@oxy.so/core 1.18.1 → 3.0.0

package/src/mixins/__tests__/identityWriteCacheInvalidation.test.ts

@@ -1,407 +0,0 @@
-/**
- * Identity-cache invalidation for the profile WRITERS, against the REAL
- * response cache.
- *
- * An account IS a user, and a profile screen never reads `/accounts/<id>` — it
- * reads `GET /users/<id>` and `GET /profiles/username/<handle>`, both cached for
- * five minutes in the caller's own process. `updateAccount` used to bust only
- * the account-graph keys, so for up to five minutes after an edit a refetch
- * handed back the PRE-EDIT profile from the client's own cache, with a
- * perfectly healthy server ("I changed my channel's picture and it doesn't
- * update until I reload the page").
- *
- * These tests drive the real `HttpService` cache over a mocked `fetch` rather
- * than spying on `clearCacheEntry` / `clearCacheByPrefix`, because a spy proves
- * only that SOME string was passed — not that the entry a read actually lands
- * under was evicted. The load-bearing case is the RENAME: an implementation
- * that busts the exact key for the handle in the write RESPONSE passes every
- * assertion about the new handle while leaving the OLD handle's entry serving
- * the pre-rename profile until its TTL. Both handles are warmed here so the two
- * implementations disagree.
- *
- * `updateProfile` is covered here too, because it carried a SECOND, drifted
- * hand-written copy of the same key list — it swept four of the six keys,
- * missing `GET:/auth/lookup/` and `GET:/profiles/resolve`. Both writers now
- * share one enumeration (`utils/identityCacheSweep`), and this is where that is
- * asserted from the outside.
- */
-
-import { OxyServices } from '../../OxyServices';
-import type { AccountNode } from '../OxyServices.accounts';
-
-/**
- * A non-verified JWT whose payload decodes to the given claims — enough for the
- * cache's identity tag and the bearer preflight (`jwtDecode` never checks a
- * signature).
- */
-function makeJwt(payload: Record<string, unknown>): string {
-  const b64url = (obj: Record<string, unknown>): string =>
-    Buffer.from(JSON.stringify(obj)).toString('base64url');
-  return `${b64url({ alg: 'none', typ: 'JWT' })}.${b64url({
-    exp: Math.floor(Date.now() / 1000) + 3600,
-    ...payload,
-  })}.sig`;
-}
-
-/** A JSON `Response` in the API's `{ data: ... }` success envelope. */
-function jsonResponse(data: unknown): Response {
-  return new Response(JSON.stringify({ data }), {
-    status: 200,
-    headers: { 'content-type': 'application/json' },
-  });
-}
-
-const ACCOUNT_ID = 'acc1';
-const PARENT_ID = 'root1';
-const OLD_USERNAME = 'oldhandle';
-const NEW_USERNAME = 'newhandle';
-
-/** The write response: the account after a rename + a new picture. */
-const renamedNode: AccountNode = {
-  accountId: ACCOUNT_ID,
-  kind: 'channel',
-  parentAccountId: PARENT_ID,
-  account: {
-    id: ACCOUNT_ID,
-    publicKey: 'pk-acc1',
-    username: NEW_USERNAME,
-    name: { displayName: 'Renamed Channel' },
-    avatar: 'file_new',
-  },
-  relationship: 'owner',
-  callerMembership: null,
-};
-
-describe('updateAccount identity-cache invalidation (real cache)', () => {
-  let originalFetch: typeof globalThis.fetch;
-  let fetchMock: jest.Mock<Promise<Response>, [RequestInfo | URL, RequestInit?]>;
-  let oxy: OxyServices;
-
-  beforeEach(() => {
-    originalFetch = globalThis.fetch;
-    fetchMock = jest.fn();
-    globalThis.fetch = fetchMock as unknown as typeof globalThis.fetch;
-
-    oxy = new OxyServices({
-      baseURL: 'http://test.invalid',
-      enableRetry: false,
-      requestTimeout: 1000,
-    });
-    oxy.httpService.setTokens(makeJwt({ userId: 'operator-1' }));
-  });
-
-  afterEach(() => {
-    globalThis.fetch = originalFetch;
-    jest.clearAllMocks();
-  });
-
-  /**
-   * Warm every cache entry an account can be served under, plus one unrelated
-   * entry that must SURVIVE. Returns the number of network calls made, so each
-   * assertion below can be expressed as "did this read hit the network again".
