@oxy.so/core 1.16.0 → 1.18.1

package/src/i18n/locales/ko-KR.json

@@ -50,7 +50,26 @@
     "createInCommons": "Commons에서 나의 아이덴티티 만들기",
     "createAccount": "계정 만들기",
     "backToSignInLink": "이미 계정이 있으신가요? 로그인",
-    "webSubtitle": "비밀번호가 없습니다. 기기가 패스키를 만들고, 계정에는 본인만 보관하는 복구 문구가 생깁니다."
+    "webSubtitle": "비밀번호가 없습니다. 기기가 패스키를 만들고, 잃어버리면 복구 이메일로 다시 들어올 수 있습니다.",
+    "username": {
+      "label": "사용자 이름",
+      "placeholder": "yourname",
+      "required": "사용자 이름을 정하세요.",
+      "taken": "이미 사용 중인 사용자 이름입니다."
+    },
+    "email": {
+      "title": "복구 이메일",
+      "subtitle": "패스키를 잃어버리면 다시 들어올 수 있도록 여기로 코드를 보냅니다. 다른 용도로는 쓰지 않습니다.",
+      "label": "이메일",
+      "placeholder": "you@example.com",
+      "invalid": "올바른 이메일 주소를 입력하세요."
+    },
+    "passkey": {
+      "title": "패스키 만들기",
+      "subtitle": "지문, 얼굴 또는 화면 잠금으로 로그인합니다. 기억할 것은 없습니다.",
+      "action": "패스키 만들기"
+    },
+    "commonsInstead": "직접 키를 보관하고 싶으신가요? Commons 사용하기"
   },
   "accountSwitcher": {
     "loading": "계정을 불러오는 중...",
@@ -225,7 +244,63 @@
     "help": "도움말 및 피드백",
     "signOut": "로그아웃",
     "privacy": "개인정보 처리방침",
-    "terms": "서비스 약관",
-    "identity": "내 아이덴티티"
+    "terms": "서비스 약관"
+  },
+  "recover": {
+    "title": "계정 복구",
+    "subtitle": "사용자 이름이나 복구 이메일을 입력하세요. 계정의 복구 이메일로 코드를 보냅니다.",
+    "identifier": {
+      "label": "사용자 이름 또는 이메일",
+      "placeholder": "yourname",
+      "required": "사용자 이름이나 이메일을 입력하세요."
+    },
+    "commonsNote": "Commons를 쓰는 계정인가요? Commons에서 복구 문구로 복구하세요.",
+    "passkey": {
+      "title": "새 패스키 추가",
+      "subtitle": "@{{username}}용. 잃어버린 패스키는 나중에 계정 보안 설정에서 삭제하세요.",
+      "action": "패스키 만들기"
+    },
+    "backToSignIn": "로그인으로 돌아가기"
+  },
+  "emailCode": {
+    "title": "이메일을 확인하세요",
+    "sentTo": "{{email}}(으)로 6자리 코드를 보냈습니다.",
+    "sentIfAccount": "이 계정에 복구 이메일이 있다면 6자리 코드를 보냈습니다.",
+    "label": "코드",
+    "resend": "새 코드 보내기",
+    "resent": "새 코드를 보냈습니다.",
+    "changeEmail": "다른 이메일 사용",
+    "errors": {
+      "codeInvalid": "코드가 올바르지 않거나 만료되었습니다.",
+      "tooManyAttempts": "틀린 코드가 너무 많습니다. 새 코드를 요청하세요.",
+      "expired": "시간이 너무 오래 걸렸습니다. 다시 시작하세요.",
+      "unavailable": "지금은 Oxy가 이메일을 보낼 수 없습니다. 나중에 다시 시도하세요.",
+      "rateLimited": "코드가 너무 많습니다. 나중에 다시 시도하세요."
+    }
+  },
+  "deleteAccount": {
+    "passkey": {
+      "subtitle": "패스키로 확인하세요. @{{username}}과(와) 그 안의 모든 것이 영구적으로 삭제됩니다.",
+      "action": "패스키로 삭제",
+      "done": "계정이 삭제되었습니다.",
+      "closeWindow": "이 창을 닫아도 됩니다.",
+      "commons": "이 계정은 Commons를 사용합니다. Oxy Commons의 설정 > 계정 삭제에서 해당 키로 삭제하세요."
+    }
+  },
+  "linkCommons": {
+    "title": "Commons 연결",
+    "subtitle": "직접 키를 보관하세요. Commons를 연결하면 이 계정은 오직 당신의 것이 됩니다. 복구 이메일은 삭제되고, Commons의 복구 문구로 다시 들어올 수 있습니다.",
+    "scan": "휴대폰에서 Commons를 열고 “웹에 Oxy 계정이 있어요”를 선택한 다음 이 코드를 스캔하세요.",
+    "waiting": "Commons를 기다리는 중…",
+    "compareTitle": "코드 확인",
+    "compare": "Commons에 같은 코드가 표시됩니다. 다르면 취소하세요.",
+    "confirm": "네, Commons 연결",
+    "cancel": "취소",
+    "doneTitle": "Commons가 연결되었습니다",
+    "done": "이 계정은 이제 자기 보관 계정입니다. 복구 이메일은 삭제되었습니다. Commons의 복구 문구로 다시 들어올 수 있습니다.",
+    "already": "이 계정은 이미 Commons를 사용합니다.",
+    "expired": "이 코드는 만료되었습니다.",
+    "renew": "새 코드 보기",
+    "failed": "Commons를 연결하지 못했습니다. 다시 시도하세요."
   }
 }

