@oxy.so/core 1.9.1 → 1.11.0

package/dist/types/HttpService.d.ts

@@ -94,8 +94,6 @@ interface RequestConfig extends RequestOptions {
     params?: Record<string, unknown>;
     /** @internal Used to prevent infinite auth retry loops */
     _isAuthRetry?: boolean;
-    /** @internal Used to prevent infinite CSRF retry loops */
-    _isCsrfRetry?: boolean;
 }
 /**
  * Unified HTTP Service
@@ -165,6 +163,21 @@ export declare class HttpService {
     private authRefreshHandler;
     private accessTokenProvider;
     private deviceSecretMintInFlight;
+    /**
+     * Bumped by every {@link endSession}. A re-mint captures it before its first
+     * await and plants nothing if it moved: a refresh that was already in flight
+     * when the user signed out would otherwise complete a moment later and put a
+     * bearer — and through the token listeners, the account — back.
+     */
+    private sessionEpoch;
+    /**
+     * Set by {@link endSession}, cleared by the next {@link setTokens}. Read by the
+     * native shared-keychain re-mint arm: after a sign-out a 401 is the expected
+     * answer, not a cue to sign back in with the identity key. The device-secret
+     * arm is NOT gated on it — minting from a credential the store still holds is
+     * how a signed-out tab joins a sign-in made in another tab.
+     */
+    private sessionEnded;
     /**
      * Epoch (ms) before which a cache-size telemetry warning must not be
      * re-emitted. Throttles the {@link CACHE_SOFT_MAX_ENTRIES} warning to at most
@@ -307,11 +320,6 @@ export declare class HttpService {
     private buildURL;
     private getCredentialsMode;
     private shouldSendCredentials;
-    /**
-     * Fetch CSRF token from server (with deduplication)
-     * Required for state-changing requests (POST, PUT, PATCH, DELETE)
-     */
-    private fetchCsrfToken;
     /**
      * Get auth header with automatic token refresh
      */
@@ -416,6 +424,22 @@ export declare class HttpService {
     patch<T = unknown>(url: string, data?: unknown, config?: Omit<RequestConfig, 'method' | 'url' | 'data'>): Promise<T>;
     delete<T = unknown>(url: string, config?: Omit<RequestConfig, 'method' | 'url'>): Promise<T>;
     setTokens(accessToken: string): void;
+    /**
+     * End the local session: clear the bearer and abandon every re-mint already
+     * in flight, so none of them can plant a token after the sign-out.
+     *
+     * {@link clearTokens} alone only drops the bearer, which is right for a
+     * mirror (a linked client following its parent) but not for a sign-out: a
+     * refresh started a moment earlier would finish and plant a new one.
+     */
+    endSession(): void;
+    /**
+     * The current session epoch — see {@link endSession}. A re-mint lane that
+     * plants tokens itself (the device-secret arm) compares it across its awaits.
+     */
+    getSessionEpoch(): number;
+    /** Whether {@link endSession} ran and no token has been planted since. */
+    hasSessionEnded(): boolean;
     setAuthRefreshHandler(handler: AuthRefreshHandler | null): void;
     setAccessTokenProvider(provider: AccessTokenProvider | null): void;
     clearTokens(): void;

package/dist/types/OxyServices.base.d.ts

@@ -96,7 +96,9 @@ export declare class OxyServicesBase {
      */
     setTokens(accessToken: string): void;
     /**
-     * Clear stored authentication tokens
+     * Clear stored authentication tokens and end the local session: a re-mint
+     * already in flight plants nothing, and no new one runs until a token is set
+     * again (see `HttpService.endSession`).
      */
     clearTokens(): void;
     /**

