@oxy.so/core 1.18.1 → 3.0.0

package/dist/types/server/rateLimit.d.ts

@@ -1,6 +1,7 @@
 import type { Request, RequestHandler } from 'express';
 import { type Store } from 'express-rate-limit';
-import type { OxyServices } from '../OxyServices';
+import type { AuthMiddlewareOptions } from './middleware';
+import { type OxyAuthHost } from './auth';
 export interface OxyRateLimitOptions {
     /**
      * Max requests per window for AUTHENTICATED users (keyed per user).
@@ -29,12 +30,13 @@ export interface OxyRateLimitOptions {
     /** Response message body sent with a 429. */
     message?: string;
     /**
-     * Options forwarded to the internal `oxy.auth({ optional: true })` resolver
-     * (e.g. `{ jwtSecret }` to verify service tokens). `optional` is forced true.
+     * Options forwarded to the internal `server.middleware.auth({ optional: true })` resolver
+     * (e.g. `{ serviceTokenJwksUrl }` to verify service tokens against a
+     * non-default JWKS). `optional` is forced true.
      */
-    auth?: Parameters<OxyServices['auth']>[0];
+    auth?: AuthMiddlewareOptions;
 }
 /**
  * Build the composed Oxy rate-limit middleware. See module docs for rationale.
  */
-export declare function createOxyRateLimit(oxy: OxyServices, options?: OxyRateLimitOptions): RequestHandler;
+export declare function createOxyRateLimit(oxy: OxyAuthHost, options?: OxyRateLimitOptions): RequestHandler;

package/dist/types/server/requesterAssertion.d.ts

@@ -2,7 +2,7 @@
  * Present-requester assertions (ADR 0025).
  *
  * A first-party product backend holding a signed-in person's live Oxy session
- * trades it with Oxy (`OxyServices.mintRequesterAssertion`) for a one-use,
+ * trades it with Oxy (`server.agency.mintRequesterAssertion`) for a one-use,
  * short-lived `OXY-REQUESTER+JWT`, and sends that — never the person's bearer —
  * to the audience service (Alia) beside its own service token. The audience
  * mounts {@link createOxyRequesterAssertionAuth} after `createOxyAuthMiddleware`
@@ -101,15 +101,18 @@ export interface OxyRequesterAssertionIntrospection {
     readonly jti?: string;
     readonly expiresAt?: string;
 }
+/** What the audience middleware needs of its `OxyServer`. */
 export interface OxyRequesterAssertionIntrospector {
-    introspectRequesterAssertion(input: {
-        assertion: string;
-        presenter: {
-            applicationId: string;
-            credentialId: string;
-        };
-    }): Promise<OxyRequesterAssertionIntrospection>;
-    getBaseURL(): string;
+    readonly baseURL: string;
+    readonly agency: {
+        introspectRequesterAssertion(input: {
+            assertion: string;
+            presenter: {
+                applicationId: string;
+                credentialId: string;
+            };
+        }): Promise<OxyRequesterAssertionIntrospection>;
+    };
 }
 /** What the audience learns about the present requester. */
 export interface OxyRequesterContext {
@@ -144,8 +147,8 @@ export interface OxyRequesterAssertionAuthOptions {
  * token. Mount it after `createOxyAuthMiddleware`. Without the header it does
  * nothing, so it composes with every other lane.
  *
- * `introspector` must be an `OxyServices` configured with THIS service's own
- * credential (`configureServiceAuth`): Oxy only lets the audience's application
+ * `introspector` is this service's `OxyServer`, holding THIS service's own
+ * credential: Oxy only lets the audience's application
  * consume an assertion.
  */
 export declare function createOxyRequesterAssertionAuth(introspector: OxyRequesterAssertionIntrospector, options: OxyRequesterAssertionAuthOptions): RequestHandler;

