@oxy.so/core 1.16.0 → 1.18.1

package/dist/cjs/index.js

@@ -19,11 +19,10 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.encryptAead = exports.hkdfSha256 = exports.RecoveryPhraseService = exports.SignatureService = exports.updateIdentityMarker = exports.readIdentityMarker = exports.IdentityUnavailableError = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.verifyPublicCardAttestation = exports.parseAttestPayload = exports.parseIdPayload = exports.buildUserDid = exports.kindAcceptsAccountCategories = exports.isSelectableAccountCategoryId = exports.SELECTABLE_ACCOUNT_CATEGORY_IDS = exports.MAX_ACCOUNT_CATEGORIES = exports.ACCOUNT_CATEGORY_IDS = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.OXY_ACCOUNT_DELETED_EVENT_URI = exports.OxyAccountEventError = exports.commonsDeliveryPlatform = exports.pushTargetsFromDelivery = exports.selectCommonsDelivery = exports.parseCommonsApprovalExpiresAt = exports.getCommonsApprovalBlockingReason = exports.ServiceCredentialMismatchError = exports.oxyClient = exports.OXY_CLOUD_URL = exports.ServiceAssetMetadataError = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.AssetUrlResolutionError = exports.OxyServices = void 0;
-exports.getLanguageName = exports.getLanguageMetadata = exports.isSupportedLocale = exports.normalizeLocale = exports.getBaseLanguage = exports.FALLBACK_LOCALE = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.verifyMoveReceipt = exports.verifyMoveCommitment = exports.signMoveReceipt = exports.sealIdentityForMove = exports.parseMoveQrPayload = exports.openMovedIdentity = exports.generateMoveEphemeralKeyPair = exports.digestMoveCiphertext = exports.deriveMoveSas = exports.deriveMoveKey = exports.createMoveCommitment = exports.buildMoveQrPayload = exports.signIdentityProof = exports.digestIdentityPayload = exports.wipeOpenedIdentity = exports.wipeBytes = exports.unwrapDataKey = exports.unlockWebIdentity = exports.sealWebIdentity = exports.removeWrap = exports.parseRecoveryMaterial = exports.openWebIdentity = exports.normalizeMnemonic = exports.markWrapVerified = exports.isUsablePrfOutput = exports.generateWebIdentity = exports.generateDataKey = exports.deriveKeyEncryptionKey = exports.deriveIdentityFromRecoveryMaterial = exports.deriveIdentityFromPrivateKey = exports.deriveIdentityFromMnemonic = exports.addWrap = exports.WEB_IDENTITY_PRF_OUTPUT_LENGTH = exports.WebIdentityUnlockError = exports.WEB_IDENTITY_PRF_INPUT = exports.deriveSharedSecret = exports.AEAD_NONCE_LENGTH = exports.AEAD_KEY_LENGTH = exports.decryptAead = void 0;
-exports.buildSearchParams = exports.buildQueryParams = exports.trustTierLabel = exports.reputationCategoryLabel = exports.accountRoleLabel = exports.accountCategoryLabel = exports.translate = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.coerceToSupportedLocale = exports.getPrimaryLanguage = exports.getUserLanguages = exports.isRTLLocale = exports.getNativeLanguageName = void 0;
-exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.isDev = exports.consoleSink = exports.resetLoggerConfig = exports.getLoggerConfig = exports.configureLogger = exports.createLogger = exports.logger = exports.normalizeMultilineText = exports.normalizeInlineText = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE = exports.DISPLAY_NAME_ORPHANED_MARK_SOURCE = exports.DISPLAY_NAME_DISALLOWED_SOURCE = exports.DISPLAY_NAME_ALLOWED_SCRIPTS = exports.isValidDisplayName = exports.isValidPassword = exports.isValidEmail = exports.DISPLAY_NAME_INVALID_MESSAGE = exports.MAX_DISPLAY_NAME_LENGTH = exports.PASSWORD_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.parseHttpErrorBody = exports.isHttpRequestError = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = void 0;
-exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.resolveAccountDelegationAccess = exports.canSwitchIntoAccount = exports.isSwitchTargetAccount = exports.showsPrincipalHeaders = exports.buildSwitcherRows = exports.resolveDeviceContext = exports.resolveActiveContext = exports.projectDevicePrincipals = exports.directoryHandle = exports.directoryDisplayName = exports.canActivateContext = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isLoopbackOrigin = exports.consumeOAuthReturnPath = exports.persistOAuthReturnPath = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.canonicalizeOAuthRedirectUri = exports.normalizeOAuthRedirectUri = exports.OXY_OAUTH_RETURN_PATH_STORAGE_KEY = exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.runColdBoot = exports.isOxyRpOrigin = exports.CENTRAL_IDP_APEX = exports.AUTH_WEB_ORIGIN = exports.registrableApex = exports.getAccountColor = void 0;
