@oxy.so/core 1.5.1 → 1.6.0

package/src/crypto/webIdentityCarrier.ts

@@ -1,18 +1,18 @@
 /**
- * Web identity carrier — the crypto of "one identity, two carriers".
+ * Web identity holder — the crypto of a browser holding a personal root (ADR 0024).
  *
- * An Oxy identity is a BIP-39 mnemonic; its seed's first 32 bytes are the
- * secp256k1 key (`recoveryPhrase.ts`). Commons keeps that key in the device
- * keychain. This module lets a browser carry the SAME identity without Oxy ever
- * being able to use it:
+ * An Oxy root is usually a BIP-39 mnemonic whose seed's first 32 bytes are the
+ * secp256k1 key (`recoveryPhrase.ts`), and for a few imported identities a raw
+ * private key with no phrase. Commons keeps it in the device keychain. This
+ * module lets a browser hold the SAME root without Oxy ever being able to use it:
  *
- *   entropy ──AEAD(DEK)──▶ sealedEntropy
+    secret  ──AEAD(DEK)──▶ sealed secret        (phrase entropy or raw key)
  *   DEK     ──AEAD(KEK_i)─▶ wraps[i]            KEK_i = HKDF(PRF output of passkey i)
  *
  * The PRF output is produced inside the user's authenticator, behind user
  * verification, and never leaves the page that asked for it. The envelope is
- * therefore safe to store anywhere — the identity origin's IndexedDB and the
- * server copy alike — and opens only with a registered passkey or the phrase.
+ * therefore safe to store anywhere — the holder host's IndexedDB and the server
+ * copy alike — and opens only with a registered passkey or the recovery material.
  *
  * PURE: no storage, no network, no WebAuthn call, no platform globals beyond the
  * CSPRNG the AEAD polyfill guarantees. The caller runs the ceremony and hands the
@@ -27,11 +27,11 @@ import { entropyToMnemonic, generateMnemonic, mnemonicToEntropy, mnemonicToSeedS
 import { wordlist } from '@scure/bip39/wordlists/english';
 import { sha256 } from '@noble/hashes/sha256';
 import { bytesToHex, hexToBytes, utf8ToBytes } from '@noble/hashes/utils';
-import { signMessage } from '@oxy.so/protocol';
 import { deriveSecp256k1PublicKey } from '@oxy.so/protocol/secp256k1';
 import {
   WEB_IDENTITY_ENVELOPE_VERSION,
   type WebIdentityEnvelope,
+  type WebIdentitySecretKind,
   type WebIdentityWrap,
 } from '@oxy.so/contracts';
 import { AEAD_KEY_LENGTH, decryptAead, encryptAead } from './aead';
@@ -46,11 +46,11 @@ import { hkdfSha256 } from './kdf';
  */
 export const WEB_IDENTITY_PRF_INPUT: Uint8Array = sha256(utf8ToBytes('oxy-web-identity-carrier/prf/v1'));
 
-/** HKDF salt of the key-encryption-key schedule. Versioned with the envelope. */
+/** HKDF salt of the key-encryption-key schedule. Shared by envelope versions 1 and 2. */
 const KEK_SALT = utf8ToBytes('oxy-web-identity-carrier/kek/v1');
 
-/** A WebAuthn PRF output is 32 bytes (HMAC-SHA-256). */
-const PRF_OUTPUT_LENGTH = 32;
+/** A WebAuthn PRF output is 32 bytes (HMAC-SHA-256). Nothing shorter or longer is usable. */
+export const WEB_IDENTITY_PRF_OUTPUT_LENGTH = 32;
 
 /** Why an envelope did not open. Every value is a normal outcome a UI can explain. */
 export type WebIdentityUnlockFailure =
@@ -59,7 +59,7 @@ export type WebIdentityUnlockFailure =
   /**
    * The passkey IS listed but its PRF output does not open its wrap — a synced
    * copy returning a different PRF value, or a provider that silently changed it.
-   * Recoverable with another passkey or the phrase.
+   * Recoverable with another passkey or the recovery material.
    */
   | 'prf-mismatch'
   /** The envelope itself is malformed or tampered with. */
@@ -72,25 +72,45 @@ export class WebIdentityUnlockError extends Error {
   }
 }
 
