@oxy.so/core 1.18.1 → 3.0.0

package/dist/esm/session/refresh.js

@@ -70,8 +70,8 @@ export const REMINT_AFTER_EXPIRY_MS = 2000;
 export async function refreshDeviceSecretArm(deps) {
     const { oxy, store } = deps;
     const pin = deps.pin ?? null;
-    return oxy.httpService.runSingleFlightDeviceSecretMint(async () => {
-        const epoch = oxy.httpService.getSessionEpoch();
+    return oxy.http.runSingleFlightDeviceSecretMint(async () => {
+        const epoch = oxy.http.getSessionEpoch();
         const persisted = await store.load();
         if (!persisted?.deviceId || !persisted?.deviceSecret) {
             return { status: 'no-secret' };
@@ -81,10 +81,10 @@ export async function refreshDeviceSecretArm(deps) {
             // Unpinned callers pass NO third argument at all, so the account-mode call
             // shape (and therefore the request body) is untouched by this feature.
             mint = pin
-                ? await oxy.mintFromDeviceSecret(persisted.deviceId, persisted.deviceSecret, {
+                ? await oxy.devices.mintToken(persisted.deviceId, persisted.deviceSecret, {
                     accountId: pin.accountId,
                 })
-                : await oxy.mintFromDeviceSecret(persisted.deviceId, persisted.deviceSecret);
+                : await oxy.devices.mintToken(persisted.deviceId, persisted.deviceSecret);
         }
         catch (error) {
             // 429 keeps the credential like any other transient failure — the secret
@@ -96,7 +96,7 @@ export async function refreshDeviceSecretArm(deps) {
             // requests. Telling HttpService lengthens the next cooldown to one attempt
             // per limiter window, which lets the budget drain and the session heal.
             if (extractErrorStatus(error) === 429) {
-                oxy.httpService.noteRefreshRateLimited();
+                oxy.http.noteRefreshRateLimited();
                 return { status: 'transient' };
             }
             if (extractErrorStatus(error) === 401) {
@@ -137,11 +137,11 @@ export async function refreshDeviceSecretArm(deps) {
             expiresAt: mint.expiresAt,
             ...(bound ? { sessionId: bound.sessionId, userId: bound.accountId } : {}),
         };
-        if (oxy.httpService.getSessionEpoch() !== epoch) {
-            // Signed out while minting. The server has rotated the secret, so a store
-            // that still holds the presented one must learn the rotation (the
-            // token-null lane keeps the store so a reload can restore); a store the
-            // sign-out cleared must NOT be refilled. Either way, plant nothing.
+        if (oxy.http.getSessionEpoch() !== epoch) {
+            // Signed out while minting. A store that still holds the presented
+            // secret takes the server's `nextDeviceSecret` (the token-null lane keeps
+            // the store so a reload can restore); a store the sign-out cleared must
+            // NOT be refilled. Either way, plant nothing.
             const current = await store.load();
             if (current?.deviceId === persisted.deviceId && current.deviceSecret === persisted.deviceSecret) {
                 await store.save(next);
@@ -154,10 +154,10 @@ export async function refreshDeviceSecretArm(deps) {
         if (!persistedOk) {
             return { status: 'persist-failed' };
         }
-        if (oxy.httpService.getSessionEpoch() !== epoch) {
+        if (oxy.http.getSessionEpoch() !== epoch) {
             return { status: 'session-ended' };
         }
-        oxy.setTokens(mint.accessToken);
+        oxy.session.setAccessToken(mint.accessToken);
         return {
             status: 'ok',
             token: mint.accessToken,
@@ -194,7 +194,7 @@ export async function refreshPersistedSession(deps) {
     const identity = deps.identity ?? null;
     // The shared keychain is never an identity-bound client's recovery path.
     const allowSharedKeyFallback = identity ? false : (deps.allowSharedKeyFallback ?? isNative());
-    const epoch = oxy.httpService.getSessionEpoch();
+    const epoch = oxy.http.getSessionEpoch();
     // Resolved per call: a re-established identity session can move the pin, and a
     // replaced/removed local key clears it (in which case arm 1 must NOT mint —
     // an unpinned mint would adopt whatever account the device switched to).
@@ -223,13 +223,20 @@ export async function refreshPersistedSession(deps) {
             // 401: secret diverged or no live session. When a key-based arm 2 can still
             // recover (native shared key, or an identity-bound client's own primary
             // key) drop ONLY the secret and keep the deviceId; otherwise (web) the
-            // session is over — clear the store.
+            // session is over.
             const persisted = await store.load();
             if (allowSharedKeyFallback || identity) {
                 if (persisted) {
                     await store.save({ ...persisted, deviceSecret: undefined });
                 }
             }
+            else if (arm1.status === 'no-session' && persisted?.deviceId && persisted.deviceSecret) {
+                // Web, a credential the server still recognises: this origin stays a
+                // holder of the browser's device (ADR 0029 D2) — the next sign-in in any
