@oxy.so/core 1.18.0 → 3.0.0

package/src/mixins/__tests__/OxyServices.serviceAssetMetadata.test.ts

@@ -1,192 +0,0 @@
-/**
- * `getServiceAssetMetadataByIds` mixin tests.
- *
- * Stubs `makeServiceRequest` (the service-token transport used by the route's
- * `serviceAuthMiddleware` + `files:read` scope) so the tests run with no network
- * and no `getServiceToken()` round-trip, then asserts:
- *  - empty / whitespace-only input no-ops to `[]` with no network call;
- *  - input is de-duplicated and a single chunk is sent for <= 100 unique ids,
- *    POSTed to `/assets/service/by-ids` as `{ ids }`;
- *  - the `{ data }` envelope is unwrapped to a bare `ServiceAssetMetadata[]`
- *    (mirroring how `makeServiceRequest<T[]>` returns the inner array);
- *  - inputs > 100 ids are chunked at 100/request and merged;
- *  - a failed chunk THROWS `ServiceAssetMetadataError` naming its ids, so a
- *    throttled request can never be read as "those assets do not exist";
- *  - `{ partial: true }` opts back into best-effort explicitly.
- */
-
-import type { ServiceAssetMetadata } from '../../models/interfaces';
-import { OxyServices } from '../../OxyServices';
-import { ServiceAssetMetadataError } from '../../OxyServices.errors';
-
-const sampleEntry: ServiceAssetMetadata = {
-  id: 'asset-1',
-  sha256: 'a'.repeat(64),
-  mime: 'image/jpeg',
-  size: 12345,
-  status: 'active',
-};
-
-describe('OxyServices.assets — getServiceAssetMetadataByIds', () => {
-  let oxy: OxyServices;
-  let makeServiceRequestSpy: jest.SpyInstance;
-
-  beforeEach(() => {
-    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
-    makeServiceRequestSpy = jest.spyOn(oxy, 'makeServiceRequest');
-  });
-
-  afterEach(() => {
-    jest.restoreAllMocks();
-  });
-
-  it('returns [] and performs no network call for empty / whitespace input', async () => {
-    await expect(oxy.getServiceAssetMetadataByIds([])).resolves.toEqual([]);
-    await expect(oxy.getServiceAssetMetadataByIds(['', '   '])).resolves.toEqual([]);
-    expect(makeServiceRequestSpy).not.toHaveBeenCalled();
-  });
-
-  // The route emits `hlsReadyAt` only for a video whose adaptive ladder finished
-  // transcoding, and this mixin does no field mapping — it returns the parsed
-  // entries as they arrive. That passthrough is the contract Mention's readiness
-  // reconciler reads, so assert it rather than assuming it: a future rewrite that
-  // reshapes entries into a picked subset would drop the field silently, and the
-  // only visible symptom would be adaptive playback never turning on.
-  it('passes an entry\'s hlsReadyAt through untouched', async () => {
-    const readyAt = '2026-09-08T10:11:12.000Z';
-    makeServiceRequestSpy.mockResolvedValueOnce([
-      { ...sampleEntry, mime: 'video/mp4', hlsReadyAt: readyAt },
-    ]);
-
-    const [entry] = await oxy.getServiceAssetMetadataByIds(['asset-1']);
-
-    expect(entry.hlsReadyAt).toBe(readyAt);
-  });
-
-  // An asset with no ladder carries no such field, and "absent" is the signal —
-  // a consumer must be able to tell it apart from a present-but-null value.
-  it('leaves hlsReadyAt absent when the response omits it', async () => {
-    makeServiceRequestSpy.mockResolvedValueOnce([{ ...sampleEntry, mime: 'video/mp4' }]);
-
-    const [entry] = await oxy.getServiceAssetMetadataByIds(['asset-1']);
-
-    expect(entry).not.toHaveProperty('hlsReadyAt');
-  });
-
-  it('de-duplicates and sends a single chunk for <= 100 unique ids', async () => {
-    // makeServiceRequest unwraps the API's `{ data }` envelope, so the resolved
-    // value is the bare array (NOT `{ data: [...] }`) — mirror that real shape.
