@oxy.so/core 1.18.1 → 3.0.0

package/src/mixins/OxyServices.identityBackup.ts

@@ -1,250 +0,0 @@
-/**
- * Encrypted off-device identity backup mixin (b3 Feature 1).
- *
- * Lets a self-custody identity store an ENCRYPTED copy of its key off-device so
- * a lost/wiped device can be recovered from the recovery phrase alone — while the
- * platform never sees the phrase, the derived key, or the plaintext private key.
- *
- * Key schedule (from the recovery phrase; see
- * {@link RecoveryPhraseService.deriveBackupMaterial}):
- *   seed      = mnemonicToSeed(phrase)                          // 64 bytes, UNCHANGED
- *   backupKey = HKDF(seed, 'oxy-identity-backup-v1', 'oxy-backup-encryption-key')
- *   lookupId  = HKDF(seed, 'oxy-identity-backup-v1', 'oxy-backup-lookup-id')   // hex
- *
- * The two derivations require the FULL seed, so a device compromise that leaks
- * only the raw 32-byte private key can neither locate nor decrypt the backup.
- *
- * Wire shapes come from `@oxy.so/contracts` (`EncryptedBackupEnvelope`,
- * `BackupUploadRequest`, `BackupStatusResponse`) — the API validates its
- * request/response against the same schemas, so producer and consumer cannot
- * drift.
- *
- * Encryption/derivation are cross-platform (pure `@noble/*`), but persisting a
- * restored key is NATIVE-ONLY: `restoreFromEncryptedBackup` ends in
- * `KeyManager.importKeyPair`, which throws on web (SecureStore does not exist
- * there) — decryption still succeeds, only the local write is native-only.
- */
-import type {
-  BackupStatusResponse,
-  BackupUploadRequest,
-  EncryptedBackupEnvelope,
-} from '@oxy.so/contracts';
-import type { OxyServicesBase } from '../OxyServices.base';
-import { KeyManager, IdentityAlreadyExistsError } from '../crypto/keyManager';
-import { RecoveryPhraseService, BACKUP_KDF_ENCRYPTION_INFO } from '../crypto/recoveryPhrase';
-import { encryptAead, decryptAead } from '../crypto/aead';
-
-/** Envelope/KDF version — bump only on a breaking scheme change. */
-const BACKUP_ENVELOPE_VERSION = 1;
-/** The AEAD the backup is sealed with. Pinned so a mismatched decryptor fails loudly. */
-const BACKUP_ALGORITHM = 'xchacha20poly1305' as const;
-/**
- * Length (hex chars) of the public-key HINT stored/echoed with a backup — enough
- * to let the owner recognise WHICH identity a backup belongs to, but only a
- * prefix (the full key is public anyway; a prefix keeps the record minimal).
- */
-const PUBLIC_KEY_HINT_LENGTH = 16;
-
-/** The decrypted backup payload. */
-interface BackupPayload {
-  privateKey: string;
-  publicKey: string;
-  createdAt: string;
-}
-
-/** Encode bytes as lowercase hex (cross-platform, no Buffer dependency). */
-function toHex(bytes: Uint8Array): string {
-  let out = '';
-  for (let i = 0; i < bytes.length; i += 1) {
-    out += bytes[i].toString(16).padStart(2, '0');
-  }
-  return out;
-}
-
-/** Decode a lowercase/uppercase hex string to bytes. Throws on malformed input. */
-function fromHex(hex: string): Uint8Array {
-  if (hex.length % 2 !== 0 || /[^0-9a-fA-F]/.test(hex)) {
-    throw new Error('Malformed hex in encrypted backup envelope.');
-  }
-  const out = new Uint8Array(hex.length / 2);
-  for (let i = 0; i < out.length; i += 1) {
-    out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
-  }
-  return out;
-}
-
-/**
- * The AEAD associated data binds the ciphertext to its `{version, publicKeyHint}`
- * context: the exact bytes must be reproduced at decrypt time, so a mismatched
- * version or hint (e.g. an envelope re-stamped by a tamperer) fails the
- * Poly1305 check. Deterministic: both sides build the SAME object literal, so
- * `JSON.stringify` yields identical bytes.
