@oxy.so/core 1.18.0 → 3.0.0

package/dist/cjs/api/store.js

@@ -0,0 +1,199 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StoreApi = exports.StoreListingApi = exports.ListingScreenshotsApi = exports.StoreReviewsApi = void 0;
+const SHORT_TTL = 60 * 1000;
+const MEDIUM_TTL = 2 * 60 * 1000;
+const enc = encodeURIComponent;
+/** Read one page out of that envelope. */
+function pageOf(res) {
+    return {
+        items: res.data ?? [],
+        total: res.pagination?.total ?? 0,
+        hasMore: res.pagination?.hasMore ?? false,
+    };
+}
+/**
+ * Build a query string from the options that were actually supplied.
+ *
+ * Generic over the options object rather than taking a `Record`: an interface
+ * has no implicit index signature in TypeScript, so `StoreReviewsOptions` would
+ * not be assignable to one and every call site would need a cast.
+ */
+function queryOf(params) {
+    const search = new URLSearchParams();
+    for (const [key, value] of Object.entries(params)) {
+        if (value !== undefined)
+            search.set(key, String(value));
+    }
+    const rendered = search.toString();
+    return rendered ? `?${rendered}` : '';
+}
+/** `oxy.store.reviews` — what people say about an app, and the caller's own review. */
+class StoreReviewsApi {
+    constructor(ctx) {
+        this.ctx = ctx;
+    }
+    /** Visible reviews for a published app, each with the publisher's reply. */
+    async list(slug, options = {}) {
+        const res = await this.ctx.request('GET', `/store/apps/${enc(slug)}/reviews${queryOf(options)}`, undefined, { cache: true, cacheTTL: SHORT_TTL });
+        return pageOf(res);
+    }
+    /** The caller's own review of an app, or `null` if they have not written one. */
+    async mine(slug) {
+        const res = await this.ctx.request('GET', reviewPath(slug), undefined, {
+            cache: false,
+        });
+        return res.data ?? null;
+    }
+    /**
+     * Write the caller's review, or replace what they said before.
+     *
+     * A person has one review per app, so this sets it rather than adding one.
+     * Rewriting does not clear a moderator's decision: a hidden review stays
+     * hidden when its author edits it.
+     */
+    async write(slug, input) {
+        const res = await this.ctx.request('PUT', reviewPath(slug), input, { cache: false });
+        return res.data;
+    }
+    /** Withdraw the caller's own review. A real delete — the words were theirs. */
+    async deleteMine(slug) {
+        await this.ctx.request('DELETE', reviewPath(slug), undefined, { cache: false });
+    }
+}
+exports.StoreReviewsApi = StoreReviewsApi;
+/** `oxy.store.listing.screenshots` — the pictures on a listing. */
+class ListingScreenshotsApi {
+    constructor(ctx) {
+        this.ctx = ctx;
+    }
+    /** Every picture on the listing, in the author's order. */
+    async list(applicationId) {
+        return this.ctx.request('GET', screenshotsPath(applicationId), undefined, { cache: false });
+    }
+    /**
+     * Attach an already-uploaded image, appended to the end.
+     *
+     * Upload through `oxy.assets` first; the store keeps a reference rather than
+     * a second copy of the asset pipeline. The file must be live, an image, and
+     * one the caller is entitled to.
+     */
+    async add(applicationId, input) {
+        return this.ctx.request('POST', screenshotsPath(applicationId), input, { cache: false });
+    }
+    /** Edit a picture's caption or the frame it was taken in. Order is `reorder`. */
+    async update(applicationId, screenshotId, input) {
+        return this.ctx.request('PATCH', `${screenshotsPath(applicationId)}/${enc(screenshotId)}`, input, { cache: false });
+    }
+    /** Remove a picture. The uploaded file stays — it may be in use elsewhere. */
+    async delete(applicationId, screenshotId) {
+        await this.ctx.request('DELETE', `${screenshotsPath(applicationId)}/${enc(screenshotId)}`, undefined, {
+            cache: false,
+        });
+    }
+    /**
+     * Set the order of every picture at once.
+     *
+     * Send EVERY id on the listing, exactly once, in the order they should
+     * appear. A partial list is rejected rather than applied: it would leave the
+     * pictures it omits at their old positions, interleaved with the new ones.