+                // app lands on it, and this app follows without opening the bridge
+                // again. Only the session fields go.
+                await store.save({ sessionId: '', userId: '', deviceId: persisted.deviceId, deviceSecret: persisted.deviceSecret });
+            }
             else {
                 await store.clear();
             }
@@ -248,14 +255,14 @@ export async function refreshPersistedSession(deps) {
     }
     // Never after a sign-out: the shared keychain holds an identity KEY, not a
     // session, and using it here would sign the user straight back in.
-    if (allowSharedKeyFallback && !oxy.httpService.hasSessionEnded()) {
+    if (allowSharedKeyFallback && !oxy.http.hasSessionEnded()) {
         try {
             // Planted here, not by the sign-in: a sign-out that lands while the
             // challenge round-trips must win, or the shared keychain signs the user
             // straight back in.
-            const session = await oxy.signInWithSharedIdentity({ plantTokens: false });
+            const session = await oxy.auth.signInWithSharedIdentity({ plantTokens: false });
             if (session?.accessToken) {
-                if (oxy.httpService.getSessionEpoch() !== epoch) {
+                if (oxy.http.getSessionEpoch() !== epoch) {
                     return null;
                 }
                 // Repopulate the fast device-secret lane from the shared-key re-mint.
@@ -269,10 +276,10 @@ export async function refreshPersistedSession(deps) {
                         expiresAt: session.expiresAt,
                     });
                 }
-                if (oxy.httpService.getSessionEpoch() !== epoch) {
+                if (oxy.http.getSessionEpoch() !== epoch) {
                     return null;
                 }
-                oxy.setTokens(session.accessToken);
+                oxy.session.setAccessToken(session.accessToken);
                 return session.accessToken;
             }
         }
@@ -319,9 +326,9 @@ export function createAuthRefreshHandler(deps) {
  * Returns a disposer that removes it.
  */
 export function installAuthRefreshHandler(deps) {
-    deps.oxy.httpService.setAuthRefreshHandler(createAuthRefreshHandler(deps));
+    deps.oxy.http.setAuthRefreshHandler(createAuthRefreshHandler(deps));
     return () => {
-        deps.oxy.httpService.setAuthRefreshHandler(null);
+        deps.oxy.http.setAuthRefreshHandler(null);
     };
 }
 /**
@@ -363,10 +370,10 @@ export function startTokenRefreshScheduler(oxy) {
     /** Schedule the next re-mint from the current token's expiry (the healthy path). */
     const scheduleFromExpiry = () => {
         clearTimer();
-        if (disposed || !oxy.getAccessToken()) {
+        if (disposed || !oxy.session.accessToken) {
             return;
         }
-        const expSeconds = oxy.getAccessTokenExpiry();
+        const expSeconds = oxy.session.accessTokenExpiry;
         if (expSeconds === null) {
             return;
         }
@@ -374,7 +381,7 @@ export function startTokenRefreshScheduler(oxy) {
         // The server already answered this token's refresh with this very token:
         // asking again before `exp` only gets it back again. Ask just after expiry,
         // when the server rotates (see REMINT_AFTER_EXPIRY_MS).
-        if (untilExpiryMs > 0 && oxy.httpService.isAwaitingCurrentTokenExpiry?.()) {
+        if (untilExpiryMs > 0 && oxy.http.isAwaitingCurrentTokenExpiry?.()) {
             armTimer(untilExpiryMs + REMINT_AFTER_EXPIRY_MS);
             return;
         }
@@ -386,11 +393,11 @@ export function startTokenRefreshScheduler(oxy) {
         clearTimer();
         // Another lane (a request-time preflight) already asked, and the server
         // answered with this same token: re-arm for just past expiry instead.
-        if (oxy.httpService.isAwaitingCurrentTokenExpiry?.()) {
+        if (oxy.http.isAwaitingCurrentTokenExpiry?.()) {
             scheduleFromExpiry();
             return;
         }
-        void oxy.httpService.refreshAccessToken('preflight')
+        void oxy.http.refreshAccessToken('preflight')
             .then((token) => Boolean(token))
             .catch(() => false)
             .then((ok) => {
@@ -417,10 +424,10 @@ export function startTokenRefreshScheduler(oxy) {
         scheduleFromExpiry();
     };
     const onFocus = () => {
-        if (disposed || !oxy.getAccessToken()) {
+        if (disposed || !oxy.session.accessToken) {
             return;
         }
-        const expSeconds = oxy.getAccessTokenExpiry();
+        const expSeconds = oxy.session.accessTokenExpiry;
         if (expSeconds === null) {
             return;
         }
@@ -435,8 +442,8 @@ export function startTokenRefreshScheduler(oxy) {
     // Re-arm only on a token that actually CHANGED. The mint plants the token it
     // returns even when that is the token already held, and treating the repeat
     // as new re-armed from an in-lead-window expiry, i.e. at the 1s floor.
-    let lastSeenToken = oxy.getAccessToken();
-    const unsubscribeTokens = oxy.onTokensChanged((token) => {
+    let lastSeenToken = oxy.session.accessToken;
+    const unsubscribeTokens = oxy.session.onChange((token) => {
         if (disposed || token === lastSeenToken) {
             return;
         }

