@oxy.so/core 1.18.1 → 3.0.0

package/dist/types/i18n/locales/zh-CN.d.ts

@@ -0,0 +1,386 @@
+declare const dict: {
+    signin: {
+        title: string;
+        subtitle: string;
+        addAccountTitle: string;
+        addAccountSubtitle: string;
+        actions: {
+            continue: string;
+            back: string;
+        };
+        createAccountLink: string;
+        status: {
+            signingIn: string;
+        };
+        subtitleToApp: string;
+        orContinueWith: string;
+        qr: {
+            caption: string;
+            renew: string;
+        };
+        errors: {
+            rateLimited: string;
+            invalidCredentials: string;
+            codeInvalid: string;
+            requestExpired: string;
+            secondFactorInvalid: string;
+            originNotAllowed: string;
+            generic: string;
+            notConfigured: string;
+            notConfiguredDescription: string;
+            failed: string;
+            failedDescription: string;
+        };
+        chooser: {
+            subtitleToApp: string;
+            title: string;
+            subtitle: string;
+            useAnother: string;
+            continueAs: string;
+        };
+        terms: {
+            before: string;
+            termsLink: string;
+            and: string;
+            privacyLink: string;
+        };
+        noAccount: string;
+        createAccount: string;
+        identifier: {
+            label: string;
+            placeholder: string;
+            required: string;
+        };
+        checkEmail: {
+            title: string;
+            description: string;
+            codeLabel: string;
+            codeHint: string;
+            resend: string;
+            resendIn: string;
+            resent: string;
+            retryLater: string;
+            usePassword: string;
+            differentAccount: string;
+        };
+        password: {
+            title: string;
+            label: string;
+            required: string;
+            forgot: string;
+        };
+        secondFactor: {
+            title: string;
+            description: string;
+            backupDescription: string;
+            label: string;
+            backupLabel: string;
+            useBackup: string;
+            useAuthenticator: string;
+        };
+        link: {
+            approvedTitle: string;
+            approvedDescription: string;
+            otherDeviceTitle: string;
+            otherDeviceDescription: string;
+            invalidTitle: string;
+            invalidDescription: string;
+        };
+    };
+    signup: {
+        title: string;
+        subtitle: string;
+        createInCommons: string;
+        backToSignInLink: string;
+        username: {
+            label: string;
+            placeholder: string;
+            required: string;
+            taken: string;
+        };
+        email: {
+            title: string;
+            subtitle: string;
+            label: string;
+            placeholder: string;
+            invalid: string;
+        };
+        commonsSubtitle: string;
+        laterNote: string;
+    };
+    accountSwitcher: {
+        loading: string;
+        qrHeadline: string;
+        signInWithOxy: string;
+        signUpWithOxy: string;
+        getCommons: string;
+        commonsNotInstalled: string;
+        showQrAnyway: string;
+        switchWhileSignedInAs: string;
+        manageOnDevice: string;
+        continueWithOxy: string;
+        havingTrouble: string;
+        progress: {
+            preparing: string;
+            awaitingApproval: string;
+            scanWithCommons: string;
+            continueInCommons: string;
+            checkCommons: string;
+            openedInCommons: string;
+            confirming: string;
+            confirmed: string;
+        };
+        signInFailures: {
+            denied: string;
+            expired: string;
+            network: string;
+            notConfigured: string;
+            unsupportedFlow: string;
+            claimFailed: string;
+            generic: string;
+        };
+        linkOpenFailed: string;
+    };
+    common: {
+        actions: {
+            back: string;
+            continue: string;
+            next: string;
+            getStarted: string;
+            createAccount: string;
+            signIn: string;
+            verify: string;
+            resetPassword: string;
+            signedOut: string;
+            close: string;
+            tryAgain: string;
+        };
+        links: {
+            recoverAccount: string;
+            signUp: string;
+        };
+        labels: {
+            username: string;
+            email: string;
+            password: string;
+            confirmPassword: string;
+        };
+        revoke: string;
+        errors: {
+            signOutAllFailed: string;
+        };
+    };
+    notifications: {
+        title: string;
+        subtitle: string;
+        updateError: string;
+        sections: {
+            channels: string;
+            alerts: string;
+            marketing: string;
+        };
+        items: {
+            push: {
+                title: string;
+                subtitle: string;
+            };
+            emailDigest: {
+                title: string;
+                subtitle: string;
+            };
+            securityAlerts: {
+                title: string;
+                subtitle: string;
+            };
+            marketingEmails: {
+                title: string;
+                subtitle: string;
+            };
+        };
+    };
+    preferences: {
+        title: string;
+        subtitle: string;
+        sections: {
+            appearance: string;
