@oxy.so/core 1.18.1 → 3.0.0

package/dist/cjs/server/namespaces.js

@@ -0,0 +1,214 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServerReputationApi = exports.ServerAgencyApi = exports.ServerLinkedAccountsApi = exports.ServerNotificationsApi = exports.ServerAssetsApi = void 0;
+const assets_1 = require("../api/assets");
+const notifications_1 = require("../api/notifications");
+const linkedAccounts_1 = require("../api/linkedAccounts");
+const agency_1 = require("../api/agency");
+const reputation_1 = require("../api/reputation");
+const OxyServices_errors_1 = require("../OxyServices.errors");
+const errorUtils_1 = require("../utils/errorUtils");
+const logger_1 = require("../logger");
+/** Server-side cap of `POST /assets/service/by-ids`. */
+const SERVICE_ASSET_METADATA_CHUNK_SIZE = 100;
+/** Server-side cap of `POST /assets/service/by-sha256`. */
+const SERVICE_ASSET_METADATA_BY_SHA_CHUNK_SIZE = 100;
+/** Server-side cap of `POST /assets/service/linked-url`. */
+const SERVICE_LINKED_DOWNLOAD_URL_CHUNK_SIZE = 25;
+const SHA256_HEX_PATTERN = /^[a-f0-9]{64}$/;
+const REPUTATION_CACHE_PREFIX = 'GET:/reputation/';
+function lane(ctx) {
+    if (!ctx.service) {
+        throw new Error('This call needs a service credential (OxyServer from @oxy.so/core/server)');
+    }
+    return ctx.service;
+}
+function chunk(items, size) {
+    const chunks = [];
+    for (let i = 0; i < items.length; i += size)
+        chunks.push(items.slice(i, i + size));
+    return chunks;
+}
+function uniqueIds(ids) {
+    return Array.from(new Set(ids.filter((id) => typeof id === 'string' && id.trim().length > 0)));
+}
+class ServerAssetsApi extends assets_1.AssetsApi {
+    /**
+     * Resolve many asset ids to their content-addressed metadata (`sha256`,
+     * `mime`, `size`, `status`) via `POST /assets/service/by-ids`, one call per
+     * chunk of 100. Service token with `files:read`.
+     *
+     * The server omits unknown/deleted ids, so a short result is normal — map by
+     * `id`. FAILURE IS NOT ABSENCE: a failed chunk throws
+     * {@link ServiceAssetMetadataError} carrying the ids it could not resolve,
+     * unless `{ partial: true }` asks for best-effort. Never cached.
+     */
+    async metadataByIds(ids, options = {}) {
+        const unique = uniqueIds(ids);
+        if (unique.length === 0)
+            return [];
+        const unresolvedIds = [];
+        const statuses = [];
+        let firstError;
+        const settled = await Promise.all(chunk(unique, SERVICE_ASSET_METADATA_CHUNK_SIZE).map(async (part) => {
+            try {
+                const entries = await lane(this.ctx).request('POST', '/assets/service/by-ids', { ids: part });
+                return Array.isArray(entries) ? entries : [];
+            }
+            catch (error) {
+                const status = (0, errorUtils_1.extractErrorStatus)(error);
+                logger_1.logger.warn('assets.metadataByIds: chunk failed', {
+                    method: 'assets.metadataByIds',
+                    chunkSize: part.length,
+                    status,
+                    partial: options.partial === true,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                unresolvedIds.push(...part);
+                if (typeof status === 'number')
+                    statuses.push(status);
+                firstError ?? (firstError = error);
+                return [];
+            }
+        }));
+        if (unresolvedIds.length > 0 && options.partial !== true) {
+            throw new OxyServices_errors_1.ServiceAssetMetadataError(unresolvedIds, statuses, firstError);
+        }
+        return settled.flat();
+    }
+    /**
+     * Mint short-lived direct download URLs for files the calling application's
+     * own users attached to it (`POST /assets/service/linked-url`, scope
+     * `files:linked:read`). The ONLY way a service token reaches file bytes.
+     *
+     * A URL comes back only for a file whose OWN OWNER linked it to this
+     * application; every other id is omitted, and the route answers identically
+     * for "no such file" and "not yours". ABSENCE IS A REFUSAL, not a fact about
+     * the file: decide what to tell your user from your own entitlement record.
+     * A failed chunk throws {@link ServiceLinkedDownloadUrlError}; there is no
+     * partial mode. Never cached — each URL is a live credential.
+     */
+    async linkedDownloadUrls(ids) {
+        const unique = uniqueIds(ids);
+        if (unique.length === 0)
+            return [];
+        const unresolvedIds = [];
+        const statuses = [];
+        let firstError;
+        const settled = await Promise.all(chunk(unique, SERVICE_LINKED_DOWNLOAD_URL_CHUNK_SIZE).map(async (part) => {
+            try {
+                const entries = await lane(this.ctx).request('POST', '/assets/service/linked-url', { ids: part });
+                return Array.isArray(entries) ? entries : [];
+            }
+            catch (error) {
+                const status = (0, errorUtils_1.extractErrorStatus)(error);
+                // `chunkSize` and `status`, never the ids and never a `url`: a minted