package/dist/esm/session/sessionClientHost.js

@@ -14,12 +14,12 @@ export function createSessionClientHost(oxyServices) {
     let currentAccountId = null;
     let deviceCredential = null;
     return {
-        makeRequest: (method, url, data, options) => oxyServices.makeRequest(method, url, data, options),
-        getBaseURL: () => oxyServices.getBaseURL(),
-        getAccessToken: () => oxyServices.getAccessToken(),
+        makeRequest: (method, url, data, options) => oxyServices.request(method, url, data, options),
+        getBaseURL: () => oxyServices.baseURL,
+        getAccessToken: () => oxyServices.session.accessToken,
         getDeviceCredential: () => deviceCredential,
-        onTokensChanged: (listener) => oxyServices.onTokensChanged(listener),
-        setTokens: (accessToken) => oxyServices.setTokens(accessToken),
+        onTokensChanged: (listener) => oxyServices.session.onChange(listener),
+        setTokens: (accessToken) => oxyServices.session.setAccessToken(accessToken),
         getCurrentAccountId: () => currentAccountId,
         setCurrentAccountId: (id) => {
             currentAccountId = id;

package/dist/esm/session/sharedDeviceCredential.js

@@ -155,8 +155,9 @@ export function decideSharedDevicePublish(proven, shared) {
             if (shared.credential.deviceSecret === proven.deviceSecret) {
                 return { action: 'skip', reason: 'already-current' };
             }
-            // Same device, newer secret. Sign-in rotates the secret (the mint does
-            // not), so the just-proven one is the credential a fresh install should
+            // Same device, newer secret. Each sign-in issues a new holder credential
+            // (the older one stays valid until the device ends with nobody signed
+            // in), so the just-proven one is the credential a fresh install should
             // join with.
             return { action: 'publish' };
         }

