@oxy.so/core 4.5.0 → 4.8.0

package/dist/types/api/organizations.d.ts

@@ -0,0 +1,246 @@
+import { type OrganizationCuration, type OrganizationImportBatch, type OrganizationClaimListQuery, type CreateOrganization, type OrganizationSearch, type UpdateOrganization, type OrganizationClaimInput, type OrganizationClaimReview, type OrganizationExternalInput, type OrganizationMerge } from '@oxy.so/contracts';
+import type { OxyContext } from '../client/context';
+/** The public canonical organization directory. Claiming changes authority, never identity. */
+export declare class OrganizationsApi {
+    private readonly ctx;
+    constructor(ctx: OxyContext);
+    search(input: OrganizationSearch): Promise<{
+        items: {
+            status: "active" | "inactive" | "merged" | "suppressed";
+            name: string;
+            organizationType: "business" | "nonprofit" | "public_body" | "community" | "other";
+            legalName: string | null;
+            websiteUrl: string | null;
+            countryCode: string | null;
+            aliases: {
+                alias: string;
+                kind: "name_variant" | "former_name" | "localized_name" | "marketing_name" | "misspelling";
+                language?: string | undefined;
+            }[];
+            accountId: string;
+            username: string | null;
+            avatar: string | null;
+            verifiedDomains: string[];
+            claimStatus: "unclaimed" | "claimed";
+            mergedIntoAccountId: string | null;
+            createdAt: string;
+            updatedAt: string;
+        }[];
+        nextCursor: string | null;
+    }>;
+    get(accountId: string): Promise<{
+        status: "active" | "inactive" | "merged" | "suppressed";
+        name: string;
+        organizationType: "business" | "nonprofit" | "public_body" | "community" | "other";
+        legalName: string | null;
+        websiteUrl: string | null;
+        countryCode: string | null;
+        aliases: {
+            alias: string;
+            kind: "name_variant" | "former_name" | "localized_name" | "marketing_name" | "misspelling";
+            language?: string | undefined;
+        }[];
+        accountId: string;
+        username: string | null;
+        avatar: string | null;
+        verifiedDomains: string[];
+        claimStatus: "unclaimed" | "claimed";
+        mergedIntoAccountId: string | null;
+        createdAt: string;
+        updatedAt: string;
+    }>;
+    batch(input: {
+        ids: string[];
+    }): Promise<{
+        items: {
+            requestedAccountId: string;
+            organization: {
+                status: "active" | "inactive" | "merged" | "suppressed";
+                name: string;
+                organizationType: "business" | "nonprofit" | "public_body" | "community" | "other";
+                legalName: string | null;
+                websiteUrl: string | null;
+                countryCode: string | null;
+                aliases: {
+                    alias: string;
+                    kind: "name_variant" | "former_name" | "localized_name" | "marketing_name" | "misspelling";
+                    language?: string | undefined;
+                }[];
+                accountId: string;
+                username: string | null;
+                avatar: string | null;
+                verifiedDomains: string[];
+                claimStatus: "unclaimed" | "claimed";
+                mergedIntoAccountId: string | null;
+                createdAt: string;
+                updatedAt: string;
+            };
+        }[];
+        missingIds: string[];
+    }>;
+    create(input: CreateOrganization): Promise<{
+        status: "active" | "inactive" | "merged" | "suppressed";
+        name: string;
+        organizationType: "business" | "nonprofit" | "public_body" | "community" | "other";
+        legalName: string | null;
+        websiteUrl: string | null;
+        countryCode: string | null;
+        aliases: {
+            alias: string;
+            kind: "name_variant" | "former_name" | "localized_name" | "marketing_name" | "misspelling";
+            language?: string | undefined;
+        }[];
+        accountId: string;
+        username: string | null;
+        avatar: string | null;
+        verifiedDomains: string[];
+        claimStatus: "unclaimed" | "claimed";
+        mergedIntoAccountId: string | null;
+        createdAt: string;
+        updatedAt: string;
+    }>;
+    update(accountId: string, input: UpdateOrganization): Promise<{
+        status: "active" | "inactive" | "merged" | "suppressed";
+        name: string;
+        organizationType: "business" | "nonprofit" | "public_body" | "community" | "other";
+        legalName: string | null;
+        websiteUrl: string | null;
+        countryCode: string | null;
+        aliases: {
+            alias: string;