+                // URL in a log line is a credential in a log line.
+                logger_1.logger.warn('assets.linkedDownloadUrls: chunk failed', {
+                    method: 'assets.linkedDownloadUrls',
+                    chunkSize: part.length,
+                    status,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                unresolvedIds.push(...part);
+                if (typeof status === 'number')
+                    statuses.push(status);
+                firstError ?? (firstError = error);
+                return [];
+            }
+        }));
+        if (unresolvedIds.length > 0) {
+            throw new OxyServices_errors_1.ServiceLinkedDownloadUrlError(unresolvedIds, statuses, firstError);
+        }
+        return settled.flat();
+    }
+    /**
+     * Reverse content-address lookup: resolve `sha256` digests to the servable
+     * asset holding each (`POST /assets/service/by-sha256`, scope `files:read`),
+     * with a public `url` for active public assets. Malformed hashes are dropped
+     * client-side; the server omits unknown ones, so map by `sha256`. A failed
+     * chunk is logged and skipped. Never cached.
+     */
+    async metadataBySha256(sha256s) {
+        const unique = Array.from(new Set(sha256s
+            .filter((sha) => typeof sha === 'string')
+            .map((sha) => sha.trim().toLowerCase())
+            .filter((sha) => SHA256_HEX_PATTERN.test(sha))));
+        if (unique.length === 0)
+            return [];
+        const settled = await Promise.all(chunk(unique, SERVICE_ASSET_METADATA_BY_SHA_CHUNK_SIZE).map(async (part) => {
+            try {
+                const entries = await lane(this.ctx).request('POST', '/assets/service/by-sha256', { sha256s: part });
+                return Array.isArray(entries) ? entries : [];
+            }
+            catch (error) {
+                logger_1.logger.warn('assets.metadataBySha256: chunk failed, continuing with remaining chunks', {
+                    method: 'assets.metadataBySha256',
+                    chunkSize: part.length,
+                    status: (0, errorUtils_1.extractErrorStatus)(error),
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                return [];
+            }
+        }));
+        return settled.flat();
+    }
+}
+exports.ServerAssetsApi = ServerAssetsApi;
+class ServerNotificationsApi extends notifications_1.NotificationsApi {
+    /**
+     * Create a notification (`POST /notifications`; the application needs
+     * `notifications:write`). `type` is one of `OXY_NOTIFICATION_TYPES` from
+     * `@oxy.so/contracts` — `system` for a message from an Oxy service about the
+     * recipient's own account.
+     */
+    async create(data) {
+        const res = await lane(this.ctx).request('POST', '/notifications', data);
+        return res.notification;
+    }
+}
+exports.ServerNotificationsApi = ServerNotificationsApi;
+class ServerLinkedAccountsApi extends linkedAccounts_1.LinkedAccountsApi {
+    /**
+     * A user's live linked accounts, each with the federated shadow user Oxy holds
+     * for it (`federatedUserId`). Needs the privileged `linked-accounts:read`.
+     */
+    async forUser(userId) {
+        return lane(this.ctx).request('GET', `/linked-accounts/by-user/${encodeURIComponent(userId)}`);
+    }
+}
+exports.ServerLinkedAccountsApi = ServerLinkedAccountsApi;
+class ServerAgencyApi extends agency_1.AgencyApi {
+    /**
+     * Product backend → Oxy: trade the signed-in requester's access token for a
+     * one-use assertion naming `agentId` (ADR 0025), authenticated with this
+     * service's credential. `subjectToken` goes to Oxy only, in the body; never
+     * forward it anywhere else. Not retried: a refusal is an answer, and the
+     * caller mints per turn.
+     */
+    async mintRequesterAssertion(input) {
+        return lane(this.ctx).request('POST', '/internal/native-agents/requester-assertions', { agentId: input.agentId, subjectToken: input.subjectToken }, { retry: false, timeout: 5000 });
+    }
+    /**
+     * Audience → Oxy: verify, live-revalidate and CONSUME a present-requester
+     * assertion (ADR 0025). A second call with the same assertion answers
+     * `active: false`. Authenticated with the audience's own service credential.
+     */
+    async introspectRequesterAssertion(input) {
+        return lane(this.ctx).request('POST', '/internal/native-agents/requester-assertions/introspect', { assertion: input.assertion, presenter: input.presenter }, { retry: false, timeout: 5000 });
+    }
+}
+exports.ServerAgencyApi = ServerAgencyApi;
+class ServerReputationApi extends reputation_1.ReputationApi {
+    /**
+     * Award (or penalise) reputation to a user by `actionType`. Service token with
+     * `reputation:write` only — people never award reputation, and nobody at Oxy
+     * moves it by hand. Invalidates cached reputation reads.
+     */
+    async award(input) {
+        const res = await lane(this.ctx).request('POST', '/reputation/award', input);
+        this.ctx.oxy.cache.deletePrefix(REPUTATION_CACHE_PREFIX);
+        return res.transaction;
+    }
+}
+exports.ServerReputationApi = ServerReputationApi;

