@oxy.so/core 1.18.0 → 3.0.0

package/dist/cjs/index.js

@@ -1,50 +1,68 @@
 "use strict";
 /**
- * @oxy.so/core — OxyHQ SDK Foundation
+ * @oxy.so/core — the Oxy SDK foundation.
  *
- * Platform-agnostic core providing API client, authentication,
- * cryptographic identity, and shared utilities.
- *
- * Works in Node.js, Browser, and React Native.
- *
- * @example
  * ```ts
- * import { OxyServices, oxyClient } from '@oxy.so/core';
+ * import { OxyServices } from '@oxy.so/core';
  *
- * const user = await oxyClient.getCurrentUser();
+ * const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
+ * const me = await oxy.users.me();
  * ```
  *
+ * The root entry is the API client and what it needs; heavier pieces have their
+ * own entries so an app ships only what it uses:
+ * - `@oxy.so/core/session`   — device-first sessions, the account dialog, cold boot
+ * - `@oxy.so/core/crypto`    — the self-custody identity (keys, recovery phrase)
+ * - `@oxy.so/core/civic`     — Oxy ID QR payloads
+ * - `@oxy.so/core/inference` — the inference client
+ * - `@oxy.so/core/server`    — `OxyServer`: service tokens and middleware
+ *
  * Every export below is NOMINAL — no `export *`, no barrels, no compat shims.
  * If a symbol does not appear here, it is NOT part of the public API.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.encryptAead = exports.hkdfSha256 = exports.RecoveryPhraseService = exports.SignatureService = exports.updateIdentityMarker = exports.readIdentityMarker = exports.IdentityUnavailableError = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.verifyPublicCardAttestation = exports.parseAttestPayload = exports.parseIdPayload = exports.buildUserDid = exports.kindAcceptsAccountCategories = exports.isSelectableAccountCategoryId = exports.SELECTABLE_ACCOUNT_CATEGORY_IDS = exports.MAX_ACCOUNT_CATEGORIES = exports.ACCOUNT_CATEGORY_IDS = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.OXY_ACCOUNT_DELETED_EVENT_URI = exports.OxyAccountEventError = exports.commonsDeliveryPlatform = exports.pushTargetsFromDelivery = exports.selectCommonsDelivery = exports.parseCommonsApprovalExpiresAt = exports.getCommonsApprovalBlockingReason = exports.ServiceCredentialMismatchError = exports.oxyClient = exports.OXY_CLOUD_URL = exports.ServiceAssetMetadataError = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.AssetUrlResolutionError = exports.OxyServices = void 0;
-exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.coerceToSupportedLocale = exports.getPrimaryLanguage = exports.getUserLanguages = exports.isRTLLocale = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.isSupportedLocale = exports.normalizeLocale = exports.getBaseLanguage = exports.FALLBACK_LOCALE = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.deriveIdentityLinkCode = exports.signIdentityProof = exports.digestIdentityPayload = exports.deriveSharedSecret = exports.AEAD_NONCE_LENGTH = exports.AEAD_KEY_LENGTH = exports.decryptAead = void 0;
-exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE = exports.DISPLAY_NAME_ORPHANED_MARK_SOURCE = exports.DISPLAY_NAME_DISALLOWED_SOURCE = exports.DISPLAY_NAME_ALLOWED_SCRIPTS = exports.isValidDisplayName = exports.isValidPassword = exports.isValidEmail = exports.DISPLAY_NAME_INVALID_MESSAGE = exports.MAX_DISPLAY_NAME_LENGTH = exports.PASSWORD_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.parseHttpErrorBody = exports.isHttpRequestError = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.buildQueryParams = exports.trustTierLabel = exports.reputationCategoryLabel = exports.accountRoleLabel = exports.accountCategoryLabel = exports.translate = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = void 0;
-exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isLoopbackOrigin = exports.consumeOAuthReturnPath = exports.persistOAuthReturnPath = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.canonicalizeOAuthRedirectUri = exports.normalizeOAuthRedirectUri = exports.OXY_OAUTH_RETURN_PATH_STORAGE_KEY = exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.runColdBoot = exports.isOxyRpOrigin = exports.CENTRAL_IDP_APEX = exports.AUTH_WEB_ORIGIN = exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.isDev = exports.consoleSink = exports.resetLoggerConfig = exports.getLoggerConfig = exports.configureLogger = exports.createLogger = exports.logger = exports.normalizeMultilineText = exports.normalizeInlineText = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = void 0;
-exports.packageInfo = exports.runSessionColdBoot = exports.OXY_INFERENCE_BASE_URL = exports.OxyInferenceProtocolError = exports.OxyInferenceError = exports.OxyInferenceClient = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.AccountNotOnDeviceError = exports.establishIdentitySession = exports.resolveIdentityPin = exports.IDENTITY_PIN_STORAGE_KEY = exports.identityPinMatches = exports.createMemoryIdentityPinStore = exports.createNativeIdentityPinStore = exports.createWebIdentityPinStore = exports.readLocalDeviceCredential = exports.publishProvenDeviceCredential = exports.normalizeSharedDeviceSessionRead = exports.decideSharedDevicePublish = exports.decideSharedDeviceJoin = exports.createSharedMirroringAuthStateStore = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.resolveAccountDelegationAccess = exports.canSwitchIntoAccount = exports.isSwitchTargetAccount = exports.showsPrincipalHeaders = exports.buildSwitcherRows = exports.resolveDeviceContext = exports.resolveActiveContext = exports.projectDevicePrincipals = exports.directoryHandle = exports.directoryDisplayName = exports.canActivateContext = exports.accountIdsOf = void 0;
-// Ensure crypto polyfills are loaded before anything else. This MUST stay the
-// first import: `@noble/hashes` captures `globalThis.crypto` when it is
-// evaluated, so the shim has to exist before any module below reaches it (see
-// the evaluation-order note in `./crypto/polyfill`).