-/** The identity in usable form. Hold it for one operation, then {@link wipeBytes}. */
-export interface OpenedWebIdentity {
+/** A root that came from a BIP-39 phrase (12–24 words). Hold it for one operation, then wipe. */
+export interface OpenedMnemonicIdentity {
+  kind: 'mnemonic';
   mnemonic: string;
-  /** 32-byte secp256k1 private key, lowercase hex. */
+  /** 32-byte secp256k1 private key, lowercase hex (`seed[0:32]`). */
   privateKey: string;
   /** Uncompressed SEC1 public key, lowercase hex (Oxy's canonical form). */
   publicKey: string;
 }
 
-function aadFor(parts: Record<string, string | number>): Uint8Array {
+/**
+ * A root that was imported as a raw private key and never had a phrase. It has
+ * no mnemonic, and nothing may ever derive or display one for it (ADR 0024 D5).
+ */
+export interface OpenedRawKeyIdentity {
+  kind: 'raw-key';
+  mnemonic: null;
+  privateKey: string;
+  publicKey: string;
+}
+
+/** The identity in usable form. Hold it for one operation, then wipe it. */
+export type OpenedWebIdentity = OpenedMnemonicIdentity | OpenedRawKeyIdentity;
+
+/** Material a person can recover a root from. */
+export type WebIdentityRecoveryMaterial =
+  | { kind: 'mnemonic'; mnemonic: string }
+  | { kind: 'raw-key'; privateKey: string };
+
+function aadFor(parts: Record<string, string | number | null>): Uint8Array {
   return utf8ToBytes(JSON.stringify(parts));
 }
 
-function entropyAad(publicKey: string): Uint8Array {
-  return aadFor({ v: WEB_IDENTITY_ENVELOPE_VERSION, purpose: 'entropy', publicKey });
+function secretAad(publicKey: string, secretKind: WebIdentitySecretKind): Uint8Array {
+  return aadFor({ v: WEB_IDENTITY_ENVELOPE_VERSION, purpose: 'secret', secretKind, publicKey });
 }
 
-function wrapAad(publicKey: string, credentialId: string): Uint8Array {
-  return aadFor({ v: WEB_IDENTITY_ENVELOPE_VERSION, purpose: 'wrap', publicKey, credentialId });
+function wrapAad(publicKey: string, credentialId: string, rpId: string): Uint8Array {
+  return aadFor({ v: WEB_IDENTITY_ENVELOPE_VERSION, purpose: 'wrap', publicKey, credentialId, rpId });
 }
 
 /** Overwrite a buffer holding secret material. Best effort — JS gives no stronger guarantee. */
@@ -98,12 +118,25 @@ export function wipeBytes(bytes: Uint8Array): void {
   bytes.fill(0);
 }
 