+     */
+    async reorder(applicationId, screenshotIds) {
+        return this.ctx.request('PUT', `${screenshotsPath(applicationId)}/order`, { screenshotIds }, {
+            cache: false,
+        });
+    }
+}
+exports.ListingScreenshotsApi = ListingScreenshotsApi;
+/** `oxy.store.listing` — the page a publisher edits for an application they own. */
+class StoreListingApi {
+    constructor(ctx) {
+        this.ctx = ctx;
+        this.screenshots = new ListingScreenshotsApi(ctx);
+    }
+    /** The application's store page in whatever state, or `null` if it has none. */
+    async get(applicationId) {
+        return this.ctx.request('GET', listingPath(applicationId), undefined, { cache: false });
+    }
+    /**
+     * Create the page or replace its content. Never its status.
+     *
+     * Editing does not move a page: correcting a typo on a live listing leaves
+     * it live, and fixing a rejected one does not re-submit it.
+     */
+    async write(applicationId, input) {
+        return this.ctx.request('PUT', listingPath(applicationId), input, { cache: false });
+    }
+    /** Hand the page to the store for review. From a draft, or a rejected page once fixed. */
+    async submit(applicationId) {
+        return this.ctx.request('POST', `${listingPath(applicationId)}/submit`, undefined, {
+            cache: false,
+        });
+    }
+    /**
+     * Take the page down, or withdraw it from the queue.
+     *
+     * Back to a draft, never deleted: the slug, the words and the screenshots are
+     * the publisher's work, and the reviews were never the listing's to take with
+     * them.
+     */
+    async unpublish(applicationId) {
+        return this.ctx.request('POST', `${listingPath(applicationId)}/unpublish`, undefined, {
+            cache: false,
+        });
+    }
+}
+exports.StoreListingApi = StoreListingApi;
+class StoreApi {
+    constructor(ctx) {
+        this.ctx = ctx;
+        this.reviews = new StoreReviewsApi(ctx);
+        this.listing = new StoreListingApi(ctx);
+    }
+    // The storefront is public: everything served here needs no session.
+    /** The shelves, in the order the store curates them. */
+    async categories() {
+        const res = await this.ctx.request('GET', '/store/categories', undefined, {
+            cache: true,
+            cacheTTL: MEDIUM_TTL,
+        });
+        return res.data ?? [];
+    }
+    /**
+     * Published listings, newest first, optionally one shelf.
+     *
+     * An unknown category slug is an EMPTY shelf, not every app on the store —
+     * so a typo shows nothing rather than showing everything.
+     *
+     * @param options - `category` is a category slug; `limit` defaults to 24.
+     */
+    async apps(options = {}) {
+        const res = await this.ctx.request('GET', `/store/apps${queryOf(options)}`, undefined, { cache: true, cacheTTL: SHORT_TTL });
+        return pageOf(res);
+    }
+    /**
+     * One store page.
+     *
+     * A draft answers 404 exactly as an unknown slug does: whether an unpublished
+     * page exists under a name is not something a visitor learns.
+     *
+     * @param slug - The listing's public slug, not an application id.
+     */
+    async app(slug) {
+        const res = await this.ctx.request('GET', `/store/apps/${enc(slug)}`, undefined, {
+            cache: true,
+            cacheTTL: SHORT_TTL,
+        });
+        return res.data;
+    }
+}
+exports.StoreApi = StoreApi;
+function reviewPath(slug) {
+    return `/store/apps/${enc(slug)}/review`;
+}
+function listingPath(applicationId) {
+    return `/applications/${enc(applicationId)}/listing`;
+}
+function screenshotsPath(applicationId) {
+    return `${listingPath(applicationId)}/screenshots`;
+}

package/dist/cjs/api/topics.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TopicsApi = void 0;
+const SHORT = 60 * 1000;
+const LONG = 5 * 60 * 1000;
+const EXTRA_LONG = 30 * 60 * 1000;
+class TopicsApi {
+    constructor(ctx) {
+        this.ctx = ctx;
+    }
+    /** Topics, filtered and paginated; returns the page with `total`/`limit`/`offset`. */
+    async list(options = {}) {
+        const params = {};
+        if (options.type)
+            params.type = options.type;