+exports.isRTLLocale = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.isSupportedLocale = exports.normalizeLocale = exports.getBaseLanguage = exports.FALLBACK_LOCALE = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.commonsDeliveryPlatform = exports.pushTargetsFromDelivery = exports.selectCommonsDelivery = exports.parseCommonsApprovalExpiresAt = exports.getCommonsApprovalBlockingReason = exports.OxyAppDataIdentifierError = exports.AccountNotOnDeviceError = exports.REPUTATION_CACHE_PREFIX = exports.kindAcceptsAccountCategories = exports.isSelectableAccountCategoryId = exports.SELECTABLE_ACCOUNT_CATEGORY_IDS = exports.MAX_ACCOUNT_CATEGORIES = exports.ACCOUNT_CATEGORY_IDS = exports.buildUserDid = exports.assetUrlCacheTTL = exports.ServiceAssetMetadataError = exports.AssetUrlResolutionError = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.OxyApiError = exports.OXY_CLOUD_URL = exports.OXY_API_URL = exports.OxyServices = void 0;
+exports.trustTierLabel = exports.reputationCategoryLabel = exports.accountRoleLabel = exports.accountCategoryLabel = exports.getLocalesVersion = exports.subscribeLocales = exports.isLocaleLoaded = exports.loadLocale = exports.translate = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.coerceToSupportedLocale = exports.getPrimaryLanguage = exports.getUserLanguages = void 0;
+exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.isDev = exports.consoleSink = exports.resetLoggerConfig = exports.getLoggerConfig = exports.configureLogger = exports.createLogger = exports.logger = exports.normalizeMultilineText = exports.normalizeInlineText = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE = exports.DISPLAY_NAME_ORPHANED_MARK_SOURCE = exports.DISPLAY_NAME_DISALLOWED_SOURCE = exports.DISPLAY_NAME_ALLOWED_SCRIPTS = exports.isValidDisplayName = exports.isValidPassword = exports.isValidEmail = exports.DISPLAY_NAME_INVALID_MESSAGE = exports.MAX_DISPLAY_NAME_LENGTH = exports.PASSWORD_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.parseHttpErrorBody = exports.isHttpRequestError = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.buildQueryParams = void 0;
+exports.packageInfo = exports.consumeOAuthReturnPath = exports.persistOAuthReturnPath = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.canonicalizeOAuthRedirectUri = exports.normalizeOAuthRedirectUri = exports.OXY_OAUTH_RETURN_PATH_STORAGE_KEY = exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.CENTRAL_IDP_APEX = exports.AUTH_WEB_ORIGIN = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = void 0;
+// The crypto shim MUST stay the first import. The root itself ships no crypto
+// library (`__tests__/rootEntryGraph.test.ts`), but `@oxy.so/protocol`'s root
+// entry (reached by the OAuth/PKCE and device helpers) does, and Metro does not
+// tree-shake: on Hermes, `@noble/hashes` would capture an absent
+// `globalThis.crypto` at evaluation. See the note in `./crypto/polyfill`.
 require("./crypto/polyfill");
 // ---------------------------------------------------------------------------
 // API client
 // ---------------------------------------------------------------------------
 var OxyServices_1 = require("./OxyServices");
 Object.defineProperty(exports, "OxyServices", { enumerable: true, get: function () { return OxyServices_1.OxyServices; } });
-Object.defineProperty(exports, "AssetUrlResolutionError", { enumerable: true, get: function () { return OxyServices_1.AssetUrlResolutionError; } });
-Object.defineProperty(exports, "OxyAuthenticationError", { enumerable: true, get: function () { return OxyServices_1.OxyAuthenticationError; } });
-Object.defineProperty(exports, "OxyAuthenticationTimeoutError", { enumerable: true, get: function () { return OxyServices_1.OxyAuthenticationTimeoutError; } });
-Object.defineProperty(exports, "ServiceAssetMetadataError", { enumerable: true, get: function () { return OxyServices_1.ServiceAssetMetadataError; } });
-var OxyServices_2 = require("./OxyServices");
-Object.defineProperty(exports, "OXY_CLOUD_URL", { enumerable: true, get: function () { return OxyServices_2.OXY_CLOUD_URL; } });
-Object.defineProperty(exports, "oxyClient", { enumerable: true, get: function () { return OxyServices_2.oxyClient; } });
-// ---------------------------------------------------------------------------
-// Authentication
-// ---------------------------------------------------------------------------
-var OxyServices_auth_1 = require("./mixins/OxyServices.auth");
-Object.defineProperty(exports, "ServiceCredentialMismatchError", { enumerable: true, get: function () { return OxyServices_auth_1.ServiceCredentialMismatchError; } });
+Object.defineProperty(exports, "OXY_API_URL", { enumerable: true, get: function () { return OxyServices_1.OXY_API_URL; } });
+Object.defineProperty(exports, "OXY_CLOUD_URL", { enumerable: true, get: function () { return OxyServices_1.OXY_CLOUD_URL; } });
+var OxyServices_errors_1 = require("./OxyServices.errors");
+Object.defineProperty(exports, "OxyApiError", { enumerable: true, get: function () { return OxyServices_errors_1.OxyApiError; } });
+Object.defineProperty(exports, "OxyAuthenticationError", { enumerable: true, get: function () { return OxyServices_errors_1.OxyAuthenticationError; } });
+Object.defineProperty(exports, "OxyAuthenticationTimeoutError", { enumerable: true, get: function () { return OxyServices_errors_1.OxyAuthenticationTimeoutError; } });