+            kind: "name_variant" | "former_name" | "localized_name" | "marketing_name" | "misspelling";
+            language?: string | undefined;
+        }[];
+        accountId: string;
+        username: string | null;
+        avatar: string | null;
+        verifiedDomains: string[];
+        claimStatus: "unclaimed" | "claimed";
+        mergedIntoAccountId: string | null;
+        createdAt: string;
+        updatedAt: string;
+    }>;
+    claim(accountId: string, input: OrganizationClaimInput): Promise<{
+        status: "pending" | "approved" | "rejected";
+        accountId: string;
+        createdAt: string;
+        id: string;
+        claimantUserId: string;
+    }>;
+    myClaims(input?: OrganizationClaimListQuery): Promise<{
+        items: {
+            status: "pending" | "approved" | "rejected";
+            accountId: string;
+            createdAt: string;
+            evidenceReference: string;
+            id: string;
+            claimantUserId: string;
+            reviewEvidenceReference: string | null;
+            reviewedAt: string | null;
+        }[];
+        nextCursor: string | null;
+    }>;
+    myClaim(claimId: string): Promise<{
+        status: "pending" | "approved" | "rejected";
+        accountId: string;
+        createdAt: string;
+        evidenceReference: string;
+        id: string;
+        claimantUserId: string;
+        reviewEvidenceReference: string | null;
+        reviewedAt: string | null;
+    }>;
+    reviewClaims(input?: OrganizationClaimListQuery): Promise<{
+        items: {
+            status: "pending" | "approved" | "rejected";
+            accountId: string;
+            createdAt: string;
+            evidenceReference: string;
+            id: string;
+            claimantUserId: string;
+            reviewEvidenceReference: string | null;
+            reviewedAt: string | null;
+        }[];
+        nextCursor: string | null;
+    }>;
+    reviewClaimDetail(claimId: string): Promise<{
+        status: "pending" | "approved" | "rejected";
+        accountId: string;
+        createdAt: string;
+        evidenceReference: string;
+        id: string;
+        claimantUserId: string;
+        reviewEvidenceReference: string | null;
+        reviewedAt: string | null;
+    }>;
+    reviewClaim(claimId: string, input: OrganizationClaimReview): Promise<{
+        status: "pending" | "approved" | "rejected";
+        accountId: string;
+        createdAt: string;
+        id: string;
+        claimantUserId: string;
+    }>;
+    importBatch(input: OrganizationImportBatch): Promise<{
+        items: {
+            accountId: string;
+            externalId: string;
+            created: boolean;
+        }[];
+    }>;
+    importExternal(input: OrganizationExternalInput): Promise<{
+        accountId: string;
+        created: boolean;
+    }>;
+    resolveExternal(input: {
+        namespace: string;
+        externalId: string;
+    }): Promise<{
+        accountId: string;
+    }>;
+    curate(accountId: string, input: OrganizationCuration): Promise<{
+        status: "active" | "inactive" | "suppressed";
+        accountId: string;
+    }>;
+    merge(accountId: string, input: OrganizationMerge): Promise<{
+        status: "active" | "inactive" | "merged" | "suppressed";
+        name: string;
+        organizationType: "business" | "nonprofit" | "public_body" | "community" | "other";
+        legalName: string | null;
+        websiteUrl: string | null;
+        countryCode: string | null;
+        aliases: {
+            alias: string;
+            kind: "name_variant" | "former_name" | "localized_name" | "marketing_name" | "misspelling";
+            language?: string | undefined;
+        }[];
+        accountId: string;
+        username: string | null;
+        avatar: string | null;
+        verifiedDomains: string[];
+        claimStatus: "unclaimed" | "claimed";
+        mergedIntoAccountId: string | null;
+        createdAt: string;
+        updatedAt: string;
+    }>;
+    iterate(input: OrganizationSearch): AsyncGenerator<{
+        status: "active" | "inactive" | "merged" | "suppressed";
+        name: string;
+        organizationType: "business" | "nonprofit" | "public_body" | "community" | "other";
+        legalName: string | null;
+        websiteUrl: string | null;
+        countryCode: string | null;
+        aliases: {
+            alias: string;
+            kind: "name_variant" | "former_name" | "localized_name" | "marketing_name" | "misspelling";
+            language?: string | undefined;
+        }[];
+        accountId: string;
+        username: string | null;
+        avatar: string | null;
+        verifiedDomains: string[];
+        claimStatus: "unclaimed" | "claimed";
+        mergedIntoAccountId: string | null;
+        createdAt: string;
+        updatedAt: string;
+    }, void, unknown>;
+}