package/dist/cjs/server/rateLimit.js

@@ -122,7 +122,7 @@ function hashAnonymousIp(ip) {
  *
  * Only identities that came from a server-validated session or a verified
  * service token/delegation may pick a bucket. `req.sessionId` is the marker
- * for the former: `oxy.auth()` sets it only after `validateSession()` came
+ * for the former: `server.middleware.auth()` sets it only after `session.validate()` came
  * back valid, so requiring it here means an identity written by some OTHER
  * middleware — which this package cannot vouch for — shares the anonymous
  * per-IP bucket rather than getting the authenticated quota.
@@ -162,7 +162,7 @@ function createOxyRateLimit(oxy, options = {}) {
     // Idempotent optional-auth resolver. Reuses the SAME session resolution as
     // every protected route, so the limiter keys by the real user identity.
     //
-    // `createOptionalOxyAuth` — NOT the raw `oxy.auth({ optional: true })` —
+    // `createOptionalOxyAuth` — NOT the raw `server.middleware.auth({ optional: true })` —
     // because only the former skips resolution when a preceding middleware has
     // already resolved a user. The raw middleware writes `req.userId = null` on
     // every request it cannot authenticate, and because it mutates the shared

package/dist/cjs/server/requesterAssertion.js

@@ -3,7 +3,7 @@
  * Present-requester assertions (ADR 0025).
  *
  * A first-party product backend holding a signed-in person's live Oxy session
- * trades it with Oxy (`OxyServices.mintRequesterAssertion`) for a one-use,
+ * trades it with Oxy (`server.agency.mintRequesterAssertion`) for a one-use,
  * short-lived `OXY-REQUESTER+JWT`, and sends that — never the person's bearer —
  * to the audience service (Alia) beside its own service token. The audience
  * mounts {@link createOxyRequesterAssertionAuth} after `createOxyAuthMiddleware`
@@ -267,8 +267,8 @@ function singleHeader(req, name) {
  * token. Mount it after `createOxyAuthMiddleware`. Without the header it does
  * nothing, so it composes with every other lane.
  *
- * `introspector` must be an `OxyServices` configured with THIS service's own
- * credential (`configureServiceAuth`): Oxy only lets the audience's application
+ * `introspector` is this service's `OxyServer`, holding THIS service's own
+ * credential: Oxy only lets the audience's application
  * consume an assertion.
  */
 function createOxyRequesterAssertionAuth(introspector, options) {
@@ -277,7 +277,7 @@ function createOxyRequesterAssertionAuth(introspector, options) {
     const resolver = () => {
         resolvePublicKey ?? (resolvePublicKey = createOxyJwksKeyResolver({
             jwksUrl: options.jwksUrl
-                ?? new URL('/capabilities/.well-known/jwks.json', introspector.getBaseURL()).toString(),
+                ?? new URL('/capabilities/.well-known/jwks.json', introspector.baseURL).toString(),
         }));
         return resolvePublicKey;
     };
@@ -329,7 +329,7 @@ function createOxyRequesterAssertionAuth(introspector, options) {
         }
         let introspection;
         try {
-            introspection = await introspector.introspectRequesterAssertion({
+            introspection = await introspector.agency.introspectRequesterAssertion({
                 assertion,
                 presenter: { applicationId: serviceApp.appId, credentialId: serviceApp.credentialId },
             });