- */
-function buildBackupAad(version: number, publicKeyHint: string): Uint8Array {
-  return new TextEncoder().encode(JSON.stringify({ version, publicKeyHint }));
-}
-
-export function OxyServicesIdentityBackupMixin<T extends typeof OxyServicesBase>(Base: T) {
-  return class extends Base {
-    constructor(...args: any[]) {
-      super(...(args as [any]));
-    }
-
-    /**
-     * Derive the backup key material from the recovery phrase, encrypt the
-     * identity's `{privateKey, publicKey, createdAt}` with it, and upload the
-     * ciphertext + raw `lookupId` (`POST /identity/backup`, bearer). The server
-     * stores only `sha256(lookupId)` + the ciphertext. Idempotent per user: a
-     * re-upload REPLACES the prior backup (upsert by user id).
-     *
-     * The identity is derived from the PHRASE (not read from SecureStore), so
-     * this works cross-platform and does not require an on-device key.
-     *
-     * @param phrase - The identity's BIP-39 recovery phrase.
-     * @returns The post-write backup status (`{ exists: true, publicKeyHint, createdAt }`).
-     */
-    async createEncryptedBackup(phrase: string): Promise<BackupStatusResponse> {
-      try {
-        const { backupKey, lookupId } = await RecoveryPhraseService.deriveBackupMaterial(phrase);
-        const privateKey = await RecoveryPhraseService.derivePrivateKeyFromPhrase(phrase);
-        const publicKey = KeyManager.derivePublicKey(privateKey);
-        const createdAt = new Date().toISOString();
-        const publicKeyHint = publicKey.slice(0, PUBLIC_KEY_HINT_LENGTH);
-
-        const payload: BackupPayload = { privateKey, publicKey, createdAt };
-        const plaintext = new TextEncoder().encode(JSON.stringify(payload));
-        const aad = buildBackupAad(BACKUP_ENVELOPE_VERSION, publicKeyHint);
-        const { nonce, ciphertext } = encryptAead(backupKey, plaintext, aad);
-
-        const body: BackupUploadRequest = {
-          version: BACKUP_ENVELOPE_VERSION,
-          algorithm: BACKUP_ALGORITHM,
-          kdfInfo: BACKUP_KDF_ENCRYPTION_INFO,
-          nonce: toHex(nonce),
-          ciphertext: toHex(ciphertext),
-          publicKeyHint,
-          createdAt,
-          lookupId,
-        };
-
-        return await this.makeRequest<BackupStatusResponse>(
-          'POST',
-          '/identity/backup',
-          body,
-          { cache: false },
-        );
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * Whether the authenticated user has a stored encrypted backup, plus the
-     * non-sensitive hint + timestamp when one exists (`GET /identity/backup/status`,
-     * bearer). Returns no ciphertext and no locator.
-     */
-    async getBackupStatus(): Promise<BackupStatusResponse> {
-      try {
-        return await this.makeRequest<BackupStatusResponse>(
-          'GET',
-          '/identity/backup/status',
-          undefined,
-          { cache: false },
-        );
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * Delete the authenticated user's stored backup (`DELETE /identity/backup`,
-     * bearer). Idempotent — deleting a non-existent backup still succeeds.
-     */
-    async deleteBackup(): Promise<{ success: boolean }> {
-      try {
-        return await this.makeRequest<{ success: boolean }>(
-          'DELETE',
-          '/identity/backup',
-          undefined,
-          { cache: false },
-        );
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * Restore an identity from its encrypted off-device backup using ONLY the
-     * recovery phrase: re-derive `{backupKey, lookupId}`, fetch the envelope by
-     * `lookupId` (`GET /identity/backup/:lookupId`, PUBLIC — the 256-bit locator
-     * is the protection), decrypt + authenticate locally, then persist the key.
-     *
-     * NATIVE-ONLY persistence: `KeyManager.importKeyPair` throws on web. It also
-     * refuses to clobber a DIFFERENT existing on-device identity unless
-     * `overwrite: true` — the {@link import('../crypto/keyManager').IdentityAlreadyExistsError}
-     * propagates to the caller (never swallowed) so the UI can confirm before
-     * overwriting.