package/src/i18n/locales/pt-PT.json

@@ -50,7 +50,26 @@
     "createInCommons": "Crie a sua identidade no Commons",
     "createAccount": "Criar conta",
     "backToSignInLink": "Já tem uma conta? Inicie sessão",
-    "webSubtitle": "Sem palavra-passe. O teu dispositivo cria uma chave de acesso e a tua conta recebe uma frase de recuperação que só tu guardas."
+    "webSubtitle": "Sem palavra-passe: o teu dispositivo cria uma passkey e um email de recuperação devolve-te o acesso se a perderes.",
+    "username": {
+      "label": "Nome de utilizador",
+      "placeholder": "oteunome",
+      "required": "Escolhe um nome de utilizador.",
+      "taken": "Esse nome de utilizador já está em uso."
+    },
+    "email": {
+      "title": "O teu email de recuperação",
+      "subtitle": "Se perderes a passkey, enviamos-te aqui um código para voltares a entrar. Não é usado para mais nada.",
+      "label": "Email",
+      "placeholder": "tu@exemplo.pt",
+      "invalid": "Escreve um email válido."
+    },
+    "passkey": {
+      "title": "Cria a tua passkey",
+      "subtitle": "É com ela que inicias sessão: impressão digital, rosto ou bloqueio do ecrã. Nada para memorizar.",
+      "action": "Criar passkey"
+    },
+    "commonsInstead": "Queres guardar a tua própria chave? Usa o Commons"
   },
   "accountSwitcher": {
     "loading": "A carregar contas...",
@@ -225,7 +244,63 @@
     "help": "Ajuda e feedback",
     "signOut": "Terminar sessão",
     "privacy": "Política de privacidade",
-    "terms": "Termos de serviço",
-    "identity": "A sua identidade"
+    "terms": "Termos de serviço"
+  },
+  "recover": {
+    "title": "Recupera a tua conta",
+    "subtitle": "Escreve o teu nome de utilizador ou o email de recuperação. Enviamos um código para o email de recuperação da conta.",
+    "identifier": {
+      "label": "Utilizador ou email",
+      "placeholder": "oteunome",
+      "required": "Escreve o teu utilizador ou email."
+    },
+    "commonsNote": "A tua conta usa o Commons? Recupera-a no Commons com a tua frase de recuperação.",
+    "passkey": {
+      "title": "Adiciona uma nova passkey",
+      "subtitle": "Para @{{username}}. Remove as passkeys perdidas mais tarde nas definições de segurança da conta.",
+      "action": "Criar passkey"
+    },
+    "backToSignIn": "Voltar a iniciar sessão"
+  },
+  "emailCode": {
+    "title": "Vê o teu email",
+    "sentTo": "Enviámos um código de 6 dígitos para {{email}}.",
+    "sentIfAccount": "Se esta conta tiver um email de recuperação, enviámos-lhe um código de 6 dígitos.",
+    "label": "Código",
+    "resend": "Enviar um novo código",
+    "resent": "Enviámos um novo código.",
+    "changeEmail": "Usar outro email",
+    "errors": {
+      "codeInvalid": "Esse código não está certo ou expirou.",
+      "tooManyAttempts": "Demasiados códigos errados. Pede um novo.",
+      "expired": "Passou demasiado tempo. Recomeça.",
+      "unavailable": "O Oxy não consegue enviar emails agora. Tenta mais tarde.",
+      "rateLimited": "Demasiados códigos. Tenta mais tarde."
+    }
+  },
+  "deleteAccount": {
+    "passkey": {
+      "subtitle": "Confirma com a tua passkey. @{{username}} e tudo o que contém são eliminados para sempre.",
+      "action": "Eliminar com passkey",
+      "done": "A tua conta foi eliminada.",
+      "closeWindow": "Podes fechar esta janela.",
+      "commons": "Esta conta usa o Commons: elimina-a no Oxy Commons, Definições > Eliminar conta, com a sua chave."
+    }
+  },
+  "linkCommons": {
+    "title": "Associar o Commons",
+    "subtitle": "Guarda a tua própria chave: associa o Commons e esta conta passa a ser só tua. O email de recuperação é eliminado e a tua frase de recuperação no Commons é como voltas a entrar.",
+    "scan": "No telemóvel, abre o Commons, escolhe «Tenho uma conta Oxy na web» e digitaliza este código.",
+    "waiting": "À espera do Commons…",
+    "compareTitle": "Verifica o código",
+    "compare": "O Commons mostra o mesmo código. Se não mostrar, cancela.",
+    "confirm": "Sim, associar o Commons",
+    "cancel": "Cancelar",
+    "doneTitle": "O Commons está associado",
+    "done": "Esta conta passou a ser de autocustódia. O email de recuperação foi eliminado: a tua frase de recuperação no Commons é como voltas a entrar.",
+    "already": "Esta conta já usa o Commons.",
+    "expired": "Este código expirou.",
+    "renew": "Mostrar um novo código",
+    "failed": "Não foi possível associar o Commons. Tenta de novo."
   }
 }