package/dist/types/crypto/deviceBackup.d.ts

@@ -0,0 +1,60 @@
+/**
+ * The device backup of the self-custody identity: a copy that lives OUTSIDE this
+ * app's own keystore, so a keystore wipe cannot take it along with the keys.
+ *
+ * Why it exists (OxyHQ/oxy#1388): on Android every Oxy app shares the Linux UID
+ * `so.oxy.shared`, and the Android Keystore is per UID. Clearing the storage of
+ * ANY sibling app (`pm clear`, or Settings › Apps › Storage › Clear storage)
+ * wipes the Keystore of the whole UID. Every copy the SDK keeps in
+ * expo-secure-store (primary, backup slot, phrase slot) and in the androidx
+ * encrypted prefs (the cross-app shared slot) is wrapped by a key in that
+ * Keystore, so they all die together, and until now the only way back was the
+ * recovery phrase.
+ *
+ * `@oxy.so/core` never imports a native module, so the store is injected by the
+ * app that owns the identity ({@link KeyManager.setDeviceBackupStore}). Commons
+ * registers Android Block Store; every other app registers nothing, which keeps
+ * every code path below a no-op for them. The design and the threat model are in
+ * `docs/identity/device-backup.md`.
+ */
+/**
+ * Where the device backup is kept. Implementations must hold the value outside
+ * the calling app's keystore (that is the whole point) and must never send it
+ * anywhere Oxy can read it.
+ *
+ * `read` resolves `null` when nothing is stored AND when the store cannot be
+ * reached (no Google Play services, an old binary without the native module):
+ * the caller treats both as "no device backup" and falls back to the phrase.
+ */
+export interface IdentityDeviceBackupStore {
+    /** Short name for logs, e.g. `android-block-store`. Never contains secrets. */
+    readonly name: string;
+    read(): Promise<string | null>;
+    write(value: string): Promise<void>;
+    clear(): Promise<void>;
+}
+/** The record format. Bump {@link DEVICE_BACKUP_VERSION} on a breaking change. */
+export declare const DEVICE_BACKUP_VERSION = 1;
+export interface DeviceBackupRecord {
+    version: typeof DEVICE_BACKUP_VERSION;
+    /** Canonical lowercase 64-hex secp256k1 private key. */
+    privateKey: string;
+    /** Canonical lowercase public key. */
+    publicKey: string;
+    /**
+     * The BIP-39 phrase, present only when it was verified to derive
+     * {@link publicKey}. Carried so a restored identity can still reveal its
+     * phrase in Settings and create the phrase-keyed Oxy backup; the phrase is
+     * never more powerful than the private key already in the record.
+     */
+    mnemonic?: string;
+    /** ISO-8601 time of the last write. */
+    updatedAt: string;
+}
+export declare function serializeDeviceBackup(record: DeviceBackupRecord): string;
+/**
+ * Parse a stored record, or `null` for anything that is not a well-formed
+ * version-1 record. Checks SHAPE only; the caller still proves the key pair is
+ * healthy (well-formed, public derives from private) before trusting it.
+ */
+export declare function parseDeviceBackup(raw: string | null | undefined): DeviceBackupRecord | null;

