@oxy.so/core 1.18.1 → 3.0.0

package/src/mixins/__tests__/agency.test.ts

@@ -1,120 +0,0 @@
-import { OxyServices } from '../../OxyServices';
-
-function makeJwt(payload: Record<string, unknown>): string {
-  const encode = (value: Record<string, unknown>): string =>
-    Buffer.from(JSON.stringify(value)).toString('base64url');
-  return `${encode({ alg: 'none', typ: 'JWT' })}.${encode({ exp: Math.floor(Date.now() / 1000) + 3600, ...payload })}.sig`;
-}
-
-function jsonResponse(data: unknown): Response {
-  return new Response(JSON.stringify({ data }), {
-    status: 200,
-    headers: { 'content-type': 'application/json' },
-  });
-}
-
-describe('native agency authority', () => {
-  let originalFetch: typeof globalThis.fetch;
-  let fetchMock: jest.Mock<Promise<Response>, [RequestInfo | URL, RequestInit?]>;
-  let oxy: OxyServices;
-
-  beforeEach(() => {
-    originalFetch = globalThis.fetch;
-    fetchMock = jest.fn();
-    globalThis.fetch = fetchMock as unknown as typeof globalThis.fetch;
-    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
-    oxy.httpService.setTokens(makeJwt({ userId: 'owner' }));
-  });
-
-  afterEach(() => {
-    globalThis.fetch = originalFetch;
-    jest.clearAllMocks();
-  });
-
-  it('loads account-scoped grants and audit events', async () => {
-    fetchMock
-      .mockResolvedValueOnce(jsonResponse({ grants: [] }))
-      .mockResolvedValueOnce(jsonResponse({ events: [] }));
-
-    await expect(oxy.listDelegationGrants('owner/account')).resolves.toEqual([]);
-    await expect(oxy.listCapabilityAuditEvents('owner/account')).resolves.toEqual([]);
-
-    expect(String(fetchMock.mock.calls[0]?.[0])).toBe(
-      'http://test.invalid/capabilities/grants?ownerAccountId=owner%2Faccount',
-    );
-    expect(String(fetchMock.mock.calls[1]?.[0])).toBe(
-      'http://test.invalid/capabilities/audit?accountId=owner%2Faccount',
-    );
-  });
-
-  it('invalidates the exact grant list after revocation', async () => {
-    const clear = jest.spyOn(oxy, 'clearCacheEntry');
-    fetchMock.mockResolvedValueOnce(jsonResponse(undefined));
-
-    await oxy.revokeDelegationGrant('grant/id', 'owner/account');
-
-    expect(String(fetchMock.mock.calls[0]?.[0])).toBe(
-      'http://test.invalid/capabilities/grants/grant%2Fid',
-    );
-    expect(fetchMock.mock.calls[0]?.[1]?.method).toBe('DELETE');
-    expect(clear).toHaveBeenCalledWith(
-      'GET:/capabilities/grants?ownerAccountId=owner%2Faccount',
-    );
-  });
-
-  it('updates only a grant authority envelope through its stable id', async () => {
-    const grant = { id: 'grant/id', catalog: null };
-    fetchMock.mockResolvedValueOnce(jsonResponse({ grant }));
-
-    await expect(oxy.updateDelegationGrant('grant/id', 'owner/account', {
-      capabilityPackages: ['read'],
-      capabilities: ['email.read'],
-      toolOverrides: [{ tool: 'sendEmail', decision: 'deny' }],
-      limits: [],
-      maximumAutonomy: 'read_only',
-      canRedelegate: false,
-      expiresAt: null,
-    })).resolves.toEqual(grant);
-
-    const [url, init] = fetchMock.mock.calls[0] ?? [];
-    expect(String(url)).toBe('http://test.invalid/capabilities/grants/grant%2Fid');
-    expect(init?.method).toBe('PUT');
-    expect(JSON.parse(String(init?.body))).toEqual({
-      capabilityPackages: ['read'],
-      capabilities: ['email.read'],
-      toolOverrides: [{ tool: 'sendEmail', decision: 'deny' }],
-      limits: [],
-      maximumAutonomy: 'read_only',
-      canRedelegate: false,
-      expiresAt: null,
-    });
-  });
-
-  it('writes the most restrictive account policy without leaking it across accounts', async () => {
-    const policy = {
-      id: 'policy-1',
-      accountId: 'account-a',
-      appSlug: 'mention',
-      maximumAutonomy: 'draft' as const,
-      deniedCapabilities: ['social.publish'],
-      createdAt: '2026-09-03T00:00:00.000Z',
-      updatedAt: '2026-09-03T00:00:00.000Z',
-    };
-    fetchMock.mockResolvedValueOnce(jsonResponse({ policy }));
-
-    await expect(oxy.putAccountCapabilityPolicy('mention', {
-      accountId: 'account-a',
-      maximumAutonomy: 'draft',
-      deniedCapabilities: ['social.publish'],
-    })).resolves.toEqual(policy);
-
-    const [url, init] = fetchMock.mock.calls[0] ?? [];
-    expect(String(url)).toBe('http://test.invalid/capabilities/account-policies/mention');
-    expect(init?.method).toBe('PUT');
-    expect(init?.body).toBe(JSON.stringify({
-      accountId: 'account-a',
-      maximumAutonomy: 'draft',
-      deniedCapabilities: ['social.publish'],
-    }));
-  });
-});

package/src/mixins/__tests__/appData.test.ts

@@ -1,203 +0,0 @@
-/**
- * App-Data Mixin Tests
- *
- * Exercises the typed helpers around `/users/me/app-data/...`. We stub
- * `makeRequest` so the tests run without a network or a database — what we
- * care about here is request shape (method, URL, body), identifier
- * validation, and response handling (`null` when missing, echo on write).