-   */
-  async function warmCaches(): Promise<number> {
-    // The profile screen's two reads, under the handle it had BEFORE the edit
-    // and under the id.
-    fetchMock.mockResolvedValueOnce(jsonResponse({ id: ACCOUNT_ID, username: OLD_USERNAME }));
-    await oxy.getProfileByUsername(OLD_USERNAME);
-    fetchMock.mockResolvedValueOnce(jsonResponse({ id: ACCOUNT_ID, username: OLD_USERNAME }));
-    await oxy.getUserById(ACCOUNT_ID);
-
-    // The handle the account is ABOUT to be renamed to may already be warm (a
-    // 404-shaped read, a previous holder, a same-session preview). Warming it
-    // is what makes the old-handle assertion below non-vacuous: an
-    // implementation that busts only the response's handle passes for this one.
-    fetchMock.mockResolvedValueOnce(jsonResponse({ id: ACCOUNT_ID, username: NEW_USERNAME }));
-    await oxy.getProfileByUsername(NEW_USERNAME);
-
-    // The pre-session login lookup (carries avatar + display name) and handle
-    // resolution — two keys the SDK's own profile-write sweep had drifted away
-    // from, and which no test previously covered from a write.
-    fetchMock.mockResolvedValueOnce(jsonResponse({ exists: true, username: OLD_USERNAME }));
-    await oxy.lookupUsername(OLD_USERNAME);
-    fetchMock.mockResolvedValueOnce(jsonResponse({ id: ACCOUNT_ID, username: OLD_USERNAME }));
-    await oxy.resolveProfile(`@${OLD_USERNAME}@test.invalid`);
-
-    // The account-graph reads.
-    fetchMock.mockResolvedValueOnce(jsonResponse({ account: renamedNode }));
-    await oxy.getAccount(ACCOUNT_ID);
-    fetchMock.mockResolvedValueOnce(jsonResponse({ accounts: [renamedNode] }));
-    await oxy.listAccounts();
-    fetchMock.mockResolvedValueOnce(jsonResponse({ accounts: [renamedNode] }));
-    await oxy.listChildAccounts(PARENT_ID);
-
-    // An unrelated cached read. It must survive — the vacuity floor that tells
-    // a targeted sweep from a blanket `clearCache()`.
-    fetchMock.mockResolvedValueOnce(jsonResponse({ count: 3 }));
-    await oxy.httpService.get('/notifications/unread-count', { cache: true });
-
-    return fetchMock.mock.calls.length;
-  }
-
-  /** Perform the rename + picture change. */
-  async function performUpdate(): Promise<void> {
-    fetchMock.mockResolvedValueOnce(jsonResponse({ account: renamedNode }));
-    await oxy.updateAccount(ACCOUNT_ID, {
-      username: NEW_USERNAME,
-      avatar: 'file_new',
-    });
-  }
-
-  it('warms every read it later asserts on (control: all are cache hits before the write)', async () => {
-    const warmed = await warmCaches();
-
-    // Re-issue every read with no queued response. A cache MISS would call
-    // `fetch`, which now resolves `undefined` and throws — so a green run here
-    // is proof that each entry really is resident, and that the assertions
-    // below are measuring eviction rather than a cache that was never warm.
