@oxy.so/core 4.6.0 → 4.8.0

package/dist/types/api/organizations.d.ts

@@ -0,0 +1,246 @@
+import { type OrganizationCuration, type OrganizationImportBatch, type OrganizationClaimListQuery, type CreateOrganization, type OrganizationSearch, type UpdateOrganization, type OrganizationClaimInput, type OrganizationClaimReview, type OrganizationExternalInput, type OrganizationMerge } from '@oxy.so/contracts';
+import type { OxyContext } from '../client/context';
+/** The public canonical organization directory. Claiming changes authority, never identity. */
+export declare class OrganizationsApi {
+    private readonly ctx;
+    constructor(ctx: OxyContext);
+    search(input: OrganizationSearch): Promise<{
+        items: {
+            status: "active" | "inactive" | "merged" | "suppressed";
+            name: string;
+            organizationType: "business" | "nonprofit" | "public_body" | "community" | "other";
+            legalName: string | null;
+            websiteUrl: string | null;
+            countryCode: string | null;
+            aliases: {
+                alias: string;
+                kind: "name_variant" | "former_name" | "localized_name" | "marketing_name" | "misspelling";
+                language?: string | undefined;
+            }[];
+            accountId: string;
+            username: string | null;
+            avatar: string | null;
+            verifiedDomains: string[];
+            claimStatus: "unclaimed" | "claimed";
+            mergedIntoAccountId: string | null;
+            createdAt: string;
+            updatedAt: string;
+        }[];
+        nextCursor: string | null;
+    }>;
+    get(accountId: string): Promise<{
+        status: "active" | "inactive" | "merged" | "suppressed";
+        name: string;
+        organizationType: "business" | "nonprofit" | "public_body" | "community" | "other";
+        legalName: string | null;
+        websiteUrl: string | null;
+        countryCode: string | null;
+        aliases: {
+            alias: string;
+            kind: "name_variant" | "former_name" | "localized_name" | "marketing_name" | "misspelling";
+            language?: string | undefined;
+        }[];
+        accountId: string;
+        username: string | null;
+        avatar: string | null;
+        verifiedDomains: string[];
+        claimStatus: "unclaimed" | "claimed";
+        mergedIntoAccountId: string | null;
+        createdAt: string;
+        updatedAt: string;
+    }>;
+    batch(input: {
+        ids: string[];
+    }): Promise<{
+        items: {
+            requestedAccountId: string;
+            organization: {
+                status: "active" | "inactive" | "merged" | "suppressed";
+                name: string;
+                organizationType: "business" | "nonprofit" | "public_body" | "community" | "other";
+                legalName: string | null;
+                websiteUrl: string | null;
+                countryCode: string | null;
+                aliases: {
+                    alias: string;
+                    kind: "name_variant" | "former_name" | "localized_name" | "marketing_name" | "misspelling";
+                    language?: string | undefined;
+                }[];
+                accountId: string;
+                username: string | null;
+                avatar: string | null;
+                verifiedDomains: string[];
+                claimStatus: "unclaimed" | "claimed";
+                mergedIntoAccountId: string | null;
+                createdAt: string;
+                updatedAt: string;
+            };
+        }[];
+        missingIds: string[];
+    }>;
+    create(input: CreateOrganization): Promise<{
+        status: "active" | "inactive" | "merged" | "suppressed";
+        name: string;
+        organizationType: "business" | "nonprofit" | "public_body" | "community" | "other";
+        legalName: string | null;
+        websiteUrl: string | null;
+        countryCode: string | null;
+        aliases: {
+            alias: string;
+            kind: "name_variant" | "former_name" | "localized_name" | "marketing_name" | "misspelling";
+            language?: string | undefined;
+        }[];
+        accountId: string;
+        username: string | null;
+        avatar: string | null;
+        verifiedDomains: string[];
+        claimStatus: "unclaimed" | "claimed";
+        mergedIntoAccountId: string | null;
+        createdAt: string;
+        updatedAt: string;
+    }>;
+    update(accountId: string, input: UpdateOrganization): Promise<{
+        status: "active" | "inactive" | "merged" | "suppressed";
+        name: string;
+        organizationType: "business" | "nonprofit" | "public_body" | "community" | "other";
+        legalName: string | null;
+        websiteUrl: string | null;
+        countryCode: string | null;
+        aliases: {
+            alias: string;