package/src/i18n/locales/zh-CN.json

@@ -50,7 +50,26 @@
     "createInCommons": "在 Commons 中创建您的身份",
     "createAccount": "创建账户",
     "backToSignInLink": "已有账户？登录",
-    "webSubtitle": "无需密码。你的设备会创建通行密钥，你的账号会获得一个只有你保管的恢复短语。"
+    "webSubtitle": "无需密码：你的设备会创建一个通行密钥，丢失时可通过恢复邮箱重新进入。",
+    "username": {
+      "label": "用户名",
+      "placeholder": "yourname",
+      "required": "请选择用户名。",
+      "taken": "该用户名已被占用。"
+    },
+    "email": {
+      "title": "你的恢复邮箱",
+      "subtitle": "如果你丢失了通行密钥，我们会向这里发送验证码让你重新进入。它不作其他用途。",
+      "label": "邮箱",
+      "placeholder": "you@example.com",
+      "invalid": "请输入有效的邮箱地址。"
+    },
+    "passkey": {
+      "title": "创建你的通行密钥",
+      "subtitle": "用指纹、面容或屏幕锁登录，无需记住任何东西。",
+      "action": "创建通行密钥"
+    },
+    "commonsInstead": "想自己保管密钥？改用 Commons"
   },
   "accountSwitcher": {
     "loading": "正在加载账户...",
@@ -225,7 +244,63 @@
     "help": "帮助与反馈",
     "signOut": "退出登录",
     "privacy": "隐私政策",
-    "terms": "服务条款",
-    "identity": "你的身份"
+    "terms": "服务条款"
+  },
+  "recover": {
+    "title": "恢复你的账户",
+    "subtitle": "输入你的用户名或恢复邮箱。我们会向该账户的恢复邮箱发送验证码。",
+    "identifier": {
+      "label": "用户名或邮箱",
+      "placeholder": "yourname",
+      "required": "请输入用户名或邮箱。"
+    },
+    "commonsNote": "你的账户使用 Commons？请在 Commons 中用恢复短语恢复。",
+    "passkey": {
+      "title": "添加新的通行密钥",
+      "subtitle": "用于 @{{username}}。丢失的通行密钥可稍后在账户安全设置中移除。",
+      "action": "创建通行密钥"
+    },
+    "backToSignIn": "返回登录"
+  },
+  "emailCode": {
+    "title": "查看你的邮箱",
+    "sentTo": "我们已向 {{email}} 发送了 6 位验证码。",
+    "sentIfAccount": "如果该账户有恢复邮箱，我们已向其发送 6 位验证码。",
+    "label": "验证码",
+    "resend": "发送新验证码",
+    "resent": "我们已发送新验证码。",
+    "changeEmail": "使用其他邮箱",
+    "errors": {
+      "codeInvalid": "验证码不正确或已过期。",
+      "tooManyAttempts": "错误次数过多，请重新获取验证码。",
+      "expired": "耗时过长，请重新开始。",
+      "unavailable": "Oxy 暂时无法发送邮件，请稍后再试。",
+      "rateLimited": "验证码请求过多，请稍后再试。"
+    }
+  },
+  "deleteAccount": {
+    "passkey": {
+      "subtitle": "请用通行密钥确认。@{{username}} 及其中的一切将被永久删除。",
+      "action": "用通行密钥删除",
+      "done": "你的账户已删除。",
+      "closeWindow": "你可以关闭此窗口。",
+      "commons": "此账户使用 Commons：请在 Oxy Commons 的“设置 > 删除账户”中用其密钥删除。"
+    }
+  },
+  "linkCommons": {
+    "title": "关联 Commons",
+    "subtitle": "自己保管密钥：关联 Commons 后，此账户只属于你。它的恢复邮箱会被删除，今后用 Commons 中的恢复短语找回账户。",
+    "scan": "在手机上打开 Commons，选择“我在网页上有 Oxy 账户”，然后扫描此码。",
+    "waiting": "正在等待 Commons…",
+    "compareTitle": "核对代码",
+    "compare": "Commons 会显示相同的代码。如果不同，请取消。",
+    "confirm": "是的，关联 Commons",
+    "cancel": "取消",
+    "doneTitle": "Commons 已关联",
+    "done": "此账户现在由你自己保管。它的恢复邮箱已删除：今后用 Commons 中的恢复短语找回账户。",
+    "already": "此账户已在使用 Commons。",
+    "expired": "此代码已过期。",
+    "renew": "显示新代码",
+    "failed": "无法关联 Commons，请重试。"
   }
 }

package/src/index.ts

@@ -344,55 +344,11 @@ export {
 export type { AeadResult } from './crypto/aead';
 export { deriveSharedSecret } from './crypto/ecdh';
 