-exports.packageInfo = exports.runSessionColdBoot = exports.OXY_INFERENCE_BASE_URL = exports.OxyInferenceProtocolError = exports.OxyInferenceError = exports.OxyInferenceClient = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.AccountNotOnDeviceError = exports.establishIdentitySession = exports.resolveIdentityPin = exports.IDENTITY_PIN_STORAGE_KEY = exports.identityPinMatches = exports.createMemoryIdentityPinStore = exports.createNativeIdentityPinStore = exports.createWebIdentityPinStore = exports.readLocalDeviceCredential = exports.publishProvenDeviceCredential = exports.normalizeSharedDeviceSessionRead = exports.decideSharedDevicePublish = exports.decideSharedDeviceJoin = exports.createSharedMirroringAuthStateStore = void 0;
+exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.coerceToSupportedLocale = exports.getPrimaryLanguage = exports.getUserLanguages = exports.isRTLLocale = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.isSupportedLocale = exports.normalizeLocale = exports.getBaseLanguage = exports.FALLBACK_LOCALE = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.deriveIdentityLinkCode = exports.signIdentityProof = exports.digestIdentityPayload = exports.deriveSharedSecret = exports.AEAD_NONCE_LENGTH = exports.AEAD_KEY_LENGTH = exports.decryptAead = void 0;
+exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE = exports.DISPLAY_NAME_ORPHANED_MARK_SOURCE = exports.DISPLAY_NAME_DISALLOWED_SOURCE = exports.DISPLAY_NAME_ALLOWED_SCRIPTS = exports.isValidDisplayName = exports.isValidPassword = exports.isValidEmail = exports.DISPLAY_NAME_INVALID_MESSAGE = exports.MAX_DISPLAY_NAME_LENGTH = exports.PASSWORD_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.parseHttpErrorBody = exports.isHttpRequestError = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.buildQueryParams = exports.trustTierLabel = exports.reputationCategoryLabel = exports.accountRoleLabel = exports.accountCategoryLabel = exports.translate = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = void 0;
+exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isLoopbackOrigin = exports.consumeOAuthReturnPath = exports.persistOAuthReturnPath = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.canonicalizeOAuthRedirectUri = exports.normalizeOAuthRedirectUri = exports.OXY_OAUTH_RETURN_PATH_STORAGE_KEY = exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.runColdBoot = exports.isOxyRpOrigin = exports.CENTRAL_IDP_APEX = exports.AUTH_WEB_ORIGIN = exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.isDev = exports.consoleSink = exports.resetLoggerConfig = exports.getLoggerConfig = exports.configureLogger = exports.createLogger = exports.logger = exports.normalizeMultilineText = exports.normalizeInlineText = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = void 0;
+exports.packageInfo = exports.runSessionColdBoot = exports.OXY_INFERENCE_BASE_URL = exports.OxyInferenceProtocolError = exports.OxyInferenceError = exports.OxyInferenceClient = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.AccountNotOnDeviceError = exports.establishIdentitySession = exports.resolveIdentityPin = exports.IDENTITY_PIN_STORAGE_KEY = exports.identityPinMatches = exports.createMemoryIdentityPinStore = exports.createNativeIdentityPinStore = exports.createWebIdentityPinStore = exports.readLocalDeviceCredential = exports.publishProvenDeviceCredential = exports.normalizeSharedDeviceSessionRead = exports.decideSharedDevicePublish = exports.decideSharedDeviceJoin = exports.createSharedMirroringAuthStateStore = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.resolveAccountDelegationAccess = exports.canSwitchIntoAccount = exports.isSwitchTargetAccount = exports.showsPrincipalHeaders = exports.buildSwitcherRows = exports.resolveDeviceContext = exports.resolveActiveContext = exports.projectDevicePrincipals = exports.directoryHandle = exports.directoryDisplayName = exports.canActivateContext = exports.accountIdsOf = void 0;
 // Ensure crypto polyfills are loaded before anything else. This MUST stay the
 // first import: `@noble/hashes` captures `globalThis.crypto` when it is
 // evaluated, so the shim has to exist before any module below reaches it (see
@@ -147,46 +146,14 @@ Object.defineProperty(exports, "AEAD_KEY_LENGTH", { enumerable: true, get: funct
