@oxy.so/core 4.5.0-oxy-one.0 → 4.5.0

package/README.md

@@ -81,7 +81,7 @@ const url = buildOAuthAuthorizeUrl({
 
 ## User Identity And Handles
 
-SDK user payloads may arrive with either `id` or Mongo-style `_id`; normalize
+SDK user payloads may arrive with either `id` or a raw `_id`; normalize
 them before exposing state to apps:
 
 ```ts

package/dist/cjs/HttpService.js

@@ -39,14 +39,25 @@ function sameTokenSession(left, right) {
         return false;
     // A refresh may rotate exp/iat/jti while preserving its account and session.
     // Opaque/malformed context fields cannot establish that equivalence.
-    return ['userId', 'id', 'sub', 'sessionId', 'operatorId', 'clientId', 'appId', 'authMethodId'].every((key) => (a[key] === undefined || typeof a[key] === 'string') && a[key] === b[key]);
+    return [
+        'userId',
+        'id',
+        'sub',
+        'sessionId',
+        'operatorId',
+        'clientId',
+        'appId',
+        'authMethodId',
+    ].every((key) => (a[key] === undefined || typeof a[key] === 'string') && a[key] === b[key]);
 }
 /** Cancel this wait only; the shared mint continues for other callers. */
 function awaitRequestSignal(pending, signal) {
     if (!signal)
         return pending;
     return new Promise((resolve, reject) => {
-        const onAbort = () => { reject((0, errorUtils_1.createCancelledError)()); };
+        const onAbort = () => {
+            reject((0, errorUtils_1.createCancelledError)());
+        };
         if (signal.aborted)
             onAbort();
         else
@@ -205,7 +216,9 @@ function isAbortLike(error) {
 function linkAbort(parent, child) {
     if (parent.aborted) {
         child.abort(parent.reason);
-        return () => { };
+        return () => {
+            /* nothing was ever attached */
+        };
     }
     const onAbort = () => {
         child.abort(parent.reason);
@@ -317,8 +330,7 @@ class HttpService {
         // the cache for the global cleanup interval. Default (config unset) keeps
         // caching ON with the 5-minute TTL — unchanged for existing consumers.
         this.cacheDisabled =
-            config.enableCache === false ||
-                (typeof config.cacheTTL === 'number' && config.cacheTTL <= 0);
+            config.enableCache === false || (typeof config.cacheTTL === 'number' && config.cacheTTL <= 0);
         this.cache = new cache_1.TTLCache(config.cacheTTL && config.cacheTTL > 0 ? config.cacheTTL : 5 * 60 * 1000);
         if (!this.cacheDisabled) {
             (0, cache_1.registerCacheForCleanup)(this.cache);
@@ -494,7 +506,7 @@ class HttpService {
                 const isUrlEncoded = this.isUrlSearchParams(data);
                 // Build headers - start with defaults
                 const headers = {
-                    'Accept': 'application/json',
+                    Accept: 'application/json',
                 };
                 // Only set Content-Type for non-FormData requests (FormData sets it automatically with boundary)
                 if (isUrlEncoded) {
@@ -528,7 +540,11 @@ class HttpService {
                 // `fetch` as-is: RN's fetch does not consistently encode it, and doing
                 // it here keeps the body identical across every platform.
                 const bodyValue = method !== 'GET' && data
-                    ? (isFormData ? data : isUrlEncoded ? data.toString() : JSON.stringify(data))
+                    ? isFormData
+                        ? data
+                        : isUrlEncoded
+                            ? data.toString()
+                            : JSON.stringify(data)
                     : undefined;
                 // React Native FormData workaround:
                 // Expo SDK 56's "winter fetch" rejects RN file descriptors `{uri, type, name}`
@@ -570,7 +586,13 @@ class HttpService {
                             // queue slot, so a queued retry waits for a slot while holding one.
                             // With every slot held by a 401 (a revoked session under load) no
                             // retry could ever start and the whole client stalled.
