@oxy.so/core 1.18.1 → 3.0.0

package/dist/esm/mixins/index.js

@@ -1,133 +0,0 @@
-/**
- * Centralized mixin exports and composition helper
- *
- * This module provides a clean way to compose all mixins
- * and ensures consistent ordering for better maintainability
- */
-import { OxyServicesBase } from '../OxyServices.base.js';
-import { OxyServicesAuthMixin } from './OxyServices.auth.js';
-import { OxyServicesUserMixin } from './OxyServices.user.js';
-import { OxyServicesIdentityMixin } from './OxyServices.identity.js';
-import { OxyServicesIdentityBackupMixin } from './OxyServices.identityBackup.js';
-import { OxyServicesPrivacyMixin } from './OxyServices.privacy.js';
-import { OxyServicesLanguageMixin } from './OxyServices.language.js';
-import { OxyServicesPaymentMixin } from './OxyServices.payment.js';
-import { OxyServicesReputationMixin } from './OxyServices.reputation.js';
-import { OxyServicesAssetsMixin } from './OxyServices.assets.js';
-import { OxyServicesAccountsMixin } from './OxyServices.accounts.js';
-import { OxyServicesConnectedAppsMixin } from './OxyServices.connectedApps.js';
-import { OxyServicesAgencyMixin } from './OxyServices.agency.js';
-import { OxyServicesStoreMixin } from './OxyServices.store.js';
-import { OxyServicesLocationMixin } from './OxyServices.location.js';
-import { OxyServicesAnalyticsMixin } from './OxyServices.analytics.js';
-import { OxyServicesDevicesMixin } from './OxyServices.devices.js';
-import { OxyServicesSecurityMixin } from './OxyServices.security.js';
-import { OxyServicesUtilityMixin } from './OxyServices.utility.js';
-import { OxyServicesFeaturesMixin } from './OxyServices.features.js';
-import { OxyServicesTopicsMixin } from './OxyServices.topics.js';
-import { OxyServicesContactsMixin } from './OxyServices.contacts.js';
-import { OxyServicesNotificationsMixin } from './OxyServices.notifications.js';
-import { OxyServicesAppDataMixin } from './OxyServices.appData.js';
-import { OxyServicesCivicMixin } from './OxyServices.civic.js';
-import { OxyServicesChainsMixin } from './OxyServices.chains.js';
-import { OxyServicesNodesMixin } from './OxyServices.nodes.js';
-import { OxyServicesFollowGraphMixin } from './OxyServices.followGraph.js';
-import { OxyServicesInferenceMixin } from './OxyServices.inference.js';
-import { OxyServicesDeviceBootMixin } from './OxyServices.deviceBoot.js';
-import { OxyServicesLinkedAccountsMixin } from './OxyServices.linkedAccounts.js';
-/**
- * Mixin pipeline - applied in order from first to last.
- *
- * Order matters for dependencies:
- * 1. Base auth mixin first (required by all others)
- * 2. User mixin (requires auth)
- * 3. Feature mixins (can depend on user)
- * 4. Utility mixin last (augments all)
- *
- * To add a new mixin: insert it at the appropriate position in this array.
- */
-const MIXIN_PIPELINE = [
-    // Base authentication
-    OxyServicesAuthMixin,
-    // User management (requires auth)
-    OxyServicesUserMixin,
-    // Self-sovereign identity (DID, signed records, auth-method ↔ VM mapping)
-    OxyServicesIdentityMixin,
-    // Encrypted off-device identity backup (b3 Feature 1): store/restore an
-    // encrypted copy of the self-custody key, keyed off the recovery phrase.
-    OxyServicesIdentityBackupMixin,
-    OxyServicesPrivacyMixin,
-    // Feature mixins
-    OxyServicesLanguageMixin,
-    OxyServicesPaymentMixin,
-    OxyServicesReputationMixin,
-    OxyServicesAssetsMixin,
-    // Unified account graph + the applications owned within it. The clean-cut
-    // replacement for the former managedAccounts + workspaces + applications
-    // (account-management) mixins.
-    OxyServicesAccountsMixin,
-    // OAuth-consent surface (public app identity + connected-app grants). Kept
-    // separate from account ownership.
-    OxyServicesConnectedAppsMixin,
-    // Oxy-owned delegated authority for Alia and digital-agent accounts.
-    OxyServicesAgencyMixin,
-    // The app store: the public storefront, the reviews on it, and the listing a
-    // publisher edits. A module OVER the platform — turn it off and OAuth still
-    // works — so it is its own surface rather than more of `accounts`.
-    OxyServicesStoreMixin,
-    OxyServicesLocationMixin,
-    OxyServicesAnalyticsMixin,
-    OxyServicesDevicesMixin,
-    OxyServicesSecurityMixin,
-    OxyServicesFeaturesMixin,
-    OxyServicesTopicsMixin,
-    OxyServicesContactsMixin,
-    // Push-token registration: the one SDK-owned register/unregister pair every
-    // Oxy app uses, and what lets a "Sign in with Oxy" request be delivered to a
-    // known Commons installation instead of falling back to a QR.
-    OxyServicesNotificationsMixin,
-    OxyServicesAppDataMixin,
-    // Civic / Commons "Oxy ID" (public signed cards, Oxy ID QR payload)
-    OxyServicesCivicMixin,
-    OxyServicesChainsMixin,
-    // User nodes / decentralization (Fase 5): register/read/revoke/manage the
-    // caller's personal data node + ingest hint.
-    OxyServicesNodesMixin,
-    // The user-owned follow graph (#809). One relationship per user and target,
-    // shared across applications, with per-application context on top.
-    OxyServicesFollowGraphMixin,
-    // The inference model catalogue (#972). Reads only, and deliberately no
-    // request/stream/receipt methods — the public inference edge those would
-    // call is workstream 4 and does not exist yet. See
-    // `docs/inference/README.md` for what is and is not built.
-    OxyServicesInferenceMixin,
-    // Device-first token mint: the client half of the zero-cookie transport
-    // (`mintFromDeviceSecret` → `POST /session/device/token`).
-    OxyServicesDeviceBootMixin,
-    // Linked external accounts (Mastodon-API, Bluesky) proven by OAuth; the
-    // service read uses the auth mixin's `makeServiceRequest`.
-    OxyServicesLinkedAccountsMixin,
-    // Device-to-device identity transfer ("add a device"): E2E-encrypted key
-    // clone over a short-lived relay (b3 Feature 2).
-    // Utility (last, can use all above)
-    OxyServicesUtilityMixin,
-];
-/**
- * Composes all OxyServices mixins using a pipeline pattern.
- *
- * This is equivalent to the nested calls but more readable and maintainable.
- * Adding a new mixin: add it to MIXIN_PIPELINE at the appropriate position
- * AND extend `AllMixinInstances` so its methods are visible to consumers.
- *
- * The cast through `unknown` carries the runtime augmentation chain into the
- * static type system. `Array.reduce` cannot track each mixin's generic
- * refinement, so we assert the final shape exposed by all mixins together.
- *
- * @returns The fully composed OxyServices constructor with all mixins applied
- */
-export function composeOxyServices() {
-    const composed = MIXIN_PIPELINE.reduce((Base, mixin) => mixin(Base), OxyServicesBase);
-    return composed;
-}
-// Export the pipeline for testing/debugging
-export { MIXIN_PIPELINE };