-// Web identity holder — the same root as Commons, sealed under a passkey's PRF
-// output; identity proofs; transfer to Commons (docs/adr/0024-one-oxy-account-root-holders.md)
-export {
-    WEB_IDENTITY_PRF_INPUT,
-    WebIdentityUnlockError,
-    WEB_IDENTITY_PRF_OUTPUT_LENGTH,
-    addWrap,
-    deriveIdentityFromMnemonic,
-    deriveIdentityFromPrivateKey,
-    deriveIdentityFromRecoveryMaterial,
-    deriveKeyEncryptionKey,
-    generateDataKey,
-    generateWebIdentity,
-    isUsablePrfOutput,
-    markWrapVerified,
-    normalizeMnemonic,
-    openWebIdentity,
-    parseRecoveryMaterial,
-    removeWrap,
-    sealWebIdentity,
-    unlockWebIdentity,
-    unwrapDataKey,
-    wipeBytes,
-    wipeOpenedIdentity,
-} from './crypto/webIdentityCarrier';
-export type {
-    OpenedMnemonicIdentity,
-    OpenedRawKeyIdentity,
-    OpenedWebIdentity,
-    WebIdentityRecoveryMaterial,
-    WebIdentityUnlockFailure,
-    WrapInput,
-} from './crypto/webIdentityCarrier';
+// Identity proofs — the one signed format for operations on a personal root
+// (docs/adr/0024-one-oxy-account-root-holders.md D7)
 export { digestIdentityPayload, signIdentityProof } from './crypto/identityProof';
-export {
-    buildMoveQrPayload,
-    createMoveCommitment,
-    deriveMoveKey,
-    deriveMoveSas,
-    digestMoveCiphertext,
-    generateMoveEphemeralKeyPair,
-    openMovedIdentity,
-    parseMoveQrPayload,
-    sealIdentityForMove,
-    signMoveReceipt,
-    verifyMoveCommitment,
-    verifyMoveReceipt,
-} from './crypto/identityMove';
-export type { MoveReceiptClaims } from './crypto/identityMove';
+// Linking Commons to a passkey account: the code both screens compare (ADR 0029 D3)
+export { deriveIdentityLinkCode } from './crypto/identityLink';
 
 // ---------------------------------------------------------------------------
 // Devices
@@ -411,6 +367,8 @@ export type {
     User,
     LoginResponse,
     Notification,
+    NotificationActor,
+    NotificationPage,
     Wallet,
     Transaction,
     BlockedUser,

package/src/mixins/OxyServices.auth.ts

@@ -9,7 +9,15 @@ import type {
   LoginResult,
   CommonsDenyReason,
 } from '@oxy.so/contracts';
-import { loginResultSchema, safeParseContract, type IdentityProof, type WebIdentityEnvelope } from '@oxy.so/contracts';
+import {
+  emailVerificationConfirmResponseSchema,
+  emailVerificationStartResponseSchema,
+  loginResultSchema,
+  safeParseContract,
+  type EmailVerificationConfirmResponse,
+  type EmailVerificationStartRequest,
+  type EmailVerificationStartResponse,
+} from '@oxy.so/contracts';
 import type { SessionLoginResponse } from '../models/session';
 import type { OxyServicesBase } from '../OxyServices.base';
 import type { PublicApplication } from './OxyServices.connectedApps';
@@ -463,6 +471,12 @@ export class ServiceCredentialMismatchError extends Error {
   }
 }
 
+/**
+ * How long a failed service-token mint sends session-less requests anonymous
+ * before the next attempt, under `serviceIdentity: 'when-anonymous'`.
+ */
+export const ANONYMOUS_SERVICE_TOKEN_RETRY_MS = 30_000;
+
 export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T) {
   return class extends Base {
     /**
@@ -489,8 +503,57 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
     /** @internal Raw apiSecret stored by configureServiceAuth() for use by getServiceToken() */
     _serviceApiSecret: string | null = null;
 
