@oxy.so/core 4.9.0 → 4.9.1

package/dist/esm/server/OxyServer.js

@@ -63,6 +63,12 @@ export class ServiceCredentialMismatchError extends Error {
     }
 }
 const WORKLOAD_CACHE_KEY = 'workload-identity';
+/** What `serviceToken()` mints, and what Oxy assumes when no audience is sent. */
+export const DEFAULT_SERVICE_TOKEN_AUDIENCE = 'oxy-api';
+/** Tokens of different audiences never share a cache entry; the default keeps its old key. */
+function audienceCacheKey(audience, key) {
+    return audience === DEFAULT_SERVICE_TOKEN_AUDIENCE ? key : `${audience}\u0000${key}`;
+}
 /** A token is reused until 60s before expiry (clock drift). */
 const TOKEN_REUSE_MARGIN_MS = 60000;
 /** Bound on remembered `appId:userId` delegation answers. */
@@ -198,19 +204,28 @@ export class OxyServer extends OxyServices {
      * {@link ServiceCredentialMismatchError} rather than return the cached token.
      */
     async serviceToken(apiKey, apiSecret) {
+        return this.serviceTokenFor(DEFAULT_SERVICE_TOKEN_AUDIENCE, apiKey, apiSecret);
+    }
+    /**
+     * A service token for `audience` — e.g. `kaana.ai` for https://kaana.ai/v1.
+     * Minted, cached and refreshed exactly as {@link serviceToken} (which is this
+     * with `oxy-api`), from the same credential or attested workload identity;
+     * each audience has its own cache entry, so one never answers for another.
+     */
+    async serviceTokenFor(audience, apiKey, apiSecret) {
         const key = apiKey || this.serviceApiKey;
         const secret = apiSecret || this.serviceApiSecret;
         if (!key || !secret) {
             // No credential — prove what this process IS instead. The fallback, not the
             // preference: a deployment that still has a credential keeps using it.
             if (canAttestWorkloadIdentity()) {
-                return this.workloadServiceToken();
+                return this.workloadServiceToken(audience);
             }
             throw new Error('Service credentials not provided. Pass serviceAuth, call configureServiceAuth(), or pass apiKey and apiSecret.');
         }
         // The apiKey is the credential's PUBLIC id (`oxy_dk_…`, the OAuth
         // client_id), so it keys the in-memory cache as is; the secret never does.
-        const cacheKey = key;
+        const cacheKey = audienceCacheKey(audience, key);
         const now = Date.now();
         const providedSecretBuf = Buffer.from(secret, 'utf8');
         let entry = this.serviceTokens.get(cacheKey);
@@ -243,7 +258,7 @@ export class OxyServer extends OxyServices {
             entry = { token: '', expiresAt: 0, secretBuf: providedSecretBuf, pending: null, apiKey: key };
             this.serviceTokens.set(cacheKey, entry);
         }
-        const pending = this.mintServiceToken(key, secret, cacheKey, providedSecretBuf);
+        const pending = this.mintServiceToken(key, secret, cacheKey, providedSecretBuf, audience);
         entry.pending = pending;
         try {
             return await pending;
@@ -276,7 +291,11 @@ export class OxyServer extends OxyServices {
             this.serviceTokens.clear();
             return;
         }
-        this.serviceTokens.delete(targetKey);
+        // Every audience minted from that credential goes with it.
+        for (const [cacheKey, entry] of this.serviceTokens) {
+            if (entry.apiKey === targetKey)
+                this.serviceTokens.delete(cacheKey);
+        }
     }
     /**
      * One request with this service's token. `actAs` sends `X-Oxy-User-Id`: the
@@ -402,8 +421,12 @@ export class OxyServer extends OxyServices {
     canMintServiceToken() {
         return Boolean(this.serviceApiKey && this.serviceApiSecret) || canAttestWorkloadIdentity();
     }
-    async mintServiceToken(key, secret, cacheKey, secretBuf) {
-        const response = await this.request('POST', '/auth/service-token', { apiKey: key, apiSecret: secret }, { cache: false, retry: false, skipAuth: true });
+    async mintServiceToken(key, secret, cacheKey, secretBuf, audience) {
+        const response = await this.request('POST', '/auth/service-token', {
+            apiKey: key,
+            apiSecret: secret,
+            ...(audience === DEFAULT_SERVICE_TOKEN_AUDIENCE ? {} : { audience }),
+        }, { cache: false, retry: false, skipAuth: true });
         const expiresAt = Date.now() + response.expiresIn * 1000;
         const entry = this.serviceTokens.get(cacheKey);
         if (entry) {
@@ -422,9 +445,10 @@ export class OxyServer extends OxyServices {
         }
         return response.token;
     }
-    /** A token obtained by attestation, cached like a credential's (one identity per process). */
-    async workloadServiceToken() {
-        const entry = this.serviceTokens.get(WORKLOAD_CACHE_KEY);
+    /** A token obtained by attestation, cached like a credential's (one identity per process, one entry per audience). */
+    async workloadServiceToken(audience) {
+        const cacheKey = audienceCacheKey(audience, WORKLOAD_CACHE_KEY);
+        const entry = this.serviceTokens.get(cacheKey);
         if (entry?.token &&
             reusableServiceToken(entry.token) &&
             entry.expiresAt > Date.now() + TOKEN_REUSE_MARGIN_MS)
@@ -438,10 +462,13 @@ export class OxyServer extends OxyServices {
             pending: null,
             apiKey: WORKLOAD_CACHE_KEY,
         };
-        this.serviceTokens.set(WORKLOAD_CACHE_KEY, seeded);
+        this.serviceTokens.set(cacheKey, seeded);
         const pending = (async () => {
-            const granted = await requestWorkloadServiceToken({ baseUrl: this.baseURL });
-            const current = this.serviceTokens.get(WORKLOAD_CACHE_KEY);
+            const granted = await requestWorkloadServiceToken({
+                baseUrl: this.baseURL,
+                ...(audience === DEFAULT_SERVICE_TOKEN_AUDIENCE ? {} : { audience }),
+            });
+            const current = this.serviceTokens.get(cacheKey);
             if (current) {
                 current.token = granted.token;
                 current.expiresAt = Date.now() + granted.expiresIn * 1000;
@@ -453,13 +480,13 @@ export class OxyServer extends OxyServices {
             return await pending;
         }
         catch (error) {
-            const failed = this.serviceTokens.get(WORKLOAD_CACHE_KEY);
+            const failed = this.serviceTokens.get(cacheKey);
             if (failed?.pending === pending && !failed.token)
-                this.serviceTokens.delete(WORKLOAD_CACHE_KEY);
+                this.serviceTokens.delete(cacheKey);
             throw error;
         }
         finally {
-            const settled = this.serviceTokens.get(WORKLOAD_CACHE_KEY);
+            const settled = this.serviceTokens.get(cacheKey);
             if (settled?.pending === pending)
                 settled.pending = null;
         }

