@oxy.so/core 1.5.0 → 1.6.0

package/dist/cjs/i18n/locales/ar-SA.json

@@ -108,6 +108,7 @@
         "loading": "جارٍ تحميل الحسابات...",
         "qrHeadline": "سجّل الدخول بهوية Oxy الخاصة بك",
         "signInWithOxy": "تسجيل الدخول باستخدام Oxy",
+        "signUpWithOxy": "التسجيل باستخدام Oxy",
         "useIdentityOnDevice": "لا تملك Commons؟ استخدم مفتاح مرور على هذا الجهاز بدلاً من ذلك",
         "getCommons": "احصل على Commons",
         "commonsNotInstalled": "لا تملك Commons؟ احصل على التطبيق لتسجيل الدخول بمعرّف Oxy الخاص بك.",

package/dist/cjs/i18n/locales/ca-ES.json

@@ -108,6 +108,7 @@
         "loading": "S'estan carregant els comptes...",
         "qrHeadline": "Inicia sessió amb la teva identitat d'Oxy",
         "signInWithOxy": "Inicia sessió amb Oxy",
+        "signUpWithOxy": "Registra't amb Oxy",
         "useIdentityOnDevice": "No tens Commons? Fes servir una clau d'accés en aquest dispositiu",
         "getCommons": "Descarrega Commons",
         "commonsNotInstalled": "No tens Commons? Descarrega l'app per iniciar sessió amb el teu Oxy ID.",

package/dist/cjs/i18n/locales/de-DE.json

@@ -108,6 +108,7 @@
         "loading": "Konten werden geladen...",
         "qrHeadline": "Melden Sie sich mit Ihrer Oxy-Identität an",
         "signInWithOxy": "Mit Oxy anmelden",
+        "signUpWithOxy": "Mit Oxy registrieren",
         "useIdentityOnDevice": "Kein Commons? Verwenden Sie stattdessen einen Passkey auf diesem Gerät",
         "getCommons": "Commons herunterladen",
         "commonsNotInstalled": "Kein Commons? Holen Sie sich die App, um sich mit Ihrer Oxy-ID anzumelden.",

package/dist/cjs/i18n/locales/en-US.json

@@ -416,6 +416,7 @@
         "scanQr": "Scan QR code",
         "qrHeadline": "Sign in with your Oxy identity",
         "signInWithOxy": "Sign in with Oxy",
+        "signUpWithOxy": "Sign up with Oxy",
         "useIdentityOnDevice": "No Commons? Use a passkey on this device instead",
         "getCommons": "Get Commons",
         "commonsNotInstalled": "Don't have Commons? Get the app to sign in with your Oxy ID.",

package/dist/cjs/i18n/locales/es-ES.json

@@ -656,6 +656,7 @@
         "scanQr": "Escanear código QR",
         "qrHeadline": "Inicia sesión con tu identidad de Oxy",
         "signInWithOxy": "Inicia sesión con Oxy",
+        "signUpWithOxy": "Regístrate con Oxy",
         "useIdentityOnDevice": "¿No tienes Commons? Usa una clave de acceso en este dispositivo",
         "getCommons": "Descargar Commons",
         "commonsNotInstalled": "¿No tienes Commons? Descarga la app para iniciar sesión con tu Oxy ID.",

package/dist/cjs/i18n/locales/fr-FR.json

@@ -108,6 +108,7 @@
         "loading": "Chargement des comptes...",
         "qrHeadline": "Connectez-vous avec votre identité Oxy",
         "signInWithOxy": "Se connecter avec Oxy",
+        "signUpWithOxy": "S'inscrire avec Oxy",
         "useIdentityOnDevice": "Pas de Commons ? Utilisez une clé d'accès sur cet appareil",
         "getCommons": "Obtenir Commons",
         "commonsNotInstalled": "Pas de Commons ? Téléchargez l'app pour vous connecter avec votre Oxy ID.",

package/dist/cjs/i18n/locales/it-IT.json

@@ -108,6 +108,7 @@
         "loading": "Caricamento account...",
         "qrHeadline": "Accedi con la tua identità Oxy",
         "signInWithOxy": "Accedi con Oxy",
+        "signUpWithOxy": "Registrati con Oxy",
         "useIdentityOnDevice": "Non hai Commons? Usa una passkey su questo dispositivo",
         "getCommons": "Ottieni Commons",
         "commonsNotInstalled": "Non hai Commons? Scarica l'app per accedere con il tuo Oxy ID.",

package/dist/cjs/i18n/locales/ja-JP.json

@@ -108,6 +108,7 @@
         "loading": "アカウントを読み込み中...",
         "qrHeadline": "Oxy IDでサインイン",
         "signInWithOxy": "Oxyでサインイン",
+        "signUpWithOxy": "Oxyで登録",
         "useIdentityOnDevice": "Commonsがありませんか？このデバイスのパスキーを使用",
         "getCommons": "Commonsを入手",
         "commonsNotInstalled": "Commonsがありませんか？アプリを入手してOxy IDでサインインしましょう。",

package/dist/cjs/i18n/locales/ko-KR.json

@@ -108,6 +108,7 @@
         "loading": "계정을 불러오는 중...",
         "qrHeadline": "Oxy ID로 로그인",
         "signInWithOxy": "Oxy로 로그인",
+        "signUpWithOxy": "Oxy로 가입하기",
         "useIdentityOnDevice": "Commons가 없으신가요? 이 기기의 패스키를 사용하세요",
         "getCommons": "Commons 다운로드",
         "commonsNotInstalled": "Commons가 없으신가요? 앱을 다운로드하여 Oxy ID로 로그인하세요.",

