@oxy.so/core 1.18.0 → 3.0.0

package/dist/cjs/civic/payloads.js

@@ -0,0 +1,156 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseIdPayload = parseIdPayload;
+exports.parseAttestPayload = parseAttestPayload;
+exports.verifyPublicCardAttestation = verifyPublicCardAttestation;
+/** URI scheme/host that introduces a Commons Oxy ID card payload. */
+const CARD_MATCHER = /^oxycommons:\/\/card(?:[/?#]|$)/i;
+/** URI scheme/host that introduces a real-life counterparty attestation payload. */
+const ATTEST_MATCHER = /^oxycommons:\/\/attest(?:[/?#]|$)/i;
+/**
+ * Minimal, allocation-light query-string parser (no `URL` / `URLSearchParams`)
+ * so it runs identically under Hermes and jsdom — mirrors the robustness of the
+ * "Sign in with Oxy" approval-link parser. Shared by every `oxycommons://…`
+ * payload parser in this module.
+ */
+function parseCommonsQuery(raw) {
+    const params = new Map();
+    const qIndex = raw.indexOf('?');
+    if (qIndex < 0)
+        return params;
+    let query = raw.slice(qIndex + 1);
+    const hashIndex = query.indexOf('#');
+    if (hashIndex >= 0)
+        query = query.slice(0, hashIndex);
+    for (const pair of query.split('&')) {
+        if (pair.length === 0)
+            continue;
+        const eq = pair.indexOf('=');
+        const rawKey = eq < 0 ? pair : pair.slice(0, eq);
+        const rawValue = eq < 0 ? '' : pair.slice(eq + 1);
+        try {
+            params.set(decodeURIComponent(rawKey), decodeURIComponent(rawValue.replace(/\+/g, ' ')));
+        }
+        catch {
+            // Malformed percent-encoding — keep the raw token rather than throwing, so
+            // a single bad field doesn't sink an otherwise valid payload.
+            params.set(rawKey, rawValue);
+        }
+    }
+    return params;
+}
+/**
+ * Parse a scanned / deep-linked Oxy ID payload (`oxycommons://card?did=…`) into
+ * the referenced DID. Pure + dependency-free (Hermes-safe, no `URL` global) so
+ * Commons (and any scanner) can reuse it without an OxyServices instance.
+ *
+ * @param raw - The raw scanned string or deep-link URL.
+ * @returns `{ did }` when a usable DID is present; `null` for anything else (a
+ *   non-card scheme, a missing/empty `did`, or non-string input).
+ */
+function parseIdPayload(raw) {
+    if (typeof raw !== 'string' || raw.trim().length === 0) {
+        return null;
+    }
+    const value = raw.trim();
+    if (!CARD_MATCHER.test(value)) {
+        return null;
+    }
+    const did = parseCommonsQuery(value).get('did');
+    if (!did || did.length === 0) {
+        return null;
+    }
+    return { did };
+}
+/**
+ * Parse a scanned / deep-linked real-life-attestation payload
+ * (`oxycommons://attest?subject=…&ctx=…&nonce=…&exp=…`). Pure + dependency-free
+ * (Hermes-safe, no `URL` global), mirroring {@link parseIdPayload}, so Commons
+ * (and any scanner) can reuse it without an OxyServices instance.
+ *
+ * @param raw - The raw scanned string or deep-link URL.
+ * @returns `{ subjectDid, context, nonce, exp }` when the required fields are
+ *   present and `exp` is a positive finite number; `null` otherwise (a non-attest
+ *   scheme, a missing `subject`/`nonce`/`exp`, an unparseable `exp`, or non-string
+ *   input). `context` defaults to `''` when the QR omits `ctx`.
+ */
+function parseAttestPayload(raw) {
+    if (typeof raw !== 'string' || raw.trim().length === 0) {
+        return null;
+    }
+    const value = raw.trim();
+    if (!ATTEST_MATCHER.test(value)) {
+        return null;
+    }
+    const params = parseCommonsQuery(value);
+    const subjectDid = params.get('subject');
+    const nonce = params.get('nonce');
+    const expRaw = params.get('exp');
+    if (!subjectDid || !nonce || expRaw === undefined || expRaw.length === 0) {
+        return null;
+    }
+    const exp = Number(expRaw);
+    if (!Number.isFinite(exp) || exp <= 0) {
+        return null;
+    }
+    return { subjectDid, context: params.get('ctx') ?? '', nonce, exp };
+}
+/**
+ * Verify the Oxy custodial attestation on a public card.
+ *
+ * Re-canonicalizes the received `card` (so the order of the JSON keys on the
+ * wire is irrelevant; `canonicalize` also omits any `undefined`-valued optional
+ * key, matching the server which omits absent keys entirely) and checks the
+ * `ES256K-DER-SHA256` signature against `attestation.publicKey`.
+ *
+ * NEVER throws: `verifySignature` already swallows malformed-input
+ * errors and returns `false`, and an absent attestation short-circuits to
+ * `false`. A pure, reusable helper (Commons can call it on a cached card).
+ *
+ * @param card - The card to verify (exactly as received).
+ * @param attestation - The card's attestation, or `null` (unsigned ⇒ `false`).
+ */
+async function verifyPublicCardAttestation(card, attestation) {
+    if (!attestation) {
+        return false;
+    }
+    const { signature, publicKey } = attestation;
+    if (!signature || !publicKey) {
+        return false;
+    }
+    const { canonicalize, verifySignature } = await Promise.resolve().then(() => __importStar(require('../crypto/internal')));
+    return verifySignature(canonicalize(card), signature, publicKey);
+}