+            language: string;
+            region: string;
+        };
+        theme: {
+            light: string;
+            dark: string;
+            system: string;
+        };
+        items: {
+            theme: {
+                title: string;
+            };
+            reduceMotion: {
+                title: string;
+                subtitle: string;
+                systemOn: string;
+            };
+            language: {
+                title: string;
+            };
+            timezone: {
+                title: string;
+                unknown: string;
+            };
+            about: {
+                title: string;
+                subtitle: string;
+            };
+        };
+    };
+    connectedApps: {
+        title: string;
+        subtitle: string;
+        empty: {
+            title: string;
+            subtitle: string;
+        };
+        item: {
+            granted: string;
+            lastUsed: string;
+        };
+        confirm: {
+            title: string;
+            message: string;
+        };
+        toasts: {
+            revoked: string;
+            revokeFailed: string;
+        };
+    };
+    accountMenu: {
+        label: string;
+        manage: string;
+        viewProfile: string;
+        addAnother: string;
+        signOutAll: string;
+        open: string;
+        openHint: string;
+        openWithUser: string;
+        switching: string;
+        signOutAccount: string;
+        greeting: string;
+        switchAccount: string;
+        storage: {
+            title: string;
+            usage: string;
+            used: string;
+            free: string;
+            unavailable: string;
+            upgrade: string;
+            manage: string;
+        };
+        data: string;
+        settings: string;
+        help: string;
+        signOut: string;
+        privacy: string;
+        terms: string;
+    };
+    emailCode: {
+        title: string;
+        sentTo: string;
+        label: string;
+        resend: string;
+        resent: string;
+        changeEmail: string;
+        errors: {
+            codeInvalid: string;
+            tooManyAttempts: string;
+            expired: string;
+            unavailable: string;
+            rateLimited: string;
+        };
+    };
+    deleteAccount: {
+        keyless: {
+            subtitle: string;
+            action: string;
+            done: string;
+            doneDescription: string;
+            keyed: string;
+        };
+        handoff: {
+            elsewhereMessage: string;
+        };
+    };
+    linkCommons: {
+        title: string;
+        subtitle: string;
+        scan: string;
+        waiting: string;
+        compareTitle: string;
+        compare: string;
+        confirm: string;
+        cancel: string;
+        doneTitle: string;
+        done: string;
+        already: string;
+        expired: string;
+        renew: string;
+        failed: string;
+        confirmTitle: string;
+        confirmDescription: string;
+        row: string;
+    };
+    reauth: {
+        title: string;
+        emailDescription: string;
+        sendCode: string;
+        codeSent: string;
+        codeLabel: string;
+        passwordLabel: string;
+        usePassword: string;
+        useEmail: string;
+        totpLabel: string;
+        errors: {
+            invalid: string;
+            totpRequired: string;
+        };
+    };
+    signInSecurity: {
+        password: {
+            title: string;
+            setTitle: string;
+            changeTitle: string;
+            description: string;
+            newLabel: string;
+            repeatLabel: string;
+            tooShort: string;
+            mismatch: string;
+            signOutOthers: string;
+            save: string;
+            saved: string;
+            row: string;
+        };
+        totp: {
+            title: string;
+            description: string;
+            setUp: string;
+            scan: string;
+            secretLabel: string;
+            codeLabel: string;
+            enable: string;
+            enabled: string;
+            disable: string;
+            disabled: string;
+            on: string;
+            off: string;
+            backupTitle: string;
+            backupDescription: string;
+            copy: string;
+            copied: string;
+            savedThem: string;
+            regenerate: string;
+            regenerateDescription: string;
+            remaining: string;
+            row: string;
+        };
+    };
+};
+export default dict;

package/dist/types/index.d.ts

@@ -1,82 +1,70 @@
 /**
- * @oxy.so/core — OxyHQ SDK Foundation
+ * @oxy.so/core — the Oxy SDK foundation.
  *
- * Platform-agnostic core providing API client, authentication,
- * cryptographic identity, and shared utilities.
- *
- * Works in Node.js, Browser, and React Native.
- *
- * @example
  * ```ts
- * import { OxyServices, oxyClient } from '@oxy.so/core';
+ * import { OxyServices } from '@oxy.so/core';
  *
- * const user = await oxyClient.getCurrentUser();
+ * const oxy = new OxyServices({ baseURL: 'https://api.oxy.so' });
+ * const me = await oxy.users.me();
  * ```
  *
+ * The root entry is the API client and what it needs; heavier pieces have their
+ * own entries so an app ships only what it uses:
+ * - `@oxy.so/core/session`   — device-first sessions, the account dialog, cold boot
+ * - `@oxy.so/core/crypto`    — the self-custody identity (keys, recovery phrase)
+ * - `@oxy.so/core/civic`     — Oxy ID QR payloads
+ * - `@oxy.so/core/inference` — the inference client
+ * - `@oxy.so/core/server`    — `OxyServer`: service tokens and middleware
+ *
  * Every export below is NOMINAL — no `export *`, no barrels, no compat shims.