package/dist/types/server/securityHeaders.d.ts

@@ -167,11 +167,10 @@ export interface OxyPagesHeadersOptions {
      * violation for a script we never asked for. The rest of the value is Pages'
      * own default, so caching is unchanged.
      *
-     * And, because this origin is where a web account is created, recovered and
-     * deleted and every Oxy passkey is asserted (ADR 0028, ADR 0029) — the rest
-     * of the holder policy: no `<base>` and no form posts (`base-uri` /
-     * `form-action 'none'`), no Referer to anyone, passkeys for this origin only
-     * with every other powerful feature off (`Permissions-Policy`), and its
+     * And, because this origin is where people sign in and approve third-party
+     * access (ADR 0028, ADR 0029, ADR 0030) — the rest of the holder policy: no
+     * `<base>` and no form posts (`base-uri` / `form-action 'none'`), no Referer
+     * to anyone, every powerful feature off (`Permissions-Policy`), and its
      * responses readable by no other origin (`Cross-Origin-Resource-Policy`).
      * Never `Cross-Origin-Opener-Policy`: the third-party OAuth popup reports
      * its code to the app that opened it, and COOP severs `window.opener`.

package/dist/types/server/userInvalidation.d.ts

@@ -6,8 +6,8 @@
  * Every Oxy backend caches Oxy identity, and none of them find out when it
  * changes. The `OxyServices` GET response cache holds `GET /users/:id` and
  * `GET /profiles/username/:name` for five minutes; it is swept when THIS process
- * writes the profile (the `evictOxyIdentityCache` calls in the user and accounts
- * mixins) and never when somebody else does — which is the normal case, since
+ * writes the profile (the `evictOxyIdentityCache` calls in the `users` and
+ * `accounts` namespaces) and never when somebody else does — which is the normal case, since
  * profiles are edited in Oxy's own apps. So an avatar or display-name change is
  * invisible to every consuming backend for up to five minutes, per process.
  *
@@ -34,11 +34,11 @@
  *     // node-redis
  *     await subscriber.subscribe(
  *       OXY_USER_INVALIDATION_CHANNEL,
- *       createOxyUserInvalidationHandler({ oxy: oxyClient }),
+ *       createOxyUserInvalidationHandler({ oxy: server }),
  *     );
  *
  *     // ioredis
- *     const handle = createOxyUserInvalidationHandler({ oxy: oxyClient });
+ *     const handle = createOxyUserInvalidationHandler({ oxy: server });
  *     await subscriber.subscribe(OXY_USER_INVALIDATION_CHANNEL);
  *     subscriber.on('message', (_channel, raw) => handle(raw));
  *
@@ -84,11 +84,13 @@ export declare function publishOxyUserInvalidation(publisher: OxyInvalidationPub
 /** Options for {@link createOxyUserInvalidationHandler}. */
 export interface OxyUserInvalidationHandlerOptions {
     /**
-     * The backend's `OxyServices` instance. When supplied, its GET response cache
-     * is swept for the invalidated user — this is the whole reason a backend that
-     * has no cache of its own still benefits from subscribing.
+     * The backend's `OxyServer` (or any `OxyServices`). When supplied, its GET
+     * response cache is swept for the invalidated user — this is the whole reason
+     * a backend that has no cache of its own still benefits from subscribing.
      */
-    oxy?: OxyIdentityCacheEvictor;
+    oxy?: {
+        readonly http: OxyIdentityCacheEvictor;
+    };
     /**
      * App-specific eviction (e.g. a Redis identity cache the app maintains itself).
      * May be async; a rejection is routed to `onError` and never escapes.

package/dist/types/session/accountDelegationAccess.d.ts

@@ -13,7 +13,7 @@
  * (or the structural subset below), so the SDK and every agent runtime read the
  * API's already-resolved relationship and effective permissions identically.
  */
-import type { AccountKind, AccountMember, AccountRelationship } from "../mixins/OxyServices.accounts";
+import type { AccountKind, AccountMember, AccountRelationship } from "../api/accounts";
 export interface AccountDelegationAccess {
     /** The caller owns the account or has a live membership in it. */
     readonly hasStanding: boolean;

