@oxy.so/core 1.18.0 → 3.0.0

package/dist/cjs/mixins/index.js

@@ -1,136 +0,0 @@
-"use strict";
-/**
- * Centralized mixin exports and composition helper
- *
- * This module provides a clean way to compose all mixins
- * and ensures consistent ordering for better maintainability
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.MIXIN_PIPELINE = void 0;
-exports.composeOxyServices = composeOxyServices;
-const OxyServices_base_1 = require("../OxyServices.base");
-const OxyServices_auth_1 = require("./OxyServices.auth");
-const OxyServices_user_1 = require("./OxyServices.user");
-const OxyServices_identity_1 = require("./OxyServices.identity");
-const OxyServices_identityBackup_1 = require("./OxyServices.identityBackup");
-const OxyServices_privacy_1 = require("./OxyServices.privacy");
-const OxyServices_language_1 = require("./OxyServices.language");
-const OxyServices_payment_1 = require("./OxyServices.payment");
-const OxyServices_reputation_1 = require("./OxyServices.reputation");
-const OxyServices_assets_1 = require("./OxyServices.assets");
-const OxyServices_accounts_1 = require("./OxyServices.accounts");
-const OxyServices_connectedApps_1 = require("./OxyServices.connectedApps");
-const OxyServices_agency_1 = require("./OxyServices.agency");
-const OxyServices_store_1 = require("./OxyServices.store");
-const OxyServices_location_1 = require("./OxyServices.location");
-const OxyServices_analytics_1 = require("./OxyServices.analytics");
-const OxyServices_devices_1 = require("./OxyServices.devices");
-const OxyServices_security_1 = require("./OxyServices.security");
-const OxyServices_utility_1 = require("./OxyServices.utility");
-const OxyServices_features_1 = require("./OxyServices.features");
-const OxyServices_topics_1 = require("./OxyServices.topics");
-const OxyServices_contacts_1 = require("./OxyServices.contacts");
-const OxyServices_notifications_1 = require("./OxyServices.notifications");
-const OxyServices_appData_1 = require("./OxyServices.appData");
-const OxyServices_civic_1 = require("./OxyServices.civic");
-const OxyServices_chains_1 = require("./OxyServices.chains");
-const OxyServices_nodes_1 = require("./OxyServices.nodes");
-const OxyServices_followGraph_1 = require("./OxyServices.followGraph");
-const OxyServices_inference_1 = require("./OxyServices.inference");
-const OxyServices_deviceBoot_1 = require("./OxyServices.deviceBoot");
-const OxyServices_linkedAccounts_1 = require("./OxyServices.linkedAccounts");
-/**
- * Mixin pipeline - applied in order from first to last.
- *
- * Order matters for dependencies:
- * 1. Base auth mixin first (required by all others)
- * 2. User mixin (requires auth)
- * 3. Feature mixins (can depend on user)
- * 4. Utility mixin last (augments all)
- *
- * To add a new mixin: insert it at the appropriate position in this array.
- */
-const MIXIN_PIPELINE = [
-    // Base authentication
-    OxyServices_auth_1.OxyServicesAuthMixin,
-    // User management (requires auth)
-    OxyServices_user_1.OxyServicesUserMixin,
-    // Self-sovereign identity (DID, signed records, auth-method ↔ VM mapping)
-    OxyServices_identity_1.OxyServicesIdentityMixin,
-    // Encrypted off-device identity backup (b3 Feature 1): store/restore an
-    // encrypted copy of the self-custody key, keyed off the recovery phrase.
-    OxyServices_identityBackup_1.OxyServicesIdentityBackupMixin,
-    OxyServices_privacy_1.OxyServicesPrivacyMixin,
-    // Feature mixins
-    OxyServices_language_1.OxyServicesLanguageMixin,
-    OxyServices_payment_1.OxyServicesPaymentMixin,
-    OxyServices_reputation_1.OxyServicesReputationMixin,
-    OxyServices_assets_1.OxyServicesAssetsMixin,
-    // Unified account graph + the applications owned within it. The clean-cut
-    // replacement for the former managedAccounts + workspaces + applications