package/dist/esm/server/index.js

@@ -16,7 +16,7 @@
  */
 // The backend client: OxyServices plus the service-token lane, middleware,
 // account events and the service-only namespace methods.
-export { OxyServer, ServiceCredentialMismatchError, ANONYMOUS_SERVICE_TOKEN_RETRY_MS, } from './OxyServer.js';
+export { OxyServer, ServiceCredentialMismatchError, ANONYMOUS_SERVICE_TOKEN_RETRY_MS, DEFAULT_SERVICE_TOKEN_AUDIENCE, } from './OxyServer.js';
 export { ServerAppsApi, ServerAgencyApi, ServerAssetsApi, ServerLinkedAccountsApi, ServerNotificationsApi, ServerReputationApi, } from './namespaces.js';
 export { createOxyAliaMachineCredentialAuth, getOxyAliaMachineCredentialBearer, isOxyAliaMachinePrincipal, OXY_ALIA_RESOURCE_APPLICATION_ID, OXY_ALIA_MACHINE_SCOPES, } from './aliaMachineCredential.js';
 export { OxyAccountEventError, OXY_ACCOUNT_DELETED_EVENT_URI } from './middleware.js';

package/dist/esm/server/workloadIdentity.js

@@ -171,7 +171,12 @@ export async function requestWorkloadServiceToken(options) {
     const tokenResponse = await fetchImpl(`${base}/auth/service-token/workload`, {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({ provider: 'aws-iam', nonce: challenge.nonce, attestation }),
+        body: JSON.stringify({
+            provider: 'aws-iam',
+            nonce: challenge.nonce,
+            attestation,
+            ...(options.audience === undefined ? {} : { audience: options.audience }),
+        }),
     });
     if (!tokenResponse.ok) {
         // The body carries a bounded `reason`; the token never travels on a failure,