package/dist/types/session/accountDialogController.d.ts

@@ -20,8 +20,8 @@
  *     account` pair) and the two removals an account id cannot name —
  *     `signOutContext` and `signOutPrincipal`;
  *   - the "Sign in with Oxy" device flow (same-device shared-keychain via
- *     `oxyServices.signInWithSharedIdentity`, else the cross-device QR handoff
- *     via `startCommonsSignIn` → poll → `claimSessionByToken`);
+ *     `oxy.auth.signInWithSharedIdentity`, else the cross-device QR handoff
+ *     via `oxy.auth.commons.start` → poll → `oxy.auth.claimSession`);
  *   - AUTOMATIC delivery selection for that flow (issue #691): the user presses
  *     ONE primary action and the controller — not the user — picks how the
  *     request reaches their Commons identity, by gathering the facts
@@ -37,10 +37,10 @@
  *     (native only, via the injected `canOpenApp` probe), so the QR view can
  *     offer a "Get Commons" fallback instead of a same-device dead end.
  *
- * Sign-in is passkey (WebAuthn) or the Commons QR / shared-keychain handoff —
- * password, social login, and 2FA were removed ecosystem-wide. Account
- * creation (`signup` view) is the same two identity backends: a passkey
- * ceremony on web, or a Commons-created identity.
+ * Sign-in is by email (a code or a link), an optional password and an
+ * optional authenticator, or the Commons QR / shared-keychain handoff. Account
+ * creation (`signup` view) is a username and a confirmed email, or a
+ * Commons-created identity.
  *
  * The controller owns NO surface PRESENTATION: whether the account dialog is
  * mounted, visible, or dismissed is the job of the shared surface stack
@@ -421,7 +421,7 @@ export declare class AccountDialogController {
      * Whether a PRIVATE endpoint may be called right now. Mirrors the
      * `hasAccessToken` term of `OxyContext.canUsePrivateApi`
      * (`authResolved && isAuthenticated && tokenReady && hasAccessToken`, where
-     * `hasAccessToken = Boolean(oxyServices.getAccessToken())`): a planted bearer
+     * `hasAccessToken = Boolean(oxy.session.accessToken)`): a planted bearer
      * is the only term that decides whether a request carries auth — the other
      * three are provider render-lifecycle gates with no headless equivalent.
      *
@@ -469,7 +469,7 @@ export declare class AccountDialogController {
     private hasSession;
     /** Switch to the "add account" view (the sign-in entry chooser). */
     add(): void;
-    /** Switch to the "create account" view (passkey / Commons signup entry). */
+    /** Switch to the "create account" view (email / Commons signup entry). */
     startSignup(): void;
     /**
      * Re-read `GET /session/device/directory`. Safe to call repeatedly;

package/dist/types/session/accountSwitchTargets.d.ts

@@ -15,7 +15,7 @@
  * question — one about the caller's account GRAPH, which is a list of accounts
  * to manage, not a list of identities the device can become.
  */
-import type { AccountRelationship, AccountKind, AccountMember } from '../mixins/OxyServices.accounts';
+import type { AccountRelationship, AccountKind, AccountMember } from '../api/accounts';
 /**
  * Whether the caller can BECOME this account — the one question every account
  * switcher asks, answered here so no surface has to re-derive it.

package/dist/types/session/authStateStore.d.ts

@@ -22,9 +22,10 @@
  * `sessionId` + `userId` identify the owning device session and active account.
  * `deviceId` + `deviceSecret` are the zero-cookie mint credential: the client
  * presents BOTH at `POST /session/device/token` — the secret is the proof, the
- * deviceId selects the device doc. The secret is rotated in-use: the mint returns
- * `nextDeviceSecret`, which the cold boot / re-mint handler persist BEFORE
- * planting the minted access token (multi-tab anti-loss).
+ * deviceId selects the device doc. The mint returns `nextDeviceSecret` (today the
+ * presented secret, unchanged — the server never rotates a holder's
+ * credential), which the cold boot / re-mint handler persist BEFORE planting
+ * the minted access token.
  *
  * `accessToken` + `expiresAt` are OPTIONAL warm-boot fields. Persisting them lets
  * the cold boot plant a still-valid access token on the very first paint WITHOUT
@@ -46,9 +47,9 @@ export interface PersistedAuthState {
      */
     deviceId?: string;
     /**
-     * The rotating device secret (zero-cookie transport). Possession of it mints a
-     * short access token for the device's active account via
-     * `POST /session/device/token`. Rotated in-use.
+     * This holder's device secret (zero-cookie transport). Possession of it mints
+     * a short access token for the device's active account via
+     * `POST /session/device/token`. Stable: the server never rotates it.
      */
     deviceSecret?: string;
     /** Optional warm-boot access token (short-lived; see interface docs). */