-     *
-     * @param phrase - The identity's BIP-39 recovery phrase.
-     * @param options.overwrite - Replace a different existing on-device identity.
-     * @returns The restored identity's public key.
-     * @throws if the phrase is invalid, no backup exists (404), the ciphertext
-     *   fails authentication (tamper), or an existing identity blocks the import.
-     */
-    async restoreFromEncryptedBackup(
-      phrase: string,
-      options?: { overwrite?: boolean },
-    ): Promise<string> {
-      try {
-        const { backupKey, lookupId } = await RecoveryPhraseService.deriveBackupMaterial(phrase);
-
-        const envelope = await this.makeRequest<EncryptedBackupEnvelope>(
-          'GET',
-          `/identity/backup/${encodeURIComponent(lookupId)}`,
-          undefined,
-          { cache: false },
-        );
-
-        if (envelope.algorithm !== BACKUP_ALGORITHM) {
-          throw new Error(`Unsupported backup algorithm: ${envelope.algorithm}`);
-        }
-
-        const aad = buildBackupAad(envelope.version, envelope.publicKeyHint);
-        const plaintext = decryptAead(
-          backupKey,
-          fromHex(envelope.nonce),
-          fromHex(envelope.ciphertext),
-          aad,
-        );
-        const payload = JSON.parse(new TextDecoder().decode(plaintext)) as BackupPayload;
-
-        if (!payload.privateKey || !payload.publicKey) {
-          throw new Error('Backup payload is missing key material');
-        }
-
-        const derivedFromPhrase = await RecoveryPhraseService.derivePublicKeyFromPhrase(phrase);
-        const derivedFromPrivate = KeyManager.derivePublicKey(payload.privateKey);
-        const phrasePk = derivedFromPhrase.toLowerCase();
-        const payloadPk = payload.publicKey.toLowerCase();
-        const privatePk = derivedFromPrivate.toLowerCase();
-        if (phrasePk !== payloadPk || privatePk !== payloadPk) {
-          throw new Error('Backup payload does not match the recovery phrase');
-        }
-
-        // Persist the recovered key. Native-only; refuses to clobber a different
-        // identity unless overwrite — the IdentityAlreadyExistsError propagates.
-        return await KeyManager.importKeyPair(payload.privateKey, {
-          overwrite: options?.overwrite === true,
-        });
-      } catch (error) {
-        // Preserve the typed "an identity already exists" signal so the caller
-        // can prompt for overwrite. `handleError` would flatten it to a generic
-        // Error and lose that discrimination.
-        if (error instanceof IdentityAlreadyExistsError) {
-          throw error;
-        }
-        throw this.handleError(error);
-      }
-    }
-  };
-}

package/src/mixins/OxyServices.inference.ts

@@ -1,57 +0,0 @@
-/**
- * The inference API, reached with whatever bearer this session already holds
- * (issue #972, workstream 15).
- *
- * ```typescript
- * const models = await oxyServices.inference().listModels();
- * ```
- *
- * One method, and it is a FACTORY rather than a set of inference methods on
- * `OxyServices`. The calls themselves live once, in
- * {@link OxyInferenceClient} — which an external developer holding only an
- * `oxy_sk_…` machine key constructs directly, with no Oxy session anywhere in
- * the picture. Declaring the same calls a second time here would give the
- * ecosystem two spellings of one request, and only one of them would stay
- * correct.
- *
- * This is the reasoning `createLinkedClient` is already built on: the plumbing
- * that binds an Oxy bearer to a client belongs in core, once, rather than in
- * each app.
- *
- * The credential is a FUNCTION, not the current token: a session bearer rotates
- * on refresh and on account switch, and a client that captured one at
- * construction would start answering 401 an hour into the process's life.
- */
-
-import { OxyInferenceClient } from '../inference/OxyInferenceClient';
-import type { OxyServicesBase } from '../OxyServices.base';
-
-export function OxyServicesInferenceMixin<T extends typeof OxyServicesBase>(Base: T) {
-    return class extends Base {
-        /** @internal Memoized so repeated calls return one object identity. */
-        _inferenceClient: OxyInferenceClient | null = null;
-
-        /**
-         * The inference client for this session.