+/** Best-effort removal of secret strings from an opened identity. */
+export function wipeOpenedIdentity(identity: OpenedWebIdentity): void {
+  (identity as { privateKey: string }).privateKey = '';
+  if (identity.kind === 'mnemonic') (identity as { mnemonic: string }).mnemonic = '';
+}
+
+/** Normalize a typed phrase: trimmed, lowercase, single spaces. */
+export function normalizeMnemonic(mnemonic: string): string {
+  return mnemonic.trim().toLowerCase().split(/\s+/).join(' ');
+}
+
 /**
  * Derive the identity from a mnemonic exactly as Commons does
- * (`RecoveryPhraseService`): seed → first 32 bytes → secp256k1.
+ * (`RecoveryPhraseService`): seed → first 32 bytes → secp256k1. Any standard
+ * BIP-39 length (12, 15, 18, 21, 24 words) is accepted; the derivation does not
+ * depend on the length.
  */
-export function deriveIdentityFromMnemonic(mnemonic: string): OpenedWebIdentity {
-  const normalized = mnemonic.trim().toLowerCase().split(/\s+/).join(' ');
+export function deriveIdentityFromMnemonic(mnemonic: string): OpenedMnemonicIdentity {
+  const normalized = normalizeMnemonic(mnemonic);
   if (!validateMnemonic(normalized, wordlist)) {
     throw new Error('Invalid recovery phrase');
   }
@@ -112,11 +145,45 @@ export function deriveIdentityFromMnemonic(mnemonic: string): OpenedWebIdentity
   wipeBytes(seed);
   const privateKey = bytesToHex(privateKeyBytes);
   wipeBytes(privateKeyBytes);
-  return { mnemonic: normalized, privateKey, publicKey: deriveSecp256k1PublicKey(privateKey) };
+  return { kind: 'mnemonic', mnemonic: normalized, privateKey, publicKey: deriveSecp256k1PublicKey(privateKey) };
+}
+
+/** A raw 32-byte private key (hex, optional `0x`) as an identity. Never gains a phrase. */
+export function deriveIdentityFromPrivateKey(privateKey: string): OpenedRawKeyIdentity {
+  const normalized = privateKey.trim().toLowerCase().replace(/^0x/, '');
+  if (!/^[0-9a-f]{64}$/.test(normalized)) {
+    throw new Error('Invalid private key');
+  }
+  let publicKey: string;
+  try {
+    publicKey = deriveSecp256k1PublicKey(normalized);
+  } catch {
+    throw new Error('Invalid private key');
+  }
+  return { kind: 'raw-key', mnemonic: null, privateKey: normalized, publicKey };
+}
+
+/**
+ * Read what a person typed as recovery material: a BIP-39 phrase, or a 64-hex
+ * private key. Throws `Invalid recovery material` for anything else.
+ */
+export function parseRecoveryMaterial(input: string): WebIdentityRecoveryMaterial {
+  const trimmed = input.trim();
+  if (/^(0x)?[0-9a-fA-F]{64}$/.test(trimmed)) return { kind: 'raw-key', privateKey: trimmed };
+  const words = normalizeMnemonic(trimmed);
+  if (words && validateMnemonic(words, wordlist)) return { kind: 'mnemonic', mnemonic: words };
+  throw new Error('Invalid recovery material');
+}
+
+/** Derive the identity recovery material names. */
+export function deriveIdentityFromRecoveryMaterial(material: WebIdentityRecoveryMaterial): OpenedWebIdentity {
+  return material.kind === 'mnemonic'
+    ? deriveIdentityFromMnemonic(material.mnemonic)
+    : deriveIdentityFromPrivateKey(material.privateKey);
 }
 
 /** A brand-new 12-word identity. Nothing is persisted. */
-export function generateWebIdentity(): OpenedWebIdentity {
+export function generateWebIdentity(): OpenedMnemonicIdentity {
   return deriveIdentityFromMnemonic(generateMnemonic(wordlist, 128));
 }
 
@@ -127,36 +194,58 @@ export function generateDataKey(): Uint8Array {
   return key;
 }
 
+/** Whether `bytes` is a usable PRF output: exactly 32 bytes. */
+export function isUsablePrfOutput(bytes: Uint8Array | null | undefined): bytes is Uint8Array {
+  return bytes instanceof Uint8Array && bytes.byteLength === WEB_IDENTITY_PRF_OUTPUT_LENGTH;
+}
+
 /** The key-encryption key a passkey's PRF output yields for its own wrap. */
 export function deriveKeyEncryptionKey(prfOutput: Uint8Array, credentialId: string): Uint8Array {
-  if (prfOutput.length !== PRF_OUTPUT_LENGTH) {
-    throw new Error(`PRF output must be ${PRF_OUTPUT_LENGTH} bytes, got ${prfOutput.length}`);
+  if (prfOutput.length !== WEB_IDENTITY_PRF_OUTPUT_LENGTH) {
+    throw new Error(`PRF output must be ${WEB_IDENTITY_PRF_OUTPUT_LENGTH} bytes, got ${prfOutput.length}`);
   }
   return hkdfSha256(prfOutput, KEK_SALT, utf8ToBytes(credentialId), AEAD_KEY_LENGTH);
 }
 