+        if (options.q)
+            params.q = options.q;
+        if (options.limit)
+            params.limit = options.limit;
+        if (options.offset)
+            params.offset = options.offset;
+        if (options.locale)
+            params.locale = options.locale;
+        const res = await this.ctx.request('GET', '/topics', params, {
+            cache: true,
+            cacheTTL: SHORT,
+        });
+        return {
+            topics: res.topics ?? [],
+            total: res.total ?? res.topics?.length ?? 0,
+            limit: res.limit ?? options.limit ?? 0,
+            offset: res.offset ?? options.offset ?? 0,
+        };
+    }
+    /** Topics matching `query`. Never cached. */
+    async search(query, limit) {
+        const params = { q: query };
+        if (limit)
+            params.limit = limit;
+        const res = await this.ctx.request('GET', '/topics/search', params, { cache: false });
+        return res.topics ?? [];
+    }
+    /** One topic by slug. */
+    async get(slug) {
+        return this.ctx.request('GET', `/topics/${slug}`, undefined, { cache: true, cacheTTL: LONG });
+    }
+    /** The top-level categories, optionally translated. */
+    async categories(locale) {
+        const res = await this.ctx.request('GET', '/topics/categories', locale ? { locale } : {}, { cache: true, cacheTTL: EXTRA_LONG });
+        return res.categories ?? [];
+    }
+    /** Resolve names to topics, creating the missing ones. Staff or service only. */
+    async resolveNames(names) {
+        const res = await this.ctx.request('POST', '/topics/resolve', { names }, {
+            cache: false,
+        });
+        return Object.values(res.topics ?? {});
+    }
+    /** Update a topic's description and translations. Staff or service only. */
+    async update(slug, data) {
+        const topic = await this.ctx.request('PATCH', `/topics/${slug}`, data, { cache: false });
+        this.ctx.oxy.cache.delete(`GET:/topics/${slug}`);
+        return topic;
+    }
+}
+exports.TopicsApi = TopicsApi;

package/dist/cjs/api/users.js

@@ -0,0 +1,309 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UsersApi = void 0;
+const contracts_1 = require("@oxy.so/contracts");
+const apiUtils_1 = require("../utils/apiUtils");
+const userIdentity_1 = require("../utils/userIdentity");
+const identityCacheSweep_1 = require("../utils/identityCacheSweep");
+const accountCacheSweep_1 = require("../utils/accountCacheSweep");
+const errorUtils_1 = require("../utils/errorUtils");
+const logger_1 = require("../logger");
+const PROFILE_TTL = 5 * 60 * 1000;
+const SESSION_USER_TTL = 2 * 60 * 1000;
+const ME_TTL = 60 * 1000;
+const SEARCH_TTL = 2 * 60 * 1000;
+/**
+ * Maximum number of ids sent per `POST /users/by-ids` request. Matches the
+ * server-side batch cap; larger inputs are split into chunked calls.
+ */
+const USERS_BY_IDS_CHUNK_SIZE = 100;
+class UsersApi {
+    constructor(ctx) {
+        this.ctx = ctx;
+    }
+    // ── Reads ────────────────────────────────────────────────────────────────
+    /**
+     * A user by id. Cached 5 minutes; pass `{ cache: false }` for a
+     * registry-fresh read that neither serves nor overwrites a cached entry.
+     */
+    async get(userId, options) {
+        const user = await this.ctx.request('GET', `/users/${userId}`, undefined, {
+            cache: options?.cache ?? true,
+            cacheTTL: PROFILE_TTL,
+        });
+        return (0, userIdentity_1.normalizeUserIdentity)(user);
+    }
+    /**
+     * Many users by id, one round-trip per chunk of 100 — for hydration call
+     * sites that would otherwise issue one `get` per author.
+     *
+     * Ids are deduplicated and blank ids dropped; the result is unordered (map
+     * by `id`). `/users/by-ids` accepts a service token, a user session or an
+     * anonymous caller and returns the same public payload in every case: on a
+     * server that can mint a service token (`OxyServer`) the chunks go over the
+     * service lane — an anonymous call from a backend is charged to its shared
+     * NAT address's per-IP budget — and everywhere else over the user bearer.
+     *
+     * Chunks are independent: a failed chunk is logged and skipped. Not cached.