 Object.defineProperty(exports, "AEAD_NONCE_LENGTH", { enumerable: true, get: function () { return aead_1.AEAD_NONCE_LENGTH; } });
 var ecdh_1 = require("./crypto/ecdh");
 Object.defineProperty(exports, "deriveSharedSecret", { enumerable: true, get: function () { return ecdh_1.deriveSharedSecret; } });
-// Web identity holder — the same root as Commons, sealed under a passkey's PRF
-// output; identity proofs; transfer to Commons (docs/adr/0024-one-oxy-account-root-holders.md)
-var webIdentityCarrier_1 = require("./crypto/webIdentityCarrier");
-Object.defineProperty(exports, "WEB_IDENTITY_PRF_INPUT", { enumerable: true, get: function () { return webIdentityCarrier_1.WEB_IDENTITY_PRF_INPUT; } });
-Object.defineProperty(exports, "WebIdentityUnlockError", { enumerable: true, get: function () { return webIdentityCarrier_1.WebIdentityUnlockError; } });
-Object.defineProperty(exports, "WEB_IDENTITY_PRF_OUTPUT_LENGTH", { enumerable: true, get: function () { return webIdentityCarrier_1.WEB_IDENTITY_PRF_OUTPUT_LENGTH; } });
-Object.defineProperty(exports, "addWrap", { enumerable: true, get: function () { return webIdentityCarrier_1.addWrap; } });
-Object.defineProperty(exports, "deriveIdentityFromMnemonic", { enumerable: true, get: function () { return webIdentityCarrier_1.deriveIdentityFromMnemonic; } });
-Object.defineProperty(exports, "deriveIdentityFromPrivateKey", { enumerable: true, get: function () { return webIdentityCarrier_1.deriveIdentityFromPrivateKey; } });
-Object.defineProperty(exports, "deriveIdentityFromRecoveryMaterial", { enumerable: true, get: function () { return webIdentityCarrier_1.deriveIdentityFromRecoveryMaterial; } });
-Object.defineProperty(exports, "deriveKeyEncryptionKey", { enumerable: true, get: function () { return webIdentityCarrier_1.deriveKeyEncryptionKey; } });
-Object.defineProperty(exports, "generateDataKey", { enumerable: true, get: function () { return webIdentityCarrier_1.generateDataKey; } });
-Object.defineProperty(exports, "generateWebIdentity", { enumerable: true, get: function () { return webIdentityCarrier_1.generateWebIdentity; } });
-Object.defineProperty(exports, "isUsablePrfOutput", { enumerable: true, get: function () { return webIdentityCarrier_1.isUsablePrfOutput; } });
-Object.defineProperty(exports, "markWrapVerified", { enumerable: true, get: function () { return webIdentityCarrier_1.markWrapVerified; } });
-Object.defineProperty(exports, "normalizeMnemonic", { enumerable: true, get: function () { return webIdentityCarrier_1.normalizeMnemonic; } });
-Object.defineProperty(exports, "openWebIdentity", { enumerable: true, get: function () { return webIdentityCarrier_1.openWebIdentity; } });
-Object.defineProperty(exports, "parseRecoveryMaterial", { enumerable: true, get: function () { return webIdentityCarrier_1.parseRecoveryMaterial; } });
-Object.defineProperty(exports, "removeWrap", { enumerable: true, get: function () { return webIdentityCarrier_1.removeWrap; } });
-Object.defineProperty(exports, "sealWebIdentity", { enumerable: true, get: function () { return webIdentityCarrier_1.sealWebIdentity; } });
-Object.defineProperty(exports, "unlockWebIdentity", { enumerable: true, get: function () { return webIdentityCarrier_1.unlockWebIdentity; } });
-Object.defineProperty(exports, "unwrapDataKey", { enumerable: true, get: function () { return webIdentityCarrier_1.unwrapDataKey; } });
-Object.defineProperty(exports, "wipeBytes", { enumerable: true, get: function () { return webIdentityCarrier_1.wipeBytes; } });
-Object.defineProperty(exports, "wipeOpenedIdentity", { enumerable: true, get: function () { return webIdentityCarrier_1.wipeOpenedIdentity; } });
+// Identity proofs — the one signed format for operations on a personal root
+// (docs/adr/0024-one-oxy-account-root-holders.md D7)
 var identityProof_1 = require("./crypto/identityProof");
 Object.defineProperty(exports, "digestIdentityPayload", { enumerable: true, get: function () { return identityProof_1.digestIdentityPayload; } });
 Object.defineProperty(exports, "signIdentityProof", { enumerable: true, get: function () { return identityProof_1.signIdentityProof; } });
-var identityMove_1 = require("./crypto/identityMove");
-Object.defineProperty(exports, "buildMoveQrPayload", { enumerable: true, get: function () { return identityMove_1.buildMoveQrPayload; } });
-Object.defineProperty(exports, "createMoveCommitment", { enumerable: true, get: function () { return identityMove_1.createMoveCommitment; } });
-Object.defineProperty(exports, "deriveMoveKey", { enumerable: true, get: function () { return identityMove_1.deriveMoveKey; } });