package/dist/types/crypto/keyManager.d.ts

@@ -5,6 +5,7 @@
  * Private keys are stored securely using expo-secure-store and never leave the device.
  */
 import { type IdentityMarker } from './identityMarker';
+import { type IdentityDeviceBackupStore } from './deviceBackup';
 /**
  * Thrown when an identity-mutating operation (createIdentity / importKeyPair)
  * is invoked while a valid identity already exists on the device.
@@ -79,10 +80,14 @@ export type IdentityStatus = {
  * which independent, `key_v1`-surviving source restored the identity. On failure
  * `reason` distinguishes "wasn't lost", "no surviving source", "a source held a
  * DIFFERENT account" (never silently switched), and "storage unavailable".
+ *
+ * `device-backup` is the copy held outside this app's keystore (Android Block
+ * Store in Commons, see {@link KeyManager.setDeviceBackupStore}); it is the only
+ * source that survives a wipe of the whole shared-UID keystore.
  */
 export type IdentityRecoveryResult = {
     recovered: true;
-    source: 'backup' | 'shared';
+    source: 'backup' | 'shared' | 'device-backup';
     publicKey: string;
 } | {
     recovered: false;
@@ -114,6 +119,23 @@ export declare class KeyManager {
      */
     private static slotMigrationPromise;
     private static slotMigrationResult;
+    /**
+     * The keystore-independent device backup, registered by the app that owns the
+     * identity (Commons). `null` in every other app, which makes every device
+     * backup path a no-op there. See `./deviceBackup`.
+     */
+    private static deviceBackupStore;
+    /**
+     * Register (or, with `null`, unregister) where the identity's device backup is
+     * kept. Call once at startup, before the first identity read, ONLY from the
+     * app that holds the self-custody identity: the backup is a full copy of the
+     * private key, and it belongs to exactly one app.
+     *
+     * From then on every create, import, rotation and restore refreshes the
+     * backup, a forced delete clears it, and {@link attemptIdentityRecovery}
+     * restores from it when the keystore copies are gone.
+     */
+    static setDeviceBackupStore(store: IdentityDeviceBackupStore | null): void;
     /**
      * Invalidate cached identity state
      * Called internally when identity is created/deleted/imported
@@ -347,6 +369,33 @@ export declare class KeyManager {
      * @internal
      */
     private static _persistIdentityAtomic;
+    /**
+     * Write the device backup for `(privateKey, publicKey)`, keeping the phrase an
+     * existing record already carries for the SAME identity. `mnemonic` replaces
+     * it, and must already be verified against `publicKey` by the caller.
+     * Best-effort: never throws, returns whether the store now holds this pair.
+     *
+     * @internal
+     */
+    private static _writeDeviceBackup;
+    /** Remove the device backup. Best-effort: never throws. @internal */
+    private static _clearDeviceBackup;
+    /** True when `phrase` is a valid BIP-39 phrase that derives `publicKey`. @internal */
+    private static _phraseDerivesPublicKey;
+    /** The primary pair when it reads back healthy, else `null`. Never throws. @internal */
+    private static _readHealthyPrimary;
+    /**
+     * Make sure the device backup holds the identity on this device, writing it
+     * when it is missing or stale. Commons calls this once per launch once the
+     * identity reads back healthy: it backfills identities created before the
+     * device backup existed, and repairs a backup whose last write failed (a
+     * failed write after a key rotation would otherwise leave the OLD key there).
+     *
+     * Carries the stored recovery phrase along only when it provably derives the
+     * current key. Resolves `true` when the backup is current, `false` when there
+     * is no store, no healthy identity, or the write failed. Never throws.
+     */
+    static ensureDeviceBackup(): Promise<boolean>;
     /**
      * Write/refresh the identity marker after a successful persist. A same-identity
      * re-persist (e.g. backup refresh, idempotent re-import) preserves `createdAt`
@@ -534,25 +583,43 @@ export declare class KeyManager {
      */
     static restoreIdentityFromBackup(): Promise<boolean>;
     /**
-     * Recovery ladder — restore a `lost` identity from an independent,
-     * `key_v1`-surviving source WITHOUT the user re-entering their recovery phrase.
+     * Recovery ladder — restore an identity whose keys are gone from an
+     * independent source WITHOUT the user re-entering their recovery phrase.
      *
-     * Gated on {@link getIdentityStatus} being `lost` (marker present, keys empty):
-     *   - `present` / `absent` → `not-lost` (nothing to recover / nothing lost)
-     *   - `unavailable`        → `unavailable` (keychain locked; retry later)
-     *
-     * Rungs, tried in order, each fully validated (well-formed + derive-match +
-     * `publicKey === marker.publicKey`, so a source holding a DIFFERENT account is
-     * SKIPPED, never restored):
-     *   1. the v2 backup slot (independent keychain key from the primary), then
+     * For a `lost` verdict (marker present, keys empty) the rungs are tried in
+     * order, each fully validated (well-formed + derive-match + `publicKey ===
+     * marker.publicKey`, so a source holding a DIFFERENT account is SKIPPED, never
+     * restored):
+     *   1. the v2 backup slot (independent keychain key from the primary),
      *   2. the cross-app shared slot (Android bridge `getShared` / iOS keychain
-     *      group) — the copy that survives a primary+backup `key_v1` death.
+     *      group) — the copy that survives a primary+backup `key_v1` death,
+     *   3. the device backup ({@link setDeviceBackupStore}; Android Block Store in
+     *      Commons) — the only copy that survives a wipe of the whole shared-UID
+     *      Android Keystore, which takes rungs 1 and 2 with it (oxy#1388).
+     *
+     * For an `absent` verdict (no keys AND no marker: this app's own data was
+     * cleared, or it was reinstalled) only rung 3 applies: a device backup there
+     * means an identity lived on this device and was never deleted (every delete
+     * clears the backup), so it is restored instead of letting onboarding create a
+     * new identity over it. Without a registered store the result stays
+     * `not-lost`, exactly as before.
+     *
+     * `present` → `not-lost`; `unavailable` (keychain locked) → `unavailable`.
+     * Everything here is on-device: no network, so it works offline.
      *
      * On success it re-persists via {@link _persistIdentityAtomic} (origin
      * `'restore'`) and invalidates the cache so routing re-reads `present`. When no
      * rung matches, the UI proceeds to recovery-phrase entry.
      */
     static attemptIdentityRecovery(): Promise<IdentityRecoveryResult>;
+    /** Read the device backup as a healthy, canonical candidate, or null. Never throws. @internal */
+    private static _readDeviceBackupCandidate;
+    /**
+     * Persist a device-backup candidate, then put its phrase back in the
+     * re-reveal slot (which died with the keystore) when it derives the key.
+     * @internal
+     */
+    private static _commitDeviceBackupRecovery;
     /** Read the active-layout backup slot as a healthy candidate, or null. @internal */
     private static _readBackupCandidate;
     /** Read the cross-app shared slot as a healthy candidate, or null. @internal */