+    /**
+     * Before this instant, a request without a user session does not try to
+     * mint a service token and goes out anonymous. Set after a failed mint; see
+     * {@link _serviceTokenForAnonymousRequest}.
+     *
+     * @internal
+     */
+    _anonymousServiceTokenRetryAt = 0;
+
     constructor(...args: any[]) {
       super(...(args as [any]));
+      if (this.config.serviceIdentity === 'when-anonymous') {
+        this.httpService.setAnonymousAuthProvider(() => this._serviceTokenForAnonymousRequest());
+      }
+    }
+
+    /**
+     * The bearer for a request with no user session, under `serviceIdentity:
+     * 'when-anonymous'`: this process's service token, or `null` to send the
+     * request anonymous as before.
+     *
+     * `null`, never a throw, whenever there is no token to offer:
+     * - no key pair and no attestable workload (a local checkout) — asking
+     *   costs nothing and there is nothing to ask for;
+     * - the mint failed. The request still goes out, anonymous, and so does
+     *   every request for the next {@link ANONYMOUS_SERVICE_TOKEN_RETRY_MS}, so
+     *   an Oxy that is refusing attestation (seen for ~2.5 minutes after a
+     *   deploy on 2026-09-25) is asked once per window rather than once per
+     *   read, and no read waits on a mint that just failed.
+     *
+     * The token itself comes from {@link getServiceToken}: cached for its
+     * lifetime and single-flight, so concurrent reads share one mint.
+     *
+     * @internal
+     */
+    async _serviceTokenForAnonymousRequest(): Promise<string | null> {
+      if (Date.now() < this._anonymousServiceTokenRetryAt) return null;
+      const hasKeyPair = Boolean(this._serviceApiKey && this._serviceApiSecret);
+      if (!hasKeyPair && !(await this._canUseWorkloadIdentity())) return null;
+      try {
+        return await this.getServiceToken();
+      } catch (error) {
+        this._anonymousServiceTokenRetryAt = Date.now() + ANONYMOUS_SERVICE_TOKEN_RETRY_MS;
+        logger.warn('[oxy.auth] No service token for a request without a session; sending it anonymous', {
+          component: 'auth',
+          method: '_serviceTokenForAnonymousRequest',
+          retryInMs: ANONYMOUS_SERVICE_TOKEN_RETRY_MS,
+          error: error instanceof Error ? error.message : String(error),
+        });
+        return null;
+      }
     }
 
     /**
@@ -1692,12 +1755,43 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
     }
 