-    makeServiceRequestSpy.mockResolvedValueOnce([sampleEntry]);
-
-    const result = await oxy.getServiceAssetMetadataByIds([
-      'asset-1',
-      'asset-1', // duplicate
-      '   ', // dropped
-    ]);
-
-    expect(result).toEqual([sampleEntry]);
-    expect(makeServiceRequestSpy).toHaveBeenCalledTimes(1);
-    expect(makeServiceRequestSpy).toHaveBeenCalledWith(
-      'POST',
-      '/assets/service/by-ids',
-      { ids: ['asset-1'] },
-    );
-  });
-
-  it('chunks at 100 ids per request and merges each chunk', async () => {
-    const ids = Array.from({ length: 250 }, (_, i) => `asset-${i}`);
-
-    makeServiceRequestSpy.mockImplementation(
-      async (
-        _method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE',
-        _url: string,
-        data?: { ids: string[] },
-      ): Promise<ServiceAssetMetadata[]> =>
-        (data?.ids ?? []).map((id) => ({
-          id,
-          sha256: 'b'.repeat(64),
-          mime: 'application/octet-stream',
-          size: 1,
-          status: 'active' as const,
-        })),
-    );
-
-    const result = await oxy.getServiceAssetMetadataByIds(ids);
-
-    // 250 unique ids => 100 + 100 + 50 across three POSTs.
-    expect(makeServiceRequestSpy).toHaveBeenCalledTimes(3);
-    const chunkSizes = makeServiceRequestSpy.mock.calls.map(
-      (call) => (call[2] as { ids: string[] }).ids.length,
-    );
-    expect(chunkSizes).toEqual([100, 100, 50]);
-
-    expect(result).toHaveLength(250);
-    expect(result[0]).toEqual({
-      id: 'asset-0',
-      sha256: 'b'.repeat(64),
-      mime: 'application/octet-stream',
-      size: 1,
-      status: 'active',
-    });
-    expect(result[249]?.id).toBe('asset-249');
-  });
-
-  it('THROWS when a chunk fails, so a failed request is never read as absence', async () => {
-    // The load-bearing assertion. The server legitimately omits unknown/deleted
-    // ids, so a short result is normal — which is exactly why a chunk that 429s
-    // must not just contribute nothing. Swallowing it made a throttled request
-    // indistinguishable from "those assets do not exist".
-    const ids = Array.from({ length: 150 }, (_, i) => `asset-${i}`);
-
-    makeServiceRequestSpy
-      .mockResolvedValueOnce([sampleEntry]) // first chunk (100 ids) succeeds
-      .mockRejectedValueOnce(new Error('chunk failed')); // second chunk (50 ids) fails
-
-    await expect(oxy.getServiceAssetMetadataByIds(ids)).rejects.toThrow(ServiceAssetMetadataError);
-    expect(makeServiceRequestSpy).toHaveBeenCalledTimes(2);
-  });
-
-  it('names every id of the failed chunk on the error', async () => {
-    const ids = Array.from({ length: 150 }, (_, i) => `asset-${i}`);
-
-    makeServiceRequestSpy
-      .mockResolvedValueOnce([sampleEntry])
-      .mockRejectedValueOnce(Object.assign(new Error('rate limited'), {
-        response: { status: 429 },
-      }));
-
-    const error = await oxy.getServiceAssetMetadataByIds(ids).catch((e: unknown) => e);
-
-    expect(error).toBeInstanceOf(ServiceAssetMetadataError);
-    const typed = error as ServiceAssetMetadataError;
-    // The whole chunk is unresolved: which of those ids the server would have
-    // omitted anyway is unknowable when the request never landed.
-    expect(typed.unresolvedIds).toHaveLength(50);
-    expect(typed.unresolvedIds).toContain('asset-100');
-    expect(typed.unresolvedIds).not.toContain('asset-0');
-    expect(typed.statuses).toEqual([429]);
-    expect(typed.code).toBe('SERVICE_ASSET_METADATA_UNRESOLVED');
-  });
-
-  it('returns the resolved entries when the caller opts into { partial: true }', async () => {
-    const ids = Array.from({ length: 150 }, (_, i) => `asset-${i}`);
-
-    makeServiceRequestSpy
-      .mockResolvedValueOnce([sampleEntry])
-      .mockRejectedValueOnce(new Error('chunk failed'));
-
-    const result = await oxy.getServiceAssetMetadataByIds(ids, { partial: true });
-
-    expect(makeServiceRequestSpy).toHaveBeenCalledTimes(2);
-    expect(result).toEqual([sampleEntry]);
-  });
-
-  it('does not throw when every chunk succeeds, with or without partial', async () => {
-    makeServiceRequestSpy.mockResolvedValue([sampleEntry]);
-
-    await expect(oxy.getServiceAssetMetadataByIds(['asset-1'])).resolves.toEqual([sampleEntry]);
-    await expect(
-      oxy.getServiceAssetMetadataByIds(['asset-1'], { partial: true }),
-    ).resolves.toEqual([sampleEntry]);
-  });
-});

package/src/mixins/__tests__/OxyServices.serviceAssetMetadataBySha.test.ts

@@ -1,135 +0,0 @@
-/**
- * `getServiceAssetMetadataBySha256` mixin tests (reverse content-address lookup).