- *
- * The mixin sits behind `withAuthRetry`, which polls for a token before
- * running the operation. We force a token in via `__resetTokensForTests`'
- * companion path (set access token directly) so the auth wait short-circuits.
- */
-
-import { OxyServices } from '../../OxyServices';
-import { OxyAppDataIdentifierError } from '../OxyServices.appData';
-
-const setAccessTokenForTest = (oxy: OxyServices): void => {
-  // Tokens are managed by HttpService — `hasAccessToken()` is the gate the
-  // `withAuthRetry` loop polls. Reaching in via the public httpService and
-  // calling setTokens with a dummy avoids us needing to expose new test
-  // hooks just for this.
-  oxy.httpService.setTokens('test-token');
-};
-
-describe('OxyServices.appData', () => {
-  let oxy: OxyServices;
-  let makeRequestSpy: jest.SpyInstance;
-
-  beforeEach(() => {
-    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
-    setAccessTokenForTest(oxy);
-    makeRequestSpy = jest.spyOn(oxy, 'makeRequest');
-  });
-
-  afterEach(() => {
-    makeRequestSpy.mockRestore();
-  });
-
-  describe('getAppData', () => {
-    it('returns the stored value when the API responds with one', async () => {
-      makeRequestSpy.mockResolvedValue({ value: { completed: ['intro'] } });
-
-      const result = await oxy.getAppData<{ completed: string[] }>(
-        'academy',
-        'getting-started',
-      );
-
-      expect(result).toEqual({ completed: ['intro'] });
-      expect(makeRequestSpy).toHaveBeenCalledWith(
-        'GET',
-        '/users/me/app-data/academy/getting-started',
-        undefined,
-        expect.objectContaining({ cache: false }),
-      );
-    });
-
-    it('returns null when the API responds with `value: null`', async () => {
-      makeRequestSpy.mockResolvedValue({ value: null });
-      const result = await oxy.getAppData('academy', 'unknown');
-      expect(result).toBeNull();
-    });
-
-    it('returns null when the response object is missing `value`', async () => {
-      makeRequestSpy.mockResolvedValue({});
-      const result = await oxy.getAppData('academy', 'unknown');
-      expect(result).toBeNull();
-    });
-
-    it('URL-encodes namespace and key path segments', async () => {
-      makeRequestSpy.mockResolvedValue({ value: 'ok' });
-      await oxy.getAppData('a-b_c', 'd-e_f');
-      // URL-encoding is a no-op for our allowed character set, but we still
-      // run through encodeURIComponent — make sure that's wired so the call
-      // site doesn't accidentally bypass it later.