package/dist/types/session/index.d.ts

@@ -0,0 +1,40 @@
+/**
+ * `@oxy.so/core/session` — the device-first session machinery.
+ *
+ * The multi-account `SessionClient`, the headless account dialog, the persisted
+ * auth-state stores, the token re-mint handler and scheduler, and the cold
+ * boot. `@oxy.so/services` builds `OxyProvider` on it; an app that only calls
+ * the API with a token it already has never needs it.
+ */
+import '../crypto/polyfill';
+export { DeviceManager } from '../utils/deviceManager';
+export type { DeviceFingerprint, StoredDeviceInfo } from '../utils/deviceManager';
+export { SessionClient } from './SessionClient';
+export type { TokenTransport, SessionClientHost, SessionClientOptions, DeviceCredential, SessionStateOrigin } from './SessionClient';
+export type { SocketIOFactory, MinimalSocket } from './socketLoader';
+export { createSessionClientHost } from './sessionClientHost';
+export { createSessionClient } from './createSessionClient';
+export { deviceStateToClientSessions, activeSessionIdOf, activeUserOf, accountIdsOf, } from './projectSessionState';
+export { canActivateContext, directoryDisplayName, directoryHandle, projectDevicePrincipals, resolveActiveContext, resolveDeviceContext, } from './deviceDirectory';
+export type { DeviceContext, DeviceContextActor, DeviceContextSubject, DevicePrincipalGroup, } from './deviceDirectory';
+export { buildSwitcherRows, showsPrincipalHeaders } from './deviceSwitcherRows';
+export type { ResolveAvatarUrl, SwitcherContextRow, SwitcherPrincipalRow, } from './deviceSwitcherRows';
+export { isSwitchTargetAccount, canSwitchIntoAccount, } from './accountSwitchTargets';
+export { resolveAccountDelegationAccess } from './accountDelegationAccess';
+export type { AccountDelegationAccess, AccountDelegationNode, } from './accountDelegationAccess';
+export { AccountDialogController, createAccountDialogController, } from './accountDialogController';
+export type { AccountDialogControllerOptions, AccountDialogSnapshot, AccountDialogView, CommonsAvailability, ContextChoiceOutcome, SignInFailureReason, SignInFlowPhase, SignInFlowState, SignInProgress, } from './accountDialogController';
+export { createWebAuthStateStore, createNativeAuthStateStore, createMemoryAuthStateStore, AUTH_STATE_STORAGE_KEY, } from './authStateStore';
+export type { PersistedAuthState, AuthStateStore, NativeKeyValueStorage, } from './authStateStore';
+export { createSharedMirroringAuthStateStore, decideSharedDeviceJoin, decideSharedDevicePublish, normalizeSharedDeviceSessionRead, publishProvenDeviceCredential, readLocalDeviceCredential, } from './sharedDeviceCredential';
+export type { SharedDeviceCredential, SharedDeviceCredentialRead, SharedDeviceCredentialStore, SharedDeviceJoinDecision, SharedDeviceJoinSkipReason, SharedDevicePublishDecision, SharedDevicePublishOutcome, SharedDevicePublishSkipReason, } from './sharedDeviceCredential';
+export { createWebIdentityPinStore, createNativeIdentityPinStore, createMemoryIdentityPinStore, identityPinMatches, IDENTITY_PIN_STORAGE_KEY, } from './identityPin';
+export type { IdentityPin, IdentityPinStore } from './identityPin';
+export { resolveIdentityPin, establishIdentitySession, } from './identitySession';
+export type { IdentityBinding, IdentityRequestOptions, EstablishedIdentitySession, } from './identitySession';
+export { refreshPersistedSession, refreshDeviceSecretArm, createAuthRefreshHandler, installAuthRefreshHandler, startTokenRefreshScheduler, TOKEN_REFRESH_LEAD_MS, } from './refresh';
+export type { RefreshDeps, TokenRefreshSchedulerHandle, DeviceSecretMintOutcome } from './refresh';
+export { runSessionColdBoot } from '../boot/sessionColdBoot';
+export type { RunSessionColdBootOptions, SessionMode, SignedOutReason, DeviceBootSession, } from '../boot/sessionColdBoot';
+export { runColdBoot } from '../utils/coldBoot';
+export type { ColdBootStep, ColdBootStepResult, ColdBootSession, ColdBootSkip, ColdBootOutcome, RunColdBootOptions, } from '../utils/coldBoot';