+            kind: "name_variant" | "former_name" | "localized_name" | "marketing_name" | "misspelling";
+            language?: string | undefined;
+        }[];
+        accountId: string;
+        username: string | null;
+        avatar: string | null;
+        verifiedDomains: string[];
+        claimStatus: "unclaimed" | "claimed";
+        mergedIntoAccountId: string | null;
+        createdAt: string;
+        updatedAt: string;
+    }>;
+    claim(accountId: string, input: OrganizationClaimInput): Promise<{
+        status: "pending" | "approved" | "rejected";
+        accountId: string;
+        createdAt: string;
+        id: string;
+        claimantUserId: string;
+    }>;
+    myClaims(input?: OrganizationClaimListQuery): Promise<{
+        items: {
+            status: "pending" | "approved" | "rejected";
+            accountId: string;
+            createdAt: string;
+            evidenceReference: string;
+            id: string;
+            claimantUserId: string;
+            reviewEvidenceReference: string | null;
+            reviewedAt: string | null;
+        }[];
+        nextCursor: string | null;
+    }>;
+    myClaim(claimId: string): Promise<{
+        status: "pending" | "approved" | "rejected";
+        accountId: string;
+        createdAt: string;
+        evidenceReference: string;
+        id: string;
+        claimantUserId: string;
+        reviewEvidenceReference: string | null;
+        reviewedAt: string | null;
+    }>;
+    reviewClaims(input?: OrganizationClaimListQuery): Promise<{
+        items: {
+            status: "pending" | "approved" | "rejected";
+            accountId: string;
+            createdAt: string;
+            evidenceReference: string;
+            id: string;
+            claimantUserId: string;
+            reviewEvidenceReference: string | null;
+            reviewedAt: string | null;
+        }[];
+        nextCursor: string | null;
+    }>;
+    reviewClaimDetail(claimId: string): Promise<{
+        status: "pending" | "approved" | "rejected";
+        accountId: string;
+        createdAt: string;
+        evidenceReference: string;
+        id: string;
+        claimantUserId: string;
+        reviewEvidenceReference: string | null;
+        reviewedAt: string | null;
+    }>;
+    reviewClaim(claimId: string, input: OrganizationClaimReview): Promise<{
+        status: "pending" | "approved" | "rejected";
+        accountId: string;
+        createdAt: string;
+        id: string;
+        claimantUserId: string;
+    }>;
+    importBatch(input: OrganizationImportBatch): Promise<{
+        items: {
+            accountId: string;
+            externalId: string;
+            created: boolean;
+        }[];
+    }>;
+    importExternal(input: OrganizationExternalInput): Promise<{
+        accountId: string;
+        created: boolean;
+    }>;
+    resolveExternal(input: {
+        namespace: string;
+        externalId: string;
+    }): Promise<{
+        accountId: string;
+    }>;
+    curate(accountId: string, input: OrganizationCuration): Promise<{
+        status: "active" | "inactive" | "suppressed";
+        accountId: string;
+    }>;
+    merge(accountId: string, input: OrganizationMerge): Promise<{
+        status: "active" | "inactive" | "merged" | "suppressed";
+        name: string;
+        organizationType: "business" | "nonprofit" | "public_body" | "community" | "other";
+        legalName: string | null;
+        websiteUrl: string | null;
+        countryCode: string | null;
+        aliases: {
+            alias: string;
+            kind: "name_variant" | "former_name" | "localized_name" | "marketing_name" | "misspelling";
+            language?: string | undefined;
+        }[];
+        accountId: string;
+        username: string | null;
+        avatar: string | null;
+        verifiedDomains: string[];
+        claimStatus: "unclaimed" | "claimed";
+        mergedIntoAccountId: string | null;
+        createdAt: string;
+        updatedAt: string;
+    }>;
+    iterate(input: OrganizationSearch): AsyncGenerator<{
+        status: "active" | "inactive" | "merged" | "suppressed";
+        name: string;
+        organizationType: "business" | "nonprofit" | "public_body" | "community" | "other";
+        legalName: string | null;
+        websiteUrl: string | null;
+        countryCode: string | null;
+        aliases: {
+            alias: string;
+            kind: "name_variant" | "former_name" | "localized_name" | "marketing_name" | "misspelling";
+            language?: string | undefined;
+        }[];
+        accountId: string;
+        username: string | null;
+        avatar: string | null;
+        verifiedDomains: string[];
+        claimStatus: "unclaimed" | "claimed";
+        mergedIntoAccountId: string | null;
+        createdAt: string;
+        updatedAt: string;
+    }, void, unknown>;
+}