package/dist/types/index.d.ts

@@ -61,6 +61,7 @@ export { KeyManager, IdentityAlreadyExistsError, IdentityPersistError, IdentityU
 export type { KeyPair, IdentityStatus, IdentityRecoveryResult } from './crypto/keyManager';
 export { readIdentityMarker, updateIdentityMarker, } from './crypto/identityMarker';
 export type { IdentityMarker } from './crypto/identityMarker';
+export type { IdentityDeviceBackupStore } from './crypto/deviceBackup';
 export { SignatureService } from './crypto/signatureService';
 export type { SignedMessage, AuthChallenge } from './crypto/signatureService';
 export { RecoveryPhraseService } from './crypto/recoveryPhrase';

package/dist/types/mixins/OxyServices.civic.d.ts

@@ -502,7 +502,17 @@ export declare function OxyServicesCivicMixin<T extends typeof OxyServicesBase>(
         handleError(error: unknown): Error;
         healthCheck(): Promise<{
             status: string;
-            users?: number;
+            users
+            /**
+             * The VC type tags. `'VerifiableCredential'` is the required base type and is
+             * prepended automatically when the caller omits it; provide at least one
+             * specific type alongside (e.g. `'EmploymentCredential'`).
+             */
+            ? /**
+             * The VC type tags. `'VerifiableCredential'` is the required base type and is
+             * prepended automatically when the caller omits it; provide at least one
+             * specific type alongside (e.g. `'EmploymentCredential'`).
+             */: number;
             timestamp?: string;
             [key: string]: any;
         }>;