-    await oxy.getProfileByUsername(OLD_USERNAME);
-    await oxy.getProfileByUsername(NEW_USERNAME);
-    await oxy.getUserById(ACCOUNT_ID);
-    await oxy.lookupUsername(OLD_USERNAME);
-    await oxy.resolveProfile(`@${OLD_USERNAME}@test.invalid`);
-    await oxy.getAccount(ACCOUNT_ID);
-    await oxy.listAccounts();
-    await oxy.listChildAccounts(PARENT_ID);
-    await oxy.httpService.get('/notifications/unread-count', { cache: true });
-
-    expect(fetchMock).toHaveBeenCalledTimes(warmed);
-  });
-
-  it('evicts the OLD handle, not just the handle in the write response', async () => {
-    await warmCaches();
-    await performUpdate();
-    const afterWrite = fetchMock.mock.calls.length;
-
-    // THE assertion. `updateAccount` cannot know the pre-rename handle — it is
-    // in neither the request nor the response — so only a PREFIX sweep of
-    // `GET:/profiles/username/` reaches it. A targeted `clearCacheEntry` for
-    // the response's handle leaves this entry serving the pre-rename profile.
-    fetchMock.mockResolvedValueOnce(jsonResponse({ id: ACCOUNT_ID, username: NEW_USERNAME }));
-    const refetched = await oxy.getProfileByUsername(OLD_USERNAME);
-
-    expect(fetchMock).toHaveBeenCalledTimes(afterWrite + 1);
-    expect(refetched.username).toBe(NEW_USERNAME);
-  });
-
-  it('evicts the by-id profile read the account detail page uses', async () => {
-    await warmCaches();
-    await performUpdate();
-    const afterWrite = fetchMock.mock.calls.length;
-
-    fetchMock.mockResolvedValueOnce(jsonResponse({ id: ACCOUNT_ID, avatar: 'file_new' }));
-    const refetched = await oxy.getUserById(ACCOUNT_ID);
-
-    expect(fetchMock).toHaveBeenCalledTimes(afterWrite + 1);
-    expect(refetched.avatar).toBe('file_new');
-  });
-
-  it('evicts the new handle, the login lookup, and handle resolution', async () => {
-    await warmCaches();
-    await performUpdate();
-    let calls = fetchMock.mock.calls.length;
-
-    fetchMock.mockResolvedValueOnce(jsonResponse({ id: ACCOUNT_ID, username: NEW_USERNAME }));
-    await oxy.getProfileByUsername(NEW_USERNAME);
-    expect(fetchMock).toHaveBeenCalledTimes(++calls);
-
-    fetchMock.mockResolvedValueOnce(jsonResponse({ exists: false, username: OLD_USERNAME }));
-    await oxy.lookupUsername(OLD_USERNAME);
-    expect(fetchMock).toHaveBeenCalledTimes(++calls);
-
-    fetchMock.mockResolvedValueOnce(jsonResponse({ id: ACCOUNT_ID, username: NEW_USERNAME }));
-    await oxy.resolveProfile(`@${OLD_USERNAME}@test.invalid`);
-    expect(fetchMock).toHaveBeenCalledTimes(++calls);
-  });
-
-  it('evicts the account detail, the account lists, and the PARENT children list', async () => {
-    await warmCaches();
-    await performUpdate();
-    let calls = fetchMock.mock.calls.length;
-
-    fetchMock.mockResolvedValueOnce(jsonResponse({ account: renamedNode }));
-    await oxy.getAccount(ACCOUNT_ID);
-    expect(fetchMock).toHaveBeenCalledTimes(++calls);
-
-    fetchMock.mockResolvedValueOnce(jsonResponse({ accounts: [renamedNode] }));
-    await oxy.listAccounts();
-    expect(fetchMock).toHaveBeenCalledTimes(++calls);
-
-    // Keyed by the PARENT id, which is reachable only from the response node —
-    // the child's own id does not build this key.
-    fetchMock.mockResolvedValueOnce(jsonResponse({ accounts: [renamedNode] }));
-    await oxy.listChildAccounts(PARENT_ID);
-    expect(fetchMock).toHaveBeenCalledTimes(++calls);
-  });
-
-  it('leaves unrelated cached reads alone (it is a sweep, not a cache wipe)', async () => {
-    await warmCaches();
-    await performUpdate();
-    const afterWrite = fetchMock.mock.calls.length;
-
-    // No queued response: a miss would call `fetch` and throw.