-         *
-         * Bound to this instance's base URL and to `getAccessToken()`, so it
-         * follows every refresh, sign-in and account switch without being
-         * rebuilt.
-         *
-         * A service-authenticated process wants a different credential and
-         * builds {@link OxyInferenceClient} directly:
-         * `new OxyInferenceClient({ credential: () => oxy.getServiceToken() })`.
-         * The mint is asynchronous and cached, which is exactly what a
-         * credential function is for.
-         */
-        inference(): OxyInferenceClient {
-            if (this._inferenceClient === null) {
-                this._inferenceClient = new OxyInferenceClient({
-                    baseURL: this.getBaseURL(),
-                    credential: () => this.getAccessToken(),
-                });
-            }
-            return this._inferenceClient;
-        }
-    };
-}

package/src/mixins/OxyServices.language.ts

@@ -1,144 +0,0 @@
-/**
- * Language Methods Mixin
- */
-import { normalizeLocale, getPrimaryLanguage, getLanguageMetadata, getLanguageName, getNativeLanguageName } from '../utils/languageUtils';
-import type { SupportedLanguage } from '../utils/languageUtils';
-import type { OxyServicesBase } from '../OxyServices.base';
-import { loadAsyncStorage } from '@oxy.so/protocol';
-import { logger } from '../logger';
-
-/**
- * Cross-mixin surface consumed by the language methods. `getCurrentUser` is
- * provided by the user mixin at runtime — both live on the composed
- * `OxyServices` instance — but it is not visible on `OxyServicesBase` at the
- * type level. We narrow `this` through this interface (mirroring the
- * `OxyAuthInstance` pattern in `OxyServices.utility.ts`) instead of casting to
- * `any`. Only the fields this mixin reads are declared, keeping it decoupled
- * from the full `User` shape.
- */
-interface LanguageMixinCrossAccess {
-  getCurrentUser(): Promise<{ languages?: string[] }>;
-}
-
-export function OxyServicesLanguageMixin<T extends typeof OxyServicesBase>(Base: T) {
-  return class extends Base {
-    constructor(...args: any[]) {
-      super(...(args as [any]));
-    }
-    /**
-     * Get appropriate storage for the platform (similar to DeviceManager)
-     */
-    public async getStorage(): Promise<{
-      getItem: (key: string) => Promise<string | null>;
-      setItem: (key: string, value: string) => Promise<void>;
-      removeItem: (key: string) => Promise<void>;
-    }> {
-      const isReactNative = typeof navigator !== 'undefined' && navigator.product === 'ReactNative';
-      
-      if (isReactNative) {
-        try {
-          // `loadAsyncStorage` is per-platform: the RN variant statically imports
-          // @react-native-async-storage/async-storage, the default variant throws
-          // (never called outside RN because of the `isReactNative` gate above).
-          const asyncStorageModule = await loadAsyncStorage();
-          const storage = asyncStorageModule.default;
-          return {
-            getItem: storage.getItem.bind(storage),
-            setItem: storage.setItem.bind(storage),
-            removeItem: storage.removeItem.bind(storage),
-          };
-        } catch (error) {
-          logger.error('AsyncStorage not available in React Native', error, { component: 'OxyServices.language' });
-          throw new Error('AsyncStorage is required in React Native environment');
-        }
-      } else {
-        // Use localStorage for web
-        return {
-          getItem: async (key: string) => {
-            if (typeof window !== 'undefined' && window.localStorage) {
-              return localStorage.getItem(key);
-            }
-            return null;
-          },
-          setItem: async (key: string, value: string) => {
-            if (typeof window !== 'undefined' && window.localStorage) {
-              localStorage.setItem(key, value);
-            }
-          },
-          removeItem: async (key: string) => {
-            if (typeof window !== 'undefined' && window.localStorage) {
-              localStorage.removeItem(key);
-            }
-          }
-        };
-      }
-    }
-
-    /**
-     * Get the current locale from the user profile or local storage.
-     * @param storageKeyPrefix - Optional prefix for storage key (default: 'oxy_session')
-     * @returns The current BCP-47 locale (e.g., 'en-US') or null if not set
-     */
-    async getCurrentLanguage(storageKeyPrefix = 'oxy_session'): Promise<string | null> {
-      try {
-        // First try the authenticated user's primary account locale.