package/dist/types/mixins/OxyServices.linkedAccounts.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Linked Accounts Methods Mixin
+ *
+ * External accounts (any Mastodon-API server, Bluesky) the current user has
+ * PROVEN they own by completing an OAuth authorization there. Oxy uses that
+ * authorization only to learn which account granted it and then discards the
+ * token — nothing here ever carries a third-party token.
+ *
+ * The flow is a top-level browser navigation: {@link startLinkedAccount} returns
+ * the other network's `authorizeUrl`; open it (a new tab, or
+ * `expo-web-browser`'s auth session on native); the network sends the browser
+ * to Oxy's callback, and Oxy sends it to `returnTo` with `?link_code=<code>` or
+ * `?link_error=<code>`. Pass the code to {@link completeLinkedAccount} with the
+ * same user signed in: that call, not the callback, creates the link, so an
+ * authorization someone else started can never link to them. `returnTo` must
+ * be a redirect URI registered on the first-party application `clientId` names.
+ *
+ * Wire types live in `@oxy.so/contracts` (`linkedAccounts.ts`).
+ */
+import type { LinkedAccount, LinkedAccountNetwork, ServiceLinkedAccountListResponse, StartLinkedAccountRequest, StartLinkedAccountResponse } from '@oxy.so/contracts';
+import type { OxyServicesBase } from '../OxyServices.base';
+export declare function OxyServicesLinkedAccountsMixin<T extends typeof OxyServicesBase>(Base: T): {
+    new (...args: any[]): {
+        /** Inherited from the auth mixin at runtime. */
+        makeServiceRequest: <R = unknown>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: unknown, userId?: string) => Promise<R>;
+        /**
+         * Begin linking an external account for the current user.
+         *
+         * @param network - `'activitypub'` (any Mastodon-API server) or `'atproto'` (Bluesky).
+         * @param options - `instance` for ActivityPub (`mastodon.social`, or
+         *   `@user@mastodon.social`), `handle` for atproto; `clientId` + `returnTo`
+         *   to be sent back to your app afterwards.
+         * @returns The URL to open, and when the attempt expires (ten minutes).
+         */
+        startLinkedAccount(network: LinkedAccountNetwork, options: StartLinkedAccountRequest): Promise<StartLinkedAccountResponse>;
+        /**
+         * Finish a link with the `link_code` the callback appended to `returnTo`.
+         * Must be the user who started the flow: for anyone else the API answers
+         * 403 and burns the code. 409 when the account is already someone else's
+         * link. Repeating it within the code's five minutes returns the same link.
+         */
+        completeLinkedAccount(code: string): Promise<LinkedAccount>;
+        /** The current user's live linked accounts, oldest first. */
+        listLinkedAccounts(): Promise<LinkedAccount[]>;
+        /**
+         * Unlink one of the current user's accounts. An ActivityPub link stops being
+         * published as an `alsoKnownAs` alias, and the external account can then be
+         * linked to another Oxy account.
+         */
+        revokeLinkedAccount(linkedAccountId: string): Promise<void>;
+        /**
+         * SERVICE: a user's live linked accounts, each with the federated shadow
+         * user Oxy already holds for it (`federatedUserId`). Requires a service
+         * credential whose application holds the privileged `linked-accounts:read`.
+         */
+        getLinkedAccountsForUser(userId: string): Promise<ServiceLinkedAccountListResponse>;
+        httpService: import("../HttpService").HttpService;
+        cloudURL: string;
+        config: import("../OxyServices.base").OxyConfig;
+        __resetTokensForTests(): void;
+        makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
+        getBaseURL(): string;
+        getClient(): import("../HttpService").HttpService;
+        createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
+        getMetrics(): {
+            totalRequests: number;
+            successfulRequests: number;
+            failedRequests: number;
+            cacheHits: number;
+            cacheMisses: number;
+            averageResponseTime: number;
+        };
+        clearCache(): void;
+        clearCacheEntry(key: string): void;
+        clearCacheByPrefix(prefix: string): number;
+        getCacheStats(): {
+            size: number;
+            hits: number;
+            misses: number;
+            hitRate: number;
+        };
+        getCloudURL(): string;
+        setTokens(accessToken: string): void;
+        clearTokens(): void;
+        onTokensChanged(listener: (accessToken: string | null) => void): () => void;
+        _cachedUserId: string | null | undefined;
+        _cachedAccessToken: string | null;
+        getCurrentUserId(): string | null;
+        hasValidToken(): boolean;
+        getAccessToken(): string | null;
+        getAccessTokenExpiry(): number | null;
+        waitForAuth(timeoutMs?: number): Promise<boolean>;
+        withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
+            maxRetries?: number;
+            retryDelay?: number;
+            authTimeoutMs?: number;
+        }): Promise<T_1>;
+        validate(): Promise<boolean>;
+        handleError(error: unknown): Error;
+        healthCheck(): Promise<{
+            status: string;
+            users?: number;
+            timestamp?: string;
+            [key: string]: any;
+        }>;
+    };
+} & T;