-/** Wrap `dataKey` for one passkey. */
-export function wrapDataKey(
-  dataKey: Uint8Array,
-  prfOutput: Uint8Array,
-  credentialId: string,
+/** One passkey's contribution to an envelope. */
+export interface WrapInput {
+  prfOutput: Uint8Array;
+  credentialId: string;
+  /** The RP ID the passkey lives under; bound into the wrap. */
+  rpId: string;
+  /** Set when this PRF output came from a ceremony separate from the one that created the wrap. */
+  verifiedAt?: string;
+}
+
+function wrapFor(
   publicKey: string,
-  now: Date = new Date(),
+  dataKey: Uint8Array,
+  input: WrapInput,
+  now: Date,
 ): WebIdentityWrap {
-  const kek = deriveKeyEncryptionKey(prfOutput, credentialId);
+  const kek = deriveKeyEncryptionKey(input.prfOutput, input.credentialId);
   try {
-    const { nonce, ciphertext } = encryptAead(kek, dataKey, wrapAad(publicKey, credentialId));
+    const { nonce, ciphertext } = encryptAead(kek, dataKey, wrapAad(publicKey, input.credentialId, input.rpId));
     return {
-      credentialId,
+      credentialId: input.credentialId,
       nonce: bytesToHex(nonce),
       wrappedKey: bytesToHex(ciphertext),
       createdAt: now.toISOString(),
+      rpId: input.rpId,
+      ...(input.verifiedAt ? { verifiedAt: input.verifiedAt } : {}),
     };
   } finally {
     wipeBytes(kek);
   }
 }
 
+function secretOf(identity: OpenedWebIdentity): { kind: WebIdentitySecretKind; bytes: Uint8Array } {
+  if (identity.kind === 'mnemonic') {
+    return { kind: 'mnemonic-entropy', bytes: mnemonicToEntropy(identity.mnemonic, wordlist) };
+  }
+  return { kind: 'raw-private-key', bytes: hexToBytes(identity.privateKey) };
+}
+
 /**
  * Seal an identity into a new envelope that opens with the given passkey.
  *
@@ -164,29 +253,37 @@ export function wrapDataKey(
  * session; wipe it when done.
  */
 export function sealWebIdentity(
-  identity: Pick<OpenedWebIdentity, 'mnemonic' | 'publicKey'>,
-  firstWrap: { prfOutput: Uint8Array; credentialId: string },
+  identity: OpenedWebIdentity,
+  firstWrap: WrapInput,
   now: Date = new Date(),
 ): { envelope: WebIdentityEnvelope; dataKey: Uint8Array } {
-  const derived = deriveIdentityFromMnemonic(identity.mnemonic);
-  if (derived.publicKey !== identity.publicKey.toLowerCase()) {
-    throw new Error('The recovery phrase does not belong to this identity');
+  const derived: OpenedWebIdentity =
+    identity.kind === 'raw-key' ? deriveIdentityFromPrivateKey(identity.privateKey) : deriveIdentityFromMnemonic(identity.mnemonic);
+  const publicKey = identity.publicKey.toLowerCase();
+  if (derived.publicKey !== publicKey) {
+    wipeOpenedIdentity(derived);
+    throw new Error('The recovery material does not belong to this identity');
   }
+  const secret = secretOf(derived);
+  wipeOpenedIdentity(derived);
   const dataKey = generateDataKey();
-  const entropy = mnemonicToEntropy(derived.mnemonic, wordlist);
   try {
-    const { nonce, ciphertext } = encryptAead(dataKey, entropy, entropyAad(derived.publicKey));
+    const { nonce, ciphertext } = encryptAead(dataKey, secret.bytes, secretAad(publicKey, secret.kind));
     const envelope: WebIdentityEnvelope = {
       version: WEB_IDENTITY_ENVELOPE_VERSION,
       algorithm: 'xchacha20poly1305',
-      publicKey: derived.publicKey,
-      entropyNonce: bytesToHex(nonce),
-      sealedEntropy: bytesToHex(ciphertext),
-      wraps: [wrapDataKey(dataKey, firstWrap.prfOutput, firstWrap.credentialId, derived.publicKey, now)],
+      publicKey,
+      secretKind: secret.kind,
+      secretNonce: bytesToHex(nonce),
+      sealedSecret: bytesToHex(ciphertext),
+      wraps: [wrapFor(publicKey, dataKey, firstWrap, now)],
     };
     return { envelope, dataKey };
+  } catch (error) {
+    wipeBytes(dataKey);
+    throw error;
   } finally {
-    wipeBytes(entropy);
+    wipeBytes(secret.bytes);
   }
 }
 