package/dist/cjs/client/context.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/crypto/identityLink.js

@@ -1,10 +1,10 @@
 "use strict";
 /**
- * The code both screens show while Commons is being linked to a passkey
- * account (ADR 0029 D3): 6 digits derived from the link request and the key
- * Commons signed with. auth.oxy.so derives it from the key the API relayed,
- * Commons from its own; the person checks they match before the passkey is
- * asserted, so a photographed QR cannot slip another key in.
+ * The code both screens show while Commons is being linked to an account
+ * (ADR 0029 D3): 6 digits derived from the link request and the key Commons
+ * signed with. The linking panel derives it from the key the API relayed,
+ * Commons from its own; the person checks they match before the link is
+ * confirmed, so a photographed QR cannot slip another key in.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.deriveIdentityLinkCode = deriveIdentityLinkCode;

package/dist/cjs/crypto/index.js

@@ -0,0 +1,44 @@
+"use strict";
+/**
+ * `@oxy.so/core/crypto` — the self-custody identity: keys, signatures, the
+ * recovery phrase, and the primitives under them.
+ *
+ * Its own entry so an app that never holds a key never ships secp256k1, bip39
+ * or the AEAD cipher. The `oxy.identity` / `oxy.civic` namespaces load what they
+ * need from here on first use.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deriveIdentityLinkCode = exports.signIdentityProof = exports.digestIdentityPayload = exports.deriveSharedSecret = exports.AEAD_NONCE_LENGTH = exports.AEAD_KEY_LENGTH = exports.decryptAead = exports.encryptAead = exports.hkdfSha256 = exports.RecoveryPhraseService = exports.SignatureService = exports.updateIdentityMarker = exports.readIdentityMarker = exports.IdentityUnavailableError = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = void 0;
+// MUST stay the first import: `@noble/hashes` captures `globalThis.crypto` when
+// it is evaluated, so the shim has to exist before anything below reaches it.
+require("./polyfill");
+var keyManager_1 = require("./keyManager");
+Object.defineProperty(exports, "KeyManager", { enumerable: true, get: function () { return keyManager_1.KeyManager; } });
+Object.defineProperty(exports, "IdentityAlreadyExistsError", { enumerable: true, get: function () { return keyManager_1.IdentityAlreadyExistsError; } });
+Object.defineProperty(exports, "IdentityPersistError", { enumerable: true, get: function () { return keyManager_1.IdentityPersistError; } });
+Object.defineProperty(exports, "IdentityUnavailableError", { enumerable: true, get: function () { return keyManager_1.IdentityUnavailableError; } });
+var identityMarker_1 = require("./identityMarker");
+Object.defineProperty(exports, "readIdentityMarker", { enumerable: true, get: function () { return identityMarker_1.readIdentityMarker; } });
+Object.defineProperty(exports, "updateIdentityMarker", { enumerable: true, get: function () { return identityMarker_1.updateIdentityMarker; } });
+var signatureService_1 = require("./signatureService");
+Object.defineProperty(exports, "SignatureService", { enumerable: true, get: function () { return signatureService_1.SignatureService; } });
+var recoveryPhrase_1 = require("./recoveryPhrase");
+Object.defineProperty(exports, "RecoveryPhraseService", { enumerable: true, get: function () { return recoveryPhrase_1.RecoveryPhraseService; } });
+// Low-level primitives (encrypted backup, device transfer)
+var kdf_1 = require("./kdf");
+Object.defineProperty(exports, "hkdfSha256", { enumerable: true, get: function () { return kdf_1.hkdfSha256; } });
+var aead_1 = require("./aead");
+Object.defineProperty(exports, "encryptAead", { enumerable: true, get: function () { return aead_1.encryptAead; } });
+Object.defineProperty(exports, "decryptAead", { enumerable: true, get: function () { return aead_1.decryptAead; } });
+Object.defineProperty(exports, "AEAD_KEY_LENGTH", { enumerable: true, get: function () { return aead_1.AEAD_KEY_LENGTH; } });
+Object.defineProperty(exports, "AEAD_NONCE_LENGTH", { enumerable: true, get: function () { return aead_1.AEAD_NONCE_LENGTH; } });
+var ecdh_1 = require("./ecdh");