-    const cached = await oxy.httpService.get<{ count: number }>(
-      '/notifications/unread-count',
-      { cache: true },
-    );
-
-    expect(fetchMock).toHaveBeenCalledTimes(afterWrite);
-    expect(cached.count).toBe(3);
-  });
-
-  it('does not sweep when the write fails', async () => {
-    await warmCaches();
-    const warmed = fetchMock.mock.calls.length;
-
-    fetchMock.mockResolvedValueOnce(
-      new Response(JSON.stringify({ message: 'forbidden' }), {
-        status: 403,
-        headers: { 'content-type': 'application/json' },
-      }),
-    );
-    await expect(
-      oxy.updateAccount(ACCOUNT_ID, { avatar: 'file_new' }),
-    ).rejects.toThrow();
-
-    // The failed PATCH is one call; every read below must still be a cache hit.
-    await oxy.getProfileByUsername(OLD_USERNAME);
-    await oxy.getUserById(ACCOUNT_ID);
-    await oxy.getAccount(ACCOUNT_ID);
-
-    expect(fetchMock).toHaveBeenCalledTimes(warmed + 1);
-  });
-
-  it('still sweeps the identity keys when the response carries no parent', async () => {
-    await warmCaches();
-    const rootNode: AccountNode = { ...renamedNode, parentAccountId: null };
-    fetchMock.mockResolvedValueOnce(jsonResponse({ account: rootNode }));
-    await oxy.updateAccount(ACCOUNT_ID, { avatar: 'file_new' });
-    const afterWrite = fetchMock.mock.calls.length;
-
-    // A root account has no children list to bust, but its identity keys go
-    // stale exactly the same way — the `parentAccountId` guard must not gate
-    // the identity sweep.
-    fetchMock.mockResolvedValueOnce(jsonResponse({ id: ACCOUNT_ID, avatar: 'file_new' }));
-    await oxy.getUserById(ACCOUNT_ID);
-
-    expect(fetchMock).toHaveBeenCalledTimes(afterWrite + 1);
-  });
-});
-
-describe('updateProfile identity-cache invalidation (real cache)', () => {
-  let originalFetch: typeof globalThis.fetch;
-  let fetchMock: jest.Mock<Promise<Response>, [RequestInfo | URL, RequestInit?]>;
-  let oxy: OxyServices;
-
-  const SELF_ID = 'me-1';
-
-  beforeEach(() => {
-    originalFetch = globalThis.fetch;
-    fetchMock = jest.fn();
-    globalThis.fetch = fetchMock as unknown as typeof globalThis.fetch;
-    oxy = new OxyServices({
-      baseURL: 'http://test.invalid',
-      enableRetry: false,
-      requestTimeout: 1000,
-    });
-    oxy.httpService.setTokens(makeJwt({ userId: SELF_ID }));
-  });
-
-  afterEach(() => {
-    globalThis.fetch = originalFetch;
-    jest.clearAllMocks();
-  });
-
-  /**
-   * The two keys `updateProfile`'s own hand-written sweep MISSED. They are the
-   * whole point of this block — a test that only re-checked `GET:/users/me` and
-   * `GET:/profiles/username/` would have passed against the drifted version.
-   */
-  it('evicts the login lookup and handle resolution, not just the keys it used to know', async () => {
-    fetchMock.mockResolvedValueOnce(jsonResponse({ exists: true, username: 'alice', avatar: 'old' }));
-    await oxy.lookupUsername('alice');
-    fetchMock.mockResolvedValueOnce(jsonResponse({ id: SELF_ID, avatar: 'old' }));
-    await oxy.resolveProfile('@alice@test.invalid');
-
-    // Control: both are warm (a miss would call the un-queued mock and throw).