package/dist/cjs/i18n/locales/locales/ar-SA.json

@@ -108,6 +108,7 @@
     "loading": "جارٍ تحميل الحسابات...",
     "qrHeadline": "سجّل الدخول بهوية Oxy الخاصة بك",
     "signInWithOxy": "تسجيل الدخول باستخدام Oxy",
+    "signUpWithOxy": "التسجيل باستخدام Oxy",
     "useIdentityOnDevice": "لا تملك Commons؟ استخدم مفتاح مرور على هذا الجهاز بدلاً من ذلك",
     "getCommons": "احصل على Commons",
     "commonsNotInstalled": "لا تملك Commons؟ احصل على التطبيق لتسجيل الدخول بمعرّف Oxy الخاص بك.",

package/dist/cjs/i18n/locales/locales/ca-ES.json

@@ -108,6 +108,7 @@
     "loading": "S'estan carregant els comptes...",
     "qrHeadline": "Inicia sessió amb la teva identitat d'Oxy",
     "signInWithOxy": "Inicia sessió amb Oxy",
+    "signUpWithOxy": "Registra't amb Oxy",
     "useIdentityOnDevice": "No tens Commons? Fes servir una clau d'accés en aquest dispositiu",
     "getCommons": "Descarrega Commons",
     "commonsNotInstalled": "No tens Commons? Descarrega l'app per iniciar sessió amb el teu Oxy ID.",

package/dist/cjs/i18n/locales/locales/de-DE.json

@@ -108,6 +108,7 @@
     "loading": "Konten werden geladen...",
     "qrHeadline": "Melden Sie sich mit Ihrer Oxy-Identität an",
     "signInWithOxy": "Mit Oxy anmelden",
+    "signUpWithOxy": "Mit Oxy registrieren",
     "useIdentityOnDevice": "Kein Commons? Verwenden Sie stattdessen einen Passkey auf diesem Gerät",
     "getCommons": "Commons herunterladen",
     "commonsNotInstalled": "Kein Commons? Holen Sie sich die App, um sich mit Ihrer Oxy-ID anzumelden.",

package/dist/cjs/i18n/locales/locales/en-US.json

@@ -416,6 +416,7 @@
     "scanQr": "Scan QR code",
     "qrHeadline": "Sign in with your Oxy identity",
     "signInWithOxy": "Sign in with Oxy",
+    "signUpWithOxy": "Sign up with Oxy",
     "useIdentityOnDevice": "No Commons? Use a passkey on this device instead",
     "getCommons": "Get Commons",
     "commonsNotInstalled": "Don't have Commons? Get the app to sign in with your Oxy ID.",

package/dist/cjs/i18n/locales/locales/es-ES.json

@@ -656,6 +656,7 @@
     "scanQr": "Escanear código QR",
     "qrHeadline": "Inicia sesión con tu identidad de Oxy",
     "signInWithOxy": "Inicia sesión con Oxy",
+    "signUpWithOxy": "Regístrate con Oxy",
     "useIdentityOnDevice": "¿No tienes Commons? Usa una clave de acceso en este dispositivo",
     "getCommons": "Descargar Commons",
     "commonsNotInstalled": "¿No tienes Commons? Descarga la app para iniciar sesión con tu Oxy ID.",

package/dist/cjs/i18n/locales/locales/fr-FR.json

@@ -108,6 +108,7 @@
     "loading": "Chargement des comptes...",
     "qrHeadline": "Connectez-vous avec votre identité Oxy",
     "signInWithOxy": "Se connecter avec Oxy",
+    "signUpWithOxy": "S'inscrire avec Oxy",
     "useIdentityOnDevice": "Pas de Commons ? Utilisez une clé d'accès sur cet appareil",
     "getCommons": "Obtenir Commons",
     "commonsNotInstalled": "Pas de Commons ? Téléchargez l'app pour vous connecter avec votre Oxy ID.",

package/dist/cjs/i18n/locales/locales/it-IT.json

@@ -108,6 +108,7 @@
     "loading": "Caricamento account...",
     "qrHeadline": "Accedi con la tua identità Oxy",
     "signInWithOxy": "Accedi con Oxy",
+    "signUpWithOxy": "Registrati con Oxy",
     "useIdentityOnDevice": "Non hai Commons? Usa una passkey su questo dispositivo",
     "getCommons": "Ottieni Commons",
     "commonsNotInstalled": "Non hai Commons? Scarica l'app per accedere con il tuo Oxy ID.",

package/dist/cjs/i18n/locales/locales/ja-JP.json

@@ -108,6 +108,7 @@
     "loading": "アカウントを読み込み中...",
     "qrHeadline": "Oxy IDでサインイン",
     "signInWithOxy": "Oxyでサインイン",
+    "signUpWithOxy": "Oxyで登録",
     "useIdentityOnDevice": "Commonsがありませんか？このデバイスのパスキーを使用",
     "getCommons": "Commonsを入手",
     "commonsNotInstalled": "Commonsがありませんか？アプリを入手してOxy IDでサインインしましょう。",

