@oxy.so/core 1.18.0 → 3.0.0

package/dist/cjs/utils/authHelpers.js

@@ -38,13 +38,13 @@ exports.AuthenticationFailedError = AuthenticationFailedError;
  * @throws {SessionSyncRequiredError} If the session needs to be synced (offline session)
  */
 async function ensureValidToken(oxyServices, _activeSessionId, syncSession) {
-    if (oxyServices.hasValidToken()) {
+    if (oxyServices.session.isAuthenticated) {
         return;
     }
     if (syncSession) {
         try {
             await syncSession();
-            if (oxyServices.hasValidToken()) {
+            if (oxyServices.session.isAuthenticated) {
                 return;
             }
         }

package/dist/cjs/utils/authWebUrl.js

@@ -18,9 +18,8 @@ exports.AUTH_WEB_ORIGIN = exports.CENTRAL_IDP_APEX = void 0;
  */
 exports.CENTRAL_IDP_APEX = 'oxy.so';
 /**
- * The IdP's origin, `auth.oxy.so` — the OAuth authorize/consent surface and the
- * one origin that asserts Oxy passkeys: where a person signs in, creates,
- * recovers or deletes a web account, in the window an app opens (ADR 0029).
- * Apps open it; they never run the passkey themselves.
+ * The IdP's origin, `auth.oxy.so` — the OAuth authorize/consent surface for
+ * third parties, the browser bridge (ADR 0029 D2) and the page an email
+ * sign-in link opens. Official apps sign in inside their own dialog (ADR 0030).
  */
 exports.AUTH_WEB_ORIGIN = `https://auth.${exports.CENTRAL_IDP_APEX}`;

package/dist/cjs/utils/avatarUtils.js

@@ -7,7 +7,7 @@ const logger_1 = require("../logger");
  * Logs non-404 errors to help debug upload issues.
  *
  * @param fileId - The file ID to update visibility for
- * @param oxyServices - OxyServices instance (or any object with assetUpdateVisibility)
+ * @param oxyServices - An OxyServices client
  * @param contextName - Context name for error logging
  */
 async function updateAvatarVisibility(fileId, oxyServices, contextName = 'AvatarUtils') {
@@ -15,7 +15,7 @@ async function updateAvatarVisibility(fileId, oxyServices, contextName = 'Avatar
         return;
     }
     try {
-        await oxyServices.assetUpdateVisibility(fileId, 'public');
+        await oxyServices.assets.setVisibility(fileId, 'public');
     }
     catch (visError) {
         // 404 is expected when asset doesn't exist yet — skip logging

package/dist/cjs/utils/cache.js

@@ -41,12 +41,15 @@ class TTLCache {
     /**
      * Create a new TTL cache
      * @param defaultTTL Default TTL in milliseconds (default: 5 minutes)
+     * @param maxEntries Bound on live entries; the least recently used is evicted
+     *   past it (default: 1000)
      */
-    constructor(defaultTTL = 5 * 60 * 1000) {
+    constructor(defaultTTL = 5 * 60 * 1000, maxEntries = 1000) {
         this.cache = new Map();
         this.hits = 0;
         this.misses = 0;
         this.defaultTTL = defaultTTL;
+        this.maxEntries = maxEntries;
     }
     /**
      * Get a value from cache
@@ -65,6 +68,9 @@ class TTLCache {
             this.misses++;
             return null;
         }
+        // Re-insert so Map order is recency order and eviction drops the LRU.
+        this.cache.delete(key);
+        this.cache.set(key, entry);
         this.hits++;
         return entry.data;
     }
@@ -84,7 +90,13 @@ class TTLCache {
         // both into the default, making `cacheTTL:0` impossible to honor.
         const effectiveTTL = ttl === undefined ? this.defaultTTL : ttl;
         const expiresAt = now + effectiveTTL;
+        this.cache.delete(key);
         this.cache.set(key, { data, timestamp: now, expiresAt });
+        if (this.cache.size > this.maxEntries) {
+            const oldest = this.cache.keys().next().value;
+            if (oldest !== undefined)
+                this.cache.delete(oldest);
+        }
         if (!cleanupInterval && activeCaches.has(this))
             updateCleanupInterval();
     }
@@ -95,7 +107,9 @@ class TTLCache {
      */
     delete(key) {
         const deleted = this.cache.delete(key);
-        if (activeCaches.has(this))
+        // Only the delete that EMPTIES this cache can let the timer stop; checking
+        // on every delete made bulk invalidation O(deletes x caches).
+        if (deleted && this.cache.size === 0 && activeCaches.has(this))
             updateCleanupInterval();
         return deleted;
     }
@@ -109,6 +123,22 @@ class TTLCache {
         if (activeCaches.has(this))
             updateCleanupInterval();
     }
+    /**
+     * Delete every entry whose key matches, in ONE pass.
+     * @returns Number of entries deleted
+     */
+    deleteWhere(match) {
+        let removed = 0;
+        for (const key of this.cache.keys()) {
+            if (match(key)) {
+                this.cache.delete(key);
+                removed++;
+            }
+        }
+        if (removed > 0 && this.cache.size === 0 && activeCaches.has(this))
+            updateCleanupInterval();
+        return removed;
+    }
     /**
      * Check if a key exists and is not expired
      * @param key Cache key