-    await oxy.lookupUsername('alice');
-    await oxy.resolveProfile('@alice@test.invalid');
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-
-    fetchMock.mockResolvedValueOnce(jsonResponse({ id: SELF_ID, avatar: 'new' }));
-    await oxy.updateProfile({ avatar: 'new' });
-    expect(fetchMock).toHaveBeenCalledTimes(3);
-
-    fetchMock.mockResolvedValueOnce(jsonResponse({ exists: true, username: 'alice', avatar: 'new' }));
-    await oxy.lookupUsername('alice');
-    expect(fetchMock).toHaveBeenCalledTimes(4);
-
-    fetchMock.mockResolvedValueOnce(jsonResponse({ id: SELF_ID, avatar: 'new' }));
-    await oxy.resolveProfile('@alice@test.invalid');
-    expect(fetchMock).toHaveBeenCalledTimes(5);
-  });
-
-  it('still evicts the self, by-id and handle reads it always did', async () => {
-    fetchMock.mockResolvedValueOnce(jsonResponse({ id: SELF_ID, avatar: 'old' }));
-    await oxy.getCurrentUser();
-    fetchMock.mockResolvedValueOnce(jsonResponse({ id: SELF_ID, avatar: 'old' }));
-    await oxy.getUserById(SELF_ID);
-    fetchMock.mockResolvedValueOnce(jsonResponse({ id: SELF_ID, avatar: 'old' }));
-    await oxy.getProfileByUsername('alice');
-    fetchMock.mockResolvedValueOnce(jsonResponse({ id: SELF_ID, avatar: 'old' }));
-    await oxy.getUserBySession('sess-1');
-    expect(fetchMock).toHaveBeenCalledTimes(4);
-
-    fetchMock.mockResolvedValueOnce(jsonResponse({ id: SELF_ID, avatar: 'new' }));
-    await oxy.updateProfile({ avatar: 'new' });
-
-    let calls = 5;
-    for (const read of [
-      () => oxy.getCurrentUser(),
-      () => oxy.getUserById(SELF_ID),
-      () => oxy.getProfileByUsername('alice'),
-      () => oxy.getUserBySession('sess-1'),
-    ]) {
-      fetchMock.mockResolvedValueOnce(jsonResponse({ id: SELF_ID, avatar: 'new' }));
-      await read();
-      expect(fetchMock).toHaveBeenCalledTimes(++calls);
-    }
-  });
-
-  it('evicts the account forest list and detail after a self-profile edit', async () => {
-    const selfNode: AccountNode = {
-      accountId: SELF_ID,
-      kind: 'personal',
-      parentAccountId: null,
-      account: {
-        id: SELF_ID,
-        publicKey: 'pk-me',
-        username: 'alice',
-        name: { displayName: 'Alice' },
-        avatar: 'old',
-      },
-      relationship: 'self',
-      callerMembership: null,
-    };
-
-    fetchMock.mockResolvedValueOnce(jsonResponse([selfNode]));
-    await oxy.listAccounts();
-    fetchMock.mockResolvedValueOnce(jsonResponse({ account: selfNode }));
-    await oxy.getAccount(SELF_ID);
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-
-    fetchMock.mockResolvedValueOnce(jsonResponse({ id: SELF_ID, avatar: 'new' }));
-    await oxy.updateProfile({ avatar: 'new' });
-    expect(fetchMock).toHaveBeenCalledTimes(3);
-
-    fetchMock.mockResolvedValueOnce(jsonResponse([{ ...selfNode, account: { ...selfNode.account!, avatar: 'new' } }]));
-    await oxy.listAccounts();
-    expect(fetchMock).toHaveBeenCalledTimes(4);
-
-    fetchMock.mockResolvedValueOnce(
-      jsonResponse({ account: { ...selfNode, account: { ...selfNode.account!, avatar: 'new' } } }),
-    );
-    await oxy.getAccount(SELF_ID);
-    expect(fetchMock).toHaveBeenCalledTimes(5);
-  });
-});

package/src/mixins/__tests__/inferenceFactory.test.ts

@@ -1,58 +0,0 @@
-/**
- * `oxyServices.inference()` — the binding, which is the only thing this mixin
- * does.