+Object.defineProperty(exports, "AssetUrlResolutionError", { enumerable: true, get: function () { return OxyServices_errors_1.AssetUrlResolutionError; } });
+Object.defineProperty(exports, "ServiceAssetMetadataError", { enumerable: true, get: function () { return OxyServices_errors_1.ServiceAssetMetadataError; } });
+var assets_1 = require("./api/assets");
+Object.defineProperty(exports, "assetUrlCacheTTL", { enumerable: true, get: function () { return assets_1.assetUrlCacheTTL; } });
+var identity_1 = require("./api/identity");
+Object.defineProperty(exports, "buildUserDid", { enumerable: true, get: function () { return identity_1.buildUserDid; } });
+var accounts_1 = require("./api/accounts");
+Object.defineProperty(exports, "ACCOUNT_CATEGORY_IDS", { enumerable: true, get: function () { return accounts_1.ACCOUNT_CATEGORY_IDS; } });
+Object.defineProperty(exports, "MAX_ACCOUNT_CATEGORIES", { enumerable: true, get: function () { return accounts_1.MAX_ACCOUNT_CATEGORIES; } });
+Object.defineProperty(exports, "SELECTABLE_ACCOUNT_CATEGORY_IDS", { enumerable: true, get: function () { return accounts_1.SELECTABLE_ACCOUNT_CATEGORY_IDS; } });
+Object.defineProperty(exports, "isSelectableAccountCategoryId", { enumerable: true, get: function () { return accounts_1.isSelectableAccountCategoryId; } });
+Object.defineProperty(exports, "kindAcceptsAccountCategories", { enumerable: true, get: function () { return accounts_1.kindAcceptsAccountCategories; } });
+var reputation_1 = require("./api/reputation");
+Object.defineProperty(exports, "REPUTATION_CACHE_PREFIX", { enumerable: true, get: function () { return reputation_1.REPUTATION_CACHE_PREFIX; } });
+var devices_1 = require("./api/devices");
+Object.defineProperty(exports, "AccountNotOnDeviceError", { enumerable: true, get: function () { return devices_1.AccountNotOnDeviceError; } });
+var appData_1 = require("./api/appData");
+Object.defineProperty(exports, "OxyAppDataIdentifierError", { enumerable: true, get: function () { return appData_1.OxyAppDataIdentifierError; } });
+// ---------------------------------------------------------------------------
+// "Sign in with Oxy" delivery helpers
+// ---------------------------------------------------------------------------
 var commonsApproval_1 = require("./utils/commonsApproval");
 Object.defineProperty(exports, "getCommonsApprovalBlockingReason", { enumerable: true, get: function () { return commonsApproval_1.getCommonsApprovalBlockingReason; } });
 Object.defineProperty(exports, "parseCommonsApprovalExpiresAt", { enumerable: true, get: function () { return commonsApproval_1.parseCommonsApprovalExpiresAt; } });
@@ -54,11 +72,6 @@ var commonsDelivery_1 = require("./utils/commonsDelivery");
 Object.defineProperty(exports, "selectCommonsDelivery", { enumerable: true, get: function () { return commonsDelivery_1.selectCommonsDelivery; } });
 Object.defineProperty(exports, "pushTargetsFromDelivery", { enumerable: true, get: function () { return commonsDelivery_1.pushTargetsFromDelivery; } });
 Object.defineProperty(exports, "commonsDeliveryPlatform", { enumerable: true, get: function () { return commonsDelivery_1.commonsDeliveryPlatform; } });
-var OxyServices_utility_1 = require("./mixins/OxyServices.utility");
-Object.defineProperty(exports, "OxyAccountEventError", { enumerable: true, get: function () { return OxyServices_utility_1.OxyAccountEventError; } });
-Object.defineProperty(exports, "OXY_ACCOUNT_DELETED_EVENT_URI", { enumerable: true, get: function () { return OxyServices_utility_1.OXY_ACCOUNT_DELETED_EVENT_URI; } });
-var OxyServices_appData_1 = require("./mixins/OxyServices.appData");
-Object.defineProperty(exports, "OxyAppDataIdentifierError", { enumerable: true, get: function () { return OxyServices_appData_1.OxyAppDataIdentifierError; } });
 // ---------------------------------------------------------------------------
 // User identity and handles
 // ---------------------------------------------------------------------------
@@ -71,39 +84,6 @@ Object.defineProperty(exports, "getCanonicalUserHandle", { enumerable: true, get
 Object.defineProperty(exports, "getNormalizedUserHandle", { enumerable: true, get: function () { return userHandle_1.getNormalizedUserHandle; } });
 var profileLinks_1 = require("./utils/profileLinks");
 Object.defineProperty(exports, "normalizeProfileLinks", { enumerable: true, get: function () { return profileLinks_1.normalizeProfileLinks; } });
-var OxyServices_accounts_1 = require("./mixins/OxyServices.accounts");
-Object.defineProperty(exports, "ACCOUNT_CATEGORY_IDS", { enumerable: true, get: function () { return OxyServices_accounts_1.ACCOUNT_CATEGORY_IDS; } });
-Object.defineProperty(exports, "MAX_ACCOUNT_CATEGORIES", { enumerable: true, get: function () { return OxyServices_accounts_1.MAX_ACCOUNT_CATEGORIES; } });
-Object.defineProperty(exports, "SELECTABLE_ACCOUNT_CATEGORY_IDS", { enumerable: true, get: function () { return OxyServices_accounts_1.SELECTABLE_ACCOUNT_CATEGORY_IDS; } });
-Object.defineProperty(exports, "isSelectableAccountCategoryId", { enumerable: true, get: function () { return OxyServices_accounts_1.isSelectableAccountCategoryId; } });
-Object.defineProperty(exports, "kindAcceptsAccountCategories", { enumerable: true, get: function () { return OxyServices_accounts_1.kindAcceptsAccountCategories; } });
-// ---------------------------------------------------------------------------
-// Reputation (Oxy Trust: ledger, balances, disputes, rules, influence).