+     */
+    async getMany(ids) {
+        const uniqueIds = Array.from(new Set(ids.filter((id) => typeof id === 'string' && id.trim().length > 0)));
+        if (uniqueIds.length === 0)
+            return [];
+        const chunks = [];
+        for (let i = 0; i < uniqueIds.length; i += USERS_BY_IDS_CHUNK_SIZE) {
+            chunks.push(uniqueIds.slice(i, i + USERS_BY_IDS_CHUNK_SIZE));
+        }
+        const service = this.ctx.service?.available ? this.ctx.service : null;
+        const settled = await Promise.all(chunks.map(async (chunk) => {
+            try {
+                const users = service
+                    ? await service.request('POST', '/users/by-ids', { ids: chunk })
+                    : await this.ctx.request('POST', '/users/by-ids', { ids: chunk }, { cache: false });
+                return Array.isArray(users) ? users.map((user) => (0, userIdentity_1.normalizeUserIdentity)(user)) : [];
+            }
+            catch (error) {
+                logger_1.logger.warn('users.getMany: chunk failed, continuing with remaining chunks', {
+                    method: 'users.getMany',
+                    mode: service ? 'service' : 'user',
+                    chunkSize: chunk.length,
+                    status: (0, errorUtils_1.extractErrorStatus)(error),
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                return [];
+            }
+        }));
+        return settled.flat();
+    }
+    /** The signed-in user. Cached 1 minute. */
+    async me() {
+        const user = await this.ctx.request('GET', '/users/me', undefined, { cache: true, cacheTTL: ME_TTL });
+        return (0, userIdentity_1.normalizeUserIdentity)(user);
+    }
+    /** A profile by username. Cached 5 minutes; `{ cache: false }` as in `get`. */
+    async byUsername(username, options) {
+        const user = await this.ctx.request('GET', `/profiles/username/${encodeURIComponent(username)}`, undefined, {
+            cache: options?.cache ?? true,
+            cacheTTL: PROFILE_TTL,
+        });
+        return (0, userIdentity_1.normalizeUserIdentity)(user);
+    }
+    /** The user owning a public key. Public (pre-session): sends no bearer. */
+    async byPublicKey(publicKey) {
+        const user = await this.ctx.request('GET', `/auth/user/${encodeURIComponent(publicKey)}`, undefined, {
+            cache: true,
+            cacheTTL: SESSION_USER_TTL,
+            skipAuth: true,
+        });
+        return (0, userIdentity_1.normalizeUserIdentity)(user);
+    }
+    /** The user a session belongs to. */
+    async bySession(sessionId) {
+        const user = await this.ctx.request('GET', `/session/user/${sessionId}`, undefined, {
+            cache: true,
+            cacheTTL: SESSION_USER_TTL,
+        });
+        return (0, userIdentity_1.normalizeUserIdentity)(user);
+    }
+    /** The users of many sessions in one request; `user` is `null` for a dead session. */
+    async bySessions(sessionIds) {
+        if (!Array.isArray(sessionIds) || sessionIds.length === 0)
+            return [];
+        const unique = Array.from(new Set(sessionIds)).sort();
+        const entries = await this.ctx.request('POST', '/session/users/batch', { sessionIds: unique }, 
+        // A read over POST: sorted ids make the body a stable cache/dedupe key.
+        { cache: true, cacheTTL: SESSION_USER_TTL, deduplicate: true });
+        return entries.map((entry) => ({ ...entry, user: (0, userIdentity_1.normalizeUserIdentityOrNull)(entry.user) }));
+    }
+    /**
+     * Search profiles. Pass `signal` from a search box: every keystroke would
+     * otherwise run a search to completion while holding a request-queue slot.
+     */
+    async search(query, pagination, options) {
+        const response = await this.ctx.request('GET', '/profiles/search', (0, apiUtils_1.buildQueryParams)({ query, ...pagination }), { cache: true, cacheTTL: SEARCH_TTL, signal: options?.signal });
+        if (typeof response !== 'object' || response === null || !Array.isArray(response.data)) {
+            throw new Error('Unexpected search response format');
+        }
+        const limit = pagination?.limit ?? response.data.length;
+        const paginationInfo = response.pagination ?? {
+            total: response.data.length,
+            limit,
+            offset: pagination?.offset ?? 0,
+            hasMore: response.data.length === limit && limit > 0,
+        };
+        return { data: response.data, pagination: paginationInfo };
+    }
+    /**
+     * Resolve a fediverse handle (`@user@mastodon.social`) to an Oxy profile by
+     * WebFinger. `null` when it cannot be resolved — discovery is best-effort.
+     * Cached 5 minutes: the profile carries the viewer-relative `relationship`.
+     */
+    async resolveHandle(handle) {
+        try {
+            const result = await this.ctx.request('GET', '/profiles/resolve', { handle }, {
+                cache: true,
+                cacheTTL: PROFILE_TTL,
+            });
+            return (0, userIdentity_1.normalizeUserIdentityOrNull)(result);
+        }
+        catch (error) {
+            // A 404 (absent) and an upstream failure both return null; the log keeps
+            // them distinguishable without turning expected misses into noise.