package/dist/cjs/utils/cacheKey.js

@@ -11,7 +11,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ANON_IDENTITY = void 0;
 exports.fnv1a32 = fnv1a32;
 exports.computeIdentityTag = computeIdentityTag;
-const jwt_decode_1 = require("jwt-decode");
+const tokenClaims_1 = require("./tokenClaims");
 /**
  * Discriminator used when there is no access token at all. Anonymous responses
  * must never collide with any authenticated identity.
@@ -73,13 +73,8 @@ function computeIdentityTag(accessToken) {
     if (!accessToken) {
         return exports.ANON_IDENTITY;
     }
-    try {
-        const decoded = (0, jwt_decode_1.jwtDecode)(accessToken);
-        return decoded.userId || decoded.id || `t${fnv1a32(accessToken)}`;
-    }
-    catch {
-        // Undecodable token — still partition it away from anon and from other
-        // tokens via a hash. Never silently fall back to ANON_IDENTITY.
-        return `t${fnv1a32(accessToken)}`;
-    }
+    const decoded = (0, tokenClaims_1.decodeTokenClaims)(accessToken);
+    // An undecodable token is still partitioned away from anon and from other
+    // tokens via a hash — never silently ANON_IDENTITY.
+    return decoded?.userId || decoded?.id || `t${fnv1a32(accessToken)}`;
 }