package/dist/cjs/server/securityHeaders.js

@@ -326,10 +326,10 @@ const MAX_INLINE_SCRIPT_HASHES = 8;
  * react-native-web's runtime stylesheet, and a style hash would silently switch
  * that off and render every Oxy web app unstyled.)
  */
-/** Passkeys for this origin itself; every other powerful feature off. */
+/** Every powerful feature off, WebAuthn included: Oxy has no passkeys (ADR 0030). */
 const SENSITIVE_PERMISSIONS_POLICY = [
-    'publickey-credentials-get=(self)',
-    'publickey-credentials-create=(self)',
+    'publickey-credentials-get=()',
+    'publickey-credentials-create=()',
     'camera=()',
     'microphone=()',
     'geolocation=()',

package/dist/cjs/server/traffic.js

@@ -4,8 +4,8 @@ exports.createEcosystemTraffic = createEcosystemTraffic;
 const trafficNodeHttp_1 = require("./trafficNodeHttp");
 const socket_1 = require("@oxy.so/telemetry/socket");
 const node_crypto_1 = require("node:crypto");
-const OxyServices_1 = require("../OxyServices");
-// Static, unlike the lazy import in `mixins/OxyServices.auth.ts`: that module is
+const OxyServer_1 = require("./OxyServer");
+// Static, like `OxyServer`'s own import: this module is
 // reachable from the root barrel, which ships to React Native, so pulling
 // `node:crypto` in eagerly there would cost every mobile bundle. This file is
 // server-only and the server barrel already exports `./workloadIdentity`, so
@@ -44,12 +44,12 @@ function createEcosystemTraffic(options) {
     if (!options.credential && (!apiKey || !apiSecret) && !(0, workloadIdentity_1.canAttestWorkloadIdentity)()) {
         throw new Error('Ecosystem activity needs one of: an OXY_ACTIVITY_API_KEY and OXY_ACTIVITY_API_SECRET pair, an OXY_SERVICE_API_KEY and OXY_SERVICE_API_SECRET pair, or a workload identity this process can attest (ADR 0026).');
     }
-    const oxy = new OxyServices_1.OxyServices({ baseURL });
-    // Left unconfigured when there is no pair on purpose: `getServiceToken()`
+    const oxy = new OxyServer_1.OxyServer({ baseURL });
+    // Left unconfigured when there is no pair on purpose: `serviceToken()`
     // attests instead of being handed half a credential to fail on.
     if (apiKey && apiSecret)
         oxy.configureServiceAuth(apiKey, apiSecret);
-    const credential = options.credential ?? (() => oxy.getServiceToken());
+    const credential = options.credential ?? (() => oxy.serviceToken());
     const fetcher = globalThis.fetch.bind(globalThis);
     const instanceId = (0, node_crypto_1.randomUUID)();
     const location = options.location ?? (0, collector_1.infrastructureLocation)(region);
@@ -129,6 +129,7 @@ function createEcosystemTraffic(options) {
             return cleanup;
         },
         async stop() { if (stopped)
-            return; stopped = true; cleanups.forEach(cleanup => cleanup()); cleanups.clear(); clearInterval(timer); clearInterval(heartbeatTimer); await flush(); await heartbeat(true); },
+            return; stopped = true; for (const cleanup of cleanups)
+            cleanup(); cleanups.clear(); clearInterval(timer); clearInterval(heartbeatTimer); await flush(); await heartbeat(true); },
     };
 }