-// The whole type family — the closed value sets, the two balance views and the
-// `isFullReputationBalance` narrowing guard, the ledger/dispute/rule/leaderboard
-// shapes, and the write-endpoint inputs — is owned by `@oxy.so/contracts`, which
-// the API's serializers are validated against. Import them from there.
-// ---------------------------------------------------------------------------
-// ---------------------------------------------------------------------------
-// Self-sovereign identity (DID, signed records, auth-method ↔ VM mapping,
-// verified domains). Wire shapes (DidDocument, SignedRecordEnvelope,
-// AuthMethodsResponse, VerifiedDomain, DomainVerificationInstructions,
-// ExportBundle) live in `@oxy.so/contracts` — import them directly from there.
-// ---------------------------------------------------------------------------
-var OxyServices_identity_1 = require("./mixins/OxyServices.identity");
-Object.defineProperty(exports, "buildUserDid", { enumerable: true, get: function () { return OxyServices_identity_1.buildUserDid; } });
-// ---------------------------------------------------------------------------
-// Civic / Commons "Oxy ID" (public signed cards + Oxy ID QR payload) and Fase 2
-// anti-gaming (real-life attestation QR + validator/jury). Wire shapes
-// (PublicCard, SignedPublicCard, RealLifeAttestationResult,
-// ValidationRequestSummary, ValidationVoteResult, ValidationVerdict, …) live in
-// `@oxy.so/contracts` — import them from there. The SDK adds the client verdict
-// wrapper, the QR payload parsers/builders, and the submit inputs/results.
-// ---------------------------------------------------------------------------
-var OxyServices_civic_1 = require("./mixins/OxyServices.civic");
-Object.defineProperty(exports, "parseIdPayload", { enumerable: true, get: function () { return OxyServices_civic_1.parseIdPayload; } });
-Object.defineProperty(exports, "parseAttestPayload", { enumerable: true, get: function () { return OxyServices_civic_1.parseAttestPayload; } });
-Object.defineProperty(exports, "verifyPublicCardAttestation", { enumerable: true, get: function () { return OxyServices_civic_1.verifyPublicCardAttestation; } });
 // ---------------------------------------------------------------------------
 // Auth helpers (token refresh, error normalisation, retry policies)
 // ---------------------------------------------------------------------------
@@ -121,44 +101,6 @@ var sessionUtils_1 = require("./utils/sessionUtils");
 Object.defineProperty(exports, "mergeSessions", { enumerable: true, get: function () { return sessionUtils_1.mergeSessions; } });
 Object.defineProperty(exports, "normalizeAndSortSessions", { enumerable: true, get: function () { return sessionUtils_1.normalizeAndSortSessions; } });
 Object.defineProperty(exports, "sessionsArraysEqual", { enumerable: true, get: function () { return sessionUtils_1.sessionsArraysEqual; } });
-// ---------------------------------------------------------------------------
-// Crypto / identity
-// ---------------------------------------------------------------------------
-var keyManager_1 = require("./crypto/keyManager");
-Object.defineProperty(exports, "KeyManager", { enumerable: true, get: function () { return keyManager_1.KeyManager; } });
-Object.defineProperty(exports, "IdentityAlreadyExistsError", { enumerable: true, get: function () { return keyManager_1.IdentityAlreadyExistsError; } });
-Object.defineProperty(exports, "IdentityPersistError", { enumerable: true, get: function () { return keyManager_1.IdentityPersistError; } });
-Object.defineProperty(exports, "IdentityUnavailableError", { enumerable: true, get: function () { return keyManager_1.IdentityUnavailableError; } });
-var identityMarker_1 = require("./crypto/identityMarker");
-Object.defineProperty(exports, "readIdentityMarker", { enumerable: true, get: function () { return identityMarker_1.readIdentityMarker; } });
-Object.defineProperty(exports, "updateIdentityMarker", { enumerable: true, get: function () { return identityMarker_1.updateIdentityMarker; } });
-var signatureService_1 = require("./crypto/signatureService");
-Object.defineProperty(exports, "SignatureService", { enumerable: true, get: function () { return signatureService_1.SignatureService; } });
-var recoveryPhrase_1 = require("./crypto/recoveryPhrase");
-Object.defineProperty(exports, "RecoveryPhraseService", { enumerable: true, get: function () { return recoveryPhrase_1.RecoveryPhraseService; } });
-// Low-level crypto primitives (b3 Phase 0 — encrypted backup + device transfer)
-var kdf_1 = require("./crypto/kdf");
-Object.defineProperty(exports, "hkdfSha256", { enumerable: true, get: function () { return kdf_1.hkdfSha256; } });
-var aead_1 = require("./crypto/aead");
-Object.defineProperty(exports, "encryptAead", { enumerable: true, get: function () { return aead_1.encryptAead; } });