  * If a symbol does not appear here, it is NOT part of the public API.
  */
 import './crypto/polyfill';
-export { OxyServices, AssetUrlResolutionError, OxyAuthenticationError, OxyAuthenticationTimeoutError, ServiceAssetMetadataError } from './OxyServices';
-export { OXY_CLOUD_URL, oxyClient } from './OxyServices';
-export type { LinkedHttpClient } from './OxyServices.base';
-export type { AuthenticatedResponseRequest, AuthRefreshReason, AuthRefreshHandler, } from './HttpService';
-export { ServiceCredentialMismatchError, } from './mixins/OxyServices.auth';
+export { OxyServices, OXY_API_URL, OXY_CLOUD_URL } from './OxyServices';
+export type { OxyConfig, LinkedHttpClient } from './OxyServices';
+export { OxyApiError, OxyAuthenticationError, OxyAuthenticationTimeoutError, AssetUrlResolutionError, ServiceAssetMetadataError, } from './OxyServices.errors';
+export type { HttpMethod } from './client/context';
+export type { RequestOptions, AuthenticatedResponseRequest, AuthRefreshReason, AuthRefreshHandler } from './HttpService';
+export type { SessionApi, DeviceCredentialProvider, SessionValidation } from './api/session';
+export type { AuthApi, ChallengeResponse, RegistrationRequest, ChallengeVerifyRequest, PublicKeyCheckResponse, OAuthUserInfoResponse, OAuthTokenExchangeResult, CommonsSignInHandle, CommonsSignInStatus, CommonsSignInPurpose, CommonsOAuthContext, CommonsApprovalInfo, CommonsApprovalSubjectAccount, CommonsSignInActionResult, CommonsOAuthFinalizeResult, CommonsDeliveryResult, SignInDeviceOptions, ClaimedSession, } from './api/auth';
+export type { UsersApi, ResolveExternalUserInput, DeleteAccountProof } from './api/users';
+export type { FollowsApi, FollowMutationResult, BulkFollowEntry, BulkFollowResult, BulkUnfollowEntry, BulkUnfollowResult, ViewerGraph, EnsureFollowTargetInput, RegisterFollowKindInput, } from './api/follows';
+export type { PrivacyApi } from './api/privacy';
+export type { NotificationsApi, PushTokenPlatform, RegisterPushTokenInput } from './api/notifications';
+export { assetUrlCacheTTL } from './api/assets';
+export type { AssetsApi, AssetRecord, UploadedAsset, AssetLinkState, AssetUploadOptions, AssetLinkTarget, AssetDeleteResult, } from './api/assets';
+export { buildUserDid } from './api/identity';
+export type { IdentityApi, VerifyDomainResult, RemoveDomainResult, RotateKeyProof, RotateKeyOptions, RotateKeyResult, } from './api/identity';
+export { ACCOUNT_CATEGORY_IDS, MAX_ACCOUNT_CATEGORIES, SELECTABLE_ACCOUNT_CATEGORY_IDS, isSelectableAccountCategoryId, kindAcceptsAccountCategories, } from './api/accounts';
+export type { AccountsApi, AccountKind, AccountCategoryId, AccountRelationship, AccountRole, AccountMemberStatus, AccountMemberSource, AccountMember, AccountNode, ListAccountsOptions, CreateAccountInput, UpdateAccountInput, InviteAccountMemberInput, UpdateAccountMemberInput, TransferAccountOwnershipInput, AccountSuccessResult, SwitchAccountResult, } from './api/accounts';
+export type { AppsApi, Application, ApplicationType, ApplicationStatus, ApplicationCredential, ApplicationCredentialType, ApplicationCredentialStatus, ApplicationEnvironment, CreateApplicationInput, UpdateApplicationInput, CreateApplicationCredentialInput, RotateApplicationCredentialInput, ApplicationCredentialWithSecret, RotateApplicationCredentialResult, ApplicationUsagePeriod, ApplicationUsageSummary, ApplicationUsageByDay, ApplicationUsageByEndpoint, ApplicationUsageStats, PublicApplication, ConnectedApp, ConnectedMcpClient, } from './api/apps';
+export type { LinkedAccountsApi } from './api/linkedAccounts';
+export type { AgencyApi, AccountCapabilityPolicy, AvailableCapabilityCatalog, CapabilityExecutionAuthorization, CreateDelegationGrantInput, DelegationCatalogBinding, DelegationGrantView, PutAccountCapabilityPolicyInput, RequesterAssertionGrant, RequesterAssertionIntrospection, UpdateDelegationGrantInput, } from './api/agency';
+export type { StoreApi, StoreCategory, StoreRating, StoreListingSummary, StoreListingDetail, StoreScreenshot, StoreScreenshotPlatform, StoreReview, StoreOwnReview, WriteStoreReviewInput, StoreListingStatus, PublisherListing, WriteListingInput, AddScreenshotInput, UpdateScreenshotInput, StorePage, StorePageOptions, StoreReviewsOptions, } from './api/store';