package/dist/types/api/safety.d.ts

@@ -0,0 +1,14 @@
+import { type ProfileAccessInput } from '@oxy.so/contracts';
+import type { OxyContext } from '../client/context';
+export declare class SafetyApi {
+    private readonly ctx;
+    constructor(ctx: OxyContext);
+    /** Server callers must explicitly supply the incoming user bearer or null for anonymous access. */
+    profileAccess(input: ProfileAccessInput, options?: {
+        accessToken: string | null;
+    }): Promise<{
+        allowed: boolean;
+        reason: "public" | "owner" | "private" | "blocked" | "unavailable";
+        policyVersion: "1";
+    }>;
+}

package/dist/types/i18n/locales/en-US.d.ts

@@ -1,4 +1,65 @@
 declare const dict: {
+    organizationDirectory: {
+        invalidName: string;
+        review: {
+            title: string;
+            forbidden: string;
+            empty: string;
+            hint: string;
+            independent: string;
+            evidence: string;
+            approved: string;
+            rejected: string;
+            conflict: string;
+            failed: string;
+        };
+        title: string;
+        search: string;
+        searchHint: string;
+        empty: string;
+        retry: string;
+        loadMore: string;
+        failed: string;
+        unclaimed: string;
+        claimed: string;
+        inactive: string;
+        newAccount: string;
+        newAccountHint: string;
+        addDirectory: string;
+        directoryHint: string;
+        added: string;
+        back: string;
+        type: string;
+        types: {
+            business: string;
+            nonprofit: string;
+            public_body: string;
+            community: string;
+            other: string;
+        };
+        name: string;
+        legalName: string;
+        website: string;
+        country: string;
+        save: string;
+        saved: string;
+        invalid: string;
+        saveFailed: string;
+        claim: string;
+        claimHint: string;
+        evidence: string;
+        evidenceHint: string;
+        claimSent: string;
+        claimFailed: string;
+        claimedHint: string;
+        requests: string;
+        pending: string;
+        approved: string;
+        rejected: string;
+        requestError: string;
+        view: string;
+        readonly: string;
+    };
     signin: {
         title: string;
         subtitle: string;

package/dist/types/i18n/locales/es-ES.d.ts

@@ -1,4 +1,65 @@
 declare const dict: {
+    organizationDirectory: {
+        invalidName: string;
+        review: {
+            title: string;
+            forbidden: string;
+            empty: string;
+            hint: string;
+            independent: string;
+            evidence: string;
+            approved: string;
+            rejected: string;
+            conflict: string;
+            failed: string;
+        };
+        title: string;
+        search: string;
+        searchHint: string;
+        empty: string;
+        retry: string;
+        loadMore: string;
+        failed: string;
+        unclaimed: string;
+        claimed: string;
+        inactive: string;
+        newAccount: string;
+        newAccountHint: string;
+        addDirectory: string;
+        directoryHint: string;
+        added: string;
+        back: string;
+        type: string;
+        types: {
+            business: string;
+            nonprofit: string;
+            public_body: string;
+            community: string;
+            other: string;
+        };
+        name: string;
+        legalName: string;
+        website: string;
+        country: string;
+        save: string;
+        saved: string;
+        invalid: string;
+        saveFailed: string;
+        claim: string;
+        claimHint: string;
+        evidence: string;
+        evidenceHint: string;
+        claimSent: string;
+        claimFailed: string;
+        claimedHint: string;
+        requests: string;
+        pending: string;
+        approved: string;
+        rejected: string;
+        requestError: string;
+        view: string;
+        readonly: string;
+    };
     signin: {
         title: string;
         subtitle: string;