package/dist/types/api/safety.d.ts

@@ -0,0 +1,14 @@
+import { type ProfileAccessInput } from '@oxy.so/contracts';
+import type { OxyContext } from '../client/context';
+export declare class SafetyApi {
+    private readonly ctx;
+    constructor(ctx: OxyContext);
+    /** Server callers must explicitly supply the incoming user bearer or null for anonymous access. */
+    profileAccess(input: ProfileAccessInput, options?: {
+        accessToken: string | null;
+    }): Promise<{
+        allowed: boolean;
+        reason: "public" | "owner" | "private" | "blocked" | "unavailable";
+        policyVersion: "1";
+    }>;
+}

package/dist/types/i18n/locales/en-US.d.ts

@@ -1,4 +1,65 @@
 declare const dict: {
+    organizationDirectory: {
+        invalidName: string;
+        review: {
+            title: string;
+            forbidden: string;
+            empty: string;
+            hint: string;
+            independent: string;
+            evidence: string;
+            approved: string;
+            rejected: string;
+            conflict: string;
+            failed: string;
+        };
+        title: string;
+        search: string;
+        searchHint: string;
+        empty: string;
+        retry: string;
+        loadMore: string;
+        failed: string;
+        unclaimed: string;
+        claimed: string;
+        inactive: string;
+        newAccount: string;
+        newAccountHint: string;
+        addDirectory: string;
+        directoryHint: string;
+        added: string;
+        back: string;
+        type: string;
+        types: {
+            business: string;
+            nonprofit: string;
+            public_body: string;
+            community: string;
+            other: string;
+        };
+        name: string;
+        legalName: string;
+        website: string;
+        country: string;
+        save: string;
+        saved: string;
+        invalid: string;
+        saveFailed: string;
+        claim: string;
+        claimHint: string;
+        evidence: string;
+        evidenceHint: string;
+        claimSent: string;
+        claimFailed: string;
+        claimedHint: string;
+        requests: string;
+        pending: string;
+        approved: string;
+        rejected: string;
+        requestError: string;
+        view: string;
+        readonly: string;
+    };
     signin: {
         title: string;
         subtitle: string;

package/dist/types/i18n/locales/es-ES.d.ts

@@ -1,4 +1,65 @@
 declare const dict: {
+    organizationDirectory: {
+        invalidName: string;
+        review: {
+            title: string;
+            forbidden: string;
+            empty: string;
+            hint: string;
+            independent: string;
+            evidence: string;
+            approved: string;
+            rejected: string;
+            conflict: string;
+            failed: string;
+        };
+        title: string;
+        search: string;
+        searchHint: string;
+        empty: string;
+        retry: string;
+        loadMore: string;
+        failed: string;
+        unclaimed: string;
+        claimed: string;
+        inactive: string;
+        newAccount: string;
+        newAccountHint: string;
+        addDirectory: string;
+        directoryHint: string;
+        added: string;
+        back: string;
+        type: string;
+        types: {
+            business: string;
+            nonprofit: string;
+            public_body: string;
+            community: string;
+            other: string;
+        };
+        name: string;
+        legalName: string;
+        website: string;
+        country: string;
+        save: string;
+        saved: string;
+        invalid: string;
+        saveFailed: string;
+        claim: string;
+        claimHint: string;
+        evidence: string;
+        evidenceHint: string;
+        claimSent: string;
+        claimFailed: string;
+        claimedHint: string;
+        requests: string;
+        pending: string;
+        approved: string;
+        rejected: string;
+        requestError: string;
+        view: string;
+        readonly: string;
+    };
     signin: {
         title: string;
         subtitle: string;