package/dist/esm/utils/corsPreflight.js

@@ -0,0 +1,45 @@
+/**
+ * Whether a browser has to send a CORS preflight (`OPTIONS`) before this
+ * cross-origin request goes out, per the Fetch standard's CORS-safelisted
+ * methods and request headers.
+ *
+ * The SDK uses it for one invariant: its anonymous telemetry headers
+ * (`X-Oxy-Activity-Id`, `X-Oxy-Edge-Region`) ride only on requests that are
+ * preflighted anyway, so they never turn a request that would go straight out
+ * into one that first waits a round trip for an `OPTIONS`. A browser caches a
+ * preflight per URL, so without this every distinct anonymous read (a post's
+ * replies, a profile, a public app record) paid a round trip of its own.
+ *
+ * Deliberately conservative: a header it does not recognise as safelisted
+ * counts as needing a preflight, which only means the telemetry headers ride
+ * along exactly as they always did. Value-level rules (for example `Accept`'s
+ * 128-byte limit) are not modelled; a misjudgement in that direction drops two
+ * advisory headers from one request and nothing else.
+ */
+const SAFELISTED_METHODS = new Set(['GET', 'HEAD', 'POST']);
+const SAFELISTED_HEADERS = new Set([
+    'accept',
+    'accept-language',
+    'content-language',
+    'content-type',
+]);
+const SAFELISTED_CONTENT_TYPES = new Set([
+    'application/x-www-form-urlencoded',
+    'multipart/form-data',
+    'text/plain',
+]);
+export function requiresCorsPreflight(method, headers) {
+    if (!SAFELISTED_METHODS.has(method.toUpperCase()))
+        return true;
+    for (const [rawName, value] of headers) {
+        const name = rawName.toLowerCase();
+        if (!SAFELISTED_HEADERS.has(name))
+            return true;
+        if (name === 'content-type') {
+            const essence = value.split(';')[0]?.trim().toLowerCase() ?? '';
+            if (!SAFELISTED_CONTENT_TYPES.has(essence))
+                return true;
+        }
+    }
+    return false;
+}

package/dist/types/api/accounts.d.ts

@@ -336,8 +336,7 @@ export declare class AccountMembersApi {
      */
     list(accountId: string): Promise<AccountMember[]>;
     /**
-     * @deprecated The API returns 410. Use accounts.invitations.create with an email.
-     * Access is granted only after recipient confirmation.
+     * Add a member to an account.
      * @param accountId - The account's `_id`.
      * @param data - Target user's username or email and role (never `owner`).
      *   The server resolves `usernameOrEmail` to a personal account; an unknown
@@ -394,46 +393,10 @@ export declare class AccountAgentKeysApi {
         revokedMethodIds: string[];
     }>;
 }
-export interface AccountInvitation {
-    id: string;
-    accountId: string;
-    email: string;
-    role: Exclude<AccountRole, 'owner'>;
-    status: 'pending' | 'expired' | 'accepted' | 'cancelled';
-    expiresAt: string;
-    createdAt: string;
-}
-export interface AccountInvitationPreview {
-    invitation: AccountInvitation;
-    account: {
-        id: string;
-        username: string | null;
-        displayName: string | null;
-    };
-}
-/** Consent-based invitations; never cached or queued as offline mutations. */
-export declare class AccountInvitationsApi {
-    private readonly ctx;
-    constructor(ctx: OxyContext);
-    list(accountId: string): Promise<AccountInvitation[]>;
-    create(accountId: string, data: {
-        email: string;
-        role: Exclude<AccountRole, 'owner'>;
-        inherit?: boolean;
-    }): Promise<AccountInvitation>;
-    resend(accountId: string, id: string): Promise<AccountInvitation>;
-    cancel(accountId: string, id: string): Promise<AccountSuccessResult>;
-    preview(token: string): Promise<AccountInvitationPreview>;
-    /** selectedUserId must equal the currently authenticated personal account. */
-    accept(token: string, selectedUserId: string): Promise<AccountSuccessResult & {
-        accountId: string;
-    }>;
-}
 export declare class AccountsApi {
     private readonly ctx;
     /** Who can act on an account, and with what role. */
     readonly members: AccountMembersApi;
-    readonly invitations: AccountInvitationsApi;
     readonly agentKeys: AccountAgentKeysApi;
     constructor(ctx: OxyContext);
     /**