package/dist/types/index.d.ts

@@ -99,3 +99,5 @@ export { AUTH_WEB_ORIGIN, CENTRAL_IDP_APEX } from './utils/authWebUrl';
 export { buildOAuthAuthorizeUrl, computeCodeChallenge, generateOAuthState, generatePkcePair, DEFAULT_OAUTH_SCOPE, OXY_AUTHORIZE_URL, OXY_OAUTH_STATE_STORAGE_KEY, OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY, OXY_OAUTH_REDIRECT_URI_STORAGE_KEY, OXY_OAUTH_RETURN_PATH_STORAGE_KEY, normalizeOAuthRedirectUri, canonicalizeOAuthRedirectUri, persistOAuthHandshake, readOAuthHandshake, clearOAuthHandshake, persistOAuthReturnPath, consumeOAuthReturnPath, } from './utils/oauthPkce';
 export type { PkcePair, BuildOAuthAuthorizeUrlParams, OxyAuthScreen } from './utils/oauthPkce';
 export { packageInfo } from './constants/version';
+export type { Organization, OrganizationType, CreateOrganization, UpdateOrganization, OrganizationSearch, OrganizationClaim, } from '@oxy.so/contracts';
+export type { ProfileAccessInput, ProfileAccessDecision } from '@oxy.so/contracts';

package/dist/types/models/interfaces.d.ts

@@ -1,4 +1,4 @@
-import type { AccountKind, AccountCategoryId, UserNameResponse, UserRelationship, ThemePreference, OxyNotificationEntityType, OxyNotificationType } from '@oxy.so/contracts';
+import type { AccountKind, AccountCategoryId, AvatarCharacter, UserNameResponse, UserRelationship, ThemePreference, OxyNotificationEntityType, OxyNotificationType } from '@oxy.so/contracts';
 export interface OxyConfig {
     baseURL: string;
     cloudURL?: string;
@@ -160,7 +160,15 @@ export interface User {
     isFederated?: boolean;
     /** Allow sharing this user's content on the fediverse. Defaults to true. */
     fediverseSharing?: boolean;
+    /**
+     * Derived from `kind === 'bot'` (the SOLE definition), NOT from `type`.
+     */
     isAgent?: boolean;
+    /**
+     * The 3D avatar character of a `kind: 'bot'` account, drawn by Bloom's
+     * `Avatar`. Present ONLY on a bot; absent for every other kind.
+     */
+    character?: AvatarCharacter;
     isAutomated?: boolean;
     instance?: string;
     federation?: {

package/dist/types/server/requesterAssertion.d.ts

@@ -36,8 +36,8 @@ export declare const oxyRequesterAssertionClaimsSchema: z.ZodObject<{
     /** The one native agent this requester may reach with it. */
     agentId: z.ZodString;
 }, "strict", z.ZodTypeAny, {
-    exp: number;
     sub: string;
+    exp: number;
     aud: string;
     iss: string;
     jti: string;
@@ -46,8 +46,8 @@ export declare const oxyRequesterAssertionClaimsSchema: z.ZodObject<{
     cid: string;
     agentId: string;
 }, {
-    exp: number;
     sub: string;
+    exp: number;
     aud: string;
     iss: string;
     jti: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/core",
-  "version": "4.5.0",
+  "version": "4.8.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -176,11 +176,11 @@
     }
   },
   "dependencies": {
-    "@oxy.so/telemetry": "^1.2.0",
     "@noble/ciphers": "^1.3.0",
     "@noble/hashes": "^1.8.0",
-    "@oxy.so/contracts": "4.12.0",
+    "@oxy.so/contracts": "4.14.0",
     "@oxy.so/protocol": "^1.2.2",
+    "@oxy.so/telemetry": "^1.2.0",
     "@scure/bip39": "^1.6.0",
     "buffer": "^6.0.3",
     "express-rate-limit": "^8.6.0",
@@ -217,7 +217,7 @@
     "@types/invariant": "^2.2.34",
     "@types/node": "^20.19.43",
     "expo-crypto": "~56.0.3",
-    "expo-secure-store": "~56.0.4",
+    "expo-secure-store": "~57.0.4",
     "express": "^4.22.2",
     "express-rate-limit": "^8.6.0",
     "jest": "^30.5.1",