-                            return this.request({ ...config, _isAuthRetry: true, retry: false, deduplicate: false, bypassQueue: true });
+                            return this.request({
+                                ...config,
+                                _isAuthRetry: true,
+                                retry: false,
+                                deduplicate: false,
+                                bypassQueue: true,
+                            });
                         }
                         // Refresh failed or no token — clear tokens
                         this.tokenStore.clearTokens();
@@ -597,7 +619,11 @@ class HttpService {
                     const parsed = (0, errorUtils_1.parseHttpErrorBody)(errorBody);
                     const error = new Error(parsed.message ?? `HTTP ${response.status}: ${response.statusText}`);
                     error.status = response.status;
-                    error.response = { status: response.status, statusText: response.statusText, data: errorBody };
+                    error.response = {
+                        status: response.status,
+                        statusText: response.statusText,
+                        data: errorBody,
+                    };
                     // Only set `code`/`details` when the server actually sent them.
                     // Assigning `undefined` would still create the property, which changes
                     // how `handleHttpError` classifies the error downstream.
@@ -644,7 +670,11 @@ class HttpService {
                         }
                     }
                 }
-                else if (contentType && (contentType.includes('application/octet-stream') || contentType.includes('image/') || contentType.includes('video/') || contentType.includes('audio/'))) {
+                else if (contentType &&
+                    (contentType.includes('application/octet-stream') ||
+                        contentType.includes('image/') ||
+                        contentType.includes('video/') ||
+                        contentType.includes('audio/'))) {
                     // For binary responses (blobs), return the blob directly without unwrapping
                     responseData = await response.blob();
                 }
@@ -710,7 +740,9 @@ class HttpService {
         // Control-plane calls the auth lane depends on (`bypassQueue`, e.g. the
         // device-secret mint) run DIRECTLY — a queued mint could never acquire a
         // slot when every slot is parked awaiting it.
-        config.bypassQueue ? attempt(domain) : this.requestQueue.enqueue(() => attempt(domain), domain);
+        config.bypassQueue
+            ? attempt(domain)
+            : this.requestQueue.enqueue(() => attempt(domain), domain);
         const execute = (domain) => retry
             ? (0, asyncUtils_1.retryAsync)(() => runAttempt(domain), {
                 maxRetries,
@@ -816,7 +848,9 @@ class HttpService {
                 try {
                     xhr.abort();
                 }
-                catch { /* xhr already finished */ }
+                catch {
+                    /* xhr already finished */
+                }
             };
             if (abortSignal.aborted) {
                 reject(new DOMException('The user aborted a request.', 'AbortError'));
@@ -1229,8 +1263,10 @@ class HttpService {
         // an auth mint, even when the trusted transport accepts absolute URLs.
         const target = new URL(this.buildURL(config.url));
         const base = new URL(this.baseURL);
-        if (target.origin !== base.origin || !['http:', 'https:'].includes(target.protocol)
-            || target.username || target.password) {
+        if (target.origin !== base.origin ||
+            !['http:', 'https:'].includes(target.protocol) ||
+            target.username ||
+            target.password) {
             throw new Error('Raw response requests must target the configured API origin');
         }
         if (config.signal?.aborted)
@@ -1240,7 +1276,8 @@ class HttpService {
         const contextToken = this.syncAccessTokenFromProvider();