-Object.defineProperty(exports, "deriveMoveSas", { enumerable: true, get: function () { return identityMove_1.deriveMoveSas; } });
-Object.defineProperty(exports, "digestMoveCiphertext", { enumerable: true, get: function () { return identityMove_1.digestMoveCiphertext; } });
-Object.defineProperty(exports, "generateMoveEphemeralKeyPair", { enumerable: true, get: function () { return identityMove_1.generateMoveEphemeralKeyPair; } });
-Object.defineProperty(exports, "openMovedIdentity", { enumerable: true, get: function () { return identityMove_1.openMovedIdentity; } });
-Object.defineProperty(exports, "parseMoveQrPayload", { enumerable: true, get: function () { return identityMove_1.parseMoveQrPayload; } });
-Object.defineProperty(exports, "sealIdentityForMove", { enumerable: true, get: function () { return identityMove_1.sealIdentityForMove; } });
-Object.defineProperty(exports, "signMoveReceipt", { enumerable: true, get: function () { return identityMove_1.signMoveReceipt; } });
-Object.defineProperty(exports, "verifyMoveCommitment", { enumerable: true, get: function () { return identityMove_1.verifyMoveCommitment; } });
-Object.defineProperty(exports, "verifyMoveReceipt", { enumerable: true, get: function () { return identityMove_1.verifyMoveReceipt; } });
+// Linking Commons to a passkey account: the code both screens compare (ADR 0029 D3)
+var identityLink_1 = require("./crypto/identityLink");
+Object.defineProperty(exports, "deriveIdentityLinkCode", { enumerable: true, get: function () { return identityLink_1.deriveIdentityLinkCode; } });
 // ---------------------------------------------------------------------------
 // Devices
 // ---------------------------------------------------------------------------

package/dist/cjs/mixins/OxyServices.auth.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ServiceCredentialMismatchError = exports.parseCommonsApprovalExpiresAt = exports.getCommonsApprovalBlockingReason = void 0;
+exports.ANONYMOUS_SERVICE_TOKEN_RETRY_MS = exports.ServiceCredentialMismatchError = exports.parseCommonsApprovalExpiresAt = exports.getCommonsApprovalBlockingReason = void 0;
 exports.OxyServicesAuthMixin = OxyServicesAuthMixin;
 const contracts_1 = require("@oxy.so/contracts");
 var commonsApproval_1 = require("../utils/commonsApproval");
@@ -125,6 +125,11 @@ class ServiceCredentialMismatchError extends Error {
     }
 }
 exports.ServiceCredentialMismatchError = ServiceCredentialMismatchError;
+/**
+ * How long a failed service-token mint sends session-less requests anonymous
+ * before the next attempt, under `serviceIdentity: 'when-anonymous'`.
+ */
+exports.ANONYMOUS_SERVICE_TOKEN_RETRY_MS = 30000;
 function OxyServicesAuthMixin(Base) {
     return class extends Base {
         constructor(...args) {
@@ -151,6 +156,56 @@ function OxyServicesAuthMixin(Base) {
             this._serviceApiKey = null;
             /** @internal Raw apiSecret stored by configureServiceAuth() for use by getServiceToken() */
             this._serviceApiSecret = null;
+            /**
+             * Before this instant, a request without a user session does not try to
+             * mint a service token and goes out anonymous. Set after a failed mint; see
+             * {@link _serviceTokenForAnonymousRequest}.
+             *
+             * @internal
+             */
+            this._anonymousServiceTokenRetryAt = 0;
+            if (this.config.serviceIdentity === 'when-anonymous') {
+                this.httpService.setAnonymousAuthProvider(() => this._serviceTokenForAnonymousRequest());
+            }
+        }
+        /**
+         * The bearer for a request with no user session, under `serviceIdentity:
+         * 'when-anonymous'`: this process's service token, or `null` to send the
+         * request anonymous as before.
+         *
+         * `null`, never a throw, whenever there is no token to offer:
+         * - no key pair and no attestable workload (a local checkout) — asking
+         *   costs nothing and there is nothing to ask for;
+         * - the mint failed. The request still goes out, anonymous, and so does
+         *   every request for the next {@link ANONYMOUS_SERVICE_TOKEN_RETRY_MS}, so
+         *   an Oxy that is refusing attestation (seen for ~2.5 minutes after a
+         *   deploy on 2026-09-25) is asked once per window rather than once per
+         *   read, and no read waits on a mint that just failed.