-    // (account-management) mixins.
-    OxyServices_accounts_1.OxyServicesAccountsMixin,
-    // OAuth-consent surface (public app identity + connected-app grants). Kept
-    // separate from account ownership.
-    OxyServices_connectedApps_1.OxyServicesConnectedAppsMixin,
-    // Oxy-owned delegated authority for Alia and digital-agent accounts.
-    OxyServices_agency_1.OxyServicesAgencyMixin,
-    // The app store: the public storefront, the reviews on it, and the listing a
-    // publisher edits. A module OVER the platform — turn it off and OAuth still
-    // works — so it is its own surface rather than more of `accounts`.
-    OxyServices_store_1.OxyServicesStoreMixin,
-    OxyServices_location_1.OxyServicesLocationMixin,
-    OxyServices_analytics_1.OxyServicesAnalyticsMixin,
-    OxyServices_devices_1.OxyServicesDevicesMixin,
-    OxyServices_security_1.OxyServicesSecurityMixin,
-    OxyServices_features_1.OxyServicesFeaturesMixin,
-    OxyServices_topics_1.OxyServicesTopicsMixin,
-    OxyServices_contacts_1.OxyServicesContactsMixin,
-    // Push-token registration: the one SDK-owned register/unregister pair every
-    // Oxy app uses, and what lets a "Sign in with Oxy" request be delivered to a
-    // known Commons installation instead of falling back to a QR.
-    OxyServices_notifications_1.OxyServicesNotificationsMixin,
-    OxyServices_appData_1.OxyServicesAppDataMixin,
-    // Civic / Commons "Oxy ID" (public signed cards, Oxy ID QR payload)
-    OxyServices_civic_1.OxyServicesCivicMixin,
-    OxyServices_chains_1.OxyServicesChainsMixin,
-    // User nodes / decentralization (Fase 5): register/read/revoke/manage the
-    // caller's personal data node + ingest hint.
-    OxyServices_nodes_1.OxyServicesNodesMixin,
-    // The user-owned follow graph (#809). One relationship per user and target,
-    // shared across applications, with per-application context on top.
-    OxyServices_followGraph_1.OxyServicesFollowGraphMixin,
-    // The inference model catalogue (#972). Reads only, and deliberately no
-    // request/stream/receipt methods — the public inference edge those would
-    // call is workstream 4 and does not exist yet. See
-    // `docs/inference/README.md` for what is and is not built.
-    OxyServices_inference_1.OxyServicesInferenceMixin,
-    // Device-first token mint: the client half of the zero-cookie transport
-    // (`mintFromDeviceSecret` → `POST /session/device/token`).
-    OxyServices_deviceBoot_1.OxyServicesDeviceBootMixin,
-    // Linked external accounts (Mastodon-API, Bluesky) proven by OAuth; the
-    // service read uses the auth mixin's `makeServiceRequest`.
-    OxyServices_linkedAccounts_1.OxyServicesLinkedAccountsMixin,
-    // Device-to-device identity transfer ("add a device"): E2E-encrypted key
-    // clone over a short-lived relay (b3 Feature 2).
-    // Utility (last, can use all above)
-    OxyServices_utility_1.OxyServicesUtilityMixin,
-];
-exports.MIXIN_PIPELINE = MIXIN_PIPELINE;
-/**
- * Composes all OxyServices mixins using a pipeline pattern.
- *
- * This is equivalent to the nested calls but more readable and maintainable.
- * Adding a new mixin: add it to MIXIN_PIPELINE at the appropriate position
- * AND extend `AllMixinInstances` so its methods are visible to consumers.
- *
- * The cast through `unknown` carries the runtime augmentation chain into the
- * static type system. `Array.reduce` cannot track each mixin's generic
- * refinement, so we assert the final shape exposed by all mixins together.
- *
- * @returns The fully composed OxyServices constructor with all mixins applied
- */
-function composeOxyServices() {
-    const composed = MIXIN_PIPELINE.reduce((Base, mixin) => mixin(Base), OxyServices_base_1.OxyServicesBase);
-    return composed;
-}