         const beforeAuthEpoch = this.sessionEpoch;
         const authHeader = await awaitRequestSignal(this.getAuthHeader(), config.signal);
-        if (beforeAuthEpoch !== this.sessionEpoch || !sameTokenSession(contextToken, this.tokenStore.getAccessToken())) {
+        if (beforeAuthEpoch !== this.sessionEpoch ||
+            !sameTokenSession(contextToken, this.tokenStore.getAccessToken())) {
             throw new OxyServices_errors_1.OxyAuthenticationError('The request session changed', 'AUTH_SESSION_CHANGED');
         }
         if (config.signal?.aborted)
@@ -1253,7 +1290,8 @@ class HttpService {
     async requestResponseAttempt(config, fullUrl, authHeader, isAuthRetry, epoch, contextToken) {
         const assertCurrent = () => {
             this.syncAccessTokenFromProvider();
-            if (epoch !== this.sessionEpoch || !sameTokenSession(contextToken, this.tokenStore.getAccessToken())) {
+            if (epoch !== this.sessionEpoch ||
+                !sameTokenSession(contextToken, this.tokenStore.getAccessToken())) {
                 throw new OxyServices_errors_1.OxyAuthenticationError('The request session changed', 'AUTH_SESSION_CHANGED');
             }
         };
@@ -1298,7 +1336,11 @@ class HttpService {
                 throw error;
             }
             const replayable = body === undefined || typeof body === 'string';
-            if (response.status === 401 && !isAuthRetry && authHeader && replayable && !config.signal?.aborted) {
+            if (response.status === 401 &&
+                !isAuthRetry &&
+                authHeader &&
+                replayable &&
+                !config.signal?.aborted) {
                 let refreshed;
                 try {
                     refreshed = await awaitRequestSignal(this.refreshAccessToken('response-401'), config.signal);
@@ -1333,7 +1375,9 @@ class HttpService {
             this.config.onRequestEnd?.(config.url, config.method, duration, false);
             const normalizedError = config.signal?.aborted || (0, errorUtils_1.isCancelledError)(error)
                 ? (0, errorUtils_1.createCancelledError)()
-                : error instanceof Error ? error : new Error(String(error));
+                : error instanceof Error
+                    ? error
+                    : new Error(String(error));
             this.config.onRequestError?.(config.url, config.method, normalizedError);
             if ((0, errorUtils_1.isCancelledError)(normalizedError) || normalizedError instanceof OxyServices_errors_1.OxyAuthenticationError)
                 throw normalizedError;
@@ -1505,7 +1549,7 @@ class HttpService {
      * per resource.
      * @returns Number of entries deleted
      */
-    invalidateCache({ keys = [], prefixes = [] }) {
+    invalidateCache({ keys = [], prefixes = [], }) {
         if (keys.length === 0 && prefixes.length === 0)
             return 0;
         const exact = new Set(keys);

package/dist/cjs/api/accounts.js

@@ -105,7 +105,9 @@ class AccountAgentKeysApi {
         this.ctx = ctx;
     }
     async list(accountId) {
-        return contracts_1.agentKeyListResponseSchema.parse(await this.ctx.request('GET', `/accounts/${enc(accountId)}/agent-keys`, undefined, { cache: false }));
+        return contracts_1.agentKeyListResponseSchema.parse(await this.ctx.request('GET', `/accounts/${enc(accountId)}/agent-keys`, undefined, {
+            cache: false,
+        }));
     }
     async requestChallenge(accountId, operation) {
         const response = await this.ctx.request('POST', `/accounts/${enc(accountId)}/agent-keys/challenge`, contracts_1.agentKeyOperationSchema.parse(operation), { cache: false });
@@ -195,7 +197,9 @@ class AccountsApi {
      * @param data - Account configuration: kind, optional parent, and profile.
      */
     async create(data) {
-        const res = await this.ctx.request('POST', '/accounts', data, { cache: false });
+        const res = await this.ctx.request('POST', '/accounts', data, {
+            cache: false,
+        });
         // A new account changes the accessible forest — bust every cached list.