package/dist/types/utils/accountCacheSweep.d.ts

@@ -12,15 +12,12 @@
  * those cached and the account switcher keeps drawing the pre-edit name and
  * picture for the full TTL, against a perfectly healthy server.
  *
- * The mixins compose into one class at runtime but are typed one at a time, so
- * the user mixin cannot call a method the accounts mixin owns. The key list
- * therefore lives here, once, and every writer calls {@link
- * evictOxyAccountForestCache} — exactly like the identity key list in
- * `identityCacheSweep`, which the accounts mixin already calls for the
- * mirror-image case (an account write staling the identity reads). The
- * alternative — a second hand-written copy of these keys in the other mixin —
- * is the drift that shipped the two stale-profile bugs `identityCacheSweep`
- * documents.
+ * The key list lives here, once, and every writer (`users.updateMe`, the
+ * `accounts` namespace) reads it — exactly like the identity key list in
+ * `identityCacheSweep`, which account writes use for the mirror-image case (an
+ * account write staling the identity reads). A second hand-written copy of
+ * these keys in another namespace is the drift that shipped the two
+ * stale-profile bugs `identityCacheSweep` documents.
  *
  * WHY THE LIST NEEDS A PREFIX AND THE DETAIL DOES NOT
  * --------------------------------------------------
@@ -72,4 +69,4 @@ export declare function oxyAccountDetailCacheKey(accountId: string): string;
  *                    account in it (create, archive, ownership transfer) has no
  *                    detail row to name, and clears only the lists.
  */
-export declare function evictOxyAccountForestCache(oxy: OxyAccountCacheEvictor, accountId?: string): void;
+export declare function evictOxyAccountForestCache(http: OxyAccountCacheEvictor, accountId?: string): void;

package/dist/types/utils/apiUtils.d.ts

@@ -72,7 +72,7 @@ export declare function buildPaginationParams(params: PaginationParams): Record<
 /**
  * Common API response wrapper
  */
-export interface ApiResponse<T = any> {
+export interface ApiResponse<T = unknown> {
     data: T;
     message?: string;
     success?: boolean;
@@ -84,7 +84,7 @@ export interface ErrorResponse {
     message: string;
     code: string;
     status: number;
-    details?: any;
+    details?: unknown;
 }
 /**
  * Safe JSON parsing with error handling
@@ -92,4 +92,4 @@ export interface ErrorResponse {
  * @param fallback Fallback value if parsing fails
  * @returns Parsed data or fallback
  */
-export declare function safeJsonParse<T>(data: any, fallback: T): T;
+export declare function safeJsonParse<T>(data: unknown, fallback: T): T;