@@ -202,7 +299,7 @@ export function unwrapDataKey(
   }
   const kek = deriveKeyEncryptionKey(prfOutput, credentialId);
   try {
-    return decryptAead(kek, hexToBytes(wrap.nonce), hexToBytes(wrap.wrappedKey), wrapAad(envelope.publicKey, credentialId));
+    return decryptAead(kek, hexToBytes(wrap.nonce), hexToBytes(wrap.wrappedKey), wrapAad(envelope.publicKey, credentialId, wrap.rpId));
   } catch {
     throw new WebIdentityUnlockError('prf-mismatch', 'This passkey returned a different secret than when it was registered');
   } finally {
@@ -213,29 +310,35 @@ export function unwrapDataKey(
 /**
  * Open an envelope with its data key.
  *
- * The derived public key is checked against the envelope's own: a sealed entropy
+ * The derived public key is checked against the envelope's own: a sealed secret
  * that decrypts into a different identity is treated as corruption, never used.
  */
 export function openWebIdentity(envelope: WebIdentityEnvelope, dataKey: Uint8Array): OpenedWebIdentity {
-  let entropy: Uint8Array;
+  const publicKey = envelope.publicKey.toLowerCase();
+  const kind = envelope.secretKind;
+  let secret: Uint8Array;
   try {
-    entropy = decryptAead(
-      dataKey,
-      hexToBytes(envelope.entropyNonce),
-      hexToBytes(envelope.sealedEntropy),
-      entropyAad(envelope.publicKey),
-    );
+    secret = decryptAead(dataKey, hexToBytes(envelope.secretNonce), hexToBytes(envelope.sealedSecret), secretAad(envelope.publicKey, kind));
   } catch {
     throw new WebIdentityUnlockError('corrupt', 'The sealed identity could not be opened');
   }
   try {
-    const identity = deriveIdentityFromMnemonic(entropyToMnemonic(entropy, wordlist));
-    if (identity.publicKey !== envelope.publicKey.toLowerCase()) {
+    let identity: OpenedWebIdentity;
+    try {
+      identity =
+        kind === 'mnemonic-entropy'
+          ? deriveIdentityFromMnemonic(entropyToMnemonic(secret, wordlist))
+          : deriveIdentityFromPrivateKey(bytesToHex(secret));
+    } catch {
+      throw new WebIdentityUnlockError('corrupt', 'The sealed identity is malformed');
+    }
+    if (identity.publicKey !== publicKey) {
+      wipeOpenedIdentity(identity);
       throw new WebIdentityUnlockError('corrupt', 'The sealed identity does not match its public key');
     }
     return identity;
   } finally {
-    wipeBytes(entropy);
+    wipeBytes(secret);
   }
 }
 
@@ -254,19 +357,30 @@ export function unlockWebIdentity(
 }
 
 /** Add (or replace) one passkey's wrap. Requires the data key of an unlocked envelope. */
-export function addWrap(
-  envelope: WebIdentityEnvelope,
-  dataKey: Uint8Array,
-  prfOutput: Uint8Array,
-  credentialId: string,
-  now: Date = new Date(),
-): WebIdentityEnvelope {
+export function addWrap(envelope: WebIdentityEnvelope, dataKey: Uint8Array, wrapInput: WrapInput, now: Date = new Date()): WebIdentityEnvelope {
   // Proves `dataKey` belongs to THIS envelope before anything new can open it.
-  openWebIdentity(envelope, dataKey);
-  const others = envelope.wraps.filter((entry) => entry.credentialId !== credentialId);
+  wipeOpenedIdentity(openWebIdentity(envelope, dataKey));
+  const others = envelope.wraps.filter((entry) => entry.credentialId !== wrapInput.credentialId);
   return {
     ...envelope,
-    wraps: [...others, wrapDataKey(dataKey, prfOutput, credentialId, envelope.publicKey, now)],
+    wraps: [...others, wrapFor(envelope.publicKey, dataKey, wrapInput, now)],
+  };
+}
+
+/**
+ * Record that a wrap's passkey opened the envelope in a ceremony of its own. The
+ * AEAD does not cover `verifiedAt`; it is holder metadata the owner writes with a
+ * root proof, not a cryptographic claim.
+ */
+export function markWrapVerified(envelope: WebIdentityEnvelope, credentialId: string, now: Date = new Date()): WebIdentityEnvelope {
+  if (!envelope.wraps.some((entry) => entry.credentialId === credentialId)) {
+    throw new WebIdentityUnlockError('unknown-credential', 'This passkey cannot open this identity');
+  }
+  return {
+    ...envelope,
+    wraps: envelope.wraps.map((entry) =>
+      entry.credentialId === credentialId ? { ...entry, verifiedAt: now.toISOString() } : entry,
+    ),
   };
 }
 