+         *
+         * The token itself comes from {@link getServiceToken}: cached for its
+         * lifetime and single-flight, so concurrent reads share one mint.
+         *
+         * @internal
+         */
+        async _serviceTokenForAnonymousRequest() {
+            if (Date.now() < this._anonymousServiceTokenRetryAt)
+                return null;
+            const hasKeyPair = Boolean(this._serviceApiKey && this._serviceApiSecret);
+            if (!hasKeyPair && !(await this._canUseWorkloadIdentity()))
+                return null;
+            try {
+                return await this.getServiceToken();
+            }
+            catch (error) {
+                this._anonymousServiceTokenRetryAt = Date.now() + exports.ANONYMOUS_SERVICE_TOKEN_RETRY_MS;
+                logger_1.logger.warn('[oxy.auth] No service token for a request without a session; sending it anonymous', {
+                    component: 'auth',
+                    method: '_serviceTokenForAnonymousRequest',
+                    retryInMs: exports.ANONYMOUS_SERVICE_TOKEN_RETRY_MS,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                return null;
+            }
         }
         /**
          * Hash an apiKey into a stable Map cache key. Uses Node's SHA-256 — service
@@ -1166,12 +1221,40 @@ function OxyServicesAuthMixin(Base) {
             }
         }
         /**
-         * Check email availability
+         * Send a 6-digit code to an email (ADR 0029 D3): the recovery email of a
+         * new passkey account (`purpose: 'signup'`), or — named by username or
+         * email — the recovery email of an account being recovered
+         * (`purpose: 'recovery'`). The answer is the same whether or not an
+         * account exists; nothing is revealed about who has one.
          */
-        async checkEmailAvailability(email) {
+        async startEmailVerification(request) {
             try {
-                // Public availability lookup (pre-session) — skip the bearer preflight.
-                return await this.makeRequest('GET', `/auth/check-email/${email}`, undefined, { cache: false, skipAuth: true });
+                const res = await this.makeRequest('POST', '/auth/email/verify/start', request, {
+                    cache: false,
+                    skipAuth: true,
+                });
+                const parsed = (0, contracts_1.safeParseContract)(contracts_1.emailVerificationStartResponseSchema, res);
+                if (!parsed)
+                    throw new Error('auth/email/verify/start returned an unexpected response shape');
+                return parsed;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Confirm the code {@link startEmailVerification} sent. Resolves to a
+         * short-lived one-use ticket: a sign-up passes it (with the email) to
+         * {@link webauthnRegisterVerify}; a recovery passes it as `recoveryTicket`
+         * to {@link webauthnRegisterOptions} and {@link webauthnRegisterVerify}.
+         */
+        async confirmEmailVerification(verificationId, code) {
+            try {
+                const res = await this.makeRequest('POST', '/auth/email/verify/confirm', { verificationId, code }, { cache: false, skipAuth: true });
+                const parsed = (0, contracts_1.safeParseContract)(contracts_1.emailVerificationConfirmResponseSchema, res);
+                if (!parsed)
+                    throw new Error('auth/email/verify/confirm returned an unexpected response shape');
+                return parsed;
             }
             catch (error) {
                 throw this.handleError(error);
@@ -1182,15 +1265,20 @@ function OxyServicesAuthMixin(Base) {
          * `PublicKeyCredentialCreationOptions` the browser's `navigator.credentials
          * .create()` (or `@simplewebauthn/browser`'s `startRegistration`) needs.
          *
-         * With a bearer token planted this links a passkey to the signed-in account
-         * (`username` ignored); without one it is a prospective signup and `username`
-         * is the desired handle. The returned options are OPAQUE — Oxy does not own
-         * their shape (the browser / `@simplewebauthn` does), so they pass through
-         * as `unknown` for the caller to hand straight to the ceremony.
+         * With a bearer token planted this adds a passkey to the signed-in account.
+         * Without one, `username` is a prospective sign-up's handle, and
+         * `recoveryTicket` a recovery's new passkey for the account it names. The
+         * returned options are OPAQUE — Oxy does not own their shape (the browser /
+         * `@simplewebauthn` does), so they pass through as `unknown` for the caller
+         * to hand straight to the ceremony.