-        try {
-          const user = await (this as unknown as LanguageMixinCrossAccess).getCurrentUser();
-          const primary = getPrimaryLanguage(user);
-          if (primary) {
-            return primary;
-          }
-        } catch {
-          // Not authenticated or the profile fetch failed — fall through to the
-          // locally stored preference below.
-        }
-
-        // Fall back to the locally stored locale preference.
-        const storage = await this.getStorage();
-        const storageKey = `${storageKeyPrefix}_language`;
-        const storedLanguage = await storage.getItem(storageKey);
-        if (storedLanguage) {
-          return normalizeLocale(storedLanguage) ?? storedLanguage;
-        }
-
-        return null;
-      } catch (error) {
-        logger.warn('Failed to get current language', { component: 'OxyServices.language' }, error);
-        return null;
-      }
-    }
-
-    /**
-     * Get the current language with metadata (name, nativeName, etc.)
-     * @param storageKeyPrefix - Optional prefix for storage key (default: 'oxy_session')
-     * @returns Language metadata object or null if not set
-     */
-    async getCurrentLanguageMetadata(storageKeyPrefix = 'oxy_session'): Promise<SupportedLanguage | null> {
-      const languageCode = await this.getCurrentLanguage(storageKeyPrefix);
-      return getLanguageMetadata(languageCode);
-    }
-
-    /**
-     * Get the current language name (e.g., 'English')
-     * @param storageKeyPrefix - Optional prefix for storage key (default: 'oxy_session')
-     * @returns Language name or null if not set
-     */
-    async getCurrentLanguageName(storageKeyPrefix = 'oxy_session'): Promise<string | null> {
-      const languageCode = await this.getCurrentLanguage(storageKeyPrefix);
-      if (!languageCode) return null;
-      return getLanguageName(languageCode);
-    }
-
-    /**
-     * Get the current native language name (e.g., 'Español')
-     * @param storageKeyPrefix - Optional prefix for storage key (default: 'oxy_session')
-     * @returns Native language name or null if not set
-     */
-    async getCurrentNativeLanguageName(storageKeyPrefix = 'oxy_session'): Promise<string | null> {
-      const languageCode = await this.getCurrentLanguage(storageKeyPrefix);
-      if (!languageCode) return null;
-      return getNativeLanguageName(languageCode);
-    }
-  };
-}
-

package/src/mixins/OxyServices.linkedAccounts.ts

@@ -1,129 +0,0 @@
-/**
- * Linked Accounts Methods Mixin
- *
- * External accounts (any Mastodon-API server, Bluesky) the current user has
- * PROVEN they own by completing an OAuth authorization there. Oxy uses that
- * authorization only to learn which account granted it and then discards the
- * token — nothing here ever carries a third-party token.
- *
- * The flow is a top-level browser navigation: {@link startLinkedAccount} returns
- * the other network's `authorizeUrl`; open it (a new tab, or
- * `expo-web-browser`'s auth session on native); the network sends the browser
- * to Oxy's callback, and Oxy sends it to `returnTo` with `?link_code=<code>` or
- * `?link_error=<code>`. Pass the code to {@link completeLinkedAccount} with the
- * same user signed in: that call, not the callback, creates the link, so an
- * authorization someone else started can never link to them. `returnTo` must
- * be a redirect URI registered on the first-party application `clientId` names.
- *
- * Wire types live in `@oxy.so/contracts` (`linkedAccounts.ts`).
- */
-import type {
-  CompleteLinkedAccountResponse,
-  LinkedAccount,
-  LinkedAccountListResponse,
-  LinkedAccountNetwork,
-  ServiceLinkedAccountListResponse,
-  StartLinkedAccountRequest,
-  StartLinkedAccountResponse,
-} from '@oxy.so/contracts';
-import type { OxyServicesBase } from '../OxyServices.base';
-
-export function OxyServicesLinkedAccountsMixin<T extends typeof OxyServicesBase>(Base: T) {
-  return class extends Base {
-    /** Inherited from the auth mixin at runtime. */
-    declare makeServiceRequest: <R = unknown>(
-      method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE',
-      url: string,
-      data?: unknown,
-      userId?: string,
-    ) => Promise<R>;
-
-    /**
-     * Begin linking an external account for the current user.