package/dist/cjs/server/trafficNodeHttp.js

@@ -70,8 +70,8 @@ function observeNodeHttp(collector, service, region, resolveEndpoint) {
     const patches = [node_http_1.default, node_https_1.default].map(module => {
         const request = module.request;
         const get = module.get;
-        const wrappedRequest = function (...args) { return safelyObserve(request.apply(module, args)); };
-        const wrappedGet = function (...args) { return safelyObserve(get.apply(module, args)); };
+        const wrappedRequest = ((...args) => safelyObserve(request.apply(module, args)));
+        const wrappedGet = ((...args) => safelyObserve(get.apply(module, args)));
         module.request = wrappedRequest;
         module.get = wrappedGet;
         return () => {
@@ -82,5 +82,11 @@ function observeNodeHttp(collector, service, region, resolveEndpoint) {
         };
     });
     (0, node_module_1.syncBuiltinESMExports)();
-    return () => { patches.forEach(restore => restore()); restoreRequests.forEach(restore => restore()); (0, node_module_1.syncBuiltinESMExports)(); };
+    return () => {
+        for (const restore of patches)
+            restore();
+        for (const restore of restoreRequests)
+            restore();
+        (0, node_module_1.syncBuiltinESMExports)();
+    };
 }

package/dist/cjs/server/userInvalidation.js

@@ -7,8 +7,8 @@
  * Every Oxy backend caches Oxy identity, and none of them find out when it
  * changes. The `OxyServices` GET response cache holds `GET /users/:id` and
  * `GET /profiles/username/:name` for five minutes; it is swept when THIS process
- * writes the profile (the `evictOxyIdentityCache` calls in the user and accounts
- * mixins) and never when somebody else does — which is the normal case, since
+ * writes the profile (the `evictOxyIdentityCache` calls in the `users` and
+ * `accounts` namespaces) and never when somebody else does — which is the normal case, since
  * profiles are edited in Oxy's own apps. So an avatar or display-name change is
  * invisible to every consuming backend for up to five minutes, per process.
  *
@@ -35,11 +35,11 @@
  *     // node-redis
  *     await subscriber.subscribe(
  *       OXY_USER_INVALIDATION_CHANNEL,
- *       createOxyUserInvalidationHandler({ oxy: oxyClient }),
+ *       createOxyUserInvalidationHandler({ oxy: server }),
  *     );
  *
  *     // ioredis
- *     const handle = createOxyUserInvalidationHandler({ oxy: oxyClient });
+ *     const handle = createOxyUserInvalidationHandler({ oxy: server });
  *     await subscriber.subscribe(OXY_USER_INVALIDATION_CHANNEL);
  *     subscriber.on('message', (_channel, raw) => handle(raw));
  *
@@ -134,7 +134,7 @@ function createOxyUserInvalidationHandler(options = {}) {
         }
         if (oxy) {
             try {
-                (0, identityCacheSweep_1.evictOxyIdentityCache)(oxy, event.userId);
+                (0, identityCacheSweep_1.evictOxyIdentityCache)(oxy.http, event.userId);
             }
             catch (error) {
                 // A cache sweep must never cost us the app-specific eviction below.