package/dist/esm/mixins/mixinHelpers.js

@@ -1,48 +0,0 @@
-/**
- * Helper utilities for mixin classes
- * Provides common patterns to reduce code duplication
- */
-/**
- * Wraps an async method with standard error handling
- * Reduces boilerplate in mixin methods
- */
-export async function withErrorHandling(operation, handleError) {
-    try {
-        return await operation();
-    }
-    catch (error) {
-        throw handleError(error);
-    }
-}
-/**
- * Creates a standard API request method with error handling
- * Reduces duplication across mixin methods
- */
-export function createApiMethod(makeRequest, handleError, method, url, options = {}) {
-    return async (...args) => {
-        const urlString = typeof url === 'function' ? url(...args) : url;
-        const requestData = options.transformData ? options.transformData(args) : args[0];
-        const requestOptions = {
-            cache: options.cache ?? true,
-            cacheTTL: options.cacheTTL,
-            retry: options.retry ?? true,
-        };
-        try {
-            const response = await makeRequest(method, urlString, requestData, requestOptions);
-            return options.transformResponse ? options.transformResponse(response) : response;
-        }
-        catch (error) {
-            throw handleError(error);
-        }
-    };
-}
-/**
- * Cache time constants (in milliseconds)
- */
-export const CACHE_TIMES = {
-    SHORT: 1 * 60 * 1000, // 1 minute
-    MEDIUM: 2 * 60 * 1000, // 2 minutes
-    LONG: 5 * 60 * 1000, // 5 minutes
-    VERY_LONG: 10 * 60 * 1000, // 10 minutes
-    EXTRA_LONG: 30 * 60 * 1000, // 30 minutes
-};

package/dist/esm/utils/webauthnOrigin.js

@@ -1,48 +0,0 @@
-/**
- * WebAuthn relying-party origin guard (client side).
- *
- * The passkey ceremonies (`OxyServices.webauthn*`) are only meaningful when the
- * page is served from a first-party Oxy web origin: a credential minted with
- * `WEBAUTHN_RP_ID=oxy.so` can only be created/asserted from `oxy.so`, one of its
- * subdomains, or a loopback dev server. This is the browser-side mirror of the
- * server's `isOxyApexOrigin` (`packages/api/src/utils/origin.ts`), which forms
- * the server's `expectedOrigin` allow-set — consumers use it to decide whether to
- * even offer the passkey UI on the current page.
- *
- * It reads `globalThis.location` directly (no argument) because that is the only
- * origin the browser will let a WebAuthn ceremony run against. On native / SSR /
- * any environment without a DOM `location`, it returns `false` (there is no
- * relying-party origin, so passkeys are not applicable).
- */
-/**
- * True iff the current page's host is a first-party Oxy relying-party origin:
- * `oxy.so`, any `*.oxy.so` subdomain, or a loopback dev host
- * (`localhost` / `127.0.0.1` / `[::1]`).
- *
- * Fails closed: no `location` (native/SSR), a non-string/empty hostname, or a
- * host that merely ends in the literal `oxy.so` without the dot boundary
- * (`evil-oxy.so`, `oxy.so.evil.com`) all return `false`.
- *
- * @example
- *   isOxyRpOrigin() // true  on https://accounts.oxy.so
- *   isOxyRpOrigin() // true  on http://localhost:8081
- *   isOxyRpOrigin() // false on https://evil.com
- *   isOxyRpOrigin() // false in a React Native / SSR context (no location)
- */
-export function isOxyRpOrigin() {
-    // `globalThis.location` is typed `Location` by the DOM lib, but is genuinely
-    // `undefined` on native/SSR — widen to a nullable local so the guard is a real
-    // runtime check, not a type-level no-op.
-    const location = globalThis.location;
-    if (!location || typeof location.hostname !== 'string') {
-        return false;
-    }
-    const hostname = location.hostname.toLowerCase();
-    if (hostname.length === 0) {
-        return false;
-    }
-    if (hostname === 'oxy.so' || hostname.endsWith('.oxy.so')) {
-        return true;
-    }
-    return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]';
-}