package/dist/types/mixins/OxyServices.user.d.ts

@@ -1,6 +1,7 @@
 /**
  * User Management Methods Mixin
  */
+import type { CreateOxyNotificationRequest } from '@oxy.so/contracts';
 import type { User, Notification, NotificationPreferences, UserPreferences, SearchProfilesResponse, PrivacySettings } from '../models/interfaces';
 import type { UserNameResponse, UserProfileUpdate, RecommendationRequest, RecommendationItem, ThemePreference } from '@oxy.so/contracts';
 import type { OxyServicesBase } from '../OxyServices.base';
@@ -235,10 +236,7 @@ export declare function OxyServicesUserMixin<T extends typeof OxyServicesBase>(B
          *   `PostHydrationService`) and is unchanged.
          * - **Plain client (browser / React Native with a user session):** when no
          *   service credentials are configured, the chunk is fetched via
-         *   `makeRequest`, which attaches the configured user bearer. oxy-api's CSRF
-         *   middleware skips bearer-authenticated writes, and `makeRequest` only
-         *   fetches a CSRF token for cookie-only (no-bearer) state-changing requests,
-         *   so the user-bearer POST is sent without CSRF and succeeds. Previously
+         *   `makeRequest`, which attaches the configured user bearer. Previously
          *   this method always used the service path, so every client-side caller
          *   silently received `[]` because `getServiceToken()` had no credentials.
          *
@@ -498,9 +496,13 @@ export declare function OxyServicesUserMixin<T extends typeof OxyServicesBase>(B
          */
         getUnreadCount(): Promise<number>;
         /**
-         * Create notification
+         * Create a notification (`POST /notifications`; the API requires a service
+         * token whose application holds `notifications:write`). `type` is one of
+         * `OXY_NOTIFICATION_TYPES` from `@oxy.so/contracts` — `system` for a message
+         * from an Oxy service about the recipient's own account, with the recipient
+         * as actor and their profile as the entity.
          */
-        createNotification(data: Partial<Notification>): Promise<Notification>;
+        createNotification(data: CreateOxyNotificationRequest | Partial<Notification>): Promise<Notification>;
         /**
          * Mark notification as read
          */

package/dist/types/mixins/index.d.ts

@@ -34,6 +34,7 @@ import { OxyServicesNodesMixin } from './OxyServices.nodes';
 import { OxyServicesFollowGraphMixin } from './OxyServices.followGraph';
 import { OxyServicesInferenceMixin } from './OxyServices.inference';
 import { OxyServicesDeviceBootMixin } from './OxyServices.deviceBoot';
+import { OxyServicesLinkedAccountsMixin } from './OxyServices.linkedAccounts';
 /**
  * Instance shape of every mixin in the pipeline, intersected. The runtime
  * `composeOxyServices()` produces a class whose instances expose all of
@@ -43,7 +44,7 @@ import { OxyServicesDeviceBootMixin } from './OxyServices.deviceBoot';
  * If you add a new mixin to `MIXIN_PIPELINE`, add it here too so its methods
  * are visible without a cast.
  */
-type AllMixinInstances = InstanceType<ReturnType<typeof OxyServicesAuthMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesUserMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesIdentityMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesIdentityBackupMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesPrivacyMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLanguageMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesPaymentMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesReputationMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAssetsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAccountsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesConnectedAppsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAgencyMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesStoreMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLocationMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAnalyticsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesDevicesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesSecurityMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesFeaturesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesTopicsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesContactsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesNotificationsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAppDataMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesCivicMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesChainsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesNodesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesFollowGraphMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesInferenceMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesDeviceBootMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesUtilityMixin<typeof OxyServicesBase>>>;
+type AllMixinInstances = InstanceType<ReturnType<typeof OxyServicesAuthMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesUserMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesIdentityMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesIdentityBackupMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesPrivacyMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLanguageMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesPaymentMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesReputationMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAssetsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAccountsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesConnectedAppsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAgencyMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesStoreMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLocationMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAnalyticsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesDevicesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesSecurityMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesFeaturesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesTopicsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesContactsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesNotificationsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAppDataMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesCivicMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesChainsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesNodesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesFollowGraphMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesInferenceMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesDeviceBootMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLinkedAccountsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesUtilityMixin<typeof OxyServicesBase>>>;
 /**
  * Constructor type for the fully composed mixin pipeline. Each mixin returns
  * a new constructor that augments its input; reducing across the pipeline