+Object.defineProperty(exports, "deriveSharedSecret", { enumerable: true, get: function () { return ecdh_1.deriveSharedSecret; } });
+// Identity proofs — the one signed format for operations on a personal root
+// (docs/adr/0024-one-oxy-account-root-holders.md D7)
+var identityProof_1 = require("./identityProof");
+Object.defineProperty(exports, "digestIdentityPayload", { enumerable: true, get: function () { return identityProof_1.digestIdentityPayload; } });
+Object.defineProperty(exports, "signIdentityProof", { enumerable: true, get: function () { return identityProof_1.signIdentityProof; } });
+// Linking Commons to an account: the code both screens compare (ADR 0029 D3)
+var identityLink_1 = require("./identityLink");
+Object.defineProperty(exports, "deriveIdentityLinkCode", { enumerable: true, get: function () { return identityLink_1.deriveIdentityLinkCode; } });

package/dist/cjs/crypto/internal.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifySignature = exports.signMessage = exports.canonicalize = exports.solveRegistrationPow = exports.deriveIdentityLinkCode = exports.signIdentityProof = exports.digestIdentityPayload = exports.AEAD_NONCE_LENGTH = exports.AEAD_KEY_LENGTH = exports.decryptAead = exports.encryptAead = exports.BACKUP_KDF_ENCRYPTION_INFO = exports.RecoveryPhraseService = exports.SignatureService = exports.KeyManager = void 0;
+/**
+ * The one module the API namespaces load crypto through, with `import()`.
+ *
+ * It installs the polyfill FIRST: on Hermes `@noble/hashes` captures
+ * `globalThis.crypto` when it is evaluated, so a namespace that dynamically
+ * imported `./keyManager` directly — before anything installed the shim —
+ * would hand noble `undefined` and every random draw would throw. Loading
+ * through here makes the order a property of the module graph, not of which
+ * entry an app happened to import first.
+ */
+require("./polyfill");
+var keyManager_1 = require("./keyManager");
+Object.defineProperty(exports, "KeyManager", { enumerable: true, get: function () { return keyManager_1.KeyManager; } });
+var signatureService_1 = require("./signatureService");
+Object.defineProperty(exports, "SignatureService", { enumerable: true, get: function () { return signatureService_1.SignatureService; } });
+var recoveryPhrase_1 = require("./recoveryPhrase");
+Object.defineProperty(exports, "RecoveryPhraseService", { enumerable: true, get: function () { return recoveryPhrase_1.RecoveryPhraseService; } });
+Object.defineProperty(exports, "BACKUP_KDF_ENCRYPTION_INFO", { enumerable: true, get: function () { return recoveryPhrase_1.BACKUP_KDF_ENCRYPTION_INFO; } });
+var aead_1 = require("./aead");
+Object.defineProperty(exports, "encryptAead", { enumerable: true, get: function () { return aead_1.encryptAead; } });
+Object.defineProperty(exports, "decryptAead", { enumerable: true, get: function () { return aead_1.decryptAead; } });
+Object.defineProperty(exports, "AEAD_KEY_LENGTH", { enumerable: true, get: function () { return aead_1.AEAD_KEY_LENGTH; } });
+Object.defineProperty(exports, "AEAD_NONCE_LENGTH", { enumerable: true, get: function () { return aead_1.AEAD_NONCE_LENGTH; } });
+var identityProof_1 = require("./identityProof");
+Object.defineProperty(exports, "digestIdentityPayload", { enumerable: true, get: function () { return identityProof_1.digestIdentityPayload; } });
+Object.defineProperty(exports, "signIdentityProof", { enumerable: true, get: function () { return identityProof_1.signIdentityProof; } });
+var identityLink_1 = require("./identityLink");
+Object.defineProperty(exports, "deriveIdentityLinkCode", { enumerable: true, get: function () { return identityLink_1.deriveIdentityLinkCode; } });
+var registrationPow_1 = require("./registrationPow");
+Object.defineProperty(exports, "solveRegistrationPow", { enumerable: true, get: function () { return registrationPow_1.solveRegistrationPow; } });
+var protocol_1 = require("@oxy.so/protocol");
+Object.defineProperty(exports, "canonicalize", { enumerable: true, get: function () { return protocol_1.canonicalize; } });
+Object.defineProperty(exports, "signMessage", { enumerable: true, get: function () { return protocol_1.signMessage; } });
+Object.defineProperty(exports, "verifySignature", { enumerable: true, get: function () { return protocol_1.verifySignature; } });