package/dist/cjs/session/accountDialogController.js

@@ -21,8 +21,8 @@
  *     account` pair) and the two removals an account id cannot name —
  *     `signOutContext` and `signOutPrincipal`;
  *   - the "Sign in with Oxy" device flow (same-device shared-keychain via
- *     `oxyServices.signInWithSharedIdentity`, else the cross-device QR handoff
- *     via `startCommonsSignIn` → poll → `claimSessionByToken`);
+ *     `oxy.auth.signInWithSharedIdentity`, else the cross-device QR handoff
+ *     via `oxy.auth.commons.start` → poll → `oxy.auth.claimSession`);
  *   - AUTOMATIC delivery selection for that flow (issue #691): the user presses
  *     ONE primary action and the controller — not the user — picks how the
  *     request reaches their Commons identity, by gathering the facts
@@ -38,10 +38,10 @@
  *     (native only, via the injected `canOpenApp` probe), so the QR view can
  *     offer a "Get Commons" fallback instead of a same-device dead end.
  *
- * Sign-in is passkey (WebAuthn) or the Commons QR / shared-keychain handoff —
- * password, social login, and 2FA were removed ecosystem-wide. Account
- * creation (`signup` view) is the same two identity backends: a passkey
- * ceremony on web, or a Commons-created identity.
+ * Sign-in is by email (a code or a link), an optional password and an
+ * optional authenticator, or the Commons QR / shared-keychain handoff. Account
+ * creation (`signup` view) is a username and a confirmed email, or a
+ * Commons-created identity.
  *
  * The controller owns NO surface PRESENTATION: whether the account dialog is
  * mounted, visible, or dismissed is the job of the shared surface stack
@@ -245,9 +245,9 @@ class AccountDialogController {
         // has returned; `ensureActiveToken` plants it async later), so the
         // device-state subscription alone cannot observe the signed-out → signed-in
         // edge. Observe the SDK-canonical readiness signal directly — a change to
-        // `oxyServices.getAccessToken()`, the `hasAccessToken` term of
+        // `oxy.session.accessToken`, the `hasAccessToken` term of
         // `OxyContext.canUsePrivateApi`.
-        this.unsubscribeTokens = this.oxyServices.onTokensChanged(() => {
+        this.unsubscribeTokens = this.oxyServices.session.onChange(() => {
             this.reconcileAuth();
         });
         // Initial projection is device-only. `refresh()` fetches the graph IFF a
@@ -288,7 +288,7 @@ class AccountDialogController {
      * Whether a PRIVATE endpoint may be called right now. Mirrors the
      * `hasAccessToken` term of `OxyContext.canUsePrivateApi`
      * (`authResolved && isAuthenticated && tokenReady && hasAccessToken`, where
-     * `hasAccessToken = Boolean(oxyServices.getAccessToken())`): a planted bearer
+     * `hasAccessToken = Boolean(oxy.session.accessToken)`): a planted bearer
      * is the only term that decides whether a request carries auth — the other
      * three are provider render-lifecycle gates with no headless equivalent.
      *
@@ -299,7 +299,7 @@ class AccountDialogController {
      * on this.
      */
     isAuthenticated() {
-        return Boolean(this.oxyServices.getAccessToken());
+        return Boolean(this.oxyServices.session.accessToken);
     }
     /**
      * Reconcile the account graph against the current auth-readiness edge. On the
@@ -386,7 +386,7 @@ class AccountDialogController {
     add() {
         this.setView('add');
     }
-    /** Switch to the "create account" view (passkey / Commons signup entry). */
+    /** Switch to the "create account" view (email / Commons signup entry). */
     startSignup() {
         this.setView('signup');
     }
@@ -635,7 +635,7 @@ class AccountDialogController {
         try {
             // Minted WITHOUT planting the bearer: `completeSignIn` installs it only if
             // this attempt is still the current one when the mint returns.
-            const session = await this.oxyServices.signInWithSharedIdentity({ plantTokens: false });
+            const session = await this.oxyServices.auth.signInWithSharedIdentity({ plantTokens: false });
             if (!this.isCurrentAttempt(attempt))
                 return;
             if (session) {
@@ -732,7 +732,7 @@ class AccountDialogController {
         this.setSignIn({ ...IDLE_SIGN_IN_FACTS, phase: 'starting' });
         let handle;
         try {
-            handle = await this.oxyServices.startCommonsSignIn({ clientId: this.clientId });
+            handle = await this.oxyServices.auth.commons.start({ clientId: this.clientId });
         }
         catch (error) {
             if (!this.isCurrentAttempt(attempt))
@@ -840,7 +840,7 @@ class AccountDialogController {
         if (!this.isAuthenticated())
             return 0;
         try {
-            const result = await this.oxyServices.deliverCommonsSignIn(authorizeCode);
+            const result = await this.oxyServices.auth.commons.deliver(authorizeCode);
             // `delivered: false` with `targets > 0` is a transport failure, not a
             // reachable install — the shared helper owns that rule so the surface
             // can never park a user on "check your phone" for a push that failed.
@@ -937,7 +937,7 @@ class AccountDialogController {
      */
     async withdrawRequest(authorizeCode) {
         try {
-            await this.oxyServices.denyCommonsSignIn(authorizeCode);
+            await this.oxyServices.auth.commons.deny(authorizeCode);
         }
         catch (error) {
             logger_1.logger.debug('[AccountDialogController] request withdrawal failed', { component: 'AccountDialogController' }, error);
@@ -972,7 +972,7 @@ class AccountDialogController {
                 return;
             }
             try {
-                const status = await this.oxyServices.pollCommonsSignIn(sessionToken);
+                const status = await this.oxyServices.auth.commons.poll(sessionToken);
                 if (this.signInToken !== sessionToken)
                     return; // cancelled mid-request
                 // Delivery PROGRESS first: it is reported alongside every status, and
@@ -1035,7 +1035,7 @@ class AccountDialogController {
         try {
             // Claimed WITHOUT planting the bearer — `completeSignIn` installs it only
             // if the user is still waiting for this attempt when the claim returns.
-            claimed = await this.oxyServices.claimSessionByToken(sessionToken, { plantTokens: false });
+            claimed = await this.oxyServices.auth.claimSession(sessionToken, { plantTokens: false });
         }
         catch (error) {
             if (!this.isCurrentAttempt(attempt))
@@ -1100,18 +1100,18 @@ class AccountDialogController {
     async completeSignIn(attempt, session, user) {
         if (!this.isCurrentAttempt(attempt))
             return;
-        const previousToken = this.oxyServices.getAccessToken();
+        const previousToken = this.oxyServices.session.accessToken;
         try {
             if (session.accessToken)
-                this.oxyServices.setTokens(session.accessToken);
+                this.oxyServices.session.setAccessToken(session.accessToken);
             await this.commitAuthorizedSession(session, user);
         }
         catch (error) {
-            if (session.accessToken && this.oxyServices.getAccessToken() === session.accessToken) {
+            if (session.accessToken && this.oxyServices.session.accessToken === session.accessToken) {
                 if (previousToken)
-                    this.oxyServices.setTokens(previousToken);
+                    this.oxyServices.session.setAccessToken(previousToken);
                 else
-                    this.oxyServices.clearTokens();
+                    this.oxyServices.session.clear();
             }
             throw error;
         }
@@ -1179,7 +1179,7 @@ class AccountDialogController {
             return;
         let socket;
         try {
-            socket = socketFactory(`${this.oxyServices.getBaseURL()}${AUTH_SESSION_NAMESPACE}`, {
+            socket = socketFactory(`${this.oxyServices.baseURL}${AUTH_SESSION_NAMESPACE}`, {
                 transports: ['websocket'],
                 autoConnect: true,
                 reconnection: true,