package/dist/types/api/billing.d.ts

@@ -1,4 +1,4 @@
-import { type ProductSubscriptionRenewalRequest, type ProductPlanCheckoutRequest, type ProductPlanCatalogue, type PersonalPlanCheckoutRequest, type PersonalPlanCheckoutResult } from '@oxy.so/contracts';
+import { type PersonalPlanCheckoutRequest, type PersonalPlanCheckoutResult } from '@oxy.so/contracts';
 /**
  * `oxy.billing` — the signed-in user's subscription, wallet and payment history.
  *
@@ -101,9 +101,6 @@ export interface WalletTransactionsPage {
 export declare class BillingApi {
     protected readonly ctx: OxyContext;
     constructor(ctx: OxyContext);
-    renewProductSubscription(request: ProductSubscriptionRenewalRequest): Promise<PersonalPlanCheckoutResult>;
-    startProductPlanCheckout(request: ProductPlanCheckoutRequest): Promise<PersonalPlanCheckoutResult>;
-    productPlans(productId: string): Promise<ProductPlanCatalogue>;
     startPersonalPlanCheckout(request: PersonalPlanCheckoutRequest): Promise<PersonalPlanCheckoutResult>;
     /** Public versioned personal plans. Discovery never proves customer access. */
     personalPlans(): Promise<PersonalPlanCatalogue>;

package/dist/types/i18n/locales/en-US.d.ts

@@ -1425,13 +1425,6 @@ declare const dict: {
         };
     };
     preferences: {
-        displayCurrency: {
-            label: string;
-            saveFailed: string;
-            unavailable: string;
-            approximate: string;
-            estimate: string;
-        };
         title: string;
         subtitle: string;
         sections: {

package/dist/types/i18n/locales/es-ES.d.ts

@@ -1425,13 +1425,6 @@ declare const dict: {
         };
     };
     preferences: {
-        displayCurrency: {
-            label: string;
-            saveFailed: string;
-            unavailable: string;
-            approximate: string;
-            estimate: string;
-        };
         title: string;
         subtitle: string;
         sections: {

package/dist/types/index.d.ts

@@ -101,4 +101,3 @@ export type { PkcePair, BuildOAuthAuthorizeUrlParams, OxyAuthScreen } from './ut
 export { packageInfo } from './constants/version';
 export type { Organization, OrganizationType, CreateOrganization, UpdateOrganization, OrganizationSearch, OrganizationClaim, } from '@oxy.so/contracts';
 export type { ProfileAccessInput, ProfileAccessDecision } from '@oxy.so/contracts';
-export type { AccountInvitation, AccountInvitationPreview } from './api/accounts';

package/dist/types/models/interfaces.d.ts

@@ -242,8 +242,6 @@ export interface NotificationPreferences {
  * Persisted on the User document.
  */
 export interface UserPreferences {
-    /** Preferred display units only; never changes a payment's denomination. */
-    displayCurrency?: 'USD' | 'EUR' | 'FAIR';
     /** BCP-47 language tag, e.g. "en-US", "es-ES". Empty string = follow device. */
     language?: string;
     /** Theme mode preference. */

package/dist/types/server/OxyServer.d.ts

@@ -58,6 +58,15 @@ export interface ServiceTokenResponse {
 export declare class ServiceCredentialMismatchError extends Error {
     constructor();
 }
+/**
+ * The resource server a service token is minted for (Oxy's closed set,
+ * `packages/api/src/config/serviceTokenAudiences.ts`). A token is only ever
+ * accepted by its own audience: Oxy's API refuses a `kaana.ai` token and
+ * https://kaana.ai/v1 refuses an `oxy-api` one (Kaana ADR 0002 decision 6).
+ */
+export type ServiceTokenAudience = 'oxy-api' | 'kaana.ai' | 'oxy-api:kaana-control';
+/** What `serviceToken()` mints, and what Oxy assumes when no audience is sent. */
+export declare const DEFAULT_SERVICE_TOKEN_AUDIENCE: ServiceTokenAudience;
 export declare class OxyServer extends OxyServices {
     private readonly serviceTokens;
     private serviceApiKey;
@@ -120,6 +129,13 @@ export declare class OxyServer extends OxyServices {
      * {@link ServiceCredentialMismatchError} rather than return the cached token.
      */
     serviceToken(apiKey?: string, apiSecret?: string): Promise<string>;
+    /**
+     * A service token for `audience` — e.g. `kaana.ai` for https://kaana.ai/v1.
+     * Minted, cached and refreshed exactly as {@link serviceToken} (which is this
+     * with `oxy-api`), from the same credential or attested workload identity;
+     * each audience has its own cache entry, so one never answers for another.
+     */
+    serviceTokenFor(audience: ServiceTokenAudience, apiKey?: string, apiSecret?: string): Promise<string>;
     /**
      * Forget cached service token(s) so the next `serviceToken()` mints anew —
      * the way back from a 401 after a credential was revoked or rotated.
@@ -187,7 +203,7 @@ export declare class OxyServer extends OxyServices {
     private serviceTokenForAnonymousRequest;
     private canMintServiceToken;
     private mintServiceToken;
-    /** A token obtained by attestation, cached like a credential's (one identity per process). */
+    /** A token obtained by attestation, cached like a credential's (one identity per process, one entry per audience). */
     private workloadServiceToken;
     private lookupActingAs;
     private clearActingAsPair;