package/dist/types/utils/asyncUtils.d.ts

@@ -1,25 +1,7 @@
 /**
- * Async utilities for common asynchronous patterns and error handling
- */
-/**
- * Wrapper for async operations with automatic error handling
- * Returns null on error instead of throwing
- */
-export declare function withErrorHandling<T>(operation: () => Promise<T>, errorHandler?: (error: any) => void, context?: string): Promise<T | null>;
-/**
- * Execute multiple async operations in parallel with error handling
- */
-export declare function parallelWithErrorHandling<T>(operations: (() => Promise<T>)[], errorHandler?: (error: any, index: number) => void): Promise<(T | null)[]>;
-/**
- * Retry an async operation with exponential backoff
- *
- * By default, does not retry on 4xx errors (client errors). The default
- * predicate accepts both the axios-style `error.response.status` and the
- * flat `error.status` shape produced by {@link handleHttpError}, so callers
- * never accidentally retry a deterministic client failure.
- *
- * Use the `shouldRetry` callback to customize retry behavior.
+ * Retry with exponential backoff and jitter — the policy `HttpService` uses.
  */
+/** Options for {@link retryAsync}. */
 export interface RetryOptions {
     maxRetries?: number;
     baseDelay?: number;
@@ -49,43 +31,14 @@ export interface RetryOptions {
      */
     deadline?: number;
 }
-export declare function retryAsync<T>(operation: () => Promise<T>, maxRetriesOrOptions?: number | RetryOptions, baseDelayArg?: number, shouldRetryArg?: (error: any) => boolean): Promise<T>;
-/**
- * Debounce async function calls
- */
-export declare function debounceAsync<T extends (...args: any[]) => Promise<any>>(func: T, delay: number): (...args: Parameters<T>) => Promise<ReturnType<T>>;
-/**
- * Throttle async function calls
- */
-export declare function throttleAsync<T extends (...args: any[]) => Promise<any>>(func: T, limit: number, interval: number): (...args: Parameters<T>) => Promise<ReturnType<T>>;
-/**
- * Execute async operations sequentially with progress tracking
- */
-export declare function sequentialWithProgress<T>(operations: (() => Promise<T>)[], onProgress?: (completed: number, total: number) => void): Promise<T[]>;
-/**
- * Batch async operations
- */
-export declare function batchAsync<T>(items: T[], batchSize: number, processor: (batch: T[]) => Promise<void>): Promise<void>;
-/**
- * Create a cancellable async operation
- */
-export declare function createCancellableAsync<T>(operation: (signal: AbortSignal) => Promise<T>): {
-    execute: () => Promise<T>;
-    cancel: () => void;
-};
 /**
- * Timeout wrapper for async operations
- */
-export declare function withTimeout<T>(operation: Promise<T>, timeoutMs: number, timeoutMessage?: string): Promise<T>;
-/**
- * Execute async operation with loading state
- */
-export declare function withLoadingState<T>(operation: () => Promise<T>, setLoading: (loading: boolean) => void): Promise<T>;
-/**
- * Create a promise that resolves after a delay
- */
-export declare const delay: (ms: number) => Promise<void>;
-/**
- * Execute async operation with retry on specific errors
+ * Retry an async operation with exponential backoff
+ *
+ * By default, does not retry on 4xx errors (client errors). The default
+ * predicate accepts both the axios-style `error.response.status` and the
+ * flat `error.status` shape produced by {@link handleHttpError}, so callers
+ * never accidentally retry a deterministic client failure.
+ *
+ * Use the `shouldRetry` callback to customize retry behavior.
  */
-export declare function retryOnError<T>(operation: () => Promise<T>, retryableErrors: (string | number)[], maxRetries?: number): Promise<T>;
+export declare function retryAsync<T>(operation: () => Promise<T>, maxRetriesOrOptions?: number | RetryOptions, baseDelayArg?: number, shouldRetryArg?: (error: unknown) => boolean): Promise<T>;

package/dist/types/utils/authWebUrl.d.ts

@@ -15,9 +15,8 @@
  */
 export declare const CENTRAL_IDP_APEX = "oxy.so";
 /**
- * The IdP's origin, `auth.oxy.so` — the OAuth authorize/consent surface and the
- * one origin that asserts Oxy passkeys: where a person signs in, creates,
- * recovers or deletes a web account, in the window an app opens (ADR 0029).
- * Apps open it; they never run the passkey themselves.
+ * The IdP's origin, `auth.oxy.so` — the OAuth authorize/consent surface for
+ * third parties, the browser bridge (ADR 0029 D2) and the page an email
+ * sign-in link opens. Official apps sign in inside their own dialog (ADR 0030).
  */
 export declare const AUTH_WEB_ORIGIN = "https://auth.oxy.so";

package/dist/types/utils/avatarUtils.d.ts

@@ -1,16 +1,15 @@
-/**
- * Minimal interface for services that can update asset visibility.
- * Kept loose to avoid mixin type-inference issues with the OxyServices class.
- */
+/** What `updateAvatarVisibility` needs of a client: `oxy.assets.setVisibility`. */
 export interface AssetVisibilityService {
-    assetUpdateVisibility(fileId: string, visibility: 'private' | 'public' | 'unlisted'): Promise<unknown>;
+    assets: {
+        setVisibility(fileId: string, visibility: 'private' | 'public' | 'unlisted'): Promise<unknown>;
+    };
 }
 /**
  * Updates file visibility to public for avatar use.
  * Logs non-404 errors to help debug upload issues.
  *
  * @param fileId - The file ID to update visibility for
- * @param oxyServices - OxyServices instance (or any object with assetUpdateVisibility)
+ * @param oxyServices - An OxyServices client
  * @param contextName - Context name for error logging
  */
 export declare function updateAvatarVisibility(fileId: string | undefined, oxyServices: AssetVisibilityService, contextName?: string): Promise<void>;