package/dist/types/index.d.ts

@@ -99,3 +99,5 @@ export { AUTH_WEB_ORIGIN, CENTRAL_IDP_APEX } from './utils/authWebUrl';
 export { buildOAuthAuthorizeUrl, computeCodeChallenge, generateOAuthState, generatePkcePair, DEFAULT_OAUTH_SCOPE, OXY_AUTHORIZE_URL, OXY_OAUTH_STATE_STORAGE_KEY, OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY, OXY_OAUTH_REDIRECT_URI_STORAGE_KEY, OXY_OAUTH_RETURN_PATH_STORAGE_KEY, normalizeOAuthRedirectUri, canonicalizeOAuthRedirectUri, persistOAuthHandshake, readOAuthHandshake, clearOAuthHandshake, persistOAuthReturnPath, consumeOAuthReturnPath, } from './utils/oauthPkce';
 export type { PkcePair, BuildOAuthAuthorizeUrlParams, OxyAuthScreen } from './utils/oauthPkce';
 export { packageInfo } from './constants/version';
+export type { Organization, OrganizationType, CreateOrganization, UpdateOrganization, OrganizationSearch, OrganizationClaim, } from '@oxy.so/contracts';
+export type { ProfileAccessInput, ProfileAccessDecision } from '@oxy.so/contracts';

package/dist/types/server/requesterAssertion.d.ts

@@ -36,8 +36,8 @@ export declare const oxyRequesterAssertionClaimsSchema: z.ZodObject<{
     /** The one native agent this requester may reach with it. */
     agentId: z.ZodString;
 }, "strict", z.ZodTypeAny, {
-    exp: number;
     sub: string;
+    exp: number;
     aud: string;
     iss: string;
     jti: string;
@@ -46,8 +46,8 @@ export declare const oxyRequesterAssertionClaimsSchema: z.ZodObject<{
     cid: string;
     agentId: string;
 }, {
-    exp: number;
     sub: string;
+    exp: number;
     aud: string;
     iss: string;
     jti: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/core",
-  "version": "4.6.0",
+  "version": "4.8.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -176,11 +176,11 @@
     }
   },
   "dependencies": {
-    "@oxy.so/telemetry": "^1.2.0",
     "@noble/ciphers": "^1.3.0",
     "@noble/hashes": "^1.8.0",
-    "@oxy.so/contracts": "4.13.0",
+    "@oxy.so/contracts": "4.14.0",
     "@oxy.so/protocol": "^1.2.2",
+    "@oxy.so/telemetry": "^1.2.0",
     "@scure/bip39": "^1.6.0",
     "buffer": "^6.0.3",
     "express-rate-limit": "^8.6.0",