package/dist/types/server/index.d.ts

@@ -14,8 +14,8 @@
  * app.use('/api', createOxyAuthMiddleware(oxy));
  * ```
  */
-export { OxyServer, ServiceCredentialMismatchError, ANONYMOUS_SERVICE_TOKEN_RETRY_MS, } from './OxyServer';
-export type { OxyServerConfig, ServiceTokenResponse } from './OxyServer';
+export { OxyServer, ServiceCredentialMismatchError, ANONYMOUS_SERVICE_TOKEN_RETRY_MS, DEFAULT_SERVICE_TOKEN_AUDIENCE, } from './OxyServer';
+export type { OxyServerConfig, ServiceTokenAudience, ServiceTokenResponse } from './OxyServer';
 export { ServerAppsApi, ServerAgencyApi, ServerAssetsApi, ServerLinkedAccountsApi, ServerNotificationsApi, ServerReputationApi, } from './namespaces';
 export { createOxyAliaMachineCredentialAuth, getOxyAliaMachineCredentialBearer, isOxyAliaMachinePrincipal, OXY_ALIA_RESOURCE_APPLICATION_ID, OXY_ALIA_MACHINE_SCOPES, } from './aliaMachineCredential';
 export type { AliaMachineCredentialIntrospection, OxyAliaMachinePrincipal, OxyAliaMachineRequest, OxyAliaMachineCredentialHost, } from './aliaMachineCredential';

package/dist/types/server/workloadIdentity.d.ts

@@ -1,6 +1,11 @@
 export interface WorkloadServiceTokenOptions {
     /** Oxy's base URL, e.g. `https://api.oxy.so`. */
     baseUrl: string;
+    /**
+     * The resource server the token is for (e.g. `kaana.ai`). Omitted, Oxy mints
+     * for `oxy-api`, as it always has.
+     */
+    audience?: string;
     /** Injected in tests; defaults to the global. */
     fetch?: typeof fetch;
 }

package/dist/types/utils/corsPreflight.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Whether a browser has to send a CORS preflight (`OPTIONS`) before this
+ * cross-origin request goes out, per the Fetch standard's CORS-safelisted
+ * methods and request headers.
+ *
+ * The SDK uses it for one invariant: its anonymous telemetry headers
+ * (`X-Oxy-Activity-Id`, `X-Oxy-Edge-Region`) ride only on requests that are
+ * preflighted anyway, so they never turn a request that would go straight out
+ * into one that first waits a round trip for an `OPTIONS`. A browser caches a
+ * preflight per URL, so without this every distinct anonymous read (a post's
+ * replies, a profile, a public app record) paid a round trip of its own.
+ *
+ * Deliberately conservative: a header it does not recognise as safelisted
+ * counts as needing a preflight, which only means the telemetry headers ride
+ * along exactly as they always did. Value-level rules (for example `Accept`'s
+ * 128-byte limit) are not modelled; a misjudgement in that direction drops two
+ * advisory headers from one request and nothing else.
+ */
+export declare function requiresCorsPreflight(method: string, headers: Iterable<readonly [string, string]>): boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/core",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -178,7 +178,7 @@
   "dependencies": {
     "@noble/ciphers": "^1.3.0",
     "@noble/hashes": "^1.8.0",
-    "@oxy.so/contracts": "4.15.0",
+    "@oxy.so/contracts": "4.14.0",
     "@oxy.so/protocol": "^1.2.2",
     "@oxy.so/telemetry": "^1.2.0",
     "@scure/bip39": "^1.6.0",

package/src/HttpService.ts

@@ -32,6 +32,7 @@ import type { DeviceSecretMintOutcome } from './session/refresh';
 import { OxyAuthenticationError } from './OxyServices.errors';
 import { peekBrowserEdgeRegionHeader } from './utils/edgeRegion';
 import { getBrowserActivityIdHeader } from './utils/activityId';
+import { requiresCorsPreflight } from './utils/corsPreflight';
 import { trimLeadingSlashes, trimTrailingSlashes } from './utils/slashes';
 
 export type AuthRefreshReason = 'preflight' | 'response-401';
@@ -712,11 +713,16 @@ export class HttpService {
           Accept: 'application/json',
         };
 