- *
- * Two properties matter and neither is visible from the client's own suite: the
- * client must inherit THIS instance's base URL, and it must read the bearer
- * LATE, so a token planted after construction is the one that gets sent. A
- * factory that captured `getAccessToken()` eagerly would pass every test that
- * signs in first and fail on the cold-boot ordering every app actually has.
- *
- * Driven through the real global `fetch`, spied — the factory takes no
- * transport, so a test that built its own client would be asserting against a
- * re-implementation of the thing under test rather than against it.
- */
-
-import { OxyServices } from '../../OxyServices';
-import { OxyInferenceClient } from '../../inference/OxyInferenceClient';
-
-describe('OxyServices.inference()', () => {
-    let fetchSpy: jest.SpyInstance;
-
-    beforeEach(() => {
-        fetchSpy = jest.spyOn(globalThis, 'fetch').mockResolvedValue(
-            new Response(JSON.stringify({ data: [], count: 0 }), {
-                status: 200,
-                headers: { 'Content-Type': 'application/json' },
-            }),
-        );
-    });
-
-    afterEach(() => {
-        fetchSpy.mockRestore();
-    });
-
-    it('returns one memoized client, so a consumer can hold it', () => {
-        const oxy = new OxyServices({ baseURL: 'http://test.invalid' });
-
-        const first = oxy.inference();
-        expect(first).toBeInstanceOf(OxyInferenceClient);
-        expect(oxy.inference()).toBe(first);
-    });
-
-    it('binds this instance base URL and reads the bearer at request time', async () => {
-        const oxy = new OxyServices({ baseURL: 'http://test.invalid' });
-        const client = oxy.inference();
-
-        // The token is planted AFTER the client exists — the cold-boot order.
-        oxy.setTokens('planted-later');
-        await client.listModels();
-
-        expect(fetchSpy).toHaveBeenCalledTimes(1);
-        const [url, init] = fetchSpy.mock.calls[0] as [string, RequestInit];
-        expect(String(url)).toBe('http://test.invalid/v1/models');
-        expect((init.headers as Record<string, string>)['Authorization']).toBe(
-            'Bearer planted-later',
-        );
-    });
-});

package/src/mixins/__tests__/linkedAccounts.test.ts

@@ -1,109 +0,0 @@
-/**
- * Linked-accounts SDK surface: the paths, methods and bodies it sends, and the
- * `{ data }` unwrapping. The flow itself is exercised in the API's route tests.
- */
-
-import { OxyServices } from '../../OxyServices';
-
-function makeJwt(payload: Record<string, unknown>): string {
-  const b64url = (obj: Record<string, unknown>): string => Buffer.from(JSON.stringify(obj)).toString('base64url');
-  const fullPayload = { exp: Math.floor(Date.now() / 1000) + 3600, ...payload };
-  return `${b64url({ alg: 'none', typ: 'JWT' })}.${b64url(fullPayload)}.sig`;
-}
-
-function jsonResponse(data: unknown, status = 200): Response {
-  return new Response(status === 204 ? null : JSON.stringify({ data }), {
-    status,
-    headers: { 'content-type': 'application/json' },
-  });
-}
-
-const LINK = {
-  id: 'link-1',
-  network: 'activitypub' as const,
-  accountKey: 'nate@mastodon.social',
-  actorUri: 'https://mastodon.social/users/nate',
-  handle: '@nate@mastodon.social',
-  host: 'mastodon.social',
-  proofMethod: 'oauth' as const,
-  verifiedAt: '2026-09-25T00:00:00.000Z',
-  createdAt: '2026-09-25T00:00:00.000Z',
-};
-
-describe('linked accounts', () => {
-  let originalFetch: typeof globalThis.fetch;
-  let fetchMock: jest.Mock<Promise<Response>, [RequestInfo | URL, RequestInit?]>;
-  let oxy: OxyServices;
-
-  beforeEach(() => {
-    originalFetch = globalThis.fetch;
-    fetchMock = jest.fn();
-    globalThis.fetch = fetchMock as unknown as typeof globalThis.fetch;
-    oxy = new OxyServices({ baseURL: 'http://test.invalid' });