         (0, accountCacheSweep_1.evictOxyAccountForestCache)(this.ctx.http);
         return res.account;
@@ -235,7 +239,10 @@ class AccountsApi {
             cache: false,
         });
         this.ctx.http.invalidateCache({
-            keys: [`GET:/accounts/${enc(accountId)}/members`, `GET:/accounts/${enc(accountId)}/credentials`],
+            keys: [
+                `GET:/accounts/${enc(accountId)}/members`,
+                `GET:/accounts/${enc(accountId)}/credentials`,
+            ],
         });
         (0, accountCacheSweep_1.evictOxyAccountForestCache)(this.ctx.http, accountId);
         return result;

package/dist/cjs/api/agency.js

@@ -36,7 +36,9 @@ class DelegationGrantsApi {
     }
     /** Revoke a grant. */
     async revoke(grantId, ownerAccountId) {
-        await this.ctx.request('DELETE', `/capabilities/grants/${enc(grantId)}`, undefined, { cache: false });
+        await this.ctx.request('DELETE', `/capabilities/grants/${enc(grantId)}`, undefined, {
+            cache: false,
+        });
         this.ctx.oxy.cache.delete(grantsKey(ownerAccountId));
     }
 }

package/dist/cjs/api/apps.js

@@ -72,7 +72,10 @@ class ConnectedAppsApi {
      * `GET /auth/grants`, briefly cached; `revoke` busts it.
      */
     async list() {
-        return this.ctx.request('GET', '/auth/grants', undefined, { cache: true, cacheTTL: SHORT_TTL });
+        return this.ctx.request('GET', '/auth/grants', undefined, {
+            cache: true,
+            cacheTTL: SHORT_TTL,
+        });
     }
     /**
      * Revoke this user's grant for a connected application. After this the
@@ -94,7 +97,9 @@ class ConnectedAppsApi {
     }
     /** Revoke one external MCP connection and every token in its family. */
     async revokeMcpClient(grantId) {
-        await this.ctx.request('DELETE', `/auth/mcp/oauth/grants/${enc(grantId)}`, undefined, { cache: false });
+        await this.ctx.request('DELETE', `/auth/mcp/oauth/grants/${enc(grantId)}`, undefined, {
+            cache: false,
+        });
         this.ctx.oxy.cache.delete('GET:/auth/mcp/oauth/grants');
     }
 }
@@ -154,7 +159,10 @@ class AppsApi {
         const result = await this.ctx.request('DELETE', appPath(applicationId), undefined, {
             cache: false,
         });
-        this.invalidateLists([`GET:${appPath(applicationId)}`, `GET:${credentialsPath(applicationId)}`]);
+        this.invalidateLists([
+            `GET:${appPath(applicationId)}`,
+            `GET:${credentialsPath(applicationId)}`,
+        ]);
         return result;
     }
     /**
@@ -185,7 +193,10 @@ class AppsApi {
      * `GET:/applications/<id>…` detail keys.
      */
     invalidateLists(extraKeys = []) {
-        this.ctx.http.invalidateCache({ keys: ['GET:/applications', ...extraKeys], prefixes: ['GET:/applications?'] });
+        this.ctx.http.invalidateCache({
+            keys: ['GET:/applications', ...extraKeys],
+            prefixes: ['GET:/applications?'],
+        });
     }
 }
 exports.AppsApi = AppsApi;

package/dist/cjs/api/assets.js

@@ -38,6 +38,12 @@ const ASSET_URL_CACHE_LIFETIME_FRACTION = 0.5;
 /** Assumed URL lifetime (seconds) when no `expiresIn` is asked for; the API default. */
 const DEFAULT_ASSET_URL_EXPIRES_IN_SECONDS = 3600;
 const ASSET_TTL = 5 * 60 * 1000;
+/**
+ * Default bound on one `POST /assets/upload`, in ms. The client's per-request
+ * default (5s) is sized for JSON calls; a video sent over a phone connection
+ * needs minutes, and timing it out at 5s failed every upload past a few MB.
+ */
+const ASSET_UPLOAD_TIMEOUT_MS = 10 * 60 * 1000;
 /**
  * How long a resolved asset URL may stay in the SDK's GET cache, in ms: never
  * longer than the media token's lifetime, and discounted below it.