- *
- * Stubs `makeServiceRequest` (the service-token transport used by the route's
- * `serviceAuthMiddleware` + `files:read` scope) so the tests run with no network
- * and no `getServiceToken()` round-trip, then asserts:
- *  - empty / whitespace / all-malformed input no-ops to `[]` with no network call;
- *  - hashes are lowercased, hex-validated (malformed dropped), and de-duplicated,
- *    and a single chunk is POSTed to `/assets/service/by-sha256` as `{ sha256s }`;
- *  - the `{ data }` envelope is unwrapped to a bare `ServiceAssetMetadataBySha[]`
- *    (mirroring how `makeServiceRequest<T[]>` returns the inner array), with the
- *    optional `url` preserved for public assets and absent for private ones;
- *  - inputs > 100 hashes are chunked at 100/request and merged;
- *  - a failed chunk is logged and skipped — successful chunks still return.
- */
-
-import type { ServiceAssetMetadataBySha } from '../../models/interfaces';
-import { OxyServices } from '../../OxyServices';
-
-const publicEntry: ServiceAssetMetadataBySha = {
-  sha256: 'a'.repeat(64),
-  id: 'asset-1',
-  mime: 'image/jpeg',
-  size: 12345,
-  status: 'active',
-  url: 'https://cloud.oxy.so/content/2026/06/aa/abc.jpg',
-};
-
-const privateEntry: ServiceAssetMetadataBySha = {
-  sha256: 'b'.repeat(64),
-  id: 'asset-2',
-  mime: 'application/octet-stream',
-  size: 7,
-  status: 'active',
-  // no url — private/unlisted assets stream through the origin
-};
-
-describe('OxyServices.assets — getServiceAssetMetadataBySha256', () => {
-  let oxy: OxyServices;
-  let makeServiceRequestSpy: jest.SpyInstance;
-
-  beforeEach(() => {
-    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
-    makeServiceRequestSpy = jest.spyOn(oxy, 'makeServiceRequest');
-  });
-
-  afterEach(() => {
-    jest.restoreAllMocks();
-  });
-
-  it('returns [] and performs no network call for empty / malformed input', async () => {
-    await expect(oxy.getServiceAssetMetadataBySha256([])).resolves.toEqual([]);
-    // whitespace, wrong length, and non-hex are all dropped → no chunk to send
-    await expect(
-      oxy.getServiceAssetMetadataBySha256(['   ', 'zzz', 'a'.repeat(63), 'a'.repeat(65)]),
-    ).resolves.toEqual([]);
-    expect(makeServiceRequestSpy).not.toHaveBeenCalled();
-  });
-
-  it('lowercases, hex-validates, de-duplicates, and sends a single chunk', async () => {
-    // makeServiceRequest unwraps the API's `{ data }` envelope, so the resolved
-    // value is the bare array (NOT `{ data: [...] }`) — mirror that real shape.
-    makeServiceRequestSpy.mockResolvedValueOnce([publicEntry, privateEntry]);
-
-    const result = await oxy.getServiceAssetMetadataBySha256([
-      'A'.repeat(64), // uppercase → normalized to 'a'*64
-      'a'.repeat(64), // duplicate after lowercasing
-      'B'.repeat(64),
-      'not-hex', // dropped
-      '   ', // dropped
-    ]);
-
-    expect(result).toEqual([publicEntry, privateEntry]);
-    // public asset carries url; private one does not
-    expect(result[0].url).toBe(publicEntry.url);
-    expect(result[1].url).toBeUndefined();
-
-    expect(makeServiceRequestSpy).toHaveBeenCalledTimes(1);
-    expect(makeServiceRequestSpy).toHaveBeenCalledWith(
-      'POST',
-      '/assets/service/by-sha256',
-      { sha256s: ['a'.repeat(64), 'b'.repeat(64)] },
-    );
-  });
-
-  it('chunks at 100 hashes per request and merges each chunk', async () => {
-    // 250 distinct valid hex digests.