package/dist/cjs/crypto/keyManager.js

@@ -225,8 +225,7 @@ async function initSecureStore() {
     }
     catch (error) {
         const errorMessage = error instanceof Error ? error.message : String(error);
-        throw new Error(`Failed to load expo-secure-store: ${errorMessage}. ` +
-            'Make sure expo-secure-store is installed and properly configured.');
+        throw new Error(`Failed to load expo-secure-store: ${errorMessage}. Make sure expo-secure-store is installed and properly configured.`);
     }
 }
 /**
@@ -275,6 +274,7 @@ async function getSecureRandomBytes(length) {
         return Crypto.getRandomBytes(length);
     }
 }
+// biome-ignore lint/complexity/noStaticOnlyClass: a public, static-only API surface (`X.method()`) that consumers and tests call and spy on by name.
 class KeyManager {
     /**
      * Register (or, with `null`, unregister) where the identity's device backup is

package/dist/cjs/crypto/polyfill.js

@@ -8,15 +8,16 @@
  * Guard order when installing a `getRandomValues` shim (see bottom of file and
  * {@link cryptoPolyfill}):
  *
- *   1. A REAL `globalThis.crypto.getRandomValues` — used as-is (browser, Node
+ *   1. A REAL `globalThis.crypto.getRandomValues` — used as-is (browsers, Node
  *      >= 20, modern Hermes). The shim below is only installed when the host is
  *      missing it, so this branch is the install-time gate.
- *   2. Node — backed by the built-in `node:crypto` module (`webcrypto`, else
- *      `randomFillSync`). This is what a Node runtime WITHOUT a global WebCrypto
- *      (Node 18 script entrypoints, some embedded hosts) falls back to.
- *   3. React Native — `expo-crypto.getRandomBytes`, through the dependency-free
+ *   2. React Native — `expo-crypto.getRandomBytes`, through the dependency-free
  *      `@oxy.so/protocol/random` entry.
  *
+ * There is deliberately no `node:crypto` branch: every supported Node has a
+ * global WebCrypto, and a `require('node:crypto')` here made web bundlers ship
+ * Node's crypto, stream and buffer polyfills (~600 KB) to every browser.
+ *
  * # Evaluation order — this module must import NOTHING that can capture the global
  *
  * `@noble/hashes` 1.x reads `globalThis.crypto` exactly once, when its
@@ -32,10 +33,6 @@
  * and `index.ts` imports this file first. `__tests__/polyfillOrder.test.ts`
  * guards both halves.
  *
- * Historically step (2) delegated to `@oxy.so/protocol`'s RN-only
- * `getRandomBytesRN`, which THROWS on Node — so any Node host lacking a global
- * WebCrypto crashed here instead of getting randomness. It is now a proper
- * Node-backed implementation.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Buffer = void 0;
@@ -58,79 +55,11 @@ const globalObject = getGlobalObject();
 if (!globalObject.Buffer) {
     globalObject.Buffer = buffer_1.Buffer;
 }
-/**
- * Lazily-resolved `node:crypto` module, cached after the first attempt.
- * `undefined` = not tried yet; `null` = tried and unavailable (non-Node host).
- */
-let cachedNodeCrypto;
-/**
- * Synchronously load `node:crypto` on a Node runtime, or `null` elsewhere.
- *
- * Uses a guarded, Node-only `require`. Every runtime that actually reaches this
- * branch has a working CommonJS `require`: `@oxy.so/core` publishes no
- * `"type": "module"`, so Node loads it as CommonJS and the `require` free