+            const status = (0, errorUtils_1.extractErrorStatus)(error);
+            logger_1.logger.debug(status === 404 ? 'users.resolveHandle: handle not found' : 'users.resolveHandle: discovery failed', {
+                method: 'users.resolveHandle',
+                handle,
+                status,
+                notFound: status === 404,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return null;
+        }
+    }
+    /**
+     * Find or create a non-local user (federated, agent, automated). All user
+     * creation for external accounts goes through here — services never write
+     * user data directly.
+     */
+    async resolveExternal(input) {
+        return (0, userIdentity_1.normalizeUserIdentity)(await this.ctx.request('PUT', '/users/resolve', input));
+    }
+    /** Profiles similar to `userId`, by co-follower overlap. Cached 5 minutes. */
+    async similar(userId, limitOrPagination) {
+        const pagination = typeof limitOrPagination === 'number' ? { limit: limitOrPagination } : limitOrPagination ?? {};
+        const users = await this.ctx.request('GET', `/profiles/${userId}/similar`, (0, apiUtils_1.buildQueryParams)(pagination), {
+            cache: true,
+            cacheTTL: PROFILE_TTL,
+        });
+        return users.map((user) => (0, userIdentity_1.normalizeUserIdentity)(user));
+    }
+    /**
+     * Profile recommendations. Works signed out (popular public profiles) and
+     * personalises when signed in.
+     *
+     * Only `excludeTypes` / `limit` → the cached `GET /profiles/recommendations`.
+     * Any scored field (`boosts`, `excludeIds`, `signalWeights`, `clientId`,
+     * `offset`) → `POST` with the body validated by `recommendationRequestSchema`
+     * (also cached, keyed on the body).
+     */
+    async recommendations(options) {
+        const scored = Boolean(options &&
+            (options.clientId !== undefined ||
+                options.offset !== undefined ||
+                (options.excludeIds?.length ?? 0) > 0 ||
+                (options.boosts?.length ?? 0) > 0 ||
+                options.signalWeights !== undefined));
+        try {
+            if (scored && options) {
+                const body = contracts_1.recommendationRequestSchema.parse(options);
+                return await this.ctx.request('POST', '/profiles/recommendations', body, { cache: true });
+            }
+            const params = {};
+            if (options?.excludeTypes?.length)
+                params.excludeTypes = options.excludeTypes.join(',');
+            if (options?.limit !== undefined)
+                params.limit = String(options.limit);
+            return await this.ctx.request('GET', '/profiles/recommendations', Object.keys(params).length > 0 ? params : undefined, { cache: true });
+        }
+        catch (error) {
+            logger_1.logger.debug('users.recommendations: discovery read failed', {
+                method: 'users.recommendations',
+                path: scored ? 'POST' : 'GET',
+                excludeTypes: options?.excludeTypes,
+                status: (0, errorUtils_1.extractErrorStatus)(error),
+                error: error instanceof Error ? error.message : String(error),
+            });
+            throw error;
+        }
+    }
+    // ── The signed-in user ───────────────────────────────────────────────────
+    /**
+     * Update the signed-in user's profile and settings (`PUT /users/me`) —
+     * including `notificationPreferences`, `userPreferences` and
+     * `themePreference`.
+     *
+     * Every cached read that can return this user goes, in one pass: the
+     * identity reads (the list `identityCacheSweep` owns) and the account forest
+     * (a personal account IS this user, and `AccountNode.account` embeds it).
+     *
+     * A 401 with no token held rejects with `AUTH_REQUIRED_OFFLINE_SESSION: …` so
+     * the caller knows to sync an offline session before retrying.
+     */
+    async updateMe(updates) {
+        let result;
+        try {
+            result = (0, userIdentity_1.normalizeUserIdentity)(await this.ctx.request('PUT', '/users/me', updates, { cache: false }));
+        }
+        catch (error) {
+            if ((0, errorUtils_1.extractErrorStatus)(error) === 401 && !this.ctx.oxy.session.isAuthenticated) {
+                throw new Error('AUTH_REQUIRED_OFFLINE_SESSION: Session needs to be synced to get a token');
+            }
+            throw error;
+        }
+        const id = result?.id;
+        this.ctx.http.invalidateCache({
+            prefixes: [...identityCacheSweep_1.OXY_IDENTITY_CACHE_PREFIXES, accountCacheSweep_1.OXY_ACCOUNT_LIST_CACHE_QUERY_PREFIX],
+            keys: id
+                ? [(0, identityCacheSweep_1.oxyUserByIdCacheKey)(id), accountCacheSweep_1.OXY_ACCOUNT_LIST_CACHE_KEY, (0, accountCacheSweep_1.oxyAccountDetailCacheKey)(id)]
+                : [accountCacheSweep_1.OXY_ACCOUNT_LIST_CACHE_KEY],
+        });
+        return result;
+    }
+    /** Ask for the verified badge. */
+    async requestVerification(reason, evidence) {
+        return this.ctx.request('POST', '/users/verify/request', { reason, evidence }, { cache: false });
+    }
+    /**
+     * Delete the signed-in account permanently. `confirmText` must equal the
+     * username. See {@link DeleteAccountProof} for what confirms it.