+export type { BillingApi, SubscriptionPlan, SubscriptionStatus, SubscriptionFeatures, Subscription, Payment, WalletTransactionType, WalletTransactionStatus, WalletTransaction, WalletPagination, WalletTransactionsPage, } from './api/billing';
+export { REPUTATION_CACHE_PREFIX } from './api/reputation';
+export type { ReputationApi, ReputationPage } from './api/reputation';
+export type { CivicApi, CivicCardResult, SubmitRealLifeAttestationInput, DenyValidationResult, VouchForPersonInput, WithdrawVouchResult, IssueCredentialInput, RevokeCredentialResult, } from './api/civic';
+export type { NodesApi, UserNodeStatus, UserNodeMode, UserNodeController, UserNodeLivenessStatus, RegisterNodeInput, RemoveNodeResult } from './api/nodes';
+export { AccountNotOnDeviceError } from './api/devices';
+export type { DevicesApi, UserDevice, SecurityInfo } from './api/devices';
+export type { TopicsApi, TopicListOptions } from './api/topics';
+export { OxyAppDataIdentifierError } from './api/appData';
+export type { AppDataApi } from './api/appData';
+export type { ContactsApi, ContactDiscoveryMatch, ContactDiscoveryResponse } from './api/contacts';
 export { getCommonsApprovalBlockingReason, parseCommonsApprovalExpiresAt, } from './utils/commonsApproval';
 export { selectCommonsDelivery, pushTargetsFromDelivery, commonsDeliveryPlatform } from './utils/commonsDelivery';
 export type { CommonsDeliveryFacts, CommonsDeliveryPlatform, CommonsDeliveryRoute, } from './utils/commonsDelivery';
-export type { ServiceTokenResponse, OAuthUserInfoResponse, OAuthTokenExchangeResult, } from './mixins/OxyServices.auth';
-export type { CommonsSignInHandle, CommonsSignInStatus, CommonsSignInPurpose, CommonsOAuthContext, CommonsApprovalInfo, CommonsApprovalSubjectAccount, CommonsSignInActionResult, CommonsOAuthFinalizeResult, CommonsDeliveryResult, } from './mixins/OxyServices.auth';
-export type { PushTokenPlatform, RegisterPushTokenInput, } from './mixins/OxyServices.notifications';
-export type { ServiceApp, ServiceActingAsVerification, OxyAuthRefusal } from './mixins/OxyServices.utility';
-export type { OxyAccountEvent, OxyAccountEventFeedItem, OxyAccountEventFeedPage, VerifyAccountEventOptions, } from './mixins/OxyServices.utility';
-export { OxyAccountEventError, OXY_ACCOUNT_DELETED_EVENT_URI } from './mixins/OxyServices.utility';
-export type { ContactDiscoveryMatch, ContactDiscoveryResponse, } from './mixins/OxyServices.contacts';
-export type { BulkFollowEntry, BulkFollowResult, BulkUnfollowEntry, BulkUnfollowResult, FollowMutationResult, ViewerGraph, } from './mixins/OxyServices.user';
-export { OxyAppDataIdentifierError } from './mixins/OxyServices.appData';
 export { getNormalizedUserId, normalizeUserIdentity, normalizeUserIdentityOrNull, } from './utils/userIdentity';
 export { getCanonicalUserHandle, getNormalizedUserHandle, } from './utils/userHandle';
 export type { CanonicalUserHandleInput, UserHandleInput } from './utils/userHandle';
 export { normalizeProfileLinks } from './utils/profileLinks';
 export type { ProfileLink, ProfileLinkMetadata } from './utils/profileLinks';
-export type { PublicApplication, ConnectedApp, ConnectedMcpClient, } from './mixins/OxyServices.connectedApps';
-export type { AccountCapabilityPolicy, AvailableCapabilityCatalog, CapabilityExecutionAuthorization, CreateDelegationGrantInput, DelegationCatalogBinding, DelegationGrantView, PutAccountCapabilityPolicyInput, RequesterAssertionGrant, RequesterAssertionIntrospection, UpdateDelegationGrantInput, } from './mixins/OxyServices.agency';
-export type { StoreCategory, StoreRating, StoreListingSummary, StoreListingDetail, StoreScreenshot, StoreScreenshotPlatform, StoreReview, StoreOwnReview, WriteStoreReviewInput, StoreListingStatus, PublisherListing, WriteListingInput, AddScreenshotInput, UpdateScreenshotInput, StorePage, StorePageOptions, StoreReviewsOptions, } from './mixins/OxyServices.store';