package/dist/cjs/i18n/locales/locales/ko-KR.json

@@ -108,6 +108,7 @@
     "loading": "계정을 불러오는 중...",
     "qrHeadline": "Oxy ID로 로그인",
     "signInWithOxy": "Oxy로 로그인",
+    "signUpWithOxy": "Oxy로 가입하기",
     "useIdentityOnDevice": "Commons가 없으신가요? 이 기기의 패스키를 사용하세요",
     "getCommons": "Commons 다운로드",
     "commonsNotInstalled": "Commons가 없으신가요? 앱을 다운로드하여 Oxy ID로 로그인하세요.",

package/dist/cjs/i18n/locales/locales/pt-PT.json

@@ -108,6 +108,7 @@
     "loading": "A carregar contas...",
     "qrHeadline": "Inicie sessão com a sua identidade Oxy",
     "signInWithOxy": "Iniciar sessão com Oxy",
+    "signUpWithOxy": "Registar-se com Oxy",
     "useIdentityOnDevice": "Não tem o Commons? Use uma chave de acesso neste dispositivo",
     "getCommons": "Obter o Commons",
     "commonsNotInstalled": "Não tem o Commons? Obtenha a app para iniciar sessão com o seu Oxy ID.",

package/dist/cjs/i18n/locales/locales/zh-CN.json

@@ -108,6 +108,7 @@
     "loading": "正在加载账户...",
     "qrHeadline": "使用您的 Oxy 身份登录",
     "signInWithOxy": "使用 Oxy 登录",
+    "signUpWithOxy": "使用 Oxy 注册",
     "useIdentityOnDevice": "没有 Commons？改用此设备上的通行密钥",
     "getCommons": "获取 Commons",
     "commonsNotInstalled": "没有 Commons？获取应用以使用您的 Oxy ID 登录。",

package/dist/cjs/i18n/locales/pt-PT.json

@@ -108,6 +108,7 @@
         "loading": "A carregar contas...",
         "qrHeadline": "Inicie sessão com a sua identidade Oxy",
         "signInWithOxy": "Iniciar sessão com Oxy",
+        "signUpWithOxy": "Registar-se com Oxy",
         "useIdentityOnDevice": "Não tem o Commons? Use uma chave de acesso neste dispositivo",
         "getCommons": "Obter o Commons",
         "commonsNotInstalled": "Não tem o Commons? Obtenha a app para iniciar sessão com o seu Oxy ID.",

package/dist/cjs/i18n/locales/zh-CN.json

@@ -108,6 +108,7 @@
         "loading": "正在加载账户...",
         "qrHeadline": "使用您的 Oxy 身份登录",
         "signInWithOxy": "使用 Oxy 登录",
+        "signUpWithOxy": "使用 Oxy 注册",
         "useIdentityOnDevice": "没有 Commons？改用此设备上的通行密钥",
         "getCommons": "获取 Commons",
         "commonsNotInstalled": "没有 Commons？获取应用以使用您的 Oxy ID 登录。",