package/dist/cjs/utils/deviceManager.js

@@ -8,6 +8,7 @@ const log = (0, logger_1.createLogger)('DeviceManager');
  * Client-side device management utility
  * Handles persistent device identification across app sessions
  */
+// biome-ignore lint/complexity/noStaticOnlyClass: a public, static-only API surface (`X.method()`) that consumers and tests call and spy on by name.
 class DeviceManager {
     /**
      * Check if we're in React Native environment
@@ -19,7 +20,7 @@ class DeviceManager {
      * Get appropriate storage for the platform
      */
     static async getStorage() {
-        if (this.isReactNative()) {
+        if (DeviceManager.isReactNative()) {
             try {
                 // `loadAsyncStorage` is per-platform: the RN variant statically imports
                 // @react-native-async-storage/async-storage, the default variant throws
@@ -71,21 +72,21 @@ class DeviceManager {
      */
     static async getDeviceInfo() {
         try {
-            const storage = await this.getStorage();
-            const stored = await storage.getItem(this.DEVICE_KEY);
+            const storage = await DeviceManager.getStorage();
+            const stored = await storage.getItem(DeviceManager.DEVICE_KEY);
             if (stored) {
                 const deviceInfo = JSON.parse(stored);
                 // Update last used timestamp
                 deviceInfo.lastUsed = new Date().toISOString();
-                await this.saveDeviceInfo(deviceInfo);
+                await DeviceManager.saveDeviceInfo(deviceInfo);
                 return deviceInfo;
             }
             // Create new device info
-            return await this.createNewDeviceInfo();
+            return await DeviceManager.createNewDeviceInfo();
         }
         catch (error) {
             log.error('Error getting device info', error);
-            return await this.createNewDeviceInfo();
+            return await DeviceManager.createNewDeviceInfo();
         }
     }
     /**
@@ -93,12 +94,12 @@ class DeviceManager {
      */
     static async createNewDeviceInfo() {
         const deviceInfo = {
-            deviceId: this.generateDeviceId(),
-            fingerprint: JSON.stringify(this.getDeviceFingerprint()),
+            deviceId: DeviceManager.generateDeviceId(),
+            fingerprint: JSON.stringify(DeviceManager.getDeviceFingerprint()),
             createdAt: new Date().toISOString(),
             lastUsed: new Date().toISOString()
         };
-        await this.saveDeviceInfo(deviceInfo);
+        await DeviceManager.saveDeviceInfo(deviceInfo);
         return deviceInfo;
     }
     /**
@@ -106,8 +107,8 @@ class DeviceManager {
      */
     static async saveDeviceInfo(deviceInfo) {
         try {
-            const storage = await this.getStorage();
-            await storage.setItem(this.DEVICE_KEY, JSON.stringify(deviceInfo));
+            const storage = await DeviceManager.getStorage();
+            await storage.setItem(DeviceManager.DEVICE_KEY, JSON.stringify(deviceInfo));
         }
         catch (error) {
             log.error('Error saving device info', error);
@@ -118,9 +119,9 @@ class DeviceManager {
      */
     static async updateDeviceName(deviceName) {
         try {
-            const deviceInfo = await this.getDeviceInfo();
+            const deviceInfo = await DeviceManager.getDeviceInfo();
             deviceInfo.deviceName = deviceName;
-            await this.saveDeviceInfo(deviceInfo);
+            await DeviceManager.saveDeviceInfo(deviceInfo);
         }
         catch (error) {
             log.error('Error updating device name', error);
@@ -131,8 +132,8 @@ class DeviceManager {
      */
     static async clearDeviceInfo() {
         try {
-            const storage = await this.getStorage();
-            await storage.removeItem(this.DEVICE_KEY);
+            const storage = await DeviceManager.getStorage();
+            await storage.removeItem(DeviceManager.DEVICE_KEY);
         }
         catch (error) {
             log.error('Error clearing device info', error);
@@ -153,7 +154,7 @@ class DeviceManager {
      * Get a user-friendly device name based on platform
      */
     static getDefaultDeviceName() {
-        const fingerprint = this.getDeviceFingerprint();
+        const fingerprint = DeviceManager.getDeviceFingerprint();
         const platform = (fingerprint.platform || '').toLowerCase();
         if (platform.includes('win'))
             return 'Windows Computer';

package/dist/cjs/utils/edgeRegion.js

@@ -1,6 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getBrowserEdgeRegionHeader = void 0;
-/** @deprecated Import from `@oxy.so/telemetry/browser` in new code. */
+exports.peekBrowserEdgeRegionHeader = void 0;
 var browser_1 = require("@oxy.so/telemetry/browser");
-Object.defineProperty(exports, "getBrowserEdgeRegionHeader", { enumerable: true, get: function () { return browser_1.getBrowserEdgeRegionHeader; } });
+Object.defineProperty(exports, "peekBrowserEdgeRegionHeader", { enumerable: true, get: function () { return browser_1.peekBrowserEdgeRegionHeader; } });