- * variable is present. Browsers never reach here (they own `globalThis.crypto`,
- * so this polyfill is never installed) and React Native takes the
- * `getRandomBytesRN` branch — so the `node:crypto` reference is dead code in
- * those bundles, and Expo's Metro resolver shims `node:*` builtins, keeping
- * web/native bundles green.
- */
-function loadNodeCryptoSync() {
-    if (cachedNodeCrypto !== undefined) {
-        return cachedNodeCrypto;
-    }
-    if (typeof require !== 'function') {
-        cachedNodeCrypto = null;
-        return cachedNodeCrypto;
-    }
-    try {
-        cachedNodeCrypto = require('node:crypto');
-    }
-    catch {
-        // No Node crypto (unexpected on a real Node host) — degrade to the next
-        // mechanism rather than crash.
-        cachedNodeCrypto = null;
-    }
-    return cachedNodeCrypto;
-}
-/**
- * Fill `array` with cryptographically-secure random bytes from `node:crypto`.
- * Prefers `webcrypto.getRandomValues`; falls back to `randomFillSync`. Returns
- * `false` when Node crypto is unavailable so the caller can try the next
- * mechanism.
- */
-function fillFromNodeCrypto(array) {
-    const nodeCrypto = loadNodeCryptoSync();
-    if (!nodeCrypto) {
-        return false;
-    }
-    const webcrypto = nodeCrypto.webcrypto;
-    if (webcrypto && typeof webcrypto.getRandomValues === 'function') {
-        try {
-            webcrypto.getRandomValues(array);
-            return true;
-        }
-        catch {
-            // `webcrypto.getRandomValues` rejects non-integer views (Float*Array,
-            // DataView); fall through to `randomFillSync`, which accepts any view.
-        }
-    }
-    if (typeof nodeCrypto.randomFillSync === 'function') {
-        nodeCrypto.randomFillSync(array);
-        return true;
-    }
-    return false;
-}
+/** Minimal structural shape of the parts of `node:crypto` this polyfill uses. */
 const cryptoPolyfill = {
     getRandomValues(array) {
-        // Node: back the CSPRNG with `node:crypto`. This is the path that matters on
-        // Node runtimes shipping WITHOUT a global WebCrypto — where delegating to
-        // the RN-only expo-crypto stub would throw.
-        if ((0, random_1.isNodeJS)() && fillFromNodeCrypto(array)) {
-            return array;
-        }
-        // React Native (and any non-Node host without WebCrypto): synchronous
-        // expo-crypto via @oxy.so/protocol's RN `platform/random` variant.
+        // React Native / Hermes (the one supported host without WebCrypto):
+        // synchronous expo-crypto via @oxy.so/protocol's RN `platform/random`.
         const bytes = (0, random_1.getRandomBytesRN)(array.byteLength);
         const uint8View = new Uint8Array(array.buffer, array.byteOffset, array.byteLength);
         uint8View.set(bytes);

package/dist/cjs/crypto/recoveryPhrase.js

@@ -46,6 +46,7 @@ exports.BACKUP_KDF_ENCRYPTION_INFO = 'oxy-backup-encryption-key';
 exports.BACKUP_KDF_LOOKUP_INFO = 'oxy-backup-lookup-id';
 /** Byte length of both the derived backup key and the derived lookup id (256-bit). */
 exports.BACKUP_MATERIAL_LENGTH = 32;
+// biome-ignore lint/complexity/noStaticOnlyClass: a public, static-only API surface (`X.method()`) that consumers and tests call and spy on by name.
 class RecoveryPhraseService {
     /**
      * Generate a new identity with a recovery phrase.