+     */
+    async deleteMe(confirmText, proof) {
+        if ('reauth' in proof) {
+            return this.ctx.request('DELETE', '/users/me', { confirmText, reauth: proof.reauth }, { cache: false });
+        }
+        // Loaded on demand: only a Commons account deleting from its own device
+        // needs the key store, and nobody else should ship it.
+        const { KeyManager, SignatureService } = await Promise.resolve().then(() => __importStar(require('../crypto/internal')));
+        const publicKey = await KeyManager.getPublicKey();
+        if (!publicKey) {
+            throw new Error('No identity found on this device. Account deletion requires the device that holds your identity key.');
+        }
+        const timestamp = Date.now();
+        const signature = await SignatureService.sign(`delete:${publicKey}:${timestamp}`);
+        return this.ctx.request('DELETE', '/users/me', { signature, timestamp, confirmText, ...(proof.totpCode ? { totpCode: proof.totpCode } : {}) }, { cache: false });
+    }
+}
+exports.UsersApi = UsersApi;

package/dist/cjs/boot/sessionColdBoot.js

@@ -17,7 +17,7 @@ exports.runSessionColdBoot = runSessionColdBoot;
  *   2. `device-secret-mint` (web + native) — the zero-cookie transport: when the
  *      origin persisted a `deviceId` + `deviceSecret`, mint a short access token
  *      with a single bearer-less POST to `/session/device/token` (no cookie, no
- *      navigation) and rotate the secret in-use.
+ *      navigation). The secret is stable across mints.
  *   3. `shared-device-adopt` (native, ACCOUNT mode) — this app has no credential
  *      of its own but a sibling official app already put one in the shared native
  *      slot: adopt it and mint. This is how a newly installed official app joins
@@ -127,7 +127,7 @@ async function runSessionColdBoot(opts) {
                     return { kind: 'skip' };
                 }
             }
-            oxy.setTokens(persisted.accessToken);
+            oxy.session.setAccessToken(persisted.accessToken);
             return {
                 kind: 'session',
                 session: {
@@ -352,11 +352,11 @@ async function runSessionColdBoot(opts) {
             id: 'shared-key-signin',
             enabled: () => isNative && !isOffline(),
             run: async () => {
-                const session = await oxy.signInWithSharedIdentity({ requestOptions: { retry: false } });
+                const session = await oxy.auth.signInWithSharedIdentity({ requestOptions: { retry: false } });
                 if (!session?.accessToken) {
                     return { kind: 'skip' };
                 }
-                // `verifyChallenge` mints a rotating deviceSecret; persist it so the next
+                // `verifyChallenge` issues a deviceSecret; persist it so the next
                 // boot can use the faster device-secret-mint lane (sockets + tab-focus
                 // re-mint depend on the credential being in the store).
                 if (session.deviceId && session.deviceSecret) {

package/dist/cjs/civic/index.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyPublicCardAttestation = exports.parseAttestPayload = exports.parseIdPayload = void 0;
+/**
+ * `@oxy.so/core/civic` — the Oxy ID QR payloads: parse, build, verify.
+ *
+ * Pure functions over the signed public card and the real-life attestation
+ * QR. Their own entry because verifying a card pulls the protocol's signature
+ * code, which an app that never scans a card should not ship.
+ */
+// Verifying a card reaches `@noble/*`; the shim goes first (see `../crypto/polyfill`).
+require("../crypto/polyfill");
+var payloads_1 = require("./payloads");
+Object.defineProperty(exports, "parseIdPayload", { enumerable: true, get: function () { return payloads_1.parseIdPayload; } });
+Object.defineProperty(exports, "parseAttestPayload", { enumerable: true, get: function () { return payloads_1.parseAttestPayload; } });
+Object.defineProperty(exports, "verifyPublicCardAttestation", { enumerable: true, get: function () { return payloads_1.verifyPublicCardAttestation; } });