-export type { AccountKind, AccountCategoryId, AccountRelationship, AccountRole, AccountMemberStatus, AccountMemberSource, AccountMember, AccountNode, ListAccountsOptions, CreateAccountInput, UpdateAccountInput, ProvisionChannelInput, ProvisionChannelMemberInput, ProvisionChannelResult, InviteAccountMemberInput, UpdateAccountMemberInput, TransferAccountOwnershipInput, AccountSuccessResult, SwitchAccountResult, Application, ApplicationType, ApplicationStatus, ApplicationCredential, ApplicationCredentialType, ApplicationCredentialStatus, ApplicationEnvironment, CreateApplicationInput, UpdateApplicationInput, CreateApplicationCredentialInput, RotateApplicationCredentialInput, ApplicationCredentialWithSecret, RotateApplicationCredentialResult, ApplicationUsagePeriod, ApplicationUsageSummary, ApplicationUsageByDay, ApplicationUsageByEndpoint, ApplicationUsageStats, } from './mixins/OxyServices.accounts';
-export { ACCOUNT_CATEGORY_IDS, MAX_ACCOUNT_CATEGORIES, SELECTABLE_ACCOUNT_CATEGORY_IDS, isSelectableAccountCategoryId, kindAcceptsAccountCategories, } from './mixins/OxyServices.accounts';
-export { buildUserDid } from './mixins/OxyServices.identity';
-export type { IdentityRecordType, LinkAuthMethodResult, PublishRecordResult, VerifyRecordResult, VerifyDomainResult, RemoveDomainResult, RotateKeyProof, RotateKeyOptions, RotateKeyResult, } from './mixins/OxyServices.identity';
-export { parseIdPayload, parseAttestPayload, verifyPublicCardAttestation, } from './mixins/OxyServices.civic';
-export type { CivicCardResult, IdCardRef, AttestQrPayload, ParsedAttestPayload, SubmitRealLifeAttestationInput, DenyValidationResult, VouchForPersonInput, WithdrawVouchResult, IssueCredentialInput, RevokeCredentialResult, } from './mixins/OxyServices.civic';
-export type { UserNodeStatus, UserNodeMode, UserNodeController, UserNodeLivenessStatus, RegisterNodeInput, RemoveNodeResult } from './mixins/OxyServices.nodes';
-/**
- * Chains — the shared per-person record log. `ChainRecord` is generic over the
- * app's own lexicon payload, so a consumer types its records without Oxy
- * knowing any app's schema.
- */
-export type { ChainRecord, ChainRecordPage, AppendedChainRecord } from './mixins/OxyServices.chains';
 export { SessionSyncRequiredError, AuthenticationFailedError, ensureValidToken, isAuthenticationError, withAuthErrorHandling, authenticatedApiCall, } from './utils/authHelpers';
 export type { HandleApiErrorOptions } from './utils/authHelpers';
 export { mergeSessions, normalizeAndSortSessions, sessionsArraysEqual, } from './utils/sessionUtils';
 export type { ClientSession, StorageKeys, MinimalUserData, SessionLoginResponse, } from './models/session';
-export { KeyManager, IdentityAlreadyExistsError, IdentityPersistError, IdentityUnavailableError, } from './crypto/keyManager';
-export type { KeyPair, IdentityStatus, IdentityRecoveryResult } from './crypto/keyManager';
-export { readIdentityMarker, updateIdentityMarker, } from './crypto/identityMarker';
-export type { IdentityMarker } from './crypto/identityMarker';
-export type { IdentityDeviceBackupStore } from './crypto/deviceBackup';
-export { SignatureService } from './crypto/signatureService';
-export type { SignedMessage, AuthChallenge } from './crypto/signatureService';
-export { RecoveryPhraseService } from './crypto/recoveryPhrase';
-export type { RecoveryPhraseResult, PendingIdentityResult, BackupMaterial } from './crypto/recoveryPhrase';
-export { hkdfSha256 } from './crypto/kdf';
-export { encryptAead, decryptAead, AEAD_KEY_LENGTH, AEAD_NONCE_LENGTH, } from './crypto/aead';
-export type { AeadResult } from './crypto/aead';
-export { deriveSharedSecret } from './crypto/ecdh';
-export { digestIdentityPayload, signIdentityProof } from './crypto/identityProof';
-export { deriveIdentityLinkCode } from './crypto/identityLink';
-export { DeviceManager } from './utils/deviceManager';
-export type { DeviceFingerprint, StoredDeviceInfo } from './utils/deviceManager';