-    const shas = Array.from({ length: 250 }, (_, i) =>
-      i.toString(16).padStart(64, '0'),
-    );
-
-    makeServiceRequestSpy.mockImplementation(
-      async (
-        _method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE',
-        _url: string,
-        data?: { sha256s: string[] },
-      ): Promise<ServiceAssetMetadataBySha[]> =>
-        (data?.sha256s ?? []).map((sha) => ({
-          sha256: sha,
-          id: `asset-${sha}`,
-          mime: 'application/octet-stream',
-          size: 1,
-          status: 'active' as const,
-        })),
-    );
-
-    const result = await oxy.getServiceAssetMetadataBySha256(shas);
-
-    // 250 unique hashes => 100 + 100 + 50 across three POSTs.
-    expect(makeServiceRequestSpy).toHaveBeenCalledTimes(3);
-    const chunkSizes = makeServiceRequestSpy.mock.calls.map(
-      (call) => (call[2] as { sha256s: string[] }).sha256s.length,
-    );
-    expect(chunkSizes).toEqual([100, 100, 50]);
-
-    expect(result).toHaveLength(250);
-    expect(result[0].sha256).toBe(shas[0]);
-    expect(result[249].sha256).toBe(shas[249]);
-  });
-
-  it('skips a failed chunk and returns the entries that resolved', async () => {
-    const shas = Array.from({ length: 150 }, (_, i) =>
-      i.toString(16).padStart(64, '0'),
-    );
-
-    makeServiceRequestSpy
-      .mockResolvedValueOnce([publicEntry]) // first chunk (100 hashes) succeeds
-      .mockRejectedValueOnce(new Error('chunk failed')); // second chunk (50) fails
-
-    const result = await oxy.getServiceAssetMetadataBySha256(shas);
-
-    expect(makeServiceRequestSpy).toHaveBeenCalledTimes(2);
-    expect(result).toEqual([publicEntry]);
-  });
-});

package/src/mixins/__tests__/OxyServices.serviceLinkedDownloadUrl.test.ts

@@ -1,139 +0,0 @@
-/**
- * `getServiceLinkedDownloadUrls` mixin tests.
- *
- * Stubs `makeServiceRequest` (the service-token transport the route's
- * `serviceAuthMiddleware` + `files:linked:read` scope require) so these run with
- * no network and no `getServiceToken()` round-trip.
- *
- * The contract worth guarding here is not the transport — the metadata sibling
- * already pins that shape — it is the TWO absences this method has to keep
- * distinguishable, because conflating them misinforms a person who paid money:
- *
- *   - The server OMITS an id it will not mint for, with no way to tell "no such
- *     file" from "not yours". That is a legitimate short result, and the caller
- *     has to map by `id`.
- *   - A FAILED chunk is not that. It throws, with no `{ partial: true }` escape
- *     hatch, because the sibling's best-effort mode would make a 429
- *     indistinguishable from the refusal above.