          */
-        async webauthnRegisterOptions(username) {
+        async webauthnRegisterOptions(request = {}) {
+            const signedOut = request.username !== undefined || request.recoveryTicket !== undefined;
             try {
-                return await this.makeRequest('POST', '/auth/webauthn/register/options', { ...(username !== undefined ? { username } : {}) }, { cache: false, ...(username !== undefined ? { skipAuth: true } : {}) });
+                return await this.makeRequest('POST', '/auth/webauthn/register/options', {
+                    ...(request.username !== undefined ? { username: request.username } : {}),
+                    ...(request.recoveryTicket !== undefined ? { recoveryTicket: request.recoveryTicket } : {}),
+                }, { cache: false, ...(signedOut ? { skipAuth: true } : {}) });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -1201,17 +1289,22 @@ function OxyServicesAuthMixin(Base) {
          * browser `RegistrationResponseJSON` (`response`) alongside the Oxy envelope
          * (desired `username` for signup + the device-session naming fields).
          *
-         * Two server branches, disambiguated by the response shape:
-         *  - **Signup** (no bearer): the account is created and a session minted —
-         *    the response carries `sessionId`, is the SAME {@link LoginResult}
-         *    contract as `POST /auth/verify`, and its access token is planted here.
+         * Server branches, disambiguated by the response shape:
+         *  - **Sign-up** (no bearer; `username`, `email`, `emailTicket`) and
+         *    **recovery** (no bearer; `recoveryTicket`): the account is created, or
+         *    gains the passkey, and a session is minted — the response carries
+         *    `sessionId`, is the SAME {@link LoginResult} contract as
+         *    `POST /auth/verify`, and its access token is planted here.
          *  - **Link** (bearer present): the passkey is attached to the signed-in
          *    account and the server returns `{ success, message }` with no session,
          *    which is returned verbatim (no token planting).
          */
         async webauthnRegisterVerify(response, envelope = {}) {
             try {
-                const res = await this.makeRequest('POST', '/auth/webauthn/register/verify', { response, ...envelope }, { cache: false, ...(envelope.username !== undefined ? { skipAuth: true } : {}) });
+                const res = await this.makeRequest('POST', '/auth/webauthn/register/verify', { response, ...envelope }, {
+                    cache: false,
+                    ...(envelope.username !== undefined || envelope.recoveryTicket !== undefined ? { skipAuth: true } : {}),
+                });
                 if (res && typeof res === 'object') {
                     const record = res;
                     // Signup branch: mints a session (LoginSessionResult, carries

package/dist/cjs/mixins/OxyServices.identity.js

@@ -2,8 +2,36 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildUserDid = buildUserDid;
 exports.OxyServicesIdentityMixin = OxyServicesIdentityMixin;
+/**
+ * Identity Methods Mixin (self-sovereign identity layer)
+ *
+ * Provides typed access to Oxy's AtProto/Bluesky-flavoured identity &
+ * portability layer:
+ *  - DID resolution (`did:web:oxy.so:u:<userId>`, derived on demand by the API).
+ *  - The auth-method ↔ DID verification-method mapping (`GET /auth/methods`) and
+ *    passkey removal. A root is linked by the holder flows (ADR 0024) and never
+ *    unlinked; it is replaced by rotation.
+ *  - Signed records: clients sign an envelope with their own cryptographic key
+ *    (`SignatureService.signRecord` + the shared `canonicalize`) and publish it;
+ *    anyone can fetch and verify it.
+ *  - The signed data-export ("credible exit") bundle.
+ *  - Verified-domain badges (prove ownership of `nate.com`).
+ *
+ * Wire shapes come from `@oxy.so/contracts` (`DidDocument`,
+ * `SignedRecordEnvelope`, `AuthMethodsResponse`, `VerifiedDomain`,
+ * `DomainVerificationInstructions`, `ExportBundle`) — the single source of truth
+ * the API validates its output against, so producer and consumer cannot drift.
+ *
+ * Identity signing is NATIVE-ONLY: the private key lives in native secure
+ * storage, so `signRecord` and `publishRecord` require an
+ * on-device identity and throw on web (where `KeyManager.getPublicKey()` is
+ * always `null`).
+ */
+const contracts_1 = require("@oxy.so/contracts");
 const protocol_1 = require("@oxy.so/protocol");
 const keyManager_1 = require("../crypto/keyManager");
+const identityLink_1 = require("../crypto/identityLink");
+const identityProof_1 = require("../crypto/identityProof");
 const signatureService_1 = require("../crypto/signatureService");
 const recoveryPhrase_1 = require("../crypto/recoveryPhrase");
 const platform_1 = require("../utils/platform");
@@ -75,11 +103,9 @@ function OxyServicesIdentityMixin(Base) {
             }
         }
         /**
-         * The signed-in account's root readiness (ADR 0024 D5): whether a root is
-         * linked, how many passkeys can open the web holder, whether the root has a
-         * phrase and whether it is saved and was shown to recover it. Metadata only —
-         * nothing here can open the root — so any first-party surface may show a
-         * "save your recovery phrase" reminder from it.