-export type { OxyConfig, PrivacySettings, NotificationPreferences, UserPreferences, User, LoginResponse, Notification, NotificationActor, NotificationPage, Wallet, Transaction, BlockedUser, RestrictedUser, TransferFundsRequest, PurchaseRequest, WithdrawalRequest, TransactionResponse, PaginationInfo, SearchProfilesResponse, ApiError, PaymentMethod, PaymentRequest, PaymentResponse, AnalyticsData, FollowerDetails, ContentViewer, FileMetadata, FileUploadResponse, FileListResponse, FileUpdateRequest, FileDeleteResponse, RNFileDescriptor, AssetUploadInput, FileVisibility, AssetLink, AssetMetadata, AssetVariant, Asset, AssetInitRequest, AssetInitResponse, AssetCompleteRequest, AssetLinkRequest, AssetUnlinkRequest, AssetUrlResponse, BatchFileAccessEntry, BatchFileAccessResponse, AssetDeleteSummary, AssetUpdateVisibilityRequest, AssetUpdateVisibilityResponse, ServiceAssetMetadata, ServiceAssetMetadataBySha, AccountStorageCategoryUsage, AccountStorageUsageResponse, SecurityEventType, SecurityEventSeverity, SecurityActivity, SecurityActivityResponse, AssetUploadProgress, DeviceLinkedSession, DeviceLinkedSessionsResponse, DeviceLinkedSessionLogoutResponse, UpdateDeviceNameResponse, } from './models/interfaces';
+export type { PrivacySettings, NotificationPreferences, UserPreferences, User, LoginResponse, Notification, NotificationActor, NotificationPage, Wallet, Transaction, BlockedUser, RestrictedUser, TransferFundsRequest, PurchaseRequest, WithdrawalRequest, TransactionResponse, PaginationInfo, SearchProfilesResponse, ApiError, PaymentMethod, PaymentRequest, PaymentResponse, AnalyticsData, FollowerDetails, ContentViewer, FileMetadata, FileUploadResponse, FileListResponse, FileUpdateRequest, FileDeleteResponse, RNFileDescriptor, AssetUploadInput, FileVisibility, AssetLink, AssetMetadata, AssetVariant, Asset, AssetInitRequest, AssetInitResponse, AssetCompleteRequest, AssetLinkRequest, AssetUnlinkRequest, AssetUrlResponse, BatchFileAccessEntry, BatchFileAccessResponse, AssetDeleteSummary, AssetUpdateVisibilityRequest, AssetUpdateVisibilityResponse, ServiceAssetMetadata, ServiceAssetMetadataBySha, AccountStorageCategoryUsage, AccountStorageUsageResponse, SecurityEventType, SecurityEventSeverity, SecurityActivity, SecurityActivityResponse, AssetUploadProgress, DeviceLinkedSession, DeviceLinkedSessionsResponse, DeviceLinkedSessionLogoutResponse, UpdateDeviceNameResponse, } from './models/interfaces';
 export { SECURITY_EVENT_SEVERITY_MAP } from './models/interfaces';
 export { TopicType, TopicSource } from './models/Topic';
 export type { TopicData, TopicTranslation, TopicListResult } from './models/Topic';
@@ -90,7 +78,7 @@ export type { ThemeValue } from './shared/utils/themeUtils';
 export { HttpStatus, getErrorStatus, getErrorMessage, isAlreadyRegisteredError, isUnauthorizedError, isForbiddenError, isNotFoundError, isRateLimitError, isServerError, isNetworkError, isRetryableError, } from './shared/utils/errorUtils';
 export { DEFAULT_CIRCUIT_BREAKER_CONFIG, createCircuitBreakerState, calculateBackoffInterval, recordFailure, recordSuccess, shouldAllowRequest, delay, withRetry, } from './shared/utils/networkUtils';
 export type { CircuitBreakerState, CircuitBreakerConfig } from './shared/utils/networkUtils';
-export { translate } from './i18n';
+export { translate, loadLocale, isLocaleLoaded, subscribeLocales, getLocalesVersion } from './i18n';
 export { accountCategoryLabel } from './i18n/accountCategoryLabels';
 export { accountRoleLabel } from './i18n/accountRoleLabels';
 export { reputationCategoryLabel } from './i18n/reputationCategoryLabels';
@@ -107,44 +95,7 @@ export type { Logger, LogLevel, EmittableLogLevel, LogContext, LogEntry, LogSink
 export { updateAvatarVisibility } from './utils/avatarUtils';
 export { buildAccountsArray, createQuickAccount, getAccountDisplayName, getAccountFallbackHandle, formatPublicKeyHandle, getAccountColor, } from './utils/accountUtils';
 export type { QuickAccount, DisplayNameUserShape } from './utils/accountUtils';
-export { registrableApex } from './utils/registrableApex';
 export { AUTH_WEB_ORIGIN, CENTRAL_IDP_APEX } from './utils/authWebUrl';
-export { isOxyRpOrigin } from './utils/webauthnOrigin';
-export { runColdBoot } from './utils/coldBoot';