- */
-
-import type { ServiceLinkedDownloadUrl } from '../../models/interfaces';
-import { OxyServices } from '../../OxyServices';
-import { ServiceLinkedDownloadUrlError } from '../../OxyServices.errors';
-
-const sampleEntry: ServiceLinkedDownloadUrl = {
-  id: 'asset-1',
-  url: 'https://s3.example/private/asset-1.stl?X-Amz-Signature=deadbeef',
-  expiresIn: 300,
-  mime: 'model/stl',
-  size: 4096,
-  sha256: 'a'.repeat(64),
-};
-
-describe('OxyServices.assets — getServiceLinkedDownloadUrls', () => {
-  let oxy: OxyServices;
-  let makeServiceRequestSpy: jest.SpyInstance;
-
-  beforeEach(() => {
-    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
-    makeServiceRequestSpy = jest.spyOn(oxy, 'makeServiceRequest');
-  });
-
-  afterEach(() => {
-    jest.restoreAllMocks();
-  });
-
-  it('returns [] and performs no network call for empty / whitespace input', async () => {
-    await expect(oxy.getServiceLinkedDownloadUrls([])).resolves.toEqual([]);
-    await expect(oxy.getServiceLinkedDownloadUrls(['', '   '])).resolves.toEqual([]);
-    expect(makeServiceRequestSpy).not.toHaveBeenCalled();
-  });
-
-  it('POSTs de-duplicated ids to /assets/service/linked-url as { ids }', async () => {
-    makeServiceRequestSpy.mockResolvedValueOnce([sampleEntry]);
-
-    await oxy.getServiceLinkedDownloadUrls(['asset-1', 'asset-1', '  ']);
-
-    expect(makeServiceRequestSpy).toHaveBeenCalledTimes(1);
-    expect(makeServiceRequestSpy).toHaveBeenCalledWith(
-      'POST',
-      '/assets/service/linked-url',
-      { ids: ['asset-1'] },
-    );
-  });
-
-  it('returns entries untouched, so expiresIn and url reach the caller as sent', async () => {
-    makeServiceRequestSpy.mockResolvedValueOnce([sampleEntry]);
-
-    const [entry] = await oxy.getServiceLinkedDownloadUrls(['asset-1']);
-
-    expect(entry).toEqual(sampleEntry);
-  });
-
-  it('chunks at 25, a QUARTER of the metadata route\'s 100', async () => {
-    // The cap is the route's, and the two routes deliberately differ: this one
-    // mints a credential per id. A client chunking at 100 would 400 every call.
-    const ids = Array.from({ length: 26 }, (_, index) => `asset-${index}`);
-    makeServiceRequestSpy.mockResolvedValue([]);
-
-    await oxy.getServiceLinkedDownloadUrls(ids);
-
-    expect(makeServiceRequestSpy).toHaveBeenCalledTimes(2);
-    const sent = makeServiceRequestSpy.mock.calls.map(
-      (call) => (call[2] as { ids: string[] }).ids.length,
-    );
-    expect(sent.sort((a, b) => b - a)).toEqual([25, 1]);
-  });
-
-  it('accepts a SHORT result without complaint — an omitted id is a refusal', async () => {
-    // The server gives no URL for a file the owner did not link here, and says so
-    // by saying nothing. A method that treated a short result as an error would
-    // make the normal case throw.
-    makeServiceRequestSpy.mockResolvedValueOnce([sampleEntry]);
-
-    const entries = await oxy.getServiceLinkedDownloadUrls(['asset-1', 'asset-refused']);
-
-    expect(entries.map((entry) => entry.id)).toEqual(['asset-1']);
-  });
-
-  it('THROWS on a failed chunk, naming its ids', async () => {
-    const failure = Object.assign(new Error('Too Many Requests'), {
-      response: { status: 429 },
-    });
-    makeServiceRequestSpy.mockRejectedValueOnce(failure);
-
-    await expect(oxy.getServiceLinkedDownloadUrls(['asset-1'])).rejects.toThrow(
-      ServiceLinkedDownloadUrlError,
-    );
-
-    makeServiceRequestSpy.mockRejectedValueOnce(failure);
-    const error = await oxy
-      .getServiceLinkedDownloadUrls(['asset-1'])
-      .catch((caught: unknown) => caught as ServiceLinkedDownloadUrlError);
-
-    expect(error.unresolvedIds).toEqual(['asset-1']);
-    expect(error.statuses).toEqual([429]);
-    expect(error.code).toBe('SERVICE_LINKED_DOWNLOAD_URL_UNRESOLVED');
-  });
-
-  it('throws even when OTHER chunks succeeded — a partial answer is not an answer', async () => {
-    // The inverse of the sibling's `{ partial: true }`. Returning the 25 that
-    // worked and dropping the one that did not is exactly how a buyer is told a
-    // file they own is missing, so there is no option to ask for it.
-    const ids = Array.from({ length: 26 }, (_, index) => `asset-${index}`);
-    makeServiceRequestSpy
-      .mockResolvedValueOnce([sampleEntry])
-      .mockRejectedValueOnce(new Error('boom'));
-
-    await expect(oxy.getServiceLinkedDownloadUrls(ids)).rejects.toThrow(
-      ServiceLinkedDownloadUrlError,
-    );
-  });
-
-  it('has no partial option at all', async () => {
-    // Asserted on the ARITY rather than by passing an option and watching it be
-    // ignored: a future signature that quietly accepted `{ partial: true }` would
-    // restore the behaviour this method exists to refuse.