     /**
-     * Check email availability
+     * Send a 6-digit code to an email (ADR 0029 D3): the recovery email of a
+     * new passkey account (`purpose: 'signup'`), or — named by username or
+     * email — the recovery email of an account being recovered
+     * (`purpose: 'recovery'`). The answer is the same whether or not an
+     * account exists; nothing is revealed about who has one.
      */
-    async checkEmailAvailability(email: string): Promise<{ available: boolean; message: string }> {
+    async startEmailVerification(request: EmailVerificationStartRequest): Promise<EmailVerificationStartResponse> {
       try {
-        // Public availability lookup (pre-session) — skip the bearer preflight.
-        return await this.makeRequest('GET', `/auth/check-email/${email}`, undefined, { cache: false, skipAuth: true });
+        const res = await this.makeRequest<unknown>('POST', '/auth/email/verify/start', request, {
+          cache: false,
+          skipAuth: true,
+        });
+        const parsed = safeParseContract(emailVerificationStartResponseSchema, res);
+        if (!parsed) throw new Error('auth/email/verify/start returned an unexpected response shape');
+        return parsed;
+      } catch (error) {
+        throw this.handleError(error);
+      }
+    }
+
+    /**
+     * Confirm the code {@link startEmailVerification} sent. Resolves to a
+     * short-lived one-use ticket: a sign-up passes it (with the email) to
+     * {@link webauthnRegisterVerify}; a recovery passes it as `recoveryTicket`
+     * to {@link webauthnRegisterOptions} and {@link webauthnRegisterVerify}.
+     */
+    async confirmEmailVerification(verificationId: string, code: string): Promise<EmailVerificationConfirmResponse> {
+      try {
+        const res = await this.makeRequest<unknown>(
+          'POST',
+          '/auth/email/verify/confirm',
+          { verificationId, code },
+          { cache: false, skipAuth: true },
+        );
+        const parsed = safeParseContract(emailVerificationConfirmResponseSchema, res);
+        if (!parsed) throw new Error('auth/email/verify/confirm returned an unexpected response shape');
+        return parsed;
       } catch (error) {
         throw this.handleError(error);
       }
@@ -1708,19 +1802,24 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
      * `PublicKeyCredentialCreationOptions` the browser's `navigator.credentials
      * .create()` (or `@simplewebauthn/browser`'s `startRegistration`) needs.
      *
-     * With a bearer token planted this links a passkey to the signed-in account
-     * (`username` ignored); without one it is a prospective signup and `username`
-     * is the desired handle. The returned options are OPAQUE — Oxy does not own
-     * their shape (the browser / `@simplewebauthn` does), so they pass through
-     * as `unknown` for the caller to hand straight to the ceremony.
+     * With a bearer token planted this adds a passkey to the signed-in account.
+     * Without one, `username` is a prospective sign-up's handle, and
+     * `recoveryTicket` a recovery's new passkey for the account it names. The
+     * returned options are OPAQUE — Oxy does not own their shape (the browser /
+     * `@simplewebauthn` does), so they pass through as `unknown` for the caller
+     * to hand straight to the ceremony.
      */
-    async webauthnRegisterOptions(username?: string): Promise<unknown> {