package/dist/cjs/index.js

@@ -19,11 +19,11 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AEAD_KEY_LENGTH = exports.decryptAead = exports.encryptAead = exports.hkdfSha256 = exports.RecoveryPhraseService = exports.SignatureService = exports.updateIdentityMarker = exports.readIdentityMarker = exports.IdentityUnavailableError = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.verifyPublicCardAttestation = exports.parseAttestPayload = exports.parseIdPayload = exports.buildUserDid = exports.kindAcceptsAccountCategories = exports.isSelectableAccountCategoryId = exports.SELECTABLE_ACCOUNT_CATEGORY_IDS = exports.MAX_ACCOUNT_CATEGORIES = exports.ACCOUNT_CATEGORY_IDS = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.commonsDeliveryPlatform = exports.pushTargetsFromDelivery = exports.selectCommonsDelivery = exports.parseCommonsApprovalExpiresAt = exports.getCommonsApprovalBlockingReason = exports.ServiceCredentialMismatchError = exports.oxyClient = exports.OXY_CLOUD_URL = exports.ServiceAssetMetadataError = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.AssetUrlResolutionError = exports.OxyServices = void 0;
-exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.coerceToSupportedLocale = exports.getPrimaryLanguage = exports.getUserLanguages = exports.isRTLLocale = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.isSupportedLocale = exports.normalizeLocale = exports.getBaseLanguage = exports.FALLBACK_LOCALE = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.verifyMoveReceipt = exports.signMoveAction = exports.sealIdentityForMove = exports.parseMoveQrPayload = exports.openMovedIdentity = exports.generateMoveEphemeralKeyPair = exports.deriveMoveSas = exports.deriveMoveKey = exports.buildMoveQrPayload = exports.buildMoveMessage = exports.IDENTITY_MOVE_ACTIONS = exports.wrapDataKey = exports.wipeBytes = exports.unwrapDataKey = exports.unlockWebIdentity = exports.signIdentityAction = exports.sealWebIdentity = exports.removeWrap = exports.openWebIdentity = exports.generateWebIdentity = exports.generateDataKey = exports.deriveTransferSas = exports.deriveKeyEncryptionKey = exports.deriveIdentityFromMnemonic = exports.buildIdentityActionMessage = exports.addWrap = exports.WebIdentityUnlockError = exports.WEB_IDENTITY_PRF_INPUT = exports.deriveSharedSecret = exports.AEAD_NONCE_LENGTH = void 0;
-exports.validateRequiredFields = exports.parseHttpErrorBody = exports.isHttpRequestError = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.buildQueryParams = exports.trustTierLabel = exports.reputationCategoryLabel = exports.accountRoleLabel = exports.accountCategoryLabel = exports.translate = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = void 0;
-exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.runColdBoot = exports.isOxyRpOrigin = exports.IDENTITY_WEB_ORIGIN = exports.CENTRAL_IDP_APEX = exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.isDev = exports.consoleSink = exports.resetLoggerConfig = exports.getLoggerConfig = exports.configureLogger = exports.createLogger = exports.logger = exports.normalizeMultilineText = exports.normalizeInlineText = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE = exports.DISPLAY_NAME_ORPHANED_MARK_SOURCE = exports.DISPLAY_NAME_DISALLOWED_SOURCE = exports.DISPLAY_NAME_ALLOWED_SCRIPTS = exports.isValidDisplayName = exports.isValidPassword = exports.isValidEmail = exports.DISPLAY_NAME_INVALID_MESSAGE = exports.MAX_DISPLAY_NAME_LENGTH = exports.PASSWORD_REGEX = exports.EMAIL_REGEX = exports.retryAsync = void 0;
-exports.createMemoryIdentityPinStore = exports.createNativeIdentityPinStore = exports.createWebIdentityPinStore = exports.readLocalDeviceCredential = exports.publishProvenDeviceCredential = exports.normalizeSharedDeviceSessionRead = exports.decideSharedDevicePublish = exports.decideSharedDeviceJoin = exports.createSharedMirroringAuthStateStore = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.resolveAccountDelegationAccess = exports.canSwitchIntoAccount = exports.isSwitchTargetAccount = exports.showsPrincipalHeaders = exports.buildSwitcherRows = exports.resolveDeviceContext = exports.resolveActiveContext = exports.projectDevicePrincipals = exports.directoryHandle = exports.directoryDisplayName = exports.canActivateContext = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isLoopbackOrigin = exports.consumeOAuthReturnPath = exports.persistOAuthReturnPath = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.canonicalizeOAuthRedirectUri = exports.normalizeOAuthRedirectUri = exports.OXY_OAUTH_RETURN_PATH_STORAGE_KEY = exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = void 0;
-exports.packageInfo = exports.runSessionColdBoot = exports.OXY_INFERENCE_BASE_URL = exports.OxyInferenceProtocolError = exports.OxyInferenceError = exports.OxyInferenceClient = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.AccountNotOnDeviceError = exports.establishIdentitySession = exports.resolveIdentityPin = exports.IDENTITY_PIN_STORAGE_KEY = exports.identityPinMatches = void 0;