package/src/OxyServices.ts

@@ -1,3 +1,4 @@
+import { SafetyApi } from './api/safety';
 /**
  * `OxyServices` — the Oxy API client.
  *
@@ -32,6 +33,7 @@ import { PrivacyApi } from './api/privacy';
 import { NotificationsApi } from './api/notifications';
 import { AssetsApi } from './api/assets';
 import { IdentityApi } from './api/identity';
+import { OrganizationsApi } from './api/organizations';
 import { AccountsApi } from './api/accounts';
 import { AppsApi } from './api/apps';
 import { LinkedAccountsApi } from './api/linkedAccounts';
@@ -191,6 +193,8 @@ export class OxyServices {
   private _assets?: AssetsApi;
   private _identity?: IdentityApi;
   private _accounts?: AccountsApi;
+  private _organizations?: OrganizationsApi;
+  private _safety?: SafetyApi;
   private _apps?: AppsApi;
   private _linkedAccounts?: LinkedAccountsApi;
   private _agency?: AgencyApi;
@@ -245,6 +249,16 @@ export class OxyServices {
     return this._identity;
   }
   /** The account graph: accounts and their members. */
+  get safety(): SafetyApi {
+    if (!this._safety) this._safety = new SafetyApi(this.context);
+    return this._safety;
+  }
+
+  get organizations(): OrganizationsApi {
+    if (!this._organizations) this._organizations = new OrganizationsApi(this.context);
+    return this._organizations;
+  }
+
   get accounts(): AccountsApi {
     if (!this._accounts) this._accounts = new AccountsApi(this.context);
     return this._accounts;

package/src/api/accounts.ts

@@ -1,3 +1,4 @@
+import type { OrganizationType } from '@oxy.so/contracts';
 /**
  * `oxy.accounts` — the unified account graph (`/accounts`).
  *
@@ -236,6 +237,7 @@ export interface CreateAccountInput {
    * keep working. At most `MAX_ACCOUNT_CATEGORIES`, no duplicates.
    */
   accountCategories?: AccountCategoryId[];
+  organizationType?: OrganizationType;
   /**
    * Create the account already opted OUT of discovery — kept out of people
    * search, the follow-graph lists, `/similar` and the recommendation pools,
@@ -301,6 +303,7 @@ export interface UpdateAccountInput {
    * every other field here (`account:update`).
    */
   character?: AvatarCharacter;
+  organizationType?: OrganizationType;
 }
 
 /** Input accepted by `accounts.members.invite`. The owner role cannot be invited. */