-export type { ColdBootStep, ColdBootStepResult, ColdBootSession, ColdBootSkip, ColdBootOutcome, RunColdBootOptions, } from './utils/coldBoot';
 export { buildOAuthAuthorizeUrl, computeCodeChallenge, generateOAuthState, generatePkcePair, DEFAULT_OAUTH_SCOPE, OXY_AUTHORIZE_URL, OXY_OAUTH_STATE_STORAGE_KEY, OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY, OXY_OAUTH_REDIRECT_URI_STORAGE_KEY, OXY_OAUTH_RETURN_PATH_STORAGE_KEY, normalizeOAuthRedirectUri, canonicalizeOAuthRedirectUri, persistOAuthHandshake, readOAuthHandshake, clearOAuthHandshake, persistOAuthReturnPath, consumeOAuthReturnPath, } from './utils/oauthPkce';
 export type { PkcePair, BuildOAuthAuthorizeUrlParams, OxyAuthScreen } from './utils/oauthPkce';
-export { isLoopbackOrigin, isOfficialWebOrigin, isAllowedDeviceJoinOrigin, } from './utils/officialOrigins';
-export { SessionClient } from './session/SessionClient';
-export type { TokenTransport, SessionClientHost, SessionClientOptions, DeviceCredential, SessionStateOrigin } from './session/SessionClient';
-export type { SocketIOFactory, MinimalSocket } from './session/socketLoader';
-export { createSessionClientHost } from './session/sessionClientHost';
-export { createSessionClient } from './session/createSessionClient';
-export { deviceStateToClientSessions, activeSessionIdOf, activeUserOf, accountIdsOf, } from './session/projectSessionState';
-export { canActivateContext, directoryDisplayName, directoryHandle, projectDevicePrincipals, resolveActiveContext, resolveDeviceContext, } from './session/deviceDirectory';
-export type { DeviceContext, DeviceContextActor, DeviceContextSubject, DevicePrincipalGroup, } from './session/deviceDirectory';
-export { buildSwitcherRows, showsPrincipalHeaders } from './session/deviceSwitcherRows';
-export type { ResolveAvatarUrl, SwitcherContextRow, SwitcherPrincipalRow, } from './session/deviceSwitcherRows';
-export { isSwitchTargetAccount, canSwitchIntoAccount, } from './session/accountSwitchTargets';
-export { resolveAccountDelegationAccess } from './session/accountDelegationAccess';
-export type { AccountDelegationAccess, AccountDelegationNode, } from './session/accountDelegationAccess';
-export { AccountDialogController, createAccountDialogController, } from './session/accountDialogController';
-export type { AccountDialogControllerOptions, AccountDialogSnapshot, AccountDialogView, CommonsAvailability, ContextChoiceOutcome, SignInFailureReason, SignInFlowPhase, SignInFlowState, SignInProgress, } from './session/accountDialogController';
-export { createWebAuthStateStore, createNativeAuthStateStore, createMemoryAuthStateStore, AUTH_STATE_STORAGE_KEY, } from './session/authStateStore';
-export type { PersistedAuthState, AuthStateStore, NativeKeyValueStorage, } from './session/authStateStore';
-export { createSharedMirroringAuthStateStore, decideSharedDeviceJoin, decideSharedDevicePublish, normalizeSharedDeviceSessionRead, publishProvenDeviceCredential, readLocalDeviceCredential, } from './session/sharedDeviceCredential';
-export type { SharedDeviceCredential, SharedDeviceCredentialRead, SharedDeviceCredentialStore, SharedDeviceJoinDecision, SharedDeviceJoinSkipReason, SharedDevicePublishDecision, SharedDevicePublishOutcome, SharedDevicePublishSkipReason, } from './session/sharedDeviceCredential';
-export { createWebIdentityPinStore, createNativeIdentityPinStore, createMemoryIdentityPinStore, identityPinMatches, IDENTITY_PIN_STORAGE_KEY, } from './session/identityPin';
-export type { IdentityPin, IdentityPinStore } from './session/identityPin';
-export { resolveIdentityPin, establishIdentitySession, } from './session/identitySession';
-export type { IdentityBinding, IdentityRequestOptions, EstablishedIdentitySession, } from './session/identitySession';
-export { AccountNotOnDeviceError } from './mixins/OxyServices.deviceBoot';
-export { refreshPersistedSession, refreshDeviceSecretArm, createAuthRefreshHandler, installAuthRefreshHandler, startTokenRefreshScheduler, TOKEN_REFRESH_LEAD_MS, } from './session/refresh';