-      expect(makeRequestSpy.mock.calls[0][1]).toBe('/users/me/app-data/a-b_c/d-e_f');
-    });
-
-    it('throws OxyAppDataIdentifierError for invalid namespace', async () => {
-      await expect(oxy.getAppData('Bad Namespace', 'k')).rejects.toBeInstanceOf(
-        OxyAppDataIdentifierError,
-      );
-      expect(makeRequestSpy).not.toHaveBeenCalled();
-    });
-
-    it('throws OxyAppDataIdentifierError for invalid key', async () => {
-      await expect(oxy.getAppData('ns', 'Bad/Key')).rejects.toBeInstanceOf(
-        OxyAppDataIdentifierError,
-      );
-      expect(makeRequestSpy).not.toHaveBeenCalled();
-    });
-
-    it('rejects empty identifiers (regex requires at least one char)', async () => {
-      await expect(oxy.getAppData('', 'k')).rejects.toBeInstanceOf(
-        OxyAppDataIdentifierError,
-      );
-      await expect(oxy.getAppData('n', '')).rejects.toBeInstanceOf(
-        OxyAppDataIdentifierError,
-      );
-    });
-
-    it('rejects identifiers longer than 64 chars', async () => {
-      const tooLong = 'a'.repeat(65);
-      await expect(oxy.getAppData(tooLong, 'k')).rejects.toBeInstanceOf(
-        OxyAppDataIdentifierError,
-      );
-    });
-
-    it('surfaces API errors (e.g. 401) via withAuthRetry', async () => {
-      const err = Object.assign(new Error('Authentication required'), {
-        response: { status: 401 },
-      });
-      makeRequestSpy.mockRejectedValue(err);
-      await expect(oxy.getAppData('academy', 'getting-started')).rejects.toThrow();
-    });
-  });
-
-  describe('setAppData', () => {
-    it('writes the value and returns the server-echoed value', async () => {
-      makeRequestSpy.mockResolvedValue({ value: { completed: ['intro'] } });
-
-      const result = await oxy.setAppData('academy', 'getting-started', {
-        completed: ['intro'],
-      });
-
-      expect(result).toEqual({ completed: ['intro'] });
-      expect(makeRequestSpy).toHaveBeenCalledWith(
-        'PUT',
-        '/users/me/app-data/academy/getting-started',
-        { value: { completed: ['intro'] } },
-        expect.objectContaining({ cache: false }),
-      );
-    });
-
-    it('falls back to the caller value when the server response omits it', async () => {
-      makeRequestSpy.mockResolvedValue({});
-      const result = await oxy.setAppData('academy', 'k', 'hello');
-      expect(result).toBe('hello');
-    });
-
-    it('throws OxyAppDataIdentifierError before issuing a request', async () => {
-      await expect(oxy.setAppData('UPPER', 'k', 1)).rejects.toBeInstanceOf(
-        OxyAppDataIdentifierError,
-      );
-      expect(makeRequestSpy).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('deleteAppData', () => {
-    it('issues a DELETE and resolves', async () => {
-      makeRequestSpy.mockResolvedValue(undefined);
-
-      await expect(oxy.deleteAppData('academy', 'getting-started')).resolves.toBeUndefined();
-      expect(makeRequestSpy).toHaveBeenCalledWith(
-        'DELETE',
-        '/users/me/app-data/academy/getting-started',
-        undefined,
-        expect.objectContaining({ cache: false }),
-      );
-    });
-
-    it('throws OxyAppDataIdentifierError on invalid identifiers', async () => {
-      await expect(oxy.deleteAppData('ns', 'BAD KEY')).rejects.toBeInstanceOf(
-        OxyAppDataIdentifierError,
-      );
-    });
-  });
-
-  describe('listAppData', () => {
-    it('returns the entries map from the API', async () => {
-      makeRequestSpy.mockResolvedValue({
-        entries: {
-          'getting-started': { completed: ['intro'] },
-          'using-oxy-id': { completed: [] },
-        },
-      });
-
-      const result = await oxy.listAppData<{ completed: string[] }>('academy');
-
-      expect(result).toEqual({
-        'getting-started': { completed: ['intro'] },
-        'using-oxy-id': { completed: [] },
-      });
-      expect(makeRequestSpy).toHaveBeenCalledWith(
-        'GET',
-        '/users/me/app-data/academy',
-        undefined,
-        expect.objectContaining({ cache: false }),
-      );
-    });
-
-    it('returns an empty object when the API returns no entries', async () => {
-      makeRequestSpy.mockResolvedValue({});
-      const result = await oxy.listAppData('academy');
-      expect(result).toEqual({});
-    });
-
-    it('throws OxyAppDataIdentifierError on invalid namespace', async () => {
-      await expect(oxy.listAppData('Bad Namespace')).rejects.toBeInstanceOf(