-Object.defineProperty(exports, "decryptAead", { enumerable: true, get: function () { return aead_1.decryptAead; } });
-Object.defineProperty(exports, "AEAD_KEY_LENGTH", { enumerable: true, get: function () { return aead_1.AEAD_KEY_LENGTH; } });
-Object.defineProperty(exports, "AEAD_NONCE_LENGTH", { enumerable: true, get: function () { return aead_1.AEAD_NONCE_LENGTH; } });
-var ecdh_1 = require("./crypto/ecdh");
-Object.defineProperty(exports, "deriveSharedSecret", { enumerable: true, get: function () { return ecdh_1.deriveSharedSecret; } });
-// Identity proofs — the one signed format for operations on a personal root
-// (docs/adr/0024-one-oxy-account-root-holders.md D7)
-var identityProof_1 = require("./crypto/identityProof");
-Object.defineProperty(exports, "digestIdentityPayload", { enumerable: true, get: function () { return identityProof_1.digestIdentityPayload; } });
-Object.defineProperty(exports, "signIdentityProof", { enumerable: true, get: function () { return identityProof_1.signIdentityProof; } });
-// Linking Commons to a passkey account: the code both screens compare (ADR 0029 D3)
-var identityLink_1 = require("./crypto/identityLink");
-Object.defineProperty(exports, "deriveIdentityLinkCode", { enumerable: true, get: function () { return identityLink_1.deriveIdentityLinkCode; } });
-// ---------------------------------------------------------------------------
-// Devices
-// ---------------------------------------------------------------------------
-var deviceManager_1 = require("./utils/deviceManager");
-Object.defineProperty(exports, "DeviceManager", { enumerable: true, get: function () { return deviceManager_1.DeviceManager; } });
 var interfaces_1 = require("./models/interfaces");
 Object.defineProperty(exports, "SECURITY_EVENT_SEVERITY_MAP", { enumerable: true, get: function () { return interfaces_1.SECURITY_EVENT_SEVERITY_MAP; } });
 // Topic enums + type
@@ -238,6 +180,10 @@ Object.defineProperty(exports, "withRetry", { enumerable: true, get: function ()
 // ---------------------------------------------------------------------------
 var i18n_1 = require("./i18n");
 Object.defineProperty(exports, "translate", { enumerable: true, get: function () { return i18n_1.translate; } });
+Object.defineProperty(exports, "loadLocale", { enumerable: true, get: function () { return i18n_1.loadLocale; } });
+Object.defineProperty(exports, "isLocaleLoaded", { enumerable: true, get: function () { return i18n_1.isLocaleLoaded; } });
+Object.defineProperty(exports, "subscribeLocales", { enumerable: true, get: function () { return i18n_1.subscribeLocales; } });
+Object.defineProperty(exports, "getLocalesVersion", { enumerable: true, get: function () { return i18n_1.getLocalesVersion; } });
 var accountCategoryLabels_1 = require("./i18n/accountCategoryLabels");
 Object.defineProperty(exports, "accountCategoryLabel", { enumerable: true, get: function () { return accountCategoryLabels_1.accountCategoryLabel; } });
 var accountRoleLabels_1 = require("./i18n/accountRoleLabels");
@@ -325,26 +271,12 @@ Object.defineProperty(exports, "getAccountDisplayName", { enumerable: true, get:
 Object.defineProperty(exports, "getAccountFallbackHandle", { enumerable: true, get: function () { return accountUtils_1.getAccountFallbackHandle; } });
 Object.defineProperty(exports, "formatPublicKeyHandle", { enumerable: true, get: function () { return accountUtils_1.formatPublicKeyHandle; } });
 Object.defineProperty(exports, "getAccountColor", { enumerable: true, get: function () { return accountUtils_1.getAccountColor; } });
-// ---------------------------------------------------------------------------
-// Registrable-domain + central-IdP-apex helpers.
-//
-// `registrableApex` (eTLD+1) is consumed via the `@oxy.so/core/server`
-// re-export by `packages/api/src/utils/sameSite.ts` for same-site origin
-// checks; `CENTRAL_IDP_APEX` by `server/cors.ts`'s `createOxyCors` (auto-allows
-// `*.oxy.so`).
-// ---------------------------------------------------------------------------
-var registrableApex_1 = require("./utils/registrableApex");
-Object.defineProperty(exports, "registrableApex", { enumerable: true, get: function () { return registrableApex_1.registrableApex; } });
+// The central IdP apex (`CENTRAL_IDP_APEX`, auto-allowed by `createOxyCors`)
+// and the auth web origin. `registrableApex` / the official-origin checks
+// (which ship the public-suffix list) are in `@oxy.so/core/server`.
 var authWebUrl_1 = require("./utils/authWebUrl");
 Object.defineProperty(exports, "AUTH_WEB_ORIGIN", { enumerable: true, get: function () { return authWebUrl_1.AUTH_WEB_ORIGIN; } });
 Object.defineProperty(exports, "CENTRAL_IDP_APEX", { enumerable: true, get: function () { return authWebUrl_1.CENTRAL_IDP_APEX; } });
-// WebAuthn relying-party origin guard (client side). Mirrors the server's
-// `isOxyApexOrigin` so consumers can decide whether to offer passkey UI on the
-// current page (first-party Oxy origin / loopback only).