package/src/OxyServices.ts

@@ -1,3 +1,4 @@
+import { SafetyApi } from './api/safety';
 /**
  * `OxyServices` — the Oxy API client.
  *
@@ -32,6 +33,7 @@ import { PrivacyApi } from './api/privacy';
 import { NotificationsApi } from './api/notifications';
 import { AssetsApi } from './api/assets';
 import { IdentityApi } from './api/identity';
+import { OrganizationsApi } from './api/organizations';
 import { AccountsApi } from './api/accounts';
 import { AppsApi } from './api/apps';
 import { LinkedAccountsApi } from './api/linkedAccounts';
@@ -191,6 +193,8 @@ export class OxyServices {
   private _assets?: AssetsApi;
   private _identity?: IdentityApi;
   private _accounts?: AccountsApi;
+  private _organizations?: OrganizationsApi;
+  private _safety?: SafetyApi;
   private _apps?: AppsApi;
   private _linkedAccounts?: LinkedAccountsApi;
   private _agency?: AgencyApi;
@@ -245,6 +249,16 @@ export class OxyServices {
     return this._identity;
   }
   /** The account graph: accounts and their members. */
+  get safety(): SafetyApi {
+    if (!this._safety) this._safety = new SafetyApi(this.context);
+    return this._safety;
+  }
+
+  get organizations(): OrganizationsApi {
+    if (!this._organizations) this._organizations = new OrganizationsApi(this.context);
+    return this._organizations;
+  }
+
   get accounts(): AccountsApi {
     if (!this._accounts) this._accounts = new AccountsApi(this.context);
     return this._accounts;

package/src/api/accounts.ts

@@ -1,3 +1,4 @@
+import type { OrganizationType } from '@oxy.so/contracts';
 /**
  * `oxy.accounts` — the unified account graph (`/accounts`).
  *
@@ -27,7 +28,12 @@ import {
   type AgentKeyOperationProof,
 } from '@oxy.so/contracts';
 import type { User } from '../models/interfaces';
-import type { AccountCategoryId, AccountKind, ChildAccountKind } from '@oxy.so/contracts';
+import type {
+  AccountCategoryId,
+  AccountKind,
+  AvatarCharacter,
+  ChildAccountKind,
+} from '@oxy.so/contracts';
 import type { SessionLoginResponse } from '../models/session';
 import type { OxyContext } from '../client/context';
 import { normalizeUserIdentity } from '../utils/userIdentity';
@@ -57,7 +63,7 @@ const enc = encodeURIComponent;
  *
  * Single source of truth is `@oxy.so/contracts`.
  */
-export type { AccountCategoryId, AccountKind } from '@oxy.so/contracts';
+export type { AccountCategoryId, AccountKind, AvatarCharacter } from '@oxy.so/contracts';
 export {
   ACCOUNT_CATEGORY_IDS,
   ACCOUNT_KINDS,
@@ -231,6 +237,7 @@ export interface CreateAccountInput {
    * keep working. At most `MAX_ACCOUNT_CATEGORIES`, no duplicates.
    */
   accountCategories?: AccountCategoryId[];
+  organizationType?: OrganizationType;
   /**
    * Create the account already opted OUT of discovery — kept out of people
    * search, the follow-graph lists, `/similar` and the recommendation pools,
@@ -247,6 +254,13 @@ export interface CreateAccountInput {
    * discoverable at all, rather than discoverable until a second call lands.
    */
   isPrivateAccount?: boolean;
+  /**
+   * The 3D avatar character, for `kind: 'bot'` ONLY (any other kind is a 400).
+   * Optional: a bot created without one is given a look seeded from its
+   * handle, so every bot has a character from birth and its owner changes it
+   * afterwards with `accounts.update`.
+   */
+  character?: AvatarCharacter;
 }
 
 /** Input accepted by `accounts.update`. Tree placement changes go through `/move`. */
@@ -283,6 +297,13 @@ export interface UpdateAccountInput {
    * always allowed.
    */
   accountCategories?: AccountCategoryId[];
+  /**
+   * Replaces the WHOLE character of a `bot` account. Rejected (400) for any
+   * other kind, and not nullable: a bot always has one. Same authorization as
+   * every other field here (`account:update`).
+   */
+  character?: AvatarCharacter;
+  organizationType?: OrganizationType;
 }
 
 /** Input accepted by `accounts.members.invite`. The owner role cannot be invited. */