+exports.isRTLLocale = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.isSupportedLocale = exports.normalizeLocale = exports.getBaseLanguage = exports.FALLBACK_LOCALE = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.verifyMoveReceipt = exports.verifyMoveCommitment = exports.signMoveReceipt = exports.sealIdentityForMove = exports.parseMoveQrPayload = exports.openMovedIdentity = exports.generateMoveEphemeralKeyPair = exports.digestMoveCiphertext = exports.deriveMoveSas = exports.deriveMoveKey = exports.createMoveCommitment = exports.buildMoveQrPayload = exports.signIdentityProof = exports.digestIdentityPayload = exports.wipeOpenedIdentity = exports.wipeBytes = exports.unwrapDataKey = exports.unlockWebIdentity = exports.sealWebIdentity = exports.removeWrap = exports.parseRecoveryMaterial = exports.openWebIdentity = exports.normalizeMnemonic = exports.markWrapVerified = exports.isUsablePrfOutput = exports.generateWebIdentity = exports.generateDataKey = exports.deriveKeyEncryptionKey = exports.deriveIdentityFromRecoveryMaterial = exports.deriveIdentityFromPrivateKey = exports.deriveIdentityFromMnemonic = exports.addWrap = exports.WEB_IDENTITY_PRF_OUTPUT_LENGTH = exports.WebIdentityUnlockError = exports.WEB_IDENTITY_PRF_INPUT = exports.deriveSharedSecret = exports.AEAD_NONCE_LENGTH = void 0;
+exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.buildQueryParams = exports.trustTierLabel = exports.reputationCategoryLabel = exports.accountRoleLabel = exports.accountCategoryLabel = exports.translate = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.coerceToSupportedLocale = exports.getPrimaryLanguage = exports.getUserLanguages = void 0;
+exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.isDev = exports.consoleSink = exports.resetLoggerConfig = exports.getLoggerConfig = exports.configureLogger = exports.createLogger = exports.logger = exports.normalizeMultilineText = exports.normalizeInlineText = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE = exports.DISPLAY_NAME_ORPHANED_MARK_SOURCE = exports.DISPLAY_NAME_DISALLOWED_SOURCE = exports.DISPLAY_NAME_ALLOWED_SCRIPTS = exports.isValidDisplayName = exports.isValidPassword = exports.isValidEmail = exports.DISPLAY_NAME_INVALID_MESSAGE = exports.MAX_DISPLAY_NAME_LENGTH = exports.PASSWORD_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.parseHttpErrorBody = exports.isHttpRequestError = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = void 0;
+exports.decideSharedDeviceJoin = exports.createSharedMirroringAuthStateStore = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.resolveAccountDelegationAccess = exports.canSwitchIntoAccount = exports.isSwitchTargetAccount = exports.showsPrincipalHeaders = exports.buildSwitcherRows = exports.resolveDeviceContext = exports.resolveActiveContext = exports.projectDevicePrincipals = exports.directoryHandle = exports.directoryDisplayName = exports.canActivateContext = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isLoopbackOrigin = exports.consumeOAuthReturnPath = exports.persistOAuthReturnPath = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.canonicalizeOAuthRedirectUri = exports.normalizeOAuthRedirectUri = exports.OXY_OAUTH_RETURN_PATH_STORAGE_KEY = exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.runColdBoot = exports.isOxyRpOrigin = exports.IDENTITY_WEB_ORIGIN = exports.CENTRAL_IDP_APEX = void 0;
+exports.packageInfo = exports.runSessionColdBoot = exports.OXY_INFERENCE_BASE_URL = exports.OxyInferenceProtocolError = exports.OxyInferenceError = exports.OxyInferenceClient = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.AccountNotOnDeviceError = exports.establishIdentitySession = exports.resolveIdentityPin = exports.IDENTITY_PIN_STORAGE_KEY = exports.identityPinMatches = exports.createMemoryIdentityPinStore = exports.createNativeIdentityPinStore = exports.createWebIdentityPinStore = exports.readLocalDeviceCredential = exports.publishProvenDeviceCredential = exports.normalizeSharedDeviceSessionRead = exports.decideSharedDevicePublish = void 0;
 // Ensure crypto polyfills are loaded before anything else
 require("./crypto/polyfill");
 // ---------------------------------------------------------------------------
@@ -141,37 +141,45 @@ Object.defineProperty(exports, "AEAD_KEY_LENGTH", { enumerable: true, get: funct
 Object.defineProperty(exports, "AEAD_NONCE_LENGTH", { enumerable: true, get: function () { return aead_1.AEAD_NONCE_LENGTH; } });
 var ecdh_1 = require("./crypto/ecdh");
 Object.defineProperty(exports, "deriveSharedSecret", { enumerable: true, get: function () { return ecdh_1.deriveSharedSecret; } });
-// Web identity carrier — the same identity as Commons, sealed under a passkey's
-// PRF output (docs/superpowers/specs/2026-09-15-one-identity-two-carriers-design.md)
+// Web identity holder — the same root as Commons, sealed under a passkey's PRF
+// output; identity proofs; transfer to Commons (docs/adr/0024-one-oxy-account-root-holders.md)
 var webIdentityCarrier_1 = require("./crypto/webIdentityCarrier");
 Object.defineProperty(exports, "WEB_IDENTITY_PRF_INPUT", { enumerable: true, get: function () { return webIdentityCarrier_1.WEB_IDENTITY_PRF_INPUT; } });
 Object.defineProperty(exports, "WebIdentityUnlockError", { enumerable: true, get: function () { return webIdentityCarrier_1.WebIdentityUnlockError; } });
+Object.defineProperty(exports, "WEB_IDENTITY_PRF_OUTPUT_LENGTH", { enumerable: true, get: function () { return webIdentityCarrier_1.WEB_IDENTITY_PRF_OUTPUT_LENGTH; } });
 Object.defineProperty(exports, "addWrap", { enumerable: true, get: function () { return webIdentityCarrier_1.addWrap; } });
-Object.defineProperty(exports, "buildIdentityActionMessage", { enumerable: true, get: function () { return webIdentityCarrier_1.buildIdentityActionMessage; } });