-var webauthnOrigin_1 = require("./utils/webauthnOrigin");
-Object.defineProperty(exports, "isOxyRpOrigin", { enumerable: true, get: function () { return webauthnOrigin_1.isOxyRpOrigin; } });
-var coldBoot_1 = require("./utils/coldBoot");
-Object.defineProperty(exports, "runColdBoot", { enumerable: true, get: function () { return coldBoot_1.runColdBoot; } });
 // ---------------------------------------------------------------------------
 // OAuth 2.0 Authorization Code + PKCE helpers ("Sign in with Oxy" third party).
 // Standard OAuth against auth.oxy.so/authorize — no FedCM/cookies/SSO bounce.
@@ -367,148 +299,8 @@ Object.defineProperty(exports, "readOAuthHandshake", { enumerable: true, get: fu
 Object.defineProperty(exports, "clearOAuthHandshake", { enumerable: true, get: function () { return oauthPkce_1.clearOAuthHandshake; } });
 Object.defineProperty(exports, "persistOAuthReturnPath", { enumerable: true, get: function () { return oauthPkce_1.persistOAuthReturnPath; } });
 Object.defineProperty(exports, "consumeOAuthReturnPath", { enumerable: true, get: function () { return oauthPkce_1.consumeOAuthReturnPath; } });
-var officialOrigins_1 = require("./utils/officialOrigins");
-Object.defineProperty(exports, "isLoopbackOrigin", { enumerable: true, get: function () { return officialOrigins_1.isLoopbackOrigin; } });
-Object.defineProperty(exports, "isOfficialWebOrigin", { enumerable: true, get: function () { return officialOrigins_1.isOfficialWebOrigin; } });
-Object.defineProperty(exports, "isAllowedDeviceJoinOrigin", { enumerable: true, get: function () { return officialOrigins_1.isAllowedDeviceJoinOrigin; } });
-// ---------------------------------------------------------------------------
-// Session sync (device-scoped multi-account session client)
-// ---------------------------------------------------------------------------
-var SessionClient_1 = require("./session/SessionClient");
-Object.defineProperty(exports, "SessionClient", { enumerable: true, get: function () { return SessionClient_1.SessionClient; } });
-// Shared SessionClient integration layer: the host adapter, the pure
-// DeviceSessionState projection helpers, and the client factory are defined
-// ONCE here so every `@oxy.so/services` platform variant reuses them instead of
-// duplicating a local copy. Each consumer supplies its own `TokenTransport`
-// (native vs. web mint strategies differ) to `createSessionClient`.
-var sessionClientHost_1 = require("./session/sessionClientHost");
-Object.defineProperty(exports, "createSessionClientHost", { enumerable: true, get: function () { return sessionClientHost_1.createSessionClientHost; } });
-var createSessionClient_1 = require("./session/createSessionClient");
-Object.defineProperty(exports, "createSessionClient", { enumerable: true, get: function () { return createSessionClient_1.createSessionClient; } });
-var projectSessionState_1 = require("./session/projectSessionState");
-Object.defineProperty(exports, "deviceStateToClientSessions", { enumerable: true, get: function () { return projectSessionState_1.deviceStateToClientSessions; } });
-Object.defineProperty(exports, "activeSessionIdOf", { enumerable: true, get: function () { return projectSessionState_1.activeSessionIdOf; } });
-Object.defineProperty(exports, "activeUserOf", { enumerable: true, get: function () { return projectSessionState_1.activeUserOf; } });
-Object.defineProperty(exports, "accountIdsOf", { enumerable: true, get: function () { return projectSessionState_1.accountIdsOf; } });
-// Pure projections over the device DIRECTORY (`GET /session/device/directory`,
-// ADR 0002) — the read model that keeps the actor (the human who authenticated)
-// and the subject (the account being acted as) apart. The flat
-// `DeviceSessionState` collapses them into one row, so it can neither tell
-// "signed in as an org" from "a person operating that org" nor hold two people
-// reaching the same org on one device.
-// `canActivateContext` is the switchability question — `available` alone, never
-// composed with `onDevice`, which is a different fact in both directions.
-// `projectDevicePrincipals` is the switcher's shape: people, each with what
-// they may become. Grouped rather than flat because the same organization
-// reached through two people is TWO rows under two humans, which a list keyed
-// by account cannot say.
-var deviceDirectory_1 = require("./session/deviceDirectory");
-Object.defineProperty(exports, "canActivateContext", { enumerable: true, get: function () { return deviceDirectory_1.canActivateContext; } });
-Object.defineProperty(exports, "directoryDisplayName", { enumerable: true, get: function () { return deviceDirectory_1.directoryDisplayName; } });
-Object.defineProperty(exports, "directoryHandle", { enumerable: true, get: function () { return deviceDirectory_1.directoryHandle; } });
-Object.defineProperty(exports, "projectDevicePrincipals", { enumerable: true, get: function () { return deviceDirectory_1.projectDevicePrincipals; } });
-Object.defineProperty(exports, "resolveActiveContext", { enumerable: true, get: function () { return deviceDirectory_1.resolveActiveContext; } });
-Object.defineProperty(exports, "resolveDeviceContext", { enumerable: true, get: function () { return deviceDirectory_1.resolveDeviceContext; } });
-// The switcher's RENDER model over that projection — names, handles and avatar
-// URLs resolved once. Shared by `@oxy.so/services`' account dialog and the
-// auth.oxy.so chooser so the two cannot drift, the same reason the flat
-// projection lived here before it.