+         * How the signed-in account is kept (ADR 0029 D3): whether Commons' root is
+         * linked (self-custody), or the recovery email of a passkey account. Any
+         * first-party surface may read it to recommend linking Commons.
          */
         async getIdentityRootStatus() {
             try {
@@ -89,15 +115,109 @@ function OxyServicesIdentityMixin(Base) {
                 throw this.handleError(error);
             }
         }
+        /**
+         * Open a request to link Commons to the signed-in passkey account (ADR 0029
+         * D3). auth.oxy.so shows its `qrPayload`; Commons scans it and signs with
+         * {@link signIdentityLink}.
+         */
+        async createIdentityLink() {
+            try {
+                const res = await this.makeRequest('POST', '/identity/link', undefined, { cache: false });
+                const parsed = (0, contracts_1.safeParseContract)(contracts_1.identityLinkCreateResponseSchema, res);
+                if (!parsed)
+                    throw new Error('identity/link returned an unexpected response shape');
+                return parsed;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /** Where a link request stands. Both devices poll it; it needs no session. */
+        async getIdentityLink(linkId) {
+            try {
+                const res = await this.makeRequest('GET', `/identity/link/${encodeURIComponent(linkId)}`, undefined, {
+                    cache: false,
+                    skipAuth: true,
+                });
+                const parsed = (0, contracts_1.safeParseContract)(contracts_1.identityLinkStateSchema, res);
+                if (!parsed)
+                    throw new Error('identity/link returned an unexpected response shape');
+                return parsed;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Commons' half: sign the scanned request's `link_identity` proof with THIS
+         * device's identity key and post it. NATIVE-ONLY (the key lives in native
+         * secure storage). Resolves to the key and the 6-digit code auth.oxy.so will
+         * show for it, for the person to compare.
+         */
+        async signIdentityLink(linkId, challenge) {
+            try {
+                const [privateKey, publicKey] = await Promise.all([keyManager_1.KeyManager.getPrivateKey(), keyManager_1.KeyManager.getPublicKey()]);
+                if (!privateKey || !publicKey) {
+                    throw new Error('No identity on this device to link');
+                }
+                const root = publicKey.trim().toLowerCase();
+                const state = await this.getIdentityLink(linkId);
+                const proof = await (0, identityProof_1.signIdentityProof)({ privateKey, publicKey: root }, {
+                    action: contracts_1.IDENTITY_PROOF_ACTIONS.link,
+                    subject: state.userId,
+                    actor: state.userId,
+                    rootPublicKey: root,
+                    payloadDigest: null,
+                    expectedRevision: null,
+                    audience: state.audience,
+                    challenge,
+                    expiresAt: state.expiresAt,
+                });
+                await this.makeRequest('POST', `/identity/link/${encodeURIComponent(linkId)}/proof`, { publicKey: root, proof }, { cache: false, skipAuth: true });
+                return { publicKey: root, code: (0, identityLink_1.deriveIdentityLinkCode)(linkId, root), username: state.username };
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /** WebAuthn request options over the account's passkeys, whose challenge is the link's. Opaque. */
+        async getIdentityLinkAssertionOptions(linkId, challenge) {
+            try {
+                return await this.makeRequest('POST', `/identity/link/${encodeURIComponent(linkId)}/options`, { challenge }, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * auth.oxy.so's half: the passkey assertion over the link's challenge. The
+         * account gains Commons' root and loses its recovery email.
+         */
+        async completeIdentityLink(linkId, assertion) {
+            try {
+                const result = await this.makeRequest('POST', `/identity/link/${encodeURIComponent(linkId)}/complete`, { assertion }, { cache: false });
+                this._invalidateIdentityCaches(this.getCurrentUserId());
+                return result;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /** Withdraw a link request that has not completed. */
+        async cancelIdentityLink(linkId) {
+            try {
+                await this.makeRequest('DELETE', `/identity/link/${encodeURIComponent(linkId)}`, undefined, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
         /**
          * Remove ONE passkey (WebAuthn credential) from the current account.
          *
          * Passkeys are per-credential, so this targets a specific credential id.
          * The server refuses to remove the last remaining auth method (the account
          * would become inaccessible) and deletes the stored `WebauthnCredential`.