@@ -65,7 +71,13 @@ class AssetsApi {
         });
         if (body.type && !headers.has('Content-Type'))
             headers.set('Content-Type', body.type);
-        const result = await fetch(target.toString(), { method: 'PUT', body, headers, credentials: 'omit', redirect: 'error' });
+        const result = await fetch(target.toString(), {
+            method: 'PUT',
+            body,
+            headers,
+            credentials: 'omit',
+            redirect: 'error',
+        });
         if (!result.ok)
             throw new Error(`Presigned upload failed (${result.status})`);
     }
@@ -83,7 +95,8 @@ class AssetsApi {
         const fileName = 'name' in file && file.name ? file.name : 'unknown';
         const fileSize = 'size' in file && file.size ? file.size : 0;
         const formData = new FormData();
-        if ((typeof File !== 'undefined' && file instanceof File) || (typeof Blob !== 'undefined' && file instanceof Blob)) {
+        if ((typeof File !== 'undefined' && file instanceof File) ||
+            (typeof Blob !== 'undefined' && file instanceof Blob)) {
             formData.append('file', file, fileName);
         }
         else if ('uri' in file && typeof file.uri === 'string') {
@@ -99,7 +112,9 @@ class AssetsApi {
                     throw new Error(`Failed to read file from uri (status ${res.status})`);
                 }
                 const fetched = await res.blob();
-                const blob = fetched.type === '' && descriptor.type ? new Blob([fetched], { type: descriptor.type }) : fetched;
+                const blob = fetched.type === '' && descriptor.type
+                    ? new Blob([fetched], { type: descriptor.type })
+                    : fetched;
                 if (blob.size === 0) {
                     throw new Error('Cannot upload an empty file');
                 }
@@ -114,13 +129,19 @@ class AssetsApi {
         if (options.metadata)
             formData.append('metadata', JSON.stringify(options.metadata));
         try {
-            const response = await this.ctx.request('POST', '/assets/upload', formData, { cache: false });
+            const response = await this.ctx.request('POST', '/assets/upload', formData, {
+                cache: false,
+                timeout: options.timeout ?? ASSET_UPLOAD_TIMEOUT_MS,
+            });
             options.onProgress?.(100);
             return response;
         }
         catch (error) {
             logger_1.logger.error('File upload error', error, { component: 'oxy.assets' });
-            error.fileContext = { fileName, fileSize };
+            error.fileContext = {
+                fileName,
+                fileSize,
+            };
             throw error;
         }
     }
@@ -136,7 +157,9 @@ class AssetsApi {
     // ── Links ────────────────────────────────────────────────────────────────
     /** Link an asset to an entity (what keeps it alive). */
     async link(fileId, target, options = {}) {
-        const body = { ...target };
+        const body = {
+            ...target,
+        };
         if (options.visibility)
             body.visibility = options.visibility;
         if (options.webhookUrl)
@@ -156,7 +179,10 @@ class AssetsApi {
     // ── Reads ────────────────────────────────────────────────────────────────
     /** An asset's record: size, mime, visibility, links, variants. */
     async get(fileId) {
-        return this.ctx.request('GET', `/assets/${enc(fileId)}`, undefined, { cache: true, cacheTTL: ASSET_TTL });
+        return this.ctx.request('GET', `/assets/${enc(fileId)}`, undefined, {
+            cache: true,
+            cacheTTL: ASSET_TTL,
+        });
     }
     /** The signed-in user's files, newest first. */
     async list(params = {}) {
@@ -169,7 +195,9 @@ class AssetsApi {
     }
     /** The account's storage usage, aggregated from its assets. */