package/dist/types/utils/cache.d.ts

@@ -44,11 +44,14 @@ export declare class TTLCache<T> {
     private defaultTTL;
     private hits;
     private misses;
+    private maxEntries;
     /**
      * Create a new TTL cache
      * @param defaultTTL Default TTL in milliseconds (default: 5 minutes)
+     * @param maxEntries Bound on live entries; the least recently used is evicted
+     *   past it (default: 1000)
      */
-    constructor(defaultTTL?: number);
+    constructor(defaultTTL?: number, maxEntries?: number);
     /**
      * Get a value from cache
      * @param key Cache key
@@ -75,6 +78,11 @@ export declare class TTLCache<T> {
      * Clear all cache entries
      */
     clear(): void;
+    /**
+     * Delete every entry whose key matches, in ONE pass.
+     * @returns Number of entries deleted
+     */
+    deleteWhere(match: (key: string) => boolean): number;
     /**
      * Check if a key exists and is not expired
      * @param key Cache key
@@ -117,9 +125,9 @@ export declare function createCache<T>(ttl?: number): TTLCache<T>;
  * Register a cache for automatic cleanup
  * @param cache Cache instance to register
  */
-export declare function registerCacheForCleanup(cache: TTLCache<any>): void;
+export declare function registerCacheForCleanup(cache: TTLCache<unknown>): void;
 /** Unregister a cache without changing its entries or TTL behavior. */
-export declare function unregisterCacheFromCleanup(cache: TTLCache<any>): void;
+export declare function unregisterCacheFromCleanup(cache: TTLCache<unknown>): void;
 /**
  * Stop all cleanup intervals (useful for testing)
  * This will clear the interval and unregister all caches

package/dist/types/utils/commonsApproval.d.ts

@@ -1,4 +1,4 @@
-import type { PublicApplication } from '../mixins/OxyServices.connectedApps';
+import type { PublicApplication } from '../api/apps';
 export interface CommonsApprovalValidationInput {
     application: PublicApplication | null;
     status: string;

package/dist/types/utils/edgeRegion.d.ts

@@ -1,2 +1 @@
-/** @deprecated Import from `@oxy.so/telemetry/browser` in new code. */
-export { getBrowserEdgeRegionHeader } from '@oxy.so/telemetry/browser';
+export { peekBrowserEdgeRegionHeader } from '@oxy.so/telemetry/browser';

package/dist/types/utils/identityCacheSweep.d.ts

@@ -47,7 +47,7 @@
  * refetch; under-eviction serves wrong data.
  *
  * Platform-neutral by construction (no imports, no `OxyServices` reference) so
- * the client mixins and the Node-only `@oxy.so/core/server` invalidation
+ * the client namespaces and the Node-only `@oxy.so/core/server` invalidation
  * subscriber can share it without either pulling in the other.
  */
 /**
@@ -55,8 +55,10 @@
  * structurally so this module stays free of any client import.
  */
 export interface OxyIdentityCacheEvictor {
-    clearCacheEntry(key: string): void;
-    clearCacheByPrefix(prefix: string): number;
+    invalidateCache(spec: {
+        keys?: readonly string[];
+        prefixes?: readonly string[];
+    }): number;
 }
 /**
  * Cache-key PREFIXES under which an account's identity can be served, for the
@@ -77,4 +79,4 @@ export declare function oxyUserByIdCacheKey(userId: string): string;
  *                 that does not know the id still clears every handle-, session-
  *                 and self-keyed entry, which is the majority of the surface.
  */
-export declare function evictOxyIdentityCache(oxy: OxyIdentityCacheEvictor, userId?: string): void;
+export declare function evictOxyIdentityCache(http: OxyIdentityCacheEvictor, userId?: string): void;

package/dist/types/utils/oauthPkce.d.ts

@@ -69,8 +69,8 @@ export interface BuildOAuthAuthorizeUrlParams {
     responseMode?: 'web_message';
     /**
      * Which of the IdP's screens a person with no session there lands on:
-     * `signin` (sign in with a passkey), `signup` (create an account with its
-     * root), `recover` (recover it from the recovery phrase). Omitted, the IdP
+     * `signin` (sign in), `signup` (create an account), `recover` (get back
+     * into one); each opens its sign-in panel. Omitted, the IdP
      * offers its Commons request first. An Oxy app sends this when it sends the
      * person to auth.oxy.so for what only that origin can do, in the same tab.
      */