package/dist/esm/shared/utils/networkUtils.js

@@ -56,7 +56,7 @@ export const calculateBackoffInterval = (state) => {
     const { consecutiveFailures, baseInterval, maxInterval } = state;
     if (consecutiveFailures === 0)
         return baseInterval;
-    const backoffMultiplier = Math.min(Math.pow(2, consecutiveFailures - 1), maxInterval / baseInterval);
+    const backoffMultiplier = Math.min(2 ** (consecutiveFailures - 1), maxInterval / baseInterval);
     return Math.min(baseInterval * backoffMultiplier, maxInterval);
 };
 /**
@@ -164,7 +164,7 @@ export const withRetry = async (fn, options = {}) => {
             if (attempt === maxRetries || !shouldRetry(error)) {
                 throw error;
             }
-            const delayMs = Math.min(baseDelay * Math.pow(2, attempt), maxDelay);
+            const delayMs = Math.min(baseDelay * 2 ** attempt, maxDelay);
             onRetry?.(error, attempt + 1);
             await delay(delayMs);
         }

package/dist/esm/utils/accountCacheSweep.js

@@ -12,15 +12,12 @@
  * those cached and the account switcher keeps drawing the pre-edit name and
  * picture for the full TTL, against a perfectly healthy server.
  *
- * The mixins compose into one class at runtime but are typed one at a time, so
- * the user mixin cannot call a method the accounts mixin owns. The key list
- * therefore lives here, once, and every writer calls {@link
- * evictOxyAccountForestCache} — exactly like the identity key list in
- * `identityCacheSweep`, which the accounts mixin already calls for the
- * mirror-image case (an account write staling the identity reads). The
- * alternative — a second hand-written copy of these keys in the other mixin —
- * is the drift that shipped the two stale-profile bugs `identityCacheSweep`
- * documents.
+ * The key list lives here, once, and every writer (`users.updateMe`, the
+ * `accounts` namespace) reads it — exactly like the identity key list in
+ * `identityCacheSweep`, which account writes use for the mirror-image case (an
+ * account write staling the identity reads). A second hand-written copy of
+ * these keys in another namespace is the drift that shipped the two
+ * stale-profile bugs `identityCacheSweep` documents.
  *
  * WHY THE LIST NEEDS A PREFIX AND THE DETAIL DOES NOT
  * --------------------------------------------------
@@ -66,10 +63,9 @@ export function oxyAccountDetailCacheKey(accountId) {
  *                    account in it (create, archive, ownership transfer) has no
  *                    detail row to name, and clears only the lists.
  */
-export function evictOxyAccountForestCache(oxy, accountId) {
-    oxy.clearCacheEntry(OXY_ACCOUNT_LIST_CACHE_KEY);
-    oxy.clearCacheByPrefix(OXY_ACCOUNT_LIST_CACHE_QUERY_PREFIX);
-    if (accountId) {
-        oxy.clearCacheEntry(oxyAccountDetailCacheKey(accountId));
-    }
+export function evictOxyAccountForestCache(http, accountId) {
+    http.invalidateCache({
+        keys: accountId ? [OXY_ACCOUNT_LIST_CACHE_KEY, oxyAccountDetailCacheKey(accountId)] : [OXY_ACCOUNT_LIST_CACHE_KEY],
+        prefixes: [OXY_ACCOUNT_LIST_CACHE_QUERY_PREFIX],
+    });
 }