     async usage() {
-        return this.ctx.request('GET', '/storage/usage', undefined, { cache: false });
+        return this.ctx.request('GET', '/storage/usage', undefined, {
+            cache: false,
+        });
     }
     // ── URLs ─────────────────────────────────────────────────────────────────
     /**
@@ -251,7 +279,9 @@ class AssetsApi {
             body.expiresIn = options.expiresIn;
         if (typeof options?.context === 'string')
             body.context = options.context;
-        return this.ctx.request('POST', '/assets/batch-access', body, { cache: false });
+        return this.ctx.request('POST', '/assets/batch-access', body, {
+            cache: false,
+        });
     }
     // ── Content ──────────────────────────────────────────────────────────────
     /** An asset's content as text. */
@@ -271,7 +301,9 @@ class AssetsApi {
      */
     async delete(fileId, options = {}) {
         const url = `/assets/${enc(fileId)}${options.force ? '?force=true' : ''}`;
-        const res = await this.ctx.request('DELETE', url, undefined, { cache: false });
+        const res = await this.ctx.request('DELETE', url, undefined, {
+            cache: false,
+        });
         this.evict(fileId);
         return res;
     }
@@ -313,7 +345,10 @@ class AssetsApi {
     }
     /** Drop the cached record and every cached URL variant of an asset, in one pass. */
     evict(fileId) {
-        this.ctx.http.invalidateCache({ keys: [`GET:/assets/${enc(fileId)}`], prefixes: [`GET:/assets/${enc(fileId)}/url`] });
+        this.ctx.http.invalidateCache({
+            keys: [`GET:/assets/${enc(fileId)}`],
+            prefixes: [`GET:/assets/${enc(fileId)}/url`],
+        });
     }
 }
 exports.AssetsApi = AssetsApi;
@@ -333,7 +368,9 @@ function dedupeFileAccessRequests(requests) {
         if (seen.has(key))
             continue;
         seen.add(key);
-        out.push(req.variant === undefined ? { fileId: req.fileId } : { fileId: req.fileId, variant: req.variant });
+        out.push(req.variant === undefined
+            ? { fileId: req.fileId }
+            : { fileId: req.fileId, variant: req.variant });
     }
     return out;
 }

package/dist/cjs/api/auth.js

@@ -233,7 +233,9 @@ class AuthPasswordApi {
         return signInStep(this.ctx, res, 'auth/signin/password');
     }
     async set(request) {
-        return this.ctx.request('PUT', '/users/me/password', request, { cache: false });
+        return this.ctx.request('PUT', '/users/me/password', request, {
+            cache: false,
+        });
     }
 }
 exports.AuthPasswordApi = AuthPasswordApi;
@@ -243,7 +245,9 @@ class AuthTotpApi {
         this.ctx = ctx;
     }
     async enroll() {
-        const res = await this.ctx.request('POST', '/users/me/totp/enroll', undefined, { cache: false });
+        const res = await this.ctx.request('POST', '/users/me/totp/enroll', undefined, {
+            cache: false,
+        });
         const parsed = (0, contracts_1.safeParseContract)(contracts_1.totpEnrollResponseSchema, res);
         if (!parsed)
             throw new Error('users/me/totp/enroll returned an unexpected response shape');
@@ -312,7 +316,10 @@ class AuthOAuthApi {
             client_id: params.clientId,
             code_verifier: params.codeVerifier,
         });
-        const res = await this.ctx.request('POST', '/auth/oauth/token', form, { cache: false, skipAuth: true });
+        const res = await this.ctx.request('POST', '/auth/oauth/token', form, {
+            cache: false,
+            skipAuth: true,
+        });
         if (!res || typeof res !== 'object') {
             throw new Error('auth/oauth/token returned an unexpected response shape');
         }
@@ -363,7 +370,9 @@ class AuthOAuthApi {
      * The response is a flat JSON document — no `{ data }` wrapper.