 Object.defineProperty(exports, "deriveIdentityFromMnemonic", { enumerable: true, get: function () { return webIdentityCarrier_1.deriveIdentityFromMnemonic; } });
+Object.defineProperty(exports, "deriveIdentityFromPrivateKey", { enumerable: true, get: function () { return webIdentityCarrier_1.deriveIdentityFromPrivateKey; } });
+Object.defineProperty(exports, "deriveIdentityFromRecoveryMaterial", { enumerable: true, get: function () { return webIdentityCarrier_1.deriveIdentityFromRecoveryMaterial; } });
 Object.defineProperty(exports, "deriveKeyEncryptionKey", { enumerable: true, get: function () { return webIdentityCarrier_1.deriveKeyEncryptionKey; } });
-Object.defineProperty(exports, "deriveTransferSas", { enumerable: true, get: function () { return webIdentityCarrier_1.deriveTransferSas; } });
 Object.defineProperty(exports, "generateDataKey", { enumerable: true, get: function () { return webIdentityCarrier_1.generateDataKey; } });
 Object.defineProperty(exports, "generateWebIdentity", { enumerable: true, get: function () { return webIdentityCarrier_1.generateWebIdentity; } });
+Object.defineProperty(exports, "isUsablePrfOutput", { enumerable: true, get: function () { return webIdentityCarrier_1.isUsablePrfOutput; } });
+Object.defineProperty(exports, "markWrapVerified", { enumerable: true, get: function () { return webIdentityCarrier_1.markWrapVerified; } });
+Object.defineProperty(exports, "normalizeMnemonic", { enumerable: true, get: function () { return webIdentityCarrier_1.normalizeMnemonic; } });
 Object.defineProperty(exports, "openWebIdentity", { enumerable: true, get: function () { return webIdentityCarrier_1.openWebIdentity; } });
+Object.defineProperty(exports, "parseRecoveryMaterial", { enumerable: true, get: function () { return webIdentityCarrier_1.parseRecoveryMaterial; } });
 Object.defineProperty(exports, "removeWrap", { enumerable: true, get: function () { return webIdentityCarrier_1.removeWrap; } });
 Object.defineProperty(exports, "sealWebIdentity", { enumerable: true, get: function () { return webIdentityCarrier_1.sealWebIdentity; } });
-Object.defineProperty(exports, "signIdentityAction", { enumerable: true, get: function () { return webIdentityCarrier_1.signIdentityAction; } });
 Object.defineProperty(exports, "unlockWebIdentity", { enumerable: true, get: function () { return webIdentityCarrier_1.unlockWebIdentity; } });
 Object.defineProperty(exports, "unwrapDataKey", { enumerable: true, get: function () { return webIdentityCarrier_1.unwrapDataKey; } });
 Object.defineProperty(exports, "wipeBytes", { enumerable: true, get: function () { return webIdentityCarrier_1.wipeBytes; } });
-Object.defineProperty(exports, "wrapDataKey", { enumerable: true, get: function () { return webIdentityCarrier_1.wrapDataKey; } });
+Object.defineProperty(exports, "wipeOpenedIdentity", { enumerable: true, get: function () { return webIdentityCarrier_1.wipeOpenedIdentity; } });
+var identityProof_1 = require("./crypto/identityProof");
+Object.defineProperty(exports, "digestIdentityPayload", { enumerable: true, get: function () { return identityProof_1.digestIdentityPayload; } });
+Object.defineProperty(exports, "signIdentityProof", { enumerable: true, get: function () { return identityProof_1.signIdentityProof; } });
 var identityMove_1 = require("./crypto/identityMove");
-Object.defineProperty(exports, "IDENTITY_MOVE_ACTIONS", { enumerable: true, get: function () { return identityMove_1.IDENTITY_MOVE_ACTIONS; } });
-Object.defineProperty(exports, "buildMoveMessage", { enumerable: true, get: function () { return identityMove_1.buildMoveMessage; } });
 Object.defineProperty(exports, "buildMoveQrPayload", { enumerable: true, get: function () { return identityMove_1.buildMoveQrPayload; } });
+Object.defineProperty(exports, "createMoveCommitment", { enumerable: true, get: function () { return identityMove_1.createMoveCommitment; } });
 Object.defineProperty(exports, "deriveMoveKey", { enumerable: true, get: function () { return identityMove_1.deriveMoveKey; } });
 Object.defineProperty(exports, "deriveMoveSas", { enumerable: true, get: function () { return identityMove_1.deriveMoveSas; } });
+Object.defineProperty(exports, "digestMoveCiphertext", { enumerable: true, get: function () { return identityMove_1.digestMoveCiphertext; } });
 Object.defineProperty(exports, "generateMoveEphemeralKeyPair", { enumerable: true, get: function () { return identityMove_1.generateMoveEphemeralKeyPair; } });
 Object.defineProperty(exports, "openMovedIdentity", { enumerable: true, get: function () { return identityMove_1.openMovedIdentity; } });
 Object.defineProperty(exports, "parseMoveQrPayload", { enumerable: true, get: function () { return identityMove_1.parseMoveQrPayload; } });
 Object.defineProperty(exports, "sealIdentityForMove", { enumerable: true, get: function () { return identityMove_1.sealIdentityForMove; } });
-Object.defineProperty(exports, "signMoveAction", { enumerable: true, get: function () { return identityMove_1.signMoveAction; } });
+Object.defineProperty(exports, "signMoveReceipt", { enumerable: true, get: function () { return identityMove_1.signMoveReceipt; } });
+Object.defineProperty(exports, "verifyMoveCommitment", { enumerable: true, get: function () { return identityMove_1.verifyMoveCommitment; } });
 Object.defineProperty(exports, "verifyMoveReceipt", { enumerable: true, get: function () { return identityMove_1.verifyMoveReceipt; } });
 // ---------------------------------------------------------------------------
 // Devices