+    async webauthnRegisterOptions(request: { username?: string; recoveryTicket?: string } = {}): Promise<unknown> {
+      const signedOut = request.username !== undefined || request.recoveryTicket !== undefined;
       try {
         return await this.makeRequest<unknown>(
           'POST',
           '/auth/webauthn/register/options',
-          { ...(username !== undefined ? { username } : {}) },
-          { cache: false, ...(username !== undefined ? { skipAuth: true } : {}) },
+          {
+            ...(request.username !== undefined ? { username: request.username } : {}),
+            ...(request.recoveryTicket !== undefined ? { recoveryTicket: request.recoveryTicket } : {}),
+          },
+          { cache: false, ...(signedOut ? { skipAuth: true } : {}) },
         );
       } catch (error) {
         throw this.handleError(error);
@@ -1732,10 +1831,12 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
      * browser `RegistrationResponseJSON` (`response`) alongside the Oxy envelope
      * (desired `username` for signup + the device-session naming fields).
      *
-     * Two server branches, disambiguated by the response shape:
-     *  - **Signup** (no bearer): the account is created and a session minted —
-     *    the response carries `sessionId`, is the SAME {@link LoginResult}
-     *    contract as `POST /auth/verify`, and its access token is planted here.
+     * Server branches, disambiguated by the response shape:
+     *  - **Sign-up** (no bearer; `username`, `email`, `emailTicket`) and
+     *    **recovery** (no bearer; `recoveryTicket`): the account is created, or
+     *    gains the passkey, and a session is minted — the response carries
+     *    `sessionId`, is the SAME {@link LoginResult} contract as
+     *    `POST /auth/verify`, and its access token is planted here.
      *  - **Link** (bearer present): the passkey is attached to the signed-in
      *    account and the server returns `{ success, message }` with no session,
      *    which is returned verbatim (no token planting).
@@ -1744,14 +1845,13 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
       response: unknown,
       envelope: {
         username?: string;
+        /** Sign-up: the recovery email, confirmed with `emailTicket`. */
+        email?: string;
+        emailTicket?: string;
+        /** Recovery: the ticket {@link confirmEmailVerification} returned. */
+        recoveryTicket?: string;
         deviceName?: string;
         deviceFingerprint?: string;
-        /**
-         * Sign-up only: the root created on the holder before this call, sealed
-         * under the passkey being registered, plus its `enroll_identity` proof
-         * (ADR 0024 D4). The account is created WITH it or not at all.
-         */
-        identity?: { envelope: WebIdentityEnvelope; proof: IdentityProof };
       } = {},
     ): Promise<{ success: true; message: string } | LoginResult> {
       try {
@@ -1759,7 +1859,10 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           'POST',
           '/auth/webauthn/register/verify',
           { response, ...envelope },
-          { cache: false, ...(envelope.username !== undefined ? { skipAuth: true } : {}) },
+          {
+            cache: false,
+            ...(envelope.username !== undefined || envelope.recoveryTicket !== undefined ? { skipAuth: true } : {}),
+          },
         );
         if (res && typeof res === 'object') {
           const record = res as Record<string, unknown>;