package/src/api/organizations.ts

@@ -0,0 +1,180 @@
+import {
+  organizationSchema,
+  organizationListSchema,
+  organizationBatchSchema,
+  organizationClaimSchema,
+  organizationExternalSchema,
+  organizationExternalResolutionSchema,
+  organizationImportBatchResultSchema,
+  organizationCurationResultSchema,
+  type OrganizationCuration,
+  type OrganizationImportBatch,
+  organizationClaimListSchema,
+  organizationClaimDetailSchema,
+  type OrganizationClaimListQuery,
+  type CreateOrganization,
+  type OrganizationSearch,
+  type UpdateOrganization,
+  type OrganizationClaimInput,
+  type OrganizationClaimReview,
+  type OrganizationExternalInput,
+  type OrganizationMerge,
+} from '@oxy.so/contracts';
+import type { OxyContext } from '../client/context';
+import { evictOxyIdentityCache } from '../utils/identityCacheSweep';
+
+/** The public canonical organization directory. Claiming changes authority, never identity. */
+export class OrganizationsApi {
+  constructor(private readonly ctx: OxyContext) {}
+  async search(input: OrganizationSearch) {
+    return organizationListSchema.parse(
+      await this.ctx.request('GET', '/organizations', input, { cache: false, skipAuth: true }),
+    );
+  }
+  async get(accountId: string) {
+    return organizationSchema.parse(
+      await this.ctx.request('GET', `/organizations/${encodeURIComponent(accountId)}`, undefined, {
+        cache: false,
+        skipAuth: true,
+      }),
+    );
+  }
+  async batch(input: { ids: string[] }) {
+    return organizationBatchSchema.parse(
+      await this.ctx.request('POST', '/organizations/batch', input, {
+        cache: false,
+        skipAuth: true,
+      }),
+    );
+  }
+  async create(input: CreateOrganization) {
+    return organizationSchema.parse(
+      await this.ctx.request('POST', '/organizations', input, { cache: false }),
+    );
+  }
+  async update(accountId: string, input: UpdateOrganization) {
+    const result = organizationSchema.parse(
+      await this.ctx.request('PATCH', `/organizations/${encodeURIComponent(accountId)}`, input, {
+        cache: false,
+      }),
+    );
+
+    evictOxyIdentityCache(this.ctx.http, accountId);
+    return result;
+  }
+  async claim(accountId: string, input: OrganizationClaimInput) {
+    return organizationClaimSchema.parse(
+      await this.ctx.request(
+        'POST',
+        `/organizations/${encodeURIComponent(accountId)}/claims`,
+        input,
+        { cache: false },
+      ),
+    );
+  }
+  async myClaims(input: OrganizationClaimListQuery = {}) {
+    return organizationClaimListSchema.parse(
+      await this.ctx.request('GET', '/organizations/claims/mine', input, { cache: false }),
+    );
+  }
+  async myClaim(claimId: string) {
+    return organizationClaimDetailSchema.parse(
+      await this.ctx.request(
+        'GET',
+        `/organizations/claims/mine/${encodeURIComponent(claimId)}`,
+        undefined,
+        { cache: false },
+      ),
+    );
+  }
+  async reviewClaims(input: OrganizationClaimListQuery = {}) {
+    return organizationClaimListSchema.parse(
+      await this.ctx.request('GET', '/organizations/claims/review', input, { cache: false }),
+    );
+  }
+  async reviewClaimDetail(claimId: string) {
+    return organizationClaimDetailSchema.parse(
+      await this.ctx.request(
+        'GET',
+        `/organizations/claims/review/${encodeURIComponent(claimId)}`,
+        undefined,
+        { cache: false },
+      ),
+    );
+  }
+  async reviewClaim(claimId: string, input: OrganizationClaimReview) {
+    const result = organizationClaimSchema.parse(
+      await this.ctx.request(
+        'POST',
+        `/organizations/claims/${encodeURIComponent(claimId)}/review`,
+        input,
+        { cache: false },
+      ),
+    );
+
+    evictOxyIdentityCache(this.ctx.http, result.accountId);
+    return result;
+  }
+  async importBatch(input: OrganizationImportBatch) {
+    if (!this.ctx.service?.available)
+      throw new Error('Organization batch import requires an OxyServer service identity');
+    return organizationImportBatchResultSchema.parse(
+      await this.ctx.service.request('POST', '/organizations/external/batch', input, {
+        cache: false,
+      }),
+    );
+  }
+  async importExternal(input: OrganizationExternalInput) {
+    return organizationExternalSchema.parse(
+      await this.ctx.request('POST', '/organizations/external', input, { cache: false }),
+    );
+  }
+  async resolveExternal(input: { namespace: string; externalId: string }) {
+    return organizationExternalResolutionSchema.parse(
+      await this.ctx.request(
+        'GET',
+        `/organizations/external/${encodeURIComponent(input.namespace)}/${encodeURIComponent(input.externalId)}`,
+        undefined,
+        { cache: false },
+      ),
+    );
+  }
+  async curate(accountId: string, input: OrganizationCuration) {
+    const result = organizationCurationResultSchema.parse(
+      await this.ctx.request(
+        'POST',
+        `/organizations/${encodeURIComponent(accountId)}/curation`,
+        input,
+        { cache: false },
+      ),
+    );
+
+    evictOxyIdentityCache(this.ctx.http, accountId);
+    return result;
+  }
+  async merge(accountId: string, input: OrganizationMerge) {
+    const result = organizationSchema.parse(
+      await this.ctx.request(
+        'POST',
+        `/organizations/${encodeURIComponent(accountId)}/merge`,
+        input,
+        { cache: false },
+      ),
+    );
+
+    evictOxyIdentityCache(this.ctx.http, accountId);
+    evictOxyIdentityCache(this.ctx.http, result.accountId);
+    return result;
+  }
+  async *iterate(input: OrganizationSearch) {
+    let cursor = input.cursor;
+    const seen = new Set<string>();
+    do {
+      const page = await this.search({ ...input, cursor });
+      yield* page.items;
+      cursor = page.nextCursor ?? undefined;
+      if (cursor && seen.has(cursor)) throw new Error('Organization directory repeated a cursor');
+      if (cursor) seen.add(cursor);
+    } while (cursor);
+  }
+}