package/dist/cjs/utils/identityCacheSweep.js

@@ -48,7 +48,7 @@
  * refetch; under-eviction serves wrong data.
  *
  * Platform-neutral by construction (no imports, no `OxyServices` reference) so
- * the client mixins and the Node-only `@oxy.so/core/server` invalidation
+ * the client namespaces and the Node-only `@oxy.so/core/server` invalidation
  * subscriber can share it without either pulling in the other.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
@@ -64,8 +64,6 @@ exports.OXY_IDENTITY_CACHE_PREFIXES = [
     'GET:/session/user/',
     // `getCurrentUser` (and `GET:/users/me/graph`, harmlessly included).
     'GET:/users/me',
-    // `lookupUsername` — the pre-session login lookup; carries avatar + display name.
-    'GET:/auth/lookup/',
     // `getProfileByUsername` — keyed by handle, including the pre-rename handle.
     'GET:/profiles/username/',
     // `resolveProfile` — keyed by fediverse handle in the query payload.
@@ -87,11 +85,9 @@ function oxyUserByIdCacheKey(userId) {
  *                 that does not know the id still clears every handle-, session-
  *                 and self-keyed entry, which is the majority of the surface.
  */
-function evictOxyIdentityCache(oxy, userId) {
-    for (const prefix of exports.OXY_IDENTITY_CACHE_PREFIXES) {
-        oxy.clearCacheByPrefix(prefix);
-    }
-    if (userId) {
-        oxy.clearCacheEntry(oxyUserByIdCacheKey(userId));
-    }
+function evictOxyIdentityCache(http, userId) {
+    http.invalidateCache({
+        prefixes: exports.OXY_IDENTITY_CACHE_PREFIXES,
+        keys: userId ? [oxyUserByIdCacheKey(userId)] : [],
+    });
 }

package/dist/cjs/utils/oxyServiceEnvironment.js

@@ -8,12 +8,8 @@ exports.OXY_SERVICE_ENVIRONMENTS = void 0;
  * literal union — `@oxy.so/core` has zero dependency on `@oxy.so/api`, so this is
  * kept in sync by hand, not by import.
  *
- * Defined here (not in `server/auth.ts` or `mixins/OxyServices.utility.ts`
- * directly) because BOTH of those files need it and neither may import from
- * the other: `server/` types import `express` (Node-only, a peer dependency
- * `mixins/` deliberately avoids so it stays safe to bundle into RN/browser
- * consumers — see the "Local request/response/socket typing" comment in
- * `OxyServices.utility.ts`). This file has zero imports, so both sides can
- * depend on it without crossing that boundary.
+ * Defined here, with zero imports, so the server middleware and any
+ * client-safe code can both depend on it without the client reaching the
+ * Node-only `server/` modules.
  */
 exports.OXY_SERVICE_ENVIRONMENTS = ['development', 'staging', 'production'];