package/dist/esm/utils/asyncUtils.js

@@ -1,35 +1,22 @@
 /**
- * Async utilities for common asynchronous patterns and error handling
+ * Retry with exponential backoff and jitter — the policy `HttpService` uses.
  */
-import { logger } from '../logger/index.js';
 import { ErrorCodes, isCancelledError } from './errorUtils.js';
 /**
- * Wrapper for async operations with automatic error handling
- * Returns null on error instead of throwing
- */
-export async function withErrorHandling(operation, errorHandler, context) {
-    try {
-        return await operation();
-    }
-    catch (error) {
-        if (errorHandler) {
-            errorHandler(error);
-        }
-        else {
-            logger.error(`Error in ${context || 'operation'}`, error instanceof Error ? error : new Error(String(error)), {
-                component: 'asyncUtils',
-                method: 'withErrorHandling',
-            });
-        }
-        return null;
-    }
-}
-/**
- * Execute multiple async operations in parallel with error handling
+ * Whether an error came from a request hitting its own timeout.
+ *
+ * A timeout and a caller cancellation both surface from `fetch` as an
+ * `AbortError`, so this only recognises one that has already been CLASSIFIED
+ * (by `HttpService`, which knows which of its own timers fired). An
+ * unclassified abort is treated as a cancellation, which is the safe
+ * direction: refusing to retry something that was abandoned costs nothing,
+ * while retrying it is the defect this whole option exists to fix.
  */
-export async function parallelWithErrorHandling(operations, errorHandler) {
-    const results = await Promise.allSettled(operations.map((op, index) => withErrorHandling(op, error => errorHandler?.(error, index))));
-    return results.map(result => result.status === 'fulfilled' ? result.value : null);
+function isTimeoutError(error) {
+    if (!error || typeof error !== 'object')
+        return false;
+    const candidate = error;
+    return candidate.timeout === true || candidate.code === ErrorCodes.TIMEOUT;
 }
 /**
  * Extract an HTTP status code from an error value, tolerating both the
@@ -54,21 +41,15 @@ function extractHttpStatus(error) {
     return undefined;
 }
 /**
- * Whether an error came from a request hitting its own timeout.
+ * Retry an async operation with exponential backoff
  *
- * A timeout and a caller cancellation both surface from `fetch` as an
- * `AbortError`, so this only recognises one that has already been CLASSIFIED
- * (by `HttpService`, which knows which of its own timers fired). An
- * unclassified abort is treated as a cancellation, which is the safe
- * direction: refusing to retry something that was abandoned costs nothing,
- * while retrying it is the defect this whole option exists to fix.
+ * By default, does not retry on 4xx errors (client errors). The default
+ * predicate accepts both the axios-style `error.response.status` and the
+ * flat `error.status` shape produced by {@link handleHttpError}, so callers
+ * never accidentally retry a deterministic client failure.
+ *
+ * Use the `shouldRetry` callback to customize retry behavior.
  */
-function isTimeoutError(error) {
-    if (!error || typeof error !== 'object')
-        return false;
-    const candidate = error;
-    return candidate.timeout === true || candidate.code === ErrorCodes.TIMEOUT;
-}
 export async function retryAsync(operation, maxRetriesOrOptions = 3, baseDelayArg = 1000, shouldRetryArg) {
     // An options-object overload rather than a fifth positional parameter:
     // `retryOnError` below and other in-tree callers pass positionally, and a
@@ -125,7 +106,7 @@ export async function retryAsync(operation, maxRetriesOrOptions = 3, baseDelayAr
                 break;
             }
             // Calculate delay with exponential backoff and jitter
-            const delay = baseDelay * Math.pow(2, attempt) + Math.random() * 1000;
+            const delay = baseDelay * 2 ** attempt + Math.random() * 1000;
             // Nothing may start, or even sleep, past the deadline — otherwise the
             // budget bounds the attempts but not the wall clock the caller feels.
             if (deadline !== undefined && Date.now() + delay >= deadline) {
@@ -136,113 +117,3 @@ export async function retryAsync(operation, maxRetriesOrOptions = 3, baseDelayAr
     }
     throw lastError;
 }
-/**
- * Debounce async function calls
- */
-export function debounceAsync(func, delay) {
-    let timeoutId;
-    return (...args) => {
-        return new Promise((resolve, reject) => {
-            clearTimeout(timeoutId);
-            timeoutId = setTimeout(async () => {
-                try {
-                    const result = await func(...args);
-                    resolve(result);
-                }
-                catch (error) {
-                    reject(error);
-                }
-            }, delay);
-        });
-    };
-}
-/**
- * Throttle async function calls
- */
-export function throttleAsync(func, limit, interval) {
-    let inThrottle = false;
-    let lastPromise = null;
-    return (...args) => {
-        if (inThrottle) {
-            return lastPromise;
-        }
-        inThrottle = true;
-        lastPromise = func(...args);
-        setTimeout(() => {
-            inThrottle = false;
-        }, interval);
-        return lastPromise;
-    };
-}
-/**
- * Execute async operations sequentially with progress tracking
- */
-export async function sequentialWithProgress(operations, onProgress) {
-    const results = [];
-    for (let i = 0; i < operations.length; i++) {
-        const result = await operations[i]();
-        results.push(result);
-        onProgress?.(i + 1, operations.length);
-    }
-    return results;
-}
-/**
- * Batch async operations
- */
-export async function batchAsync(items, batchSize, processor) {
-    for (let i = 0; i < items.length; i += batchSize) {
-        const batch = items.slice(i, i + batchSize);
-        await processor(batch);
-    }
-}
-/**
- * Create a cancellable async operation
- */
-export function createCancellableAsync(operation) {
-    let abortController = null;
-    return {
-        execute: async () => {
-            abortController = new AbortController();
-            return await operation(abortController.signal);
-        },
-        cancel: () => {
-            abortController?.abort();
-        }
-    };
-}
-/**
- * Timeout wrapper for async operations
- */
-export async function withTimeout(operation, timeoutMs, timeoutMessage) {
-    const timeoutPromise = new Promise((_, reject) => {
-        setTimeout(() => {
-            reject(new Error(timeoutMessage || `Operation timed out after ${timeoutMs}ms`));
-        }, timeoutMs);
-    });
-    return Promise.race([operation, timeoutPromise]);
-}
-/**
- * Execute async operation with loading state
- */
-export async function withLoadingState(operation, setLoading) {
-    setLoading(true);
-    try {
-        return await operation();
-    }
-    finally {
-        setLoading(false);
-    }
-}
-/**
- * Create a promise that resolves after a delay
- */
-export const delay = (ms) => new Promise(resolve => setTimeout(resolve, ms));
-/**
- * Execute async operation with retry on specific errors
- */
-export async function retryOnError(operation, retryableErrors, maxRetries = 3) {
-    return retryAsync(operation, maxRetries, 1000, (error) => {
-        const errorCode = error?.code || error?.status || error?.message;
-        return retryableErrors.includes(errorCode);
-    });
-}