      */
     async userInfo() {
-        const res = await this.ctx.request('GET', '/auth/oauth/userinfo', undefined, { cache: false });
+        const res = await this.ctx.request('GET', '/auth/oauth/userinfo', undefined, {
+            cache: false,
+        });
         if (!res || typeof res !== 'object') {
             throw new Error('auth/oauth/userinfo returned an unexpected response shape');
         }
@@ -693,12 +702,18 @@ class AuthAgentApi {
     }
     async requestChallenge(publicKey) {
         const body = contracts_1.agentChallengeRequestSchema.parse({ publicKey });
-        const response = await this.ctx.request('POST', '/auth/agent/challenge', body, { cache: false, skipAuth: true });
+        const response = await this.ctx.request('POST', '/auth/agent/challenge', body, {
+            cache: false,
+            skipAuth: true,
+        });
         return contracts_1.agentProofClaimsSchema.parse(response);
     }
     async verify(publicKey, proof) {
         const body = contracts_1.agentVerifyRequestSchema.parse({ publicKey, ...proof });
-        const response = await this.ctx.request('POST', '/auth/agent/verify', body, { cache: false, skipAuth: true });
+        const response = await this.ctx.request('POST', '/auth/agent/verify', body, {
+            cache: false,
+            skipAuth: true,
+        });
         return plantSession(this.ctx, response, 'auth/agent/verify');
     }
 }
@@ -714,14 +729,19 @@ class AuthApi {
         this.agent = new AuthAgentApi(ctx);
     }
     /**
-     * Register a new identity with public key authentication
-     * Identity is purely cryptographic - username and profile data are optional
+     * Register a new account for a public key, together with its username.
+     *
+     * The username is required: the server writes it in the same insert as the
+     * key, so an account never exists without one. A taken username is a 409
+     * (`Username already taken`), as is a key that is already registered
+     * (`Identity already registered`).
      *
      * @param publicKey - The user's ECDSA public key (hex)
      * @param signature - Signature of the registration request
      * @param timestamp - Timestamp when the signature was created
+     * @param username - The account's username
      */
-    async registerKey(publicKey, signature, timestamp) {
+    async registerKey(publicKey, signature, timestamp, username) {
         // Advisory for now (server soft-enforces — see
         // `SessionController.register`), but solved unconditionally so every
         // client is already sending it once the server starts requiring it.
@@ -731,6 +751,7 @@ class AuthApi {
             publicKey,
             signature,
             timestamp,
+            username,
             powNonce,
         }, { cache: false, skipAuth: true });
         if (!res || (typeof res === 'object' && Object.keys(res).length === 0)) {
@@ -895,7 +916,10 @@ class AuthApi {
      */
     async checkUsername(username) {
         // Public availability lookup (pre-session) — skip the bearer preflight.
-        return this.ctx.request('GET', `/auth/check-username/${username}`, undefined, { cache: false, skipAuth: true });
+        return this.ctx.request('GET', `/auth/check-username/${username}`, undefined, {
+            cache: false,
+            skipAuth: true,
+        });
     }
     /**
      * The authenticator's code (or a backup code) for a first factor's
@@ -913,7 +937,9 @@ class AuthApi {
         return plantSession(this.ctx, res, 'auth/signup');
     }
     async methods() {
-        const res = await this.ctx.request('GET', '/users/me/sign-in-methods', undefined, { cache: false });
+        const res = await this.ctx.request('GET', '/users/me/sign-in-methods', undefined, {
+            cache: false,
+        });
         const parsed = (0, contracts_1.safeParseContract)(contracts_1.signInMethodsSchema, res);
         if (!parsed)
             throw new Error('users/me/sign-in-methods returned an unexpected response shape');

package/dist/cjs/api/billing.js

@@ -27,7 +27,9 @@ class BillingApi {
     }
     /** Public versioned personal plans. Discovery never proves customer access. */
     async personalPlans() {
-        return contracts_2.personalPlanCatalogueSchema.parse(await this.ctx.request('GET', '/billing/personal-plans', undefined, { cache: false }));
+        return contracts_2.personalPlanCatalogueSchema.parse(await this.ctx.request('GET', '/billing/personal-plans', undefined, {