package/dist/cjs/mixins/mixinHelpers.js

@@ -1,53 +0,0 @@
-"use strict";
-/**
- * Helper utilities for mixin classes
- * Provides common patterns to reduce code duplication
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CACHE_TIMES = void 0;
-exports.withErrorHandling = withErrorHandling;
-exports.createApiMethod = createApiMethod;
-/**
- * Wraps an async method with standard error handling
- * Reduces boilerplate in mixin methods
- */
-async function withErrorHandling(operation, handleError) {
-    try {
-        return await operation();
-    }
-    catch (error) {
-        throw handleError(error);
-    }
-}
-/**
- * Creates a standard API request method with error handling
- * Reduces duplication across mixin methods
- */
-function createApiMethod(makeRequest, handleError, method, url, options = {}) {
-    return async (...args) => {
-        const urlString = typeof url === 'function' ? url(...args) : url;
-        const requestData = options.transformData ? options.transformData(args) : args[0];
-        const requestOptions = {
-            cache: options.cache ?? true,
-            cacheTTL: options.cacheTTL,
-            retry: options.retry ?? true,
-        };
-        try {
-            const response = await makeRequest(method, urlString, requestData, requestOptions);
-            return options.transformResponse ? options.transformResponse(response) : response;
-        }
-        catch (error) {
-            throw handleError(error);
-        }
-    };
-}
-/**
- * Cache time constants (in milliseconds)
- */
-exports.CACHE_TIMES = {
-    SHORT: 1 * 60 * 1000, // 1 minute
-    MEDIUM: 2 * 60 * 1000, // 2 minutes
-    LONG: 5 * 60 * 1000, // 5 minutes
-    VERY_LONG: 10 * 60 * 1000, // 10 minutes
-    EXTRA_LONG: 30 * 60 * 1000, // 30 minutes
-};

package/dist/cjs/utils/webauthnOrigin.js

@@ -1,51 +0,0 @@
-"use strict";
-/**
- * WebAuthn relying-party origin guard (client side).
- *
- * The passkey ceremonies (`OxyServices.webauthn*`) are only meaningful when the
- * page is served from a first-party Oxy web origin: a credential minted with
- * `WEBAUTHN_RP_ID=oxy.so` can only be created/asserted from `oxy.so`, one of its
- * subdomains, or a loopback dev server. This is the browser-side mirror of the
- * server's `isOxyApexOrigin` (`packages/api/src/utils/origin.ts`), which forms
- * the server's `expectedOrigin` allow-set — consumers use it to decide whether to
- * even offer the passkey UI on the current page.
- *
- * It reads `globalThis.location` directly (no argument) because that is the only
- * origin the browser will let a WebAuthn ceremony run against. On native / SSR /
- * any environment without a DOM `location`, it returns `false` (there is no
- * relying-party origin, so passkeys are not applicable).
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.isOxyRpOrigin = isOxyRpOrigin;
-/**
- * True iff the current page's host is a first-party Oxy relying-party origin:
- * `oxy.so`, any `*.oxy.so` subdomain, or a loopback dev host
- * (`localhost` / `127.0.0.1` / `[::1]`).
- *
- * Fails closed: no `location` (native/SSR), a non-string/empty hostname, or a
- * host that merely ends in the literal `oxy.so` without the dot boundary
- * (`evil-oxy.so`, `oxy.so.evil.com`) all return `false`.
- *
- * @example
- *   isOxyRpOrigin() // true  on https://accounts.oxy.so
- *   isOxyRpOrigin() // true  on http://localhost:8081
- *   isOxyRpOrigin() // false on https://evil.com
- *   isOxyRpOrigin() // false in a React Native / SSR context (no location)
- */
-function isOxyRpOrigin() {
-    // `globalThis.location` is typed `Location` by the DOM lib, but is genuinely
-    // `undefined` on native/SSR — widen to a nullable local so the guard is a real
-    // runtime check, not a type-level no-op.
-    const location = globalThis.location;
-    if (!location || typeof location.hostname !== 'string') {
-        return false;
-    }
-    const hostname = location.hostname.toLowerCase();
-    if (hostname.length === 0) {
-        return false;
-    }
-    if (hostname === 'oxy.so' || hostname.endsWith('.oxy.so')) {
-        return true;
-    }
-    return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]';
-}