), or `null` when the
      * attempt failed (already set as `signIn.failure`) or was abandoned while the
      * request was being created.
@@ -696,8 +636,8 @@ export declare class AccountDialogController {
      *   request, a socket, and a poll behind it.
      * @param opts.deliver - Whether to run automatic Commons delivery selection
      *   ({@link resolveDeliveryRoute}). `true` for the normal one-primary-action
-     *   entry; `false` when the caller already owns the primary surface (the
-     *   passkey hub popup), where the request's Commons route is simply the QR.
+     *   entry; `false` for the embedded QR, which the screen starts by itself,
+     *   where the request's Commons route is simply the QR.
      */
     private startDeviceFlowSession;
     /**
@@ -744,17 +684,6 @@ export declare class AccountDialogController {
      * end the user stares at.
      */
     private openCommonsLink;
-    /**
-     * Poll {@link PopupWindowHandle.closed} so a user who dismisses the hub
-     * popup without completing sign-in gets prompt feedback (there is no DOM
-     * event for a cross-origin popup closing — polling is the only mechanism).
-     * Cleared by {@link closeActivePopup}, which every sign-in exit path already
-     * calls.
-     */
-    private watchPopup;
-    private clearPopupWatchTimer;
-    /** Tear down the popup watch timer and close the popup, if any. Idempotent. */
-    private closeActivePopup;
     /**
      * Resolve whether Commons is installed on this device via the injected
      * `canOpenApp` probe, updating {@link commonsAvailability} as durable,
@@ -769,7 +698,7 @@ export declare class AccountDialogController {
      */
     private resolveCommonsAvailability;
     /**
-     * Tear down the active sign-in device flow (timers + socket + popup + token),
+     * Tear down the active sign-in device flow (timers + socket + token),
      * WITHDRAW the request server-side, and reset to idle.
      *
      * Cancellation has to converge in both directions: the surface closing must
@@ -869,6 +798,8 @@ export declare class AccountDialogController {
      * to advance without a fact behind it.
      */
     private setSignIn;
+    /** `facts` as the current attempt's state. */
+    private stampSignIn;
     /** Update a subset of the device-flow facts, re-deriving `progress`. */
     private patchSignIn;
     private computeSnapshot;