package/dist/cjs/session/authStateStore.js

@@ -175,8 +175,8 @@ function composeState(durableRaw, warmRaw) {
         // New split layout: the warm key is authoritative for the token fields.
         // Drop anything the durable blob may have carried, then overlay the warm
         // values (a warm key with no token → the session simply has no warm token).
-        delete state.accessToken;
-        delete state.expiresAt;
+        Reflect.deleteProperty(state, 'accessToken');
+        Reflect.deleteProperty(state, 'expiresAt');
         const warm = parseWarmToken(warmRaw);
         if (warm?.accessToken) {
             state.accessToken = warm.accessToken;

package/dist/cjs/session/identitySession.js

@@ -98,7 +98,7 @@ async function establishIdentitySession(args) {
     if (!publicKey) {
         return null;
     }
-    const { challenge } = await oxy.requestChallenge(publicKey, requestOptions);
+    const { challenge } = await oxy.auth.requestChallenge(publicKey, requestOptions);
     const signed = await signChallengeOf(binding)(challenge);
     if (signed.publicKey.toLowerCase() !== publicKey.toLowerCase()) {
         // The signer disagrees with the key we resolved a challenge for — the
@@ -107,11 +107,11 @@ async function establishIdentitySession(args) {
         throw new Error('Identity sign-in aborted: the signing key does not match the device identity key');
     }
     // `signed.challenge` carries the SIGNATURE (mirrors `signChallengeWithSharedKey`).
-    const session = await oxy.verifyChallenge(signed.publicKey, challenge, signed.challenge, signed.timestamp, binding.deviceName, binding.deviceFingerprint, requestOptions);
+    const session = await oxy.auth.verifyChallenge(signed.publicKey, challenge, signed.challenge, signed.timestamp, binding.deviceName, binding.deviceFingerprint, requestOptions);
     if (!session?.accessToken) {
         return null;
     }
-    // Persist the rotating device credential so later boots re-mint through the
+    // Persist the device credential so later boots re-mint through the
     // fast `POST /session/device/token` lane instead of re-signing a challenge.
     if (session.deviceId && session.deviceSecret) {
         await store.save({