-         * A passkey that also opens the account's root on the web takes its wrap with
-         * it, and the ONLY such passkey is refused with
-         * `code: 'IDENTITY_LAST_WEB_HOLDER'` (ADR 0024 D6).
          *
          * @param credentialId - The passkey's public credential id
          *   (`AuthMethodEntry.credentialId`).

package/dist/cjs/mixins/OxyServices.user.js

@@ -535,6 +535,35 @@ function OxyServicesUserMixin(Base) {
                 throw this.handleError(error);
             }
         }
+        /**
+         * WebAuthn request options to delete a PASSKEY account (ADR 0029 D3): its own
+         * passkeys, user verification required, and a challenge bound to it. Opaque —
+         * hand them to the browser's authentication ceremony, on auth.oxy.so. An
+         * account with a Commons key deletes with {@link deleteAccount} instead.
+         */
+        async getAccountDeletionOptions() {
+            try {
+                return await this.makeRequest('POST', '/users/me/delete/options', undefined, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Delete a PASSKEY account permanently, with an assertion by one of its
+         * passkeys over {@link getAccountDeletionOptions}' challenge.
+         *
+         * @param confirmText - Must equal the user's username (verified server-side)
+         * @param assertion - The ceremony's opaque `AuthenticationResponseJSON`
+         */
+        async deleteAccountWithPasskey(confirmText, assertion) {
+            try {
+                return await this.makeRequest('DELETE', '/users/me', { confirmText, assertion }, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
         /**
          * Invalidate every cached read a follow/unfollow write invalidates.
          *
@@ -844,11 +873,13 @@ function OxyServicesUserMixin(Base) {
             }
         }
         /**
-         * Get notifications
+         * One page of the signed-in user's Oxy notifications, newest first
+         * (`GET /notifications`), with the unread count across all pages.
          */
-        async getNotifications() {
+        async getNotifications(params = {}) {
+            const query = (0, apiUtils_1.buildQueryParams)({ page: params.page, limit: params.limit });
             return this.withAuthRetry(async () => {
-                return await this.makeRequest('GET', '/notifications', undefined, {
+                return await this.makeRequest('GET', '/notifications', query, {
                     cache: false, // Don't cache notifications - always get fresh data
                 });
             }, 'getNotifications');
@@ -861,7 +892,7 @@ function OxyServicesUserMixin(Base) {
                 const res = await this.makeRequest('GET', '/notifications/unread-count', undefined, {
                     cache: false, // Don't cache unread count - always get fresh data
                 });
-                return res.count;
+                return res.unreadCount;
             }
             catch (error) {
                 throw this.handleError(error);
@@ -876,18 +907,22 @@ function OxyServicesUserMixin(Base) {
          */
         async createNotification(data) {
             try {
-                return await this.makeRequest('POST', '/notifications', data, { cache: false });
+                const res = await this.makeRequest('POST', '/notifications', data, { cache: false });
+                return res.notification;
             }
             catch (error) {
                 throw this.handleError(error);
             }
         }
         /**
-         * Mark notification as read
+         * Mark one of the signed-in user's notifications read and return it as
+         * stored. Scoped to the recipient server-side, so it is also the
+         * authoritative read of a notification by id: a foreign or unknown id 404s.
          */
         async markNotificationAsRead(notificationId) {
             try {
-                await this.makeRequest('PUT', `/notifications/${notificationId}/read`, undefined, { cache: false });
+                const res = await this.makeRequest('PUT', `/notifications/${encodeURIComponent(notificationId)}/read`, undefined, { cache: false });
+                return res.notification;
             }
             catch (error) {
                 throw this.handleError(error);

package/dist/cjs/utils/authWebUrl.js

@@ -18,10 +18,9 @@ exports.AUTH_WEB_ORIGIN = exports.CENTRAL_IDP_APEX = void 0;
  */
 exports.CENTRAL_IDP_APEX = 'oxy.so';
 /**
- * The IdP's origin, `auth.oxy.so` — the OAuth authorize/consent surface AND the
- * web identity carrier: where a person signs in or creates an account with a
- * passkey from another origin's popup, and the one origin that may create,
- * open, recover or move their self-custody identity (one identity, two
- * carriers). Apps open it; they never handle the identity themselves.
+ * The IdP's origin, `auth.oxy.so` — the OAuth authorize/consent surface and the
+ * one origin that asserts Oxy passkeys: where a person signs in, creates,
+ * recovers or deletes a web account, in the window an app opens (ADR 0029).
+ * Apps open it; they never run the passkey themselves.
  */
 exports.AUTH_WEB_ORIGIN = `https://auth.${exports.CENTRAL_IDP_APEX}`;