-var deviceSwitcherRows_1 = require("./session/deviceSwitcherRows");
-Object.defineProperty(exports, "buildSwitcherRows", { enumerable: true, get: function () { return deviceSwitcherRows_1.buildSwitcherRows; } });
-Object.defineProperty(exports, "showsPrincipalHeaders", { enumerable: true, get: function () { return deviceSwitcherRows_1.showsPrincipalHeaders; } });
-// The switch-target predicates over the account GRAPH — a list of accounts to
-// manage, not the device's list of identities to become (that is the directory
-// above). `isSwitchTargetAccount` is the structural half ("is this kind
-// switchable at all?"); `canSwitchIntoAccount` adds the caller's
-// `account:act_as` permission. Exported so the surfaces that render
-// `AccountNode`s — the Console workspace switcher, managed-accounts rows — ask
-// the SAME questions instead of testing a kind literal.
-var accountSwitchTargets_1 = require("./session/accountSwitchTargets");
-Object.defineProperty(exports, "isSwitchTargetAccount", { enumerable: true, get: function () { return accountSwitchTargets_1.isSwitchTargetAccount; } });
-Object.defineProperty(exports, "canSwitchIntoAccount", { enumerable: true, get: function () { return accountSwitchTargets_1.canSwitchIntoAccount; } });
-// The service/agent counterpart to the human switch predicates above. Kept on
-// its own semantic seam because `bot` is delegable but never human-switchable.
-var accountDelegationAccess_1 = require("./session/accountDelegationAccess");
-Object.defineProperty(exports, "resolveAccountDelegationAccess", { enumerable: true, get: function () { return accountDelegationAccess_1.resolveAccountDelegationAccess; } });
-// Headless controller for the unified account dialog. Framework-agnostic
-// state machine + subscribe/getSnapshot store (bind via `useSyncExternalStore`)
-// — sign-in is passkey (WebAuthn) or the Commons QR / shared-keychain handoff;
-// password, social login, and 2FA were removed ecosystem-wide. Reuses
-// `SessionClient.switchAccount` / `oxyServices.switchToAccount` for the uniform
-// switch and the existing device-flow methods for sign-in.
-var accountDialogController_1 = require("./session/accountDialogController");
-Object.defineProperty(exports, "AccountDialogController", { enumerable: true, get: function () { return accountDialogController_1.AccountDialogController; } });
-Object.defineProperty(exports, "createAccountDialogController", { enumerable: true, get: function () { return accountDialogController_1.createAccountDialogController; } });
-// ---------------------------------------------------------------------------
-// Device-first session machinery (zero-cookie transport).
-// Persisted auth-state store, the unified re-mint handler + scheduler, and the
-// cold-boot runner. Built ON the `runColdBoot` primitive + `SessionClient`. The
-// device credential is `deviceId` + `deviceSecret`; the access token is re-minted
-// via `POST /session/device/token`.
-// ---------------------------------------------------------------------------
-var authStateStore_1 = require("./session/authStateStore");
-Object.defineProperty(exports, "createWebAuthStateStore", { enumerable: true, get: function () { return authStateStore_1.createWebAuthStateStore; } });
-Object.defineProperty(exports, "createNativeAuthStateStore", { enumerable: true, get: function () { return authStateStore_1.createNativeAuthStateStore; } });
-Object.defineProperty(exports, "createMemoryAuthStateStore", { enumerable: true, get: function () { return authStateStore_1.createMemoryAuthStateStore; } });
-Object.defineProperty(exports, "AUTH_STATE_STORAGE_KEY", { enumerable: true, get: function () { return authStateStore_1.AUTH_STATE_STORAGE_KEY; } });
-// The shared NATIVE DeviceSession credential — how several official apps on one
-// device end up on ONE `DeviceSession` and therefore one active context. It is an
-// ordinary rotatable/revocable `deviceId` + `deviceSecret`, deliberately NOT the
-// Commons private identity key: an app that only needs a session must never be
-// handed the key that signs identity approvals.
-var sharedDeviceCredential_1 = require("./session/sharedDeviceCredential");
-Object.defineProperty(exports, "createSharedMirroringAuthStateStore", { enumerable: true, get: function () { return sharedDeviceCredential_1.createSharedMirroringAuthStateStore; } });
-Object.defineProperty(exports, "decideSharedDeviceJoin", { enumerable: true, get: function () { return sharedDeviceCredential_1.decideSharedDeviceJoin; } });
-Object.defineProperty(exports, "decideSharedDevicePublish", { enumerable: true, get: function () { return sharedDeviceCredential_1.decideSharedDevicePublish; } });
-Object.defineProperty(exports, "normalizeSharedDeviceSessionRead", { enumerable: true, get: function () { return sharedDeviceCredential_1.normalizeSharedDeviceSessionRead; } });
-Object.defineProperty(exports, "publishProvenDeviceCredential", { enumerable: true, get: function () { return sharedDeviceCredential_1.publishProvenDeviceCredential; } });
-Object.defineProperty(exports, "readLocalDeviceCredential", { enumerable: true, get: function () { return sharedDeviceCredential_1.readLocalDeviceCredential; } });
-// Identity-bound sessions (the identity vault). The pin is the durable
-// `{publicKey, accountId}` binding between this device's PRIMARY identity key
-// and the account it authenticates as; it is what keeps such a client from
-// following the device's mutable `activeAccountId`.