+            cache: false,
+        }));
     }
     /** Product rights only; requires a production application-bound user session. Never cached. */
     async productAccess(query) {
@@ -37,19 +39,29 @@ class BillingApi {
     }
     /** Named commercial sources for the current subject; no inferred plan collapse. */
     async productSubscriptions(expectedSubjectAccountId) {
-        return contracts_4.productSubscriptionsResponseSchema.parse(await this.ctx.request("GET", expectedSubjectAccountId ? `/billing/product-subscriptions?expectedSubjectAccountId=${encodeURIComponent(expectedSubjectAccountId)}` : "/billing/product-subscriptions", undefined, { cache: false })).subscriptions;
+        return contracts_4.productSubscriptionsResponseSchema.parse(await this.ctx.request('GET', expectedSubjectAccountId
+            ? `/billing/product-subscriptions?expectedSubjectAccountId=${encodeURIComponent(expectedSubjectAccountId)}`
+            : '/billing/product-subscriptions', undefined, { cache: false })).subscriptions;
     }
     /** Per-grant credit provenance; no interpretation of the historical mixed balance. */
     async creditGrants() {
-        return contracts_4.subscriptionCreditGrantsResponseSchema.parse(await this.ctx.request("GET", "/billing/credit-grants", undefined, { cache: false })).grants;
+        return contracts_4.subscriptionCreditGrantsResponseSchema.parse(await this.ctx.request('GET', '/billing/credit-grants', undefined, { cache: false })).grants;
     }
     /** Payer-only named-source cancellation. Resolves on provider acceptance, including pending local reconciliation. Use cancelProductSubscriptionWithStatus for detailed completion state. */
     async cancelProductSubscription(sourceId, expectedSubjectAccountId, actionId) {
-        await this.ctx.request("POST", "/billing/product-subscriptions/cancel", contracts_4.cancelProductSubscriptionSchema.parse({ sourceId, ...(actionId ? { actionId } : {}), ...(expectedSubjectAccountId ? { expectedSubjectAccountId } : {}) }), { cache: false });
+        await this.ctx.request('POST', '/billing/product-subscriptions/cancel', contracts_4.cancelProductSubscriptionSchema.parse({
+            sourceId,
+            ...(actionId ? { actionId } : {}),
+            ...(expectedSubjectAccountId ? { expectedSubjectAccountId } : {}),
+        }), { cache: false });
     }
     /** Provider acceptance versus completed local cancellation, for user-facing flows. */
     async cancelProductSubscriptionWithStatus(sourceId, expectedSubjectAccountId, actionId) {
-        return contracts_4.productSubscriptionCancellationResultSchema.parse(await this.ctx.request('POST', '/billing/product-subscriptions/cancel', contracts_4.cancelProductSubscriptionSchema.parse({ sourceId, ...(actionId ? { actionId } : {}), ...(expectedSubjectAccountId ? { expectedSubjectAccountId } : {}) }), { cache: false }));
+        return contracts_4.productSubscriptionCancellationResultSchema.parse(await this.ctx.request('POST', '/billing/product-subscriptions/cancel', contracts_4.cancelProductSubscriptionSchema.parse({
+            sourceId,
+            ...(actionId ? { actionId } : {}),
+            ...(expectedSubjectAccountId ? { expectedSubjectAccountId } : {}),
+        }), { cache: false }));
     }
     /** The signed-in user's payment history. Never cached. */
     async payments() {
@@ -66,7 +78,10 @@ class BillingApi {
     /** A user's wallet (default: the signed-in user's). Cached briefly: the balance moves. */
     async wallet(userId) {
         const id = this.resolveUserId(userId);
-        return this.ctx.request('GET', `/wallet/${id}`, undefined, { cache: true, cacheTTL: WALLET_TTL });
+        return this.ctx.request('GET', `/wallet/${id}`, undefined, {
+            cache: true,
+            cacheTTL: WALLET_TTL,
+        });
     }
     /** A page of a user's wallet transactions (default: the signed-in user's). Never cached. */
     async walletTransactions(options = {}) {
@@ -76,7 +91,9 @@ class BillingApi {
             params.limit = options.limit;
         if (options.offset)
             params.offset = options.offset;
-        return this.ctx.request('GET', `/wallet/transactions/${id}`, params, { cache: false });
+        return this.ctx.request('GET', `/wallet/transactions/${id}`, params, {
+            cache: false,
+        });
     }
     resolveUserId(userId) {
         const id = userId || this.ctx.oxy.session.userId;