-export type { RefreshDeps, TokenRefreshSchedulerHandle, DeviceSecretMintOutcome } from './session/refresh';
-export { OxyInferenceClient, OxyInferenceError, OxyInferenceProtocolError, OXY_INFERENCE_BASE_URL, } from './inference/OxyInferenceClient';
-export type { OxyInferenceClientOptions, OxyInferenceCredential, OxyInferenceFetch, OxyInferenceRequestOptions, OxyInferenceResponse, OxyGenerationReceipt, OxyResponsesRequest, OxySpeechRequest, OxySpeechResponse, } from './inference/OxyInferenceClient';
-export { runSessionColdBoot } from './boot/sessionColdBoot';
-export type { RunSessionColdBootOptions, SessionMode, SignedOutReason, DeviceBootSession, } from './boot/sessionColdBoot';
 export { packageInfo } from './constants/version';
-import { OxyServices } from './OxyServices';
-export default OxyServices;

package/dist/types/inference/index.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `@oxy.so/core/inference` — the Oxy inference client.
+ *
+ * Its own subpath so an app that never calls inference never bundles it.
+ *
+ * ```ts
+ * import { createInferenceClient } from '@oxy.so/core/inference';
+ * const inference = createInferenceClient(oxy); // the session's bearer
+ * ```
+ *
+ * A server holding an Oxy API key builds `new OxyInferenceClient({ credential })`
+ * directly — one surface, two credential lanes. See `docs/inference/sdk.md`.
+ */
+import type { OxyServices } from '../OxyServices';
+import { OxyInferenceClient, type OxyInferenceClientOptions } from './OxyInferenceClient';
+export { OXY_INFERENCE_BASE_URL, OxyInferenceClient, OxyInferenceError, OxyInferenceProtocolError, } from './OxyInferenceClient';
+export type { OxyGenerationReceipt, OxyInferenceClientOptions, OxyInferenceCredential, OxyInferenceFetch, OxyInferenceRequestOptions, OxyInferenceResponse, OxyResponsesRequest, OxySpeechRequest, OxySpeechResponse, } from './OxyInferenceClient';
+/**
+ * An inference client bound to `oxy`'s session: it calls the same API origin
+ * with the session's current bearer on every request.
+ */
+export declare function createInferenceClient(oxy: OxyServices, options?: Omit<OxyInferenceClientOptions, 'baseURL' | 'credential'>): OxyInferenceClient;

package/dist/types/models/interfaces.d.ts

@@ -13,27 +13,6 @@ export interface OxyConfig {
      * bounce (which uses the RP origin, not this registered client id).
      */
     clientId?: string;
-    /**
-     * How a BACKEND identifies itself on requests that carry no user session.
-     *
-     * - `'never'` (default): such requests go out anonymous. Right for browsers
-     *   and apps, which have no service identity to offer.
-     * - `'when-anonymous'`: they carry this process's service token instead —
-     *   from `configureServiceAuth()`'s key pair, or, with none, from workload
-     *   attestation (ADR 0026). A user session, when there is one, still wins,
-     *   and a process that can produce no service token (a local checkout) keeps
-     *   sending the request anonymous.
-     *
-     * Why a server wants it: oxy-api charges anonymous traffic to the SOURCE
-     * ADDRESS (`rl:general`, and a +500 ms `slowDown` per request past 100 in 15
-     * minutes), and a fleet leaves through one NAT address, so every anonymous
-     * read a backend makes shares — and past the threshold pays for — one budget.
-     * A first-party service token is exempt from both and charged to its own
-     * application's budget instead. Measured from Mention's task (2026-09-25):
-     * `GET /users/:id` 543–575 ms anonymous past the threshold, `POST
-     * /users/by-ids` 19–24 ms with the service token.
-     */
-    serviceIdentity?: 'never' | 'when-anonymous';
     /**
      * Enable the per-instance GET response cache. Defaults to `true` (5-minute
      * TTL). Set to `false` to disable caching entirely for this instance — GET
@@ -749,7 +728,7 @@ export interface SecurityActivity {
     userId: string;
     eventType: SecurityEventType;
     eventDescription: string;
-    metadata?: Record<string, any>;
+    metadata?: Record<string, unknown>;
     userAgent?: string;
     deviceId?: string;
     timestamp: string;