@@ -278,49 +392,3 @@ export function removeWrap(envelope: WebIdentityEnvelope, credentialId: string):
   }
   return { ...envelope, wraps: remaining };
 }
-
-/**
- * The message an identity key signs to authorize an account action
- * (`link_identity`, `web_envelope_delete`, …): `JSON.stringify({ action, userId,
- * timestamp })`, byte-identical to what the API reconstructs.
- */
-export function buildIdentityActionMessage(action: string, userId: string, timestamp: number): string {
-  return JSON.stringify({ action, userId, timestamp });
-}
-
-/** Sign an identity-action message with an opened identity's key. */
-export async function signIdentityAction(
-  identity: Pick<OpenedWebIdentity, 'privateKey'>,
-  action: string,
-  userId: string,
-  timestamp: number = Date.now(),
-): Promise<{ signature: string; timestamp: number }> {
-  const signature = await signMessage(buildIdentityActionMessage(action, userId, timestamp), identity.privateKey);
-  return { signature, timestamp };
-}
-
-/**
- * The 6-digit short authentication string both sides of an identity transfer show.
- *
- * Bound to the pairing and to BOTH ephemeral public keys in their roles, so a relay
- * that substitutes either key produces a different code on each screen. The user
- * comparing the two codes is what makes the transfer safe against the relay itself.
- */
-export function deriveTransferSas(input: {
-  pairingId: string;
-  initiatorEphemeralPublicKey: string;
-  responderEphemeralPublicKey: string;
-}): string {
-  const digest = sha256(
-    utf8ToBytes(
-      JSON.stringify({
-        v: 'oxy-identity-transfer-sas-v1',
-        pairingId: input.pairingId.toLowerCase(),
-        initiator: input.initiatorEphemeralPublicKey.toLowerCase(),
-        responder: input.responderEphemeralPublicKey.toLowerCase(),
-      }),
-    ),
-  );
-  const value = ((digest[0] << 24) | (digest[1] << 16) | (digest[2] << 8) | digest[3]) >>> 0;
-  return String(value % 1_000_000).padStart(6, '0');
-}

package/src/i18n/locales/ar-SA.json

@@ -108,6 +108,7 @@
     "loading": "جارٍ تحميل الحسابات...",
     "qrHeadline": "سجّل الدخول بهوية Oxy الخاصة بك",
     "signInWithOxy": "تسجيل الدخول باستخدام Oxy",
+    "signUpWithOxy": "التسجيل باستخدام Oxy",
     "useIdentityOnDevice": "لا تملك Commons؟ استخدم مفتاح مرور على هذا الجهاز بدلاً من ذلك",
     "getCommons": "احصل على Commons",
     "commonsNotInstalled": "لا تملك Commons؟ احصل على التطبيق لتسجيل الدخول بمعرّف Oxy الخاص بك.",

package/src/i18n/locales/ca-ES.json

@@ -108,6 +108,7 @@
     "loading": "S'estan carregant els comptes...",
     "qrHeadline": "Inicia sessió amb la teva identitat d'Oxy",
     "signInWithOxy": "Inicia sessió amb Oxy",
+    "signUpWithOxy": "Registra't amb Oxy",
     "useIdentityOnDevice": "No tens Commons? Fes servir una clau d'accés en aquest dispositiu",
     "getCommons": "Descarrega Commons",
     "commonsNotInstalled": "No tens Commons? Descarrega l'app per iniciar sessió amb el teu Oxy ID.",

package/src/i18n/locales/de-DE.json

@@ -108,6 +108,7 @@
     "loading": "Konten werden geladen...",
     "qrHeadline": "Melden Sie sich mit Ihrer Oxy-Identität an",
     "signInWithOxy": "Mit Oxy anmelden",
+    "signUpWithOxy": "Mit Oxy registrieren",
     "useIdentityOnDevice": "Kein Commons? Verwenden Sie stattdessen einen Passkey auf diesem Gerät",
     "getCommons": "Commons herunterladen",
     "commonsNotInstalled": "Kein Commons? Holen Sie sich die App, um sich mit Ihrer Oxy-ID anzumelden.",