package/dist/cjs/inference/OxyInferenceClient.js

@@ -207,6 +207,63 @@ class OxyInferenceClient {
                 : { delegatedUserId: options.delegatedUserId }),
         });
     }
+    /** Generate audio bytes through Oxy's authenticated inference edge. */
+    async speech(request, options = {}) {
+        const response = await __classPrivateFieldGet(this, _OxyInferenceClient_fetch, "f").call(this, `${__classPrivateFieldGet(this, _OxyInferenceClient_baseURL, "f")}/v1/audio/speech`, {
+            method: 'POST',
+            headers: await __classPrivateFieldGet(this, _OxyInferenceClient_instances, "m", _OxyInferenceClient_headers).call(this, 'audio/*', {
+                hasBody: true,
+                ...(options.idempotencyKey === undefined
+                    ? {}
+                    : { idempotencyKey: options.idempotencyKey }),
+                ...(options.delegatedUserId === undefined
+                    ? {}
+                    : { delegatedUserId: options.delegatedUserId }),
+            }),
+            body: JSON.stringify(request),
+            ...(options.signal === undefined ? {} : { signal: options.signal }),
+        });
+        const requestId = response.headers.get('X-Oxy-Request-Id') ?? '';
+        if (!response.ok) {
+            throw toInferenceError(await response.json().catch(() => undefined), response.status, requestId);
+        }
+        const mediaType = contracts_1.inferenceAudioMediaTypeSchema.safeParse(mediaTypeOf(response));
+        if (!mediaType.success || !response.body) {
+            await cancelUnreadResponse(response);
+            throw protocolError('The inference API returned no supported audio body.', requestId);
+        }
+        const reader = response.body.getReader();
+        const chunks = [];
+        let size = 0;
+        let completed = false;
+        try {
+            while (true) {
+                const next = await reader.read();
+                if (next.done) {
+                    completed = true;
+                    break;
+                }
+                size += next.value.byteLength;
+                if (size > contracts_1.MAX_INFERENCE_AUDIO_BYTES)
+                    throw protocolError('The inference audio exceeds the response limit.', requestId);
+                chunks.push(next.value);
+            }
+        }
+        finally {
+            if (!completed)
+                await reader.cancel().catch(() => undefined);
+            reader.releaseLock();
+        }
+        if (size === 0)
+            throw protocolError('The inference API returned empty audio.', requestId);
+        const audio = new Uint8Array(size);
+        let offset = 0;
+        for (const chunk of chunks) {
+            audio.set(chunk, offset);
+            offset += chunk.byteLength;
+        }
+        return { audio, mediaType: mediaType.data, requestId };
+    }
     /**
      * Stream one inference request from `POST /v1/responses`.
      *
@@ -245,11 +302,7 @@ class OxyInferenceClient {
             throw toInferenceError(payload, response.status, response.headers.get('X-Oxy-Request-Id'));
         }
         const requestId = response.headers.get('X-Oxy-Request-Id') ?? undefined;
-        const mediaType = response.headers
-            .get('Content-Type')
-            ?.split(';', 1)[0]
-            ?.trim()
-            .toLowerCase();
+        const mediaType = mediaTypeOf(response);
         if (mediaType !== 'text/event-stream') {
             await cancelUnreadResponse(response);
             throw protocolError(`The inference API answered a streaming request with ${mediaType ?? 'no Content-Type'} instead of text/event-stream.`, requestId);
@@ -379,6 +432,10 @@ const MAX_INFERENCE_STREAM_EVENT_DATA_LINES = 4096;
 function protocolError(message, requestId) {
     return new OxyInferenceProtocolError(message, requestId);
 }
+/** The bare, lowercased media type of a response's `Content-Type`, if any. */
+function mediaTypeOf(response) {
+    return response.headers.get('Content-Type')?.split(';', 1)[0]?.trim().toLowerCase();
+}
 /** Cancel a nominally successful response whose stream contract is unreadable. */
 async function cancelUnreadResponse(response) {
     await response.body?.cancel().catch(() => undefined);

package/dist/cjs/mixins/OxyServices.auth.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ServiceCredentialMismatchError = exports.parseCommonsApprovalExpiresAt = exports.getCommonsApprovalBlockingReason = void 0;
 exports.OxyServicesAuthMixin = OxyServicesAuthMixin;
@@ -169,6 +202,24 @@ function OxyServicesAuthMixin(Base) {
             const key = apiKey || this._serviceApiKey;
             const secret = apiSecret || this._serviceApiSecret;
             if (!key || !secret) {
+                /**
+                 * No credential configured — so prove what this process IS instead
+                 * (ADR 0026).
+                 *
+                 * This is what lets an official service drop its api key and secret
+                 * WITHOUT a code change: remove the two environment variables, and the
+                 * next token comes from the workload path. It is deliberately the
+                 * fallback rather than the preference, so a deployment that still has a
+                 * credential keeps using it and the migration is one service at a time.
+                 *
+                 * A process with no credential AND no attestation still gets the
+                 * original error: "nothing to authenticate with" is the truth there, and
+                 * a local checkout must not be told to go looking for a container
+                 * credentials endpoint that is not there.
+                 */
+                if (await this._canUseWorkloadIdentity()) {
+                    return this._getWorkloadServiceToken();
+                }
                 throw new Error('Service credentials not provided. Call configureServiceAuth() or pass apiKey and apiSecret.');
             }
             const cacheKey = await this._hashApiKey(key);
@@ -244,6 +295,84 @@ function OxyServicesAuthMixin(Base) {
                 }
             }
         }
+        /**
+         * Whether this process can prove what it is (ADR 0026).
+         *
+         * The check and the module that performs it are loaded LAZILY and only on a
+         * Node host. `@oxy.so/core`'s root barrel reaches React Native and Expo, and
+         * `server/workloadIdentity` imports `node:crypto` — a static import here
+         * would pull it into every mobile bundle for a path a phone can never take.
+         *
+         * @internal
+         */
+        async _canUseWorkloadIdentity() {
+            if (typeof process === 'undefined' || !process.versions?.node)
+                return false;
+            try {
+                const { canAttestWorkloadIdentity } = await Promise.resolve().then(() => __importStar(require('../server/workloadIdentity')));
+                return canAttestWorkloadIdentity();
+            }
+            catch {
+                // A bundler that dropped the server subpath, or a runtime without it.
+                // "We cannot attest here" is the correct reading, and the caller falls
+                // back to the credential error it would have thrown anyway.
+                return false;
+            }
+        }
+        /**
+         * A service token obtained by attestation, cached like a credential's.
+         *
+         * The cache key is a constant, not a credential hash: a process has exactly
+         * one identity, so there is nothing to key on and nothing to keep separate.
+         * The secret-comparison guard the credential path applies has nothing to
+         * compare here, which is the point — there is no secret.
+         *
+         * @internal
+         */
+        async _getWorkloadServiceToken() {
+            const cacheKey = 'workload-identity';
+            const entry = this._serviceTokenCache.get(cacheKey);
+            const now = Date.now();
+            if (entry?.token && entry.expiresAt > now + 60000)
+                return entry.token;
+            if (entry?.pending)
+                return entry.pending;
+            const { requestWorkloadServiceToken } = await Promise.resolve().then(() => __importStar(require('../server/workloadIdentity')));
+            const seeded = entry ?? {
+                token: '',
+                expiresAt: 0,
+                secretBuf: Buffer.alloc(0),
+                pending: null,
+                apiKey: cacheKey,
+            };
+            this._serviceTokenCache.set(cacheKey, seeded);
+            const pending = (async () => {
+                const granted = await requestWorkloadServiceToken({ baseUrl: this.getBaseURL() });
+                const current = this._serviceTokenCache.get(cacheKey);
+                if (current) {
+                    current.token = granted.token;
+                    current.expiresAt = Date.now() + granted.expiresIn * 1000;
+                }
+                return granted.token;
+            })();
+            seeded.pending = pending;
+            try {
+                return await pending;
+            }
+            catch (error) {
+                // Never keep an entry that never held a token: the next caller must try
+                // again rather than inherit a failure.
+                const failed = this._serviceTokenCache.get(cacheKey);
+                if (failed?.pending === pending && !failed.token)
+                    this._serviceTokenCache.delete(cacheKey);
+                throw error;
+            }
+            finally {
+                const settled = this._serviceTokenCache.get(cacheKey);
+                if (settled?.pending === pending)
+                    settled.pending = null;
+            }
+        }
         /**
          * Perform the actual /auth/service-token request and cache the result.
          * Separated so getServiceToken() can deduplicate concurrent calls.