-     *
-     * @param network - `'activitypub'` (any Mastodon-API server) or `'atproto'` (Bluesky).
-     * @param options - `instance` for ActivityPub (`mastodon.social`, or
-     *   `@user@mastodon.social`), `handle` for atproto; `clientId` + `returnTo`
-     *   to be sent back to your app afterwards.
-     * @returns The URL to open, and when the attempt expires (ten minutes).
-     */
-    async startLinkedAccount(
-      network: LinkedAccountNetwork,
-      options: StartLinkedAccountRequest,
-    ): Promise<StartLinkedAccountResponse> {
-      try {
-        return await this.makeRequest<StartLinkedAccountResponse>(
-          'POST',
-          `/linked-accounts/${encodeURIComponent(network)}/start`,
-          options,
-          { cache: false },
-        );
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * Finish a link with the `link_code` the callback appended to `returnTo`.
-     * Must be the user who started the flow: for anyone else the API answers
-     * 403 and burns the code. 409 when the account is already someone else's
-     * link. Repeating it within the code's five minutes returns the same link.
-     */
-    async completeLinkedAccount(code: string): Promise<LinkedAccount> {
-      try {
-        const response = await this.makeRequest<CompleteLinkedAccountResponse>(
-          'POST',
-          '/linked-accounts/complete',
-          { code },
-          { cache: false },
-        );
-        return response.linkedAccount;
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /** The current user's live linked accounts, oldest first. */
-    async listLinkedAccounts(): Promise<LinkedAccount[]> {
-      try {
-        const response = await this.makeRequest<LinkedAccountListResponse>('GET', '/linked-accounts', undefined, {
-          cache: false,
-        });
-        return response.linkedAccounts;
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * Unlink one of the current user's accounts. An ActivityPub link stops being
-     * published as an `alsoKnownAs` alias, and the external account can then be
-     * linked to another Oxy account.
-     */
-    async revokeLinkedAccount(linkedAccountId: string): Promise<void> {
-      try {
-        await this.makeRequest<void>('DELETE', `/linked-accounts/${encodeURIComponent(linkedAccountId)}`, undefined, {
-          cache: false,
-        });
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * SERVICE: a user's live linked accounts, each with the federated shadow
-     * user Oxy already holds for it (`federatedUserId`). Requires a service
-     * credential whose application holds the privileged `linked-accounts:read`.
-     */
-    async getLinkedAccountsForUser(userId: string): Promise<ServiceLinkedAccountListResponse> {
-      try {
-        return await this.makeServiceRequest<ServiceLinkedAccountListResponse>(
-          'GET',
-          `/linked-accounts/by-user/${encodeURIComponent(userId)}`,
-        );
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-  };
-}

package/src/mixins/OxyServices.location.ts

@@ -1,46 +0,0 @@
-/**
- * Location Methods Mixin
- */
-import type { OxyServicesBase } from '../OxyServices.base';
-
-export function OxyServicesLocationMixin<T extends typeof OxyServicesBase>(Base: T) {
-  return class extends Base {
-    constructor(...args: any[]) {
-      super(...(args as [any]));
-    }
-
-    /**
-     * Update user location
-     * @param latitude - Latitude coordinate
-     * @param longitude - Longitude coordinate
-     * @returns Location update result
-     */
-    async updateLocation(latitude: number, longitude: number): Promise<any> {
-      try {
-        return await this.makeRequest('POST', '/location', {
-          latitude,
-          longitude
-        }, { cache: false });
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * Get nearby users
-     * @param radius - Optional search radius in meters
-     * @returns Array of nearby users
-     */
-    async getNearbyUsers(radius?: number): Promise<any[]> {
-      try {
-        const params: any = radius ? { radius } : undefined;
-        return await this.makeRequest('GET', '/location/nearby', params, {
-          cache: false, // Don't cache location data - always get fresh data
-        });
-      } catch (error) {
-        throw this.handleError(error);
-      }
-    }
-  };
-}
-