-        OxyAppDataIdentifierError,
-      );
-    });
-  });
-});

package/src/mixins/__tests__/assetCredentials.test.ts

@@ -1,47 +0,0 @@
-import { OxyServices } from '../../OxyServices';
-
-interface FetchCall {
-  url: string;
-  init: RequestInit | undefined;
-}
-
-describe('asset fetch credentials', () => {
-  const originalFetch = globalThis.fetch;
-
-  afterEach(() => {
-    globalThis.fetch = originalFetch;
-    jest.restoreAllMocks();
-  });
-
-  it('omits credentials for arbitrary asset content URLs', async () => {
-    const calls: FetchCall[] = [];
-    globalThis.fetch = async (input, init) => {
-      calls.push({ url: String(input), init });
-      return new Response('asset-body', { status: 200 });
-    };
-
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-
-    await oxy.fetchAssetContent('https://attacker.oxy.so/cdn/object.txt', 'text');
-
-    expect(calls).toHaveLength(1);
-    expect(calls[0].url).toBe('https://attacker.oxy.so/cdn/object.txt');
-    expect(calls[0].init?.credentials).toBe('omit');
-  });
-
-  it('includes credentials for asset content fetched from the configured API origin', async () => {
-    const calls: FetchCall[] = [];
-    globalThis.fetch = async (input, init) => {
-      calls.push({ url: String(input), init });
-      return new Response('asset-body', { status: 200 });
-    };
-
-    const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-
-    await oxy.fetchAssetContent('https://api.oxy.so/assets/private-file/stream', 'text');
-
-    expect(calls).toHaveLength(1);
-    expect(calls[0].url).toBe('https://api.oxy.so/assets/private-file/stream');
-    expect(calls[0].init?.credentials).toBe('include');
-  });
-});

package/src/mixins/__tests__/assetUpload.test.ts

@@ -1,191 +0,0 @@
-/**
- * `OxyServices.assetUpload()` multipart-body tests.
- *
- * `assetUpload` accepts three input shapes: a web `File`, a web `Blob`, or a
- * React Native `{ uri, type?, name?, size? }` descriptor. The descriptor path
- * is platform-sensitive:
- *
- *   - React Native — RN's FormData reads the file from disk via the uri during
- *     the multipart request, so the descriptor is appended as-is.
- *   - Web (browser/Node) — the browser's FormData CANNOT read bytes from a plain
- *     `{ uri }` object (it would serialize `[object Object]` → the server stores
- *     a 0-byte asset). The uri must be materialized into a real `Blob` via
- *     `fetch` before appending. An empty fetched blob must throw instead of
- *     silently uploading an empty asset.
- *
- * These tests assert exactly which value lands in the FormData `file` part for
- * each platform, and that an empty web source is rejected.
- */
-
-import { OxyServices } from '../../OxyServices';
-
-/**
- * Captures every `FormData.append` call so a test can inspect the multipart body
- * that `assetUpload` built without sending a real network request.
- */
-function captureUpload(oxy: OxyServices) {
-  const appended: Array<{ name: string; value: unknown; fileName?: string }> = [];
-  // Capture-only: do NOT delegate to the real (undici) FormData.append. Node's
-  // undici rejects a plain { uri } object as not-a-Blob, but real React Native
-  // FormData accepts it — the test asserts on captured args, not a built body.
-  const appendSpy = jest
-    .spyOn(FormData.prototype, 'append')
-    .mockImplementation(function (this: FormData, name: string, value: unknown, fileName?: string) {
-      appended.push({ name, value, fileName });
-    });
-
-  const requestSpy = jest
-    .spyOn(oxy.getClient(), 'request')
-    .mockResolvedValue({ file: { id: 'asset123' } } as never);
-
-  return {
-    appended,
-    requestSpy,
-    restore: () => {
-      appendSpy.mockRestore();
-      requestSpy.mockRestore();
-    },
-  };
-}
-
-describe('OxyServices.assetUpload — uri descriptor', () => {
-  const originalNavigator = (globalThis as { navigator?: unknown }).navigator;
-  const originalFetch = globalThis.fetch;
-
-  afterEach(() => {
-    jest.restoreAllMocks();
-    if (originalNavigator === undefined) {
-      delete (globalThis as { navigator?: unknown }).navigator;
-    } else {
-      (globalThis as { navigator?: unknown }).navigator = originalNavigator;
-    }
-    globalThis.fetch = originalFetch;
-  });
-
-  describe('web (NOT React Native)', () => {
-    beforeEach(() => {
-      // Node/jsdom-like: no React Native navigator → isReactNative() === false.