package/dist/cjs/mixins/OxyServices.identity.js

@@ -75,50 +75,15 @@ function OxyServicesIdentityMixin(Base) {
             }
         }
         /**
-         * Link the on-device cryptographic identity to the current account,
-         * upgrading it from custodial to self-sovereign. Signs a proof of private
-         * key ownership and posts it to `POST /auth/link`.
-         *
-         * NATIVE-ONLY: requires a stored identity (throws if `KeyManager` has no key
-         * or no user is authenticated). The signed payload is
-         * `JSON.stringify({ action: 'link_identity', userId, timestamp })` — the
-         * exact bytes the server reconstructs and verifies.
+         * The signed-in account's root readiness (ADR 0024 D5): whether a root is
+         * linked, how many passkeys can open the web holder, whether the root has a
+         * phrase and whether it is saved and was shown to recover it. Metadata only —
+         * nothing here can open the root — so any first-party surface may show a
+         * "save your recovery phrase" reminder from it.
          */
-        async linkIdentityKey() {
+        async getIdentityRootStatus() {
             try {
-                const userId = this.getCurrentUserId();
-                if (!userId) {
-                    throw new Error('No authenticated user — sign in before linking an identity key.');
-                }
-                const publicKey = await keyManager_1.KeyManager.getPublicKey();
-                if (!publicKey) {
-                    throw new Error('No identity found on this device. Create or import an identity first.');
-                }
-                const timestamp = Date.now();
-                // The signed message MUST match the server's reconstruction byte-for-byte:
-                // JSON.stringify with this exact key order (action, userId, timestamp).
-                const message = JSON.stringify({ action: 'link_identity', userId, timestamp });
-                const signature = await signatureService_1.SignatureService.sign(message);
-                const result = await this.makeRequest('POST', '/auth/link', { type: 'identity', publicKey, signature, timestamp }, { cache: false });
-                this._invalidateIdentityCaches(userId);
-                return result;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Unlink an authentication method from the current account. The server
-         * refuses to remove the last remaining method (the account would become
-         * inaccessible). Unlinking `identity` downgrades the account to custodial.
-         *
-         * @param type - The auth-method type to remove.
-         */
-        async unlinkAuthMethod(type) {
-            try {
-                const result = await this.makeRequest('DELETE', `/auth/link/${encodeURIComponent(type)}`, undefined, { cache: false });
-                this._invalidateIdentityCaches(this.getCurrentUserId());
-                return result;
+                return await this.makeRequest('GET', '/identity/root-status', undefined, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -127,10 +92,12 @@ function OxyServicesIdentityMixin(Base) {
         /**
          * Remove ONE passkey (WebAuthn credential) from the current account.
          *
-         * Passkeys are per-credential, so unlike {@link unlinkAuthMethod} (which
-         * removes an auth method by type) this targets a specific credential id.
+         * Passkeys are per-credential, so this targets a specific credential id.
          * The server refuses to remove the last remaining auth method (the account
          * would become inaccessible) and deletes the stored `WebauthnCredential`.
+         * A passkey that also opens the account's root on the web takes its wrap with
+         * it, and the ONLY such passkey is refused with
+         * `code: 'IDENTITY_LAST_WEB_HOLDER'` (ADR 0024 D6).
          *
          * @param credentialId - The passkey's public credential id
          *   (`AuthMethodEntry.credentialId`).