package/dist/types/utils/oxyServiceEnvironment.d.ts

@@ -5,13 +5,9 @@
  * literal union — `@oxy.so/core` has zero dependency on `@oxy.so/api`, so this is
  * kept in sync by hand, not by import.
  *
- * Defined here (not in `server/auth.ts` or `mixins/OxyServices.utility.ts`
- * directly) because BOTH of those files need it and neither may import from
- * the other: `server/` types import `express` (Node-only, a peer dependency
- * `mixins/` deliberately avoids so it stays safe to bundle into RN/browser
- * consumers — see the "Local request/response/socket typing" comment in
- * `OxyServices.utility.ts`). This file has zero imports, so both sides can
- * depend on it without crossing that boundary.
+ * Defined here, with zero imports, so the server middleware and any
+ * client-safe code can both depend on it without the client reaching the
+ * Node-only `server/` modules.
  */
 export declare const OXY_SERVICE_ENVIRONMENTS: readonly ["development", "staging", "production"];
 export type OxyServiceEnvironment = (typeof OXY_SERVICE_ENVIRONMENTS)[number];

package/dist/types/utils/requestUtils.d.ts

@@ -6,28 +6,32 @@
 /**
  * Request deduplication - prevents duplicate concurrent requests
  *
- * When multiple requests with the same key are made simultaneously,
- * only one request is executed and all callers receive the same result.
+ * When multiple requests with the same key are made simultaneously, only one
+ * request is executed and all callers receive the same result.
+ *
+ * The shared work runs in its OWN abort domain, not the first caller's: each
+ * caller owns its cancellation, and the shared work is aborted only once every
+ * caller waiting on it has cancelled. Binding it to the first caller's signal
+ * meant one cancelled caller failed every other caller on the same key.
  *
  * @example
  * ```typescript
  * const deduplicator = new RequestDeduplicator();
  *
- * // Multiple calls with same key will share the same promise
- * const promise1 = deduplicator.deduplicate('user-123', () => fetchUser('123'));
- * const promise2 = deduplicator.deduplicate('user-123', () => fetchUser('123'));
- * // promise1 === promise2, only one API call is made
+ * // Multiple calls with same key share one in-flight call
+ * const promise1 = deduplicator.deduplicate('user-123', (signal) => fetchUser('123', signal));
+ * const promise2 = deduplicator.deduplicate('user-123', (signal) => fetchUser('123', signal));
  * ```
  */
 export declare class RequestDeduplicator {
-    private pendingRequests;
+    private pending;
     /**
      * Deduplicate a request by key
      * @param key Unique key for the request
-     * @param requestFn Function that returns a promise
-     * @returns Promise that will be shared if key already exists
+     * @param requestFn Runs the work; its signal aborts once every caller has cancelled
+     * @param signal This caller's cancellation
      */
-    deduplicate<T>(key: string, requestFn: () => Promise<T>, signal?: AbortSignal): Promise<T>;
+    deduplicate<T>(key: string, requestFn: (signal: AbortSignal) => Promise<T>, signal?: AbortSignal): Promise<T>;
     /**
      * Clear all pending requests
      */
@@ -116,8 +120,8 @@ export declare class SimpleLogger {
     constructor(enabled?: boolean, level?: LogLevel, prefix?: string);
     private shouldLog;
     private formatMessage;
-    error(...args: any[]): void;
-    warn(...args: any[]): void;
-    info(...args: any[]): void;
-    debug(...args: any[]): void;
+    error(...args: unknown[]): void;
+    warn(...args: unknown[]): void;
+    info(...args: unknown[]): void;
+    debug(...args: unknown[]): void;
 }

package/dist/types/utils/tokenClaims.d.ts

@@ -0,0 +1,9 @@
+export interface AccessTokenClaims {
+    exp?: number;
+    userId?: string;
+    id?: string;
+    sessionId?: string;
+    [claim: string]: unknown;
+}
+/** The token's claims, or `null` for an opaque/undecodable token. */
+export declare function decodeTokenClaims(token: string): AccessTokenClaims | null;