-      delete (globalThis as { navigator?: unknown }).navigator;
-    });
-
-    it('materializes a blob: uri into a real, non-empty Blob before appending', async () => {
-      const bytes = new Blob([new Uint8Array([1, 2, 3, 4, 5])], { type: 'image/png' });
-      const fetchMock = jest
-        .fn()
-        .mockResolvedValue({ ok: true, status: 200, blob: async () => bytes });
-      globalThis.fetch = fetchMock as unknown as typeof fetch;
-
-      const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-      const capture = captureUpload(oxy);
-
-      try {
-        await oxy.assetUpload({ uri: 'blob:https://app.test/abc', type: 'image/png', name: 'avatar.png' });
-
-        expect(fetchMock).toHaveBeenCalledWith('blob:https://app.test/abc');
-
-        const filePart = capture.appended.find((p) => p.name === 'file');
-        expect(filePart).toBeDefined();
-        // The appended value is the fetched Blob with real bytes — NOT the { uri } object.
-        expect(filePart?.value).toBeInstanceOf(Blob);
-        expect((filePart?.value as Blob).size).toBe(5);
-        expect((filePart?.value as { uri?: string }).uri).toBeUndefined();
-        expect(filePart?.fileName).toBe('avatar.png');
-      } finally {
-        capture.restore();
-      }
-    });
-
-    it('wraps a typeless fetched blob with the descriptor MIME type', async () => {
-      const typeless = new Blob([new Uint8Array([9, 9, 9])]); // type === ''
-      const fetchMock = jest
-        .fn()
-        .mockResolvedValue({ ok: true, status: 200, blob: async () => typeless });
-      globalThis.fetch = fetchMock as unknown as typeof fetch;
-
-      const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-      const capture = captureUpload(oxy);
-
-      try {
-        await oxy.assetUpload({ uri: 'data:application/octet-stream;base64,CQkJ', type: 'image/jpeg', name: 'x.jpg' });
-
-        const filePart = capture.appended.find((p) => p.name === 'file');
-        expect(filePart?.value).toBeInstanceOf(Blob);
-        expect((filePart?.value as Blob).size).toBe(3);
-        expect((filePart?.value as Blob).type).toBe('image/jpeg');
-      } finally {
-        capture.restore();
-      }
-    });
-
-    it('throws "Cannot upload an empty file" when the fetched blob is empty', async () => {
-      const empty = new Blob([], { type: 'image/png' });
-      const fetchMock = jest
-        .fn()
-        .mockResolvedValue({ ok: true, status: 200, blob: async () => empty });
-      globalThis.fetch = fetchMock as unknown as typeof fetch;
-
-      const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-      const capture = captureUpload(oxy);
-
-      try {
-        await expect(
-          oxy.assetUpload({ uri: 'blob:https://app.test/empty', type: 'image/png', name: 'empty.png' }),
-        ).rejects.toThrow('Cannot upload an empty file');
-
-        // Nothing was sent — the empty source surfaces instead of creating a 0-byte asset.
-        expect(capture.requestSpy).not.toHaveBeenCalled();
-      } finally {
-        capture.restore();
-      }
-    });
-
-    it('throws when the uri cannot be fetched (non-ok response)', async () => {
-      const fetchMock = jest
-        .fn()
-        .mockResolvedValue({ ok: false, status: 404, blob: async () => new Blob([]) });
-      globalThis.fetch = fetchMock as unknown as typeof fetch;
-
-      const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-      const capture = captureUpload(oxy);
-
-      try {
-        await expect(
-          oxy.assetUpload({ uri: 'https://cdn.test/missing.png', type: 'image/png', name: 'missing.png' }),
-        ).rejects.toThrow('Failed to read file from uri (status 404)');
-        expect(capture.requestSpy).not.toHaveBeenCalled();
-      } finally {
-        capture.restore();
-      }
-    });
-  });
-
-  describe('React Native', () => {
-    beforeEach(() => {
-      // Make isReactNative() === true: navigator.product === 'ReactNative'.
-      (globalThis as { navigator?: unknown }).navigator = { product: 'ReactNative' };
-    });
-
-    it('appends the descriptor as-is and never calls fetch', async () => {
-      const fetchMock = jest.fn();
-      globalThis.fetch = fetchMock as unknown as typeof fetch;
-
-      const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
-      const capture = captureUpload(oxy);
-
-      const descriptor = { uri: 'file:///tmp/avatar.png', type: 'image/png', name: 'avatar.png', size: 1024 };
-
-      try {
-        await oxy.assetUpload(descriptor);
-
-        // RN path: the raw descriptor object lands in the multipart body unchanged.
-        const filePart = capture.appended.find((p) => p.name === 'file');
-        expect(filePart?.value).toBe(descriptor);
-        expect(filePart?.fileName).toBe('avatar.png');
-        // No in-JS materialization on RN — FormData reads the file from the uri.
-        expect(fetchMock).not.toHaveBeenCalled();
-      } finally {
-        capture.restore();
-      }
-    });
-  });
-});