package/dist/cjs/utils/requestUtils.js

@@ -29,74 +29,81 @@ function abortReason(signal) {
 /**
  * Request deduplication - prevents duplicate concurrent requests
  *
- * When multiple requests with the same key are made simultaneously,
- * only one request is executed and all callers receive the same result.
+ * When multiple requests with the same key are made simultaneously, only one
+ * request is executed and all callers receive the same result.
+ *
+ * The shared work runs in its OWN abort domain, not the first caller's: each
+ * caller owns its cancellation, and the shared work is aborted only once every
+ * caller waiting on it has cancelled. Binding it to the first caller's signal
+ * meant one cancelled caller failed every other caller on the same key.
  *
  * @example
  * ```typescript
  * const deduplicator = new RequestDeduplicator();
  *
- * // Multiple calls with same key will share the same promise
- * const promise1 = deduplicator.deduplicate('user-123', () => fetchUser('123'));
- * const promise2 = deduplicator.deduplicate('user-123', () => fetchUser('123'));
- * // promise1 === promise2, only one API call is made
+ * // Multiple calls with same key share one in-flight call
+ * const promise1 = deduplicator.deduplicate('user-123', (signal) => fetchUser('123', signal));
+ * const promise2 = deduplicator.deduplicate('user-123', (signal) => fetchUser('123', signal));
  * ```
  */
 class RequestDeduplicator {
     constructor() {
-        this.pendingRequests = new Map();
+        this.pending = new Map();
     }
     /**
      * Deduplicate a request by key
      * @param key Unique key for the request
-     * @param requestFn Function that returns a promise
-     * @returns Promise that will be shared if key already exists
+     * @param requestFn Runs the work; its signal aborts once every caller has cancelled
+     * @param signal This caller's cancellation
      */
     async deduplicate(key, requestFn, signal) {
         if (signal?.aborted) {
             throw abortReason(signal);
         }
-        let promise = this.pendingRequests.get(key);
-        if (!promise) {
-            promise = requestFn().finally(() => {
-                this.pendingRequests.delete(key);
+        let entry = this.pending.get(key);
+        if (!entry) {
+            const controller = new AbortController();
+            const promise = requestFn(controller.signal).finally(() => {
+                if (this.pending.get(key) === entry)
+                    this.pending.delete(key);
             });
-            this.pendingRequests.set(key, promise);
+            // Ownership stays with the callers awaiting it; this only stops a
+            // rejection nobody is left to observe from surfacing as unhandled.
+            promise.catch(() => { });
+            entry = { promise, controller, waiters: 0 };
+            this.pending.set(key, entry);
         }
-        // Callers SHARE the work but own their cancellation separately.
-        //
-        // Returning the shared promise directly meant one caller's abort rejected
-        // every other caller on the same key — including ones that never cancelled
-        // anything, and which had no way to tell that the failure was not theirs.
-        // Racing each caller's own signal against the shared work keeps the single
-        // in-flight request (the point of deduplication) while making cancellation
-        // per-caller. The shared promise is left running: another caller may still
-        // want it, and if nobody does its own abort domain ends it.
+        const shared = entry;
+        shared.waiters++;
         if (!signal) {
-            return promise;
+            return shared.promise;
         }
-        // `promise` is already owned by the map's `finally`, so attach a no-op
-        // catch to the copy we race: without it, a rejection settled by the race's
-        // loser surfaces as an unhandled rejection.
-        const shared = promise;
-        shared.catch(() => { });
         return new Promise((resolve, reject) => {
-            const onAbort = () => reject(abortReason(signal));
+            const onAbort = () => {
+                shared.waiters--;
+                if (shared.waiters === 0) {
+                    // Nobody wants the result any more: free the key and end the work.
+                    if (this.pending.get(key) === shared)
+                        this.pending.delete(key);
+                    shared.controller.abort();
+                }
+                reject(abortReason(signal));
+            };
             signal.addEventListener('abort', onAbort, { once: true });
-            shared.then((value) => { signal.removeEventListener('abort', onAbort); resolve(value); }, (error) => { signal.removeEventListener('abort', onAbort); reject(error); });
+            shared.promise.then((value) => { signal.removeEventListener('abort', onAbort); resolve(value); }, (error) => { signal.removeEventListener('abort', onAbort); reject(error); });
         });
     }
     /**
      * Clear all pending requests
      */
     clear() {
-        this.pendingRequests.clear();
+        this.pending.clear();
     }
     /**
      * Get number of pending requests
      */
     size() {
-        return this.pendingRequests.size;
+        return this.pending.size;
     }
 }
 exports.RequestDeduplicator = RequestDeduplicator;

package/dist/cjs/utils/sessionUtils.js

@@ -93,8 +93,6 @@ function deduplicateSessionsByUserId(sessions, activeSessionId) {
                 userSessionMap.set(session.userId, session);
             }
             else if (!isCurrentActive && isExistingActive) {
-                // Keep existing (active) session
-                continue;
             }
             else {
                 // Neither is active, keep the one with more recent lastActive

package/dist/cjs/utils/tokenClaims.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeTokenClaims = decodeTokenClaims;
+/**
+ * Decoded access-token claims, memoised per token string.
+ *
+ * Every request used to decode the same JWT several times (the auth preflight,
+ * the cache key, the dedupe key, the expiry checks). A token is immutable, so
+ * its claims are decoded once and reused until a new token replaces it. The
+ * memo holds a handful of recent tokens (a client, its linked clients, a
+ * rotation in flight) and never the payload of a token no longer in use.
+ */
+const jwt_decode_1 = require("jwt-decode");
+const MEMO_SIZE = 4;
+const memo = new Map();
+/** The token's claims, or `null` for an opaque/undecodable token. */
+function decodeTokenClaims(token) {
+    if (memo.has(token))
+        return memo.get(token) ?? null;
+    let claims;
+    try {
+        claims = (0, jwt_decode_1.jwtDecode)(token);
+    }
+    catch {
+        claims = null;
+    }
+    memo.set(token, claims);
+    if (memo.size > MEMO_SIZE) {
+        const oldest = memo.keys().next().value;
+        if (oldest !== undefined)
+            memo.delete(oldest);
+    }
+    return claims;
+}