-var identityPin_1 = require("./session/identityPin");
-Object.defineProperty(exports, "createWebIdentityPinStore", { enumerable: true, get: function () { return identityPin_1.createWebIdentityPinStore; } });
-Object.defineProperty(exports, "createNativeIdentityPinStore", { enumerable: true, get: function () { return identityPin_1.createNativeIdentityPinStore; } });
-Object.defineProperty(exports, "createMemoryIdentityPinStore", { enumerable: true, get: function () { return identityPin_1.createMemoryIdentityPinStore; } });
-Object.defineProperty(exports, "identityPinMatches", { enumerable: true, get: function () { return identityPin_1.identityPinMatches; } });
-Object.defineProperty(exports, "IDENTITY_PIN_STORAGE_KEY", { enumerable: true, get: function () { return identityPin_1.IDENTITY_PIN_STORAGE_KEY; } });
-var identitySession_1 = require("./session/identitySession");
-Object.defineProperty(exports, "resolveIdentityPin", { enumerable: true, get: function () { return identitySession_1.resolveIdentityPin; } });
-Object.defineProperty(exports, "establishIdentitySession", { enumerable: true, get: function () { return identitySession_1.establishIdentitySession; } });
-// The typed `401 account_not_on_device` from a PINNED device-secret mint: the
-// pinned account left this device's session set, so the caller re-establishes
-// the identity session instead of dropping a healthy device credential.
-var OxyServices_deviceBoot_1 = require("./mixins/OxyServices.deviceBoot");
-Object.defineProperty(exports, "AccountNotOnDeviceError", { enumerable: true, get: function () { return OxyServices_deviceBoot_1.AccountNotOnDeviceError; } });
-var refresh_1 = require("./session/refresh");
-Object.defineProperty(exports, "refreshPersistedSession", { enumerable: true, get: function () { return refresh_1.refreshPersistedSession; } });
-Object.defineProperty(exports, "refreshDeviceSecretArm", { enumerable: true, get: function () { return refresh_1.refreshDeviceSecretArm; } });
-Object.defineProperty(exports, "createAuthRefreshHandler", { enumerable: true, get: function () { return refresh_1.createAuthRefreshHandler; } });
-Object.defineProperty(exports, "installAuthRefreshHandler", { enumerable: true, get: function () { return refresh_1.installAuthRefreshHandler; } });
-Object.defineProperty(exports, "startTokenRefreshScheduler", { enumerable: true, get: function () { return refresh_1.startTokenRefreshScheduler; } });
-Object.defineProperty(exports, "TOKEN_REFRESH_LEAD_MS", { enumerable: true, get: function () { return refresh_1.TOKEN_REFRESH_LEAD_MS; } });
-// The inference API. `oxyServices.inference()` binds the session bearer into
-// the same client an external developer constructs with an `oxy_sk_…` machine
-// key — one surface, two credential lanes. See `docs/inference/sdk.md`.
-var OxyInferenceClient_1 = require("./inference/OxyInferenceClient");
-Object.defineProperty(exports, "OxyInferenceClient", { enumerable: true, get: function () { return OxyInferenceClient_1.OxyInferenceClient; } });
-Object.defineProperty(exports, "OxyInferenceError", { enumerable: true, get: function () { return OxyInferenceClient_1.OxyInferenceError; } });
-Object.defineProperty(exports, "OxyInferenceProtocolError", { enumerable: true, get: function () { return OxyInferenceClient_1.OxyInferenceProtocolError; } });
-Object.defineProperty(exports, "OXY_INFERENCE_BASE_URL", { enumerable: true, get: function () { return OxyInferenceClient_1.OXY_INFERENCE_BASE_URL; } });
-var sessionColdBoot_1 = require("./boot/sessionColdBoot");
-Object.defineProperty(exports, "runSessionColdBoot", { enumerable: true, get: function () { return sessionColdBoot_1.runSessionColdBoot; } });
-// API response contracts (request/response Zod schemas + inferred types) live in
-// `@oxy.so/contracts` — the single source of truth shared by the backend and every
-// client SDK. Import them directly from `@oxy.so/contracts`; `@oxy.so/core` does NOT
-// re-export them (no barrel re-exports — clean imports from the owning package).
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
 var version_1 = require("./constants/version");
 Object.defineProperty(exports, "packageInfo", { enumerable: true, get: function () { return version_1.packageInfo; } });
-// ---------------------------------------------------------------------------
-// Default export (back-compat — OxyServices is the most common consumer entry)
-// ---------------------------------------------------------------------------
-const OxyServices_3 = require("./OxyServices");
-exports.default = OxyServices_3.OxyServices;

package/dist/cjs/inference/index.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OxyInferenceProtocolError = exports.OxyInferenceError = exports.OxyInferenceClient = exports.OXY_INFERENCE_BASE_URL = void 0;
+exports.createInferenceClient = createInferenceClient;
+const OxyInferenceClient_1 = require("./OxyInferenceClient");
+var OxyInferenceClient_2 = require("./OxyInferenceClient");
+Object.defineProperty(exports, "OXY_INFERENCE_BASE_URL", { enumerable: true, get: function () { return OxyInferenceClient_2.OXY_INFERENCE_BASE_URL; } });
+Object.defineProperty(exports, "OxyInferenceClient", { enumerable: true, get: function () { return OxyInferenceClient_2.OxyInferenceClient; } });
+Object.defineProperty(exports, "OxyInferenceError", { enumerable: true, get: function () { return OxyInferenceClient_2.OxyInferenceError; } });
+Object.defineProperty(exports, "OxyInferenceProtocolError", { enumerable: true, get: function () { return OxyInferenceClient_2.OxyInferenceProtocolError; } });
+/**
+ * An inference client bound to `oxy`'s session: it calls the same API origin
+ * with the session's current bearer on every request.
+ */
+function createInferenceClient(oxy, options = {}) {
+    return new OxyInferenceClient_1.OxyInferenceClient({
+        ...options,
+        baseURL: oxy.baseURL,
+        credential: () => oxy.session.accessToken,
+    });
+}