-    expect(oxy.getServiceLinkedDownloadUrls.length).toBe(1);
-  });
-});

package/src/mixins/__tests__/accountEvents.test.ts

@@ -1,158 +0,0 @@
-import { generateKeyPairSync, sign as signBytes, type KeyObject } from 'node:crypto';
-import { OxyServices } from '../../OxyServices';
-import { OXY_ACCOUNT_DELETED_EVENT_URI, OxyAccountEventError } from '../OxyServices.utility';
-
-const b64url = (value: string | Uint8Array): string => Buffer.from(value).toString('base64url');
-
-function sign(
-  privateKey: KeyObject,
-  header: Record<string, unknown>,
-  payload: Record<string, unknown>,
-): string {
-  const signingInput = `${b64url(JSON.stringify(header))}.${b64url(JSON.stringify(payload))}`;
-  return `${signingInput}.${b64url(signBytes(null, Buffer.from(signingInput), privateKey))}`;
-}
-
-const KID = 'oxy-service-test';
-
-function eventToken(
-  privateKey: KeyObject,
-  overrides: { header?: Record<string, unknown>; payload?: Record<string, unknown>; event?: Record<string, unknown> } = {},
-): string {
-  return sign(
-    privateKey,
-    { alg: 'EdDSA', typ: 'secevent+jwt', kid: KID, ...overrides.header },
-    {
-      iss: 'oxy-auth',
-      aud: 'app-mention',
-      iat: 1_790_000_000,
-      jti: '019a0000-0000-7000-8000-000000000001',
-      events: {
-        [OXY_ACCOUNT_DELETED_EVENT_URI]: {
-          userId: 'user-deleted',
-          username: 'qatest0925',
-          occurredAt: '2026-09-26T09:14:00.000Z',
-          retained: false,
-          ...overrides.event,
-        },
-      },
-      ...overrides.payload,
-    },
-  );
-}
-
-describe('verifyAccountEvent', () => {
-  const oxyKey = generateKeyPairSync('ed25519');
-  const strangerKey = generateKeyPairSync('ed25519');
-  const jwk = { ...oxyKey.publicKey.export({ format: 'jwk' }), use: 'sig', alg: 'EdDSA', kid: KID };
-
-  let fetchSpy: jest.SpyInstance;
-  beforeEach(() => {
-    fetchSpy = jest.spyOn(globalThis, 'fetch').mockImplementation(async () => new Response(
-      JSON.stringify({ keys: [jwk] }),
-      { status: 200, headers: { 'content-type': 'application/json' } },
-    ));
-  });
-  afterEach(() => jest.restoreAllMocks());
-
-  const client = () => new OxyServices({ baseURL: 'https://api.oxy.test' });
-
-  it('returns the event from a genuine Oxy-signed token, verified against the public JWKS', async () => {
-    const event = await client().verifyAccountEvent(eventToken(oxyKey.privateKey), { audience: 'app-mention' });
-
-    expect(event).toEqual({
-      eventId: '019a0000-0000-7000-8000-000000000001',
-      type: 'account.deleted',
-      userId: 'user-deleted',
-      username: 'qatest0925',
-      occurredAt: '2026-09-26T09:14:00.000Z',
-      retained: false,
-      applicationId: 'app-mention',
-      issuedAt: 1_790_000_000,
-    });
-    expect(fetchSpy).toHaveBeenCalledWith(
-      'https://api.oxy.test/.well-known/jwks.json',
-      expect.objectContaining({ method: 'GET', redirect: 'error' }),
-    );
-  });
-
-  it('reads a token without `username` (issued before the field existed) as username null', async () => {
-    const token = eventToken(oxyKey.privateKey, { event: { username: undefined } });
-    const event = await client().verifyAccountEvent(token, { audience: 'app-mention' });
-    expect(event.username).toBeNull();
-  });
-
-  it('carries `retained` through for an archived account', async () => {
-    const token = eventToken(oxyKey.privateKey, { event: { retained: true } });
-    await expect(client().verifyAccountEvent(token, { audience: 'app-mention' }))
-      .resolves.toMatchObject({ retained: true });
-  });
-
-  it('defaults the audience to the appId of the configured service credential', async () => {
-    const oxy = client();