-    oxy.httpService.setTokens(makeJwt({ userId: 'me' }));
-  });
-
-  afterEach(() => {
-    globalThis.fetch = originalFetch;
-    jest.clearAllMocks();
-  });
-
-  it('starts a link with POST /linked-accounts/:network/start and returns the authorize URL', async () => {
-    fetchMock.mockResolvedValueOnce(
-      jsonResponse({ authorizeUrl: 'https://mastodon.social/oauth/authorize?x=1', expiresAt: '2026-09-25T00:10:00.000Z' }),
-    );
-    const started = await oxy.startLinkedAccount('activitypub', {
-      instance: 'mastodon.social',
-      clientId: 'oxy_dk_move',
-      returnTo: 'https://move.oxy.so/linked',
-    });
-    expect(started.authorizeUrl).toBe('https://mastodon.social/oauth/authorize?x=1');
-    const [url, init] = fetchMock.mock.calls[0];
-    expect(String(url)).toBe('http://test.invalid/linked-accounts/activitypub/start');
-    expect(init?.method).toBe('POST');
-    expect(JSON.parse(String(init?.body))).toEqual({
-      instance: 'mastodon.social',
-      clientId: 'oxy_dk_move',
-      returnTo: 'https://move.oxy.so/linked',
-    });
-  });
-
-  it('completes a link with POST /linked-accounts/complete and returns the link', async () => {
-    fetchMock.mockImplementation(async (url) =>
-      String(url).endsWith('/linked-accounts/complete') ? jsonResponse({ linkedAccount: LINK }) : jsonResponse({ csrfToken: 't'.repeat(32) }),
-    );
-    expect(await oxy.completeLinkedAccount('one-time-code')).toEqual(LINK);
-    const completion = fetchMock.mock.calls.find(([url]) => String(url).endsWith('/linked-accounts/complete'));
-    expect(completion?.[1]?.method).toBe('POST');
-    expect(JSON.parse(String(completion?.[1]?.body))).toEqual({ code: 'one-time-code' });
-  });
-
-  it('lists the live links, unwrapping the envelope, without caching', async () => {
-    fetchMock.mockImplementation(async () => jsonResponse({ linkedAccounts: [LINK] }));
-    expect(await oxy.listLinkedAccounts()).toEqual([LINK]);
-    await oxy.listLinkedAccounts();
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-    expect(String(fetchMock.mock.calls[0][0])).toBe('http://test.invalid/linked-accounts');
-  });
-
-  it('revokes with DELETE /linked-accounts/:id', async () => {
-    // A state-changing request may first fetch a CSRF token; answer anything.
-    fetchMock.mockImplementation(async (_url, init) =>
-      init?.method === 'DELETE' ? new Response(null, { status: 204 }) : jsonResponse({ csrfToken: 't'.repeat(32) }),
-    );
-    await oxy.revokeLinkedAccount('link-1');
-    const deletion = fetchMock.mock.calls.find(([, init]) => init?.method === 'DELETE');
-    expect(String(deletion?.[0])).toBe('http://test.invalid/linked-accounts/link-1');
-  });
-
-  it('reads a user\'s links on the service lane with a service token', async () => {
-    const service = new OxyServices({ baseURL: 'http://test.invalid' });
-    jest.spyOn(service, 'getServiceToken').mockResolvedValue('service-token');
-    fetchMock.mockResolvedValueOnce(jsonResponse({ userId: 'u1', linkedAccounts: [{ ...LINK, federatedUserId: null }] }));
-    const result = await service.getLinkedAccountsForUser('u1');
-    expect(result.linkedAccounts[0].federatedUserId).toBeNull();
-    const [url, init] = fetchMock.mock.calls[0];
-    expect(String(url)).toBe('http://test.invalid/linked-accounts/by-user/u1');
-    expect(new Headers(init?.headers).get('authorization')).toBe('Bearer service-token');
-  });
-});

package/src/mixins/__tests__/notifications.read.test.ts

@@ -1,82 +0,0 @@
-/**
- * The notification READ methods against the wire bodies `GET /notifications`,
- * `GET /notifications/unread-count` and `PUT /notifications/:id/read` actually
- * send (`packages/api/src/controllers/notification.controller.ts`), driven
- * through the real HTTP stack with only `fetch` stubbed.