package/dist/esm/utils/authHelpers.js

@@ -29,13 +29,13 @@ export class AuthenticationFailedError extends Error {
  * @throws {SessionSyncRequiredError} If the session needs to be synced (offline session)
  */
 export async function ensureValidToken(oxyServices, _activeSessionId, syncSession) {
-    if (oxyServices.hasValidToken()) {
+    if (oxyServices.session.isAuthenticated) {
         return;
     }
     if (syncSession) {
         try {
             await syncSession();
-            if (oxyServices.hasValidToken()) {
+            if (oxyServices.session.isAuthenticated) {
                 return;
             }
         }

package/dist/esm/utils/authWebUrl.js

@@ -15,9 +15,8 @@
  */
 export const CENTRAL_IDP_APEX = 'oxy.so';
 /**
- * The IdP's origin, `auth.oxy.so` — the OAuth authorize/consent surface and the
- * one origin that asserts Oxy passkeys: where a person signs in, creates,
- * recovers or deletes a web account, in the window an app opens (ADR 0029).
- * Apps open it; they never run the passkey themselves.
+ * The IdP's origin, `auth.oxy.so` — the OAuth authorize/consent surface for
+ * third parties, the browser bridge (ADR 0029 D2) and the page an email
+ * sign-in link opens. Official apps sign in inside their own dialog (ADR 0030).
  */
 export const AUTH_WEB_ORIGIN = `https://auth.${CENTRAL_IDP_APEX}`;

package/dist/esm/utils/avatarUtils.js

@@ -4,7 +4,7 @@ import { logger } from '../logger/index.js';
  * Logs non-404 errors to help debug upload issues.
  *
  * @param fileId - The file ID to update visibility for
- * @param oxyServices - OxyServices instance (or any object with assetUpdateVisibility)
+ * @param oxyServices - An OxyServices client
  * @param contextName - Context name for error logging
  */
 export async function updateAvatarVisibility(fileId, oxyServices, contextName = 'AvatarUtils') {
@@ -12,7 +12,7 @@ export async function updateAvatarVisibility(fileId, oxyServices, contextName =
         return;
     }
     try {
-        await oxyServices.assetUpdateVisibility(fileId, 'public');
+        await oxyServices.assets.setVisibility(fileId, 'public');
     }
     catch (visError) {
         // 404 is expected when asset doesn't exist yet — skip logging