package/src/i18n/locales/en-US.json

@@ -416,6 +416,7 @@
     "scanQr": "Scan QR code",
     "qrHeadline": "Sign in with your Oxy identity",
     "signInWithOxy": "Sign in with Oxy",
+    "signUpWithOxy": "Sign up with Oxy",
     "useIdentityOnDevice": "No Commons? Use a passkey on this device instead",
     "getCommons": "Get Commons",
     "commonsNotInstalled": "Don't have Commons? Get the app to sign in with your Oxy ID.",

package/src/i18n/locales/es-ES.json

@@ -656,6 +656,7 @@
     "scanQr": "Escanear código QR",
     "qrHeadline": "Inicia sesión con tu identidad de Oxy",
     "signInWithOxy": "Inicia sesión con Oxy",
+    "signUpWithOxy": "Regístrate con Oxy",
     "useIdentityOnDevice": "¿No tienes Commons? Usa una clave de acceso en este dispositivo",
     "getCommons": "Descargar Commons",
     "commonsNotInstalled": "¿No tienes Commons? Descarga la app para iniciar sesión con tu Oxy ID.",

package/src/i18n/locales/fr-FR.json

@@ -108,6 +108,7 @@
     "loading": "Chargement des comptes...",
     "qrHeadline": "Connectez-vous avec votre identité Oxy",
     "signInWithOxy": "Se connecter avec Oxy",
+    "signUpWithOxy": "S'inscrire avec Oxy",
     "useIdentityOnDevice": "Pas de Commons ? Utilisez une clé d'accès sur cet appareil",
     "getCommons": "Obtenir Commons",
     "commonsNotInstalled": "Pas de Commons ? Téléchargez l'app pour vous connecter avec votre Oxy ID.",

package/src/i18n/locales/it-IT.json

@@ -108,6 +108,7 @@
     "loading": "Caricamento account...",
     "qrHeadline": "Accedi con la tua identità Oxy",
     "signInWithOxy": "Accedi con Oxy",
+    "signUpWithOxy": "Registrati con Oxy",
     "useIdentityOnDevice": "Non hai Commons? Usa una passkey su questo dispositivo",
     "getCommons": "Ottieni Commons",
     "commonsNotInstalled": "Non hai Commons? Scarica l'app per accedere con il tuo Oxy ID.",

package/src/i18n/locales/ja-JP.json

@@ -108,6 +108,7 @@
     "loading": "アカウントを読み込み中...",
     "qrHeadline": "Oxy IDでサインイン",
     "signInWithOxy": "Oxyでサインイン",
+    "signUpWithOxy": "Oxyで登録",
     "useIdentityOnDevice": "Commonsがありませんか？このデバイスのパスキーを使用",
     "getCommons": "Commonsを入手",
     "commonsNotInstalled": "Commonsがありませんか？アプリを入手してOxy IDでサインインしましょう。",

package/src/i18n/locales/ko-KR.json

@@ -108,6 +108,7 @@
     "loading": "계정을 불러오는 중...",
     "qrHeadline": "Oxy ID로 로그인",
     "signInWithOxy": "Oxy로 로그인",
+    "signUpWithOxy": "Oxy로 가입하기",
     "useIdentityOnDevice": "Commons가 없으신가요? 이 기기의 패스키를 사용하세요",
     "getCommons": "Commons 다운로드",
     "commonsNotInstalled": "Commons가 없으신가요? 앱을 다운로드하여 Oxy ID로 로그인하세요.",

package/src/i18n/locales/pt-PT.json

@@ -108,6 +108,7 @@
     "loading": "A carregar contas...",
     "qrHeadline": "Inicie sessão com a sua identidade Oxy",
     "signInWithOxy": "Iniciar sessão com Oxy",
+    "signUpWithOxy": "Registar-se com Oxy",
     "useIdentityOnDevice": "Não tem o Commons? Use uma chave de acesso neste dispositivo",
     "getCommons": "Obter o Commons",
     "commonsNotInstalled": "Não tem o Commons? Obtenha a app para iniciar sessão com o seu Oxy ID.",