-    const serviceToken = `${b64url(JSON.stringify({ alg: 'EdDSA' }))}.${b64url(JSON.stringify({ appId: 'app-mention' }))}.sig`;
-    jest.spyOn(oxy, 'getServiceToken').mockResolvedValue(serviceToken);
-
-    await expect(oxy.verifyAccountEvent(eventToken(oxyKey.privateKey))).resolves.toMatchObject({
-      applicationId: 'app-mention',
-    });
-    await expect(oxy.verifyAccountEvent(eventToken(oxyKey.privateKey, { payload: { aud: 'app-other' } })))
-      .rejects.toThrow('addressed to another application');
-  });
-
-  const refusals: Array<[string, () => string, string]> = [
-    ['a token signed by a key Oxy did not publish', () => eventToken(strangerKey.privateKey), 'signature is invalid'],
-    ['a service token (typ JWT) replayed as an event', () => eventToken(oxyKey.privateKey, { header: { typ: 'JWT' } }), 'header is not supported'],
-    ['a token for another application', () => eventToken(oxyKey.privateKey, { payload: { aud: 'app-other' } }), 'addressed to another application'],
-    ['a token from another issuer', () => eventToken(oxyKey.privateKey, { payload: { iss: 'someone-else' } }), 'issuer is not Oxy'],
-    ['a token without an event id', () => eventToken(oxyKey.privateKey, { payload: { jti: undefined } }), 'no event id'],
-    ['a token with an unknown event', () => eventToken(oxyKey.privateKey, { payload: { events: { 'https://oxy.so/events/other': {} } } }), 'unknown event'],
-    ['a token naming no account', () => eventToken(oxyKey.privateKey, { event: { userId: '' } }), 'names no account'],
-    ['a token whose username is not a string', () => eventToken(oxyKey.privateKey, { event: { username: 42 } }), 'username is malformed'],
-    ['a token with an unknown key id', () => eventToken(oxyKey.privateKey, { header: { kid: 'rotated-away' } }), 'unknown'],
-  ];
-
-  it.each(refusals)('refuses %s', async (_label, build, message) => {
-    const attempt = client().verifyAccountEvent(build(), { audience: 'app-mention' });
-    await expect(attempt).rejects.toBeInstanceOf(OxyAccountEventError);
-    await expect(client().verifyAccountEvent(build(), { audience: 'app-mention' })).rejects.toThrow(message);
-  });
-
-  it('refuses a tampered payload', async () => {
-    const [header, , signature] = eventToken(oxyKey.privateKey).split('.');
-    const forged = b64url(JSON.stringify({
-      iss: 'oxy-auth',
-      aud: 'app-mention',
-      iat: 1,
-      jti: 'x',
-      events: { [OXY_ACCOUNT_DELETED_EVENT_URI]: { userId: 'someone-else', occurredAt: '2026-09-26T00:00:00Z' } },
-    }));
-    await expect(client().verifyAccountEvent(`${header}.${forged}.${signature}`, { audience: 'app-mention' }))
-      .rejects.toThrow('signature is invalid');
-  });
-
-  it('refuses garbage without fetching keys', async () => {
-    await expect(client().verifyAccountEvent('not-a-token', { audience: 'app-mention' }))
-      .rejects.toThrow('not a compact JWS');
-    expect(fetchSpy).not.toHaveBeenCalled();
-  });
-});
-
-describe('listAccountEvents', () => {
-  afterEach(() => jest.restoreAllMocks());
-
-  it('reads the pull feed with the service token and passes the cursor', async () => {
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.test' });
-    jest.spyOn(oxy, 'getServiceToken').mockResolvedValue('service-token');
-    const page = { events: [], nextCursor: 'cursor-1' };
-    const request = jest.spyOn(oxy, 'makeRequest').mockResolvedValue(page as never);
-
-    await expect(oxy.listAccountEvents({ after: 'cursor-1', limit: 50 })).resolves.toEqual(page);
-    expect(request).toHaveBeenCalledWith(
-      'GET',
-      '/account-events',
-      { after: 'cursor-1', limit: '50' },
-      expect.objectContaining({ cache: false, headers: { Authorization: 'Bearer service-token' } }),
-    );
-  });
-});