- *
- * They used to be typed against a shape the API never sent: `getNotifications`
- * claimed an array while the server answers a page object, `getUnreadCount`
- * read `count` from a body that carries `unreadCount` (so it always returned
- * `undefined`), and `markNotificationAsRead` dropped the stored notification the
- * server returns — the one authoritative read of a notification by id.
- */
-
-import { OxyServices } from '../../OxyServices';
-
-const SYSTEM_NOTIFICATION = {
-  _id: '0192f0c4-7b1e-7000-8000-000000000001',
-  recipientId: 'user-1',
-  actorId: 'user-1',
-  type: 'system',
-  entityId: 'job-42',
-  entityType: 'app',
-  title: 'Your Mastodon account moved',
-  message: '312 followers came with you.',
-  url: 'https://move.oxy.so/jobs/job-42',
-  read: false,
-  createdAt: '2026-09-26T10:00:00.000Z',
-  updatedAt: '2026-09-26T10:00:00.000Z',
-};
-
-describe('OxyServices notification reads', () => {
-  const originalFetch = globalThis.fetch;
-  let fetchMock: jest.Mock;
-
-  function answer(body: unknown): void {
-    fetchMock.mockResolvedValueOnce(
-      new Response(JSON.stringify(body), { status: 200, headers: { 'content-type': 'application/json' } }),
-    );
-  }
-
-  let oxy: OxyServices;
-  beforeEach(() => {
-    fetchMock = jest.fn();
-    globalThis.fetch = fetchMock as unknown as typeof fetch;
-    oxy = new OxyServices({ baseURL: 'http://api.test.invalid' });
-    oxy.setTokens('test-token');
-  });
-
-  afterEach(() => {
-    globalThis.fetch = originalFetch;
-  });
-
-  it('getNotifications returns the page the API sends, with the paging it asked for', async () => {
-    const page = { notifications: [SYSTEM_NOTIFICATION], unreadCount: 1, hasMore: false, page: 2, limit: 10 };
-    answer({ data: page });
-
-    await expect(oxy.getNotifications({ page: 2, limit: 10 })).resolves.toEqual(page);
-
-    const url = new URL(String(fetchMock.mock.calls[0][0]));
-    expect(url.pathname).toBe('/notifications');
-    expect(url.searchParams.get('page')).toBe('2');
-    expect(url.searchParams.get('limit')).toBe('10');
-  });
-
-  it('getUnreadCount reads `unreadCount`', async () => {
-    answer({ data: { unreadCount: 3 } });
-
-    await expect(oxy.getUnreadCount()).resolves.toBe(3);
-  });
-
-  it('markNotificationAsRead returns the stored notification', async () => {
-    answer({ data: { notification: { ...SYSTEM_NOTIFICATION, read: true } } });
-
-    await expect(oxy.markNotificationAsRead(SYSTEM_NOTIFICATION._id)).resolves.toEqual({
-      ...SYSTEM_NOTIFICATION,
-      read: true,
-    });
-    expect(String(fetchMock.mock.calls[0][0])).toBe(
-      `http://api.test.invalid/notifications/${SYSTEM_NOTIFICATION._id}/read`,
-    );
-  });
-});