package/src/i18n/locales/zh-CN.json

@@ -108,6 +108,7 @@
     "loading": "正在加载账户...",
     "qrHeadline": "使用您的 Oxy 身份登录",
     "signInWithOxy": "使用 Oxy 登录",
+    "signUpWithOxy": "使用 Oxy 注册",
     "useIdentityOnDevice": "没有 Commons？改用此设备上的通行密钥",
     "getCommons": "获取 Commons",
     "commonsNotInstalled": "没有 Commons？获取应用以使用您的 Oxy ID 登录。",

package/src/index.ts

@@ -86,10 +86,6 @@ export type {
     ContactDiscoveryMatch,
     ContactDiscoveryResponse,
 } from './mixins/OxyServices.contacts';
-export type {
-    InitDeviceTransferResult,
-    DeviceTransferOutcome,
-} from './mixins/OxyServices.deviceTransfer';
 export type {
     BulkFollowEntry,
     BulkFollowResult,
@@ -234,7 +230,6 @@ export {
 export { buildUserDid } from './mixins/OxyServices.identity';
 export type {
     IdentityRecordType,
-    UnlinkableAuthMethodType,
     LinkAuthMethodResult,
     PublishRecordResult,
     VerifyRecordResult,
@@ -338,41 +333,55 @@ export {
 export type { AeadResult } from './crypto/aead';
 export { deriveSharedSecret } from './crypto/ecdh';
 
-// Web identity carrier — the same identity as Commons, sealed under a passkey's
-// PRF output (docs/superpowers/specs/2026-09-15-one-identity-two-carriers-design.md)
+// Web identity holder — the same root as Commons, sealed under a passkey's PRF
+// output; identity proofs; transfer to Commons (docs/adr/0024-one-oxy-account-root-holders.md)
 export {
     WEB_IDENTITY_PRF_INPUT,
     WebIdentityUnlockError,
+    WEB_IDENTITY_PRF_OUTPUT_LENGTH,
     addWrap,
-    buildIdentityActionMessage,
     deriveIdentityFromMnemonic,
+    deriveIdentityFromPrivateKey,
+    deriveIdentityFromRecoveryMaterial,
     deriveKeyEncryptionKey,
-    deriveTransferSas,
     generateDataKey,
     generateWebIdentity,
+    isUsablePrfOutput,
+    markWrapVerified,
+    normalizeMnemonic,
     openWebIdentity,
+    parseRecoveryMaterial,
     removeWrap,
     sealWebIdentity,
-    signIdentityAction,
     unlockWebIdentity,
     unwrapDataKey,
     wipeBytes,
-    wrapDataKey,
+    wipeOpenedIdentity,
+} from './crypto/webIdentityCarrier';
+export type {
+    OpenedMnemonicIdentity,
+    OpenedRawKeyIdentity,
+    OpenedWebIdentity,
+    WebIdentityRecoveryMaterial,
+    WebIdentityUnlockFailure,
+    WrapInput,
 } from './crypto/webIdentityCarrier';
-export type { OpenedWebIdentity, WebIdentityUnlockFailure } from './crypto/webIdentityCarrier';
+export { digestIdentityPayload, signIdentityProof } from './crypto/identityProof';
 export {
-    IDENTITY_MOVE_ACTIONS,
-    buildMoveMessage,
     buildMoveQrPayload,
+    createMoveCommitment,
     deriveMoveKey,
     deriveMoveSas,
+    digestMoveCiphertext,
     generateMoveEphemeralKeyPair,
     openMovedIdentity,
     parseMoveQrPayload,
     sealIdentityForMove,
-    signMoveAction,
+    signMoveReceipt,
+    verifyMoveCommitment,
     verifyMoveReceipt,
 } from './crypto/identityMove';
+export type { MoveReceiptClaims } from './crypto/identityMove';
 
 // ---------------------------------------------------------------------------
 // Devices
@@ -909,6 +918,8 @@ export type {
     OxyInferenceResponse,
     OxyGenerationReceipt,
     OxyResponsesRequest,
+    OxySpeechRequest,
+    OxySpeechResponse,
 } from './inference/OxyInferenceClient';
 
 export { runSessionColdBoot } from './boot/sessionColdBoot';