package/dist/esm/utils/cache.js

@@ -34,12 +34,15 @@ export class TTLCache {
     /**
      * Create a new TTL cache
      * @param defaultTTL Default TTL in milliseconds (default: 5 minutes)
+     * @param maxEntries Bound on live entries; the least recently used is evicted
+     *   past it (default: 1000)
      */
-    constructor(defaultTTL = 5 * 60 * 1000) {
+    constructor(defaultTTL = 5 * 60 * 1000, maxEntries = 1000) {
         this.cache = new Map();
         this.hits = 0;
         this.misses = 0;
         this.defaultTTL = defaultTTL;
+        this.maxEntries = maxEntries;
     }
     /**
      * Get a value from cache
@@ -58,6 +61,9 @@ export class TTLCache {
             this.misses++;
             return null;
         }
+        // Re-insert so Map order is recency order and eviction drops the LRU.
+        this.cache.delete(key);
+        this.cache.set(key, entry);
         this.hits++;
         return entry.data;
     }
@@ -77,7 +83,13 @@ export class TTLCache {
         // both into the default, making `cacheTTL:0` impossible to honor.
         const effectiveTTL = ttl === undefined ? this.defaultTTL : ttl;
         const expiresAt = now + effectiveTTL;
+        this.cache.delete(key);
         this.cache.set(key, { data, timestamp: now, expiresAt });
+        if (this.cache.size > this.maxEntries) {
+            const oldest = this.cache.keys().next().value;
+            if (oldest !== undefined)
+                this.cache.delete(oldest);
+        }
         if (!cleanupInterval && activeCaches.has(this))
             updateCleanupInterval();
     }
@@ -88,7 +100,9 @@ export class TTLCache {
      */
     delete(key) {
         const deleted = this.cache.delete(key);
-        if (activeCaches.has(this))
+        // Only the delete that EMPTIES this cache can let the timer stop; checking
+        // on every delete made bulk invalidation O(deletes x caches).
+        if (deleted && this.cache.size === 0 && activeCaches.has(this))
             updateCleanupInterval();
         return deleted;
     }
@@ -102,6 +116,22 @@ export class TTLCache {
         if (activeCaches.has(this))
             updateCleanupInterval();
     }
+    /**
+     * Delete every entry whose key matches, in ONE pass.
+     * @returns Number of entries deleted
+     */
+    deleteWhere(match) {
+        let removed = 0;
+        for (const key of this.cache.keys()) {
+            if (match(key)) {
+                this.cache.delete(key);
+                removed++;
+            }
+        }
+        if (removed > 0 && this.cache.size === 0 && activeCaches.has(this))
+            updateCleanupInterval();
+        return removed;
+    }
     /**
      * Check if a key exists and is not expired
      * @param key Cache key

package/dist/esm/utils/cacheKey.js

@@ -6,7 +6,7 @@
  * The HTTP service injects the live access token; everything here is
  * referentially transparent given that input.
  */
-import { jwtDecode } from 'jwt-decode';
+import { decodeTokenClaims } from './tokenClaims.js';
 /**
  * Discriminator used when there is no access token at all. Anonymous responses
  * must never collide with any authenticated identity.
@@ -68,13 +68,8 @@ export function computeIdentityTag(accessToken) {
     if (!accessToken) {
         return ANON_IDENTITY;
     }
-    try {
-        const decoded = jwtDecode(accessToken);
-        return decoded.userId || decoded.id || `t${fnv1a32(accessToken)}`;
-    }
-    catch {
-        // Undecodable token — still partition it away from anon and from other
-        // tokens via a hash. Never silently fall back to ANON_IDENTITY.
-        return `t${fnv1a32(accessToken)}`;
-    }
+    const decoded = decodeTokenClaims(accessToken);
+    // An undecodable token is still partitioned away from anon and from other
+    // tokens via a hash — never silently ANON_IDENTITY.
+    return decoded?.userId || decoded?.id || `t${fnv1a32(accessToken)}`;
 }