package/dist/cjs/crypto/registrationPow.js

@@ -1,7 +1,7 @@
 "use strict";
 /**
  * Registration proof-of-work — the CLIENT half of the anti-automation nonce
- * `register()` (`mixins/OxyServices.auth.ts`) submits alongside the
+ * `auth.registerKey()` (`api/auth.ts`) submits alongside the
  * registration signature. The message format, difficulty and the full design
  * rationale (why 16 bits, why sequential nonces are fine, what this is and
  * isn't a defense against) live in `@oxy.so/protocol`'s

package/dist/cjs/crypto/signatureService.js

@@ -13,6 +13,7 @@ exports.SignatureService = void 0;
 const protocol_1 = require("@oxy.so/protocol");
 const keyManager_1 = require("./keyManager");
 const logger_1 = require("../logger");
+// biome-ignore lint/complexity/noStaticOnlyClass: a public, static-only API surface (`X.method()`) that consumers and tests call and spy on by name.
 class SignatureService {
     /**
      * Generate a random challenge string (for offline use)

package/dist/cjs/i18n/accountCategoryLabels.js

@@ -5,13 +5,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EN_ACCOUNT_CATEGORY_LABELS = void 0;
 exports.accountCategoryLabel = accountCategoryLabel;
-const en_US_json_1 = __importDefault(require("./locales/en-US.json"));
+const en_US_1 = __importDefault(require("./locales/en-US"));
 const index_1 = require("./index");
 /**
  * Every account category's English name, keyed by its stable id.
  *
  * **The annotation is the point.** The vocabulary lives in `@oxy.so/contracts`
- * and the names live in `locales/en-US.json`, so they are two lists that must
+ * and the names live in `locales/en-US.ts`, so they are two lists that must
  * agree and nothing but a type can make them. Declaring the JSON node as a
  * TOTAL `Record<AccountCategoryId, string>` turns "somebody added a category at
  * Oxy and nobody wrote its English" into a `TS2741` naming the missing id, at
@@ -38,7 +38,7 @@ const index_1 = require("./index");
  * to make an exported reference safe from a consumer's stray write, and there
  * is no such consumer. Exported from the MODULE so its own test can name it.
  */
-exports.EN_ACCOUNT_CATEGORY_LABELS = en_US_json_1.default.accounts.accountCategory;
+exports.EN_ACCOUNT_CATEGORY_LABELS = en_US_1.default.accounts.accountCategory;
 function accountCategoryLabel(locale, id) {
     return (0, index_1.translate)(locale, `accounts.accountCategory.${id}`);
 }

package/dist/cjs/i18n/accountRoleLabels.js

@@ -5,7 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EN_ACCOUNT_ROLE_LABELS = void 0;
 exports.accountRoleLabel = accountRoleLabel;
-const en_US_json_1 = __importDefault(require("./locales/en-US.json"));
+const en_US_1 = __importDefault(require("./locales/en-US"));
 const index_1 = require("./index");
 /**
  * Every account member role's English name, keyed by its stable id.
@@ -15,12 +15,12 @@ const index_1 = require("./index");
  * `accounts.roles.<role>.label`.
  */
 exports.EN_ACCOUNT_ROLE_LABELS = {
-    owner: en_US_json_1.default.accounts.roles.owner.label,
-    admin: en_US_json_1.default.accounts.roles.admin.label,
-    editor: en_US_json_1.default.accounts.roles.editor.label,
-    developer: en_US_json_1.default.accounts.roles.developer.label,
-    billing: en_US_json_1.default.accounts.roles.billing.label,
-    viewer: en_US_json_1.default.accounts.roles.viewer.label,
+    owner: en_US_1.default.accounts.roles.owner.label,
+    admin: en_US_1.default.accounts.roles.admin.label,
+    editor: en_US_1.default.accounts.roles.editor.label,
+    developer: en_US_1.default.accounts.roles.developer.label,
+    billing: en_US_1.default.accounts.roles.billing.label,
+    viewer: en_US_1.default.accounts.roles.viewer.label,
 };
 function accountRoleLabel(locale, role) {
     return (0, index_1.translate)(locale, `accounts.roles.${role}.label`);