package/dist/types/models/interfaces.d.ts

@@ -99,6 +99,13 @@ export interface User {
      * lists, profile search) — the two are separate fields on the User document.
      */
     description?: string;
+    /**
+     * ActivityPub actor URIs this account is also known as — its live,
+     * OAuth-proven linked Mastodon-API accounts. Emitted by
+     * `GET /profiles/username/:username`; a relying app passes it to the shared
+     * actor builder (`@oxy.so/federation`) so its actor publishes it.
+     */
+    alsoKnownAs?: string[];
     phone?: string;
     address?: string;
     /** Legacy free-text birthday, kept for backward compatibility. Prefer `dateOfBirth`. */
@@ -237,6 +244,22 @@ export interface LoginResponse {
 export interface Notification {
     id: string;
     message: string;
+    /** One of `OXY_NOTIFICATION_TYPES` (`@oxy.so/contracts`). */
+    type?: string;
+    /**
+     * `system` notifications only (with `message`): the text an Oxy service sent
+     * about the recipient's own account. Render these two instead of composing a
+     * sentence from actor + entity.
+     */
+    title?: string;
+    /** `system` notifications only: an optional deep link (https or the sending app's scheme). */
+    url?: string;
+    /**
+     * What `entityId` names: `post` | `reply` | `profile`, or `app` — an opaque id
+     * in the notifying application's namespace (`system` notifications only).
+     */
+    entityType?: string;
+    entityId?: string;
 }
 export interface Wallet {
     id: string;
@@ -594,6 +617,13 @@ export interface ServiceAssetMetadata {
      * play. Treat absence as "no adaptive stream, play the progressive original".
      */
     hlsReadyAt?: string;
+    /**
+     * The Oxy user who owns the file (`null` for a system-owned file such as the
+     * federated media cache). PRESENT ONLY for Oxy's own applications (service
+     * tokens with `tier: 'internal'`), so a first-party service can check that an
+     * asset a user attached is really that user's. Absent for every other caller.
+     */
+    ownerUserId?: string | null;
 }
 /**
  * Reverse-lookup asset metadata returned by `POST /assets/service/by-sha256`.

package/dist/types/server/securityHeaders.d.ts

@@ -161,6 +161,11 @@ export interface OxyPagesHeadersOptions {
      * the app — is REMOVED from `script-src` and `connect-src`, so third-party
      * measurement cannot run there even when the zone has Web Analytics enabled.
      * A structural block in the policy the page is served with, not a build flag.
+     *
+     * It also sends `Cache-Control: no-transform`, which stops the edge from
+     * injecting the beacon at all — otherwise every page load logs a CSP
+     * violation for a script we never asked for. The rest of the value is Pages'
+     * own default, so caching is unchanged.
      */
     sensitive?: boolean;
     /**

package/dist/types/session/refresh.d.ts

@@ -82,6 +82,11 @@ export interface RefreshDeps {
  *    The device secret is FINE — it is the identity binding that went stale, so
  *    the caller must re-establish from the local key, never drop the credential.
  *  - `transient` — network / 5xx; keep the secret, a later attempt can succeed.
+ *  - `session-ended` — the mint succeeded, but the local session was ended
+ *    (`HttpService.endSession`, i.e. a sign-out) while it was in flight. Nothing
+ *    is planted. The rotated secret is persisted only if the store still holds
+ *    the credential that was presented — a store the sign-out cleared stays
+ *    clear.
  *  - `persist-failed` — the mint succeeded but `nextDeviceSecret` could NOT be
  *    durably persisted. The token is deliberately NOT planted: advertising a
  *    healthy session on a secret that will not survive a reload is exactly the
@@ -103,6 +108,8 @@ export type DeviceSecretMintOutcome = {
     status: 'account-not-on-device';
 } | {
     status: 'transient';
+} | {
+    status: 'session-ended';
 } | {
     status: 'persist-failed';
 };

package/dist/types/utils/errorUtils.d.ts

@@ -93,7 +93,7 @@ export interface ParsedHttpErrorBody {
  * - `{ error: '<CODE>', error_description }` — RFC 6749 §5.2 / RFC 6750 §3, the
  *   OAuth token and userinfo endpoints. `error_description` is the human text
  *   and `error` is the machine code, so both survive.
- * - `{ message, code }` — e.g. the API's CSRF rejections.
+ * - `{ message, code }` — e.g. the API's middleware rejections.
  * - `{ error: '<human message>' }` — legacy hand-rolled routes. With no sibling
  *   `message`/`error_description` the string is the message, not a code: a bare
  *   `error` string is not machine-readable enough to promote to `code`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/core",
-  "version": "1.9.1",
+  "version": "1.11.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -118,7 +118,7 @@
     "@oxy.so/telemetry": "^1.1.1",
     "@noble/ciphers": "^1.3.0",
     "@noble/hashes": "^1.8.0",
-    "@oxy.so/contracts": "^1.4.0",
+    "@oxy.so/contracts": "^1.5.0",
     "@oxy.so/protocol": "^1.1.1",
     "@scure/bip39": "^1.6.0",
     "buffer": "^6.0.3",