-        // Only set Content-Type for non-FormData requests (FormData sets it automatically with boundary)
-        if (isUrlEncoded) {
-          headers['Content-Type'] = 'application/x-www-form-urlencoded;charset=UTF-8';
-        } else if (!isFormData) {
-          headers['Content-Type'] = 'application/json';
+        // Content-Type describes a body, so a GET (which never sends one) gets
+        // none: `application/json` is not a CORS-safelisted type, and on a GET it
+        // only made the browser preflight a request with nothing to describe.
+        // FormData sets its own multipart type with the boundary.
+        if (method !== 'GET') {
+          if (isUrlEncoded) {
+            headers['Content-Type'] = 'application/x-www-form-urlencoded;charset=UTF-8';
+          } else if (!isFormData) {
+            headers['Content-Type'] = 'application/json';
+          }
         }
 
         // Add authorization header if available
@@ -741,9 +747,14 @@ export class HttpService {
 
         // This is Cloudflare's coarse serving PoP (for example `mad`), never an
         // IP or coordinate. Set it after caller headers so request code cannot
-        // accidentally or deliberately substitute a different origin.
-        Object.assign(headers, edgeRegionHeader);
-        Object.assign(headers, activityIdHeader);
+        // accidentally or deliberately substitute a different origin. Both are
+        // advisory telemetry, so they ride only on a request the browser
+        // preflights anyway: on an anonymous GET they were the only thing that
+        // made it non-simple, and every distinct URL paid an OPTIONS round trip.
+        if (requiresCorsPreflight(method, Object.entries(headers))) {
+          Object.assign(headers, edgeRegionHeader);
+          Object.assign(headers, activityIdHeader);
+        }
 
         // `URLSearchParams` is serialised explicitly rather than handed to
         // `fetch` as-is: RN's fetch does not consistently encode it, and doing
@@ -1637,10 +1648,18 @@ export class HttpService {
     for (const name of ['Authorization', 'Cookie', 'Cookie2', 'Host', 'Proxy-Authorization'])
       headers.delete(name);
     if (authHeader) headers.set('Authorization', authHeader);
-    const edgeRegionHeader = peekBrowserEdgeRegionHeader();
-    for (const [name, value] of Object.entries(edgeRegionHeader)) headers.set(name, value);
-    const activityIdHeader = getBrowserActivityIdHeader();
-    for (const [name, value] of Object.entries(activityIdHeader)) headers.set(name, value);
+    // Telemetry rides only on a request the browser preflights anyway — see
+    // `request()`.
+    const sentHeaders: Array<[string, string]> = [];
+    headers.forEach((value, name) => {
+      sentHeaders.push([name, value]);
+    });
+    if (requiresCorsPreflight(config.method, sentHeaders)) {
+      const edgeRegionHeader = peekBrowserEdgeRegionHeader();
+      for (const [name, value] of Object.entries(edgeRegionHeader)) headers.set(name, value);
+      const activityIdHeader = getBrowserActivityIdHeader();
+      for (const [name, value] of Object.entries(activityIdHeader)) headers.set(name, value);
+    }
 
     try {
       const body = config.method === 'GET' ? undefined : config.body;

package/src/api/accounts.ts

@@ -391,8 +391,7 @@ export class AccountMembersApi {
   }
 
   /**
-   * @deprecated The API returns 410. Use accounts.invitations.create with an email.
-   * Access is granted only after recipient confirmation.
+   * Add a member to an account.
    * @param accountId - The account's `_id`.
    * @param data - Target user's username or email and role (never `owner`).
    *   The server resolves `usernameOrEmail` to a personal account; an unknown
@@ -477,93 +476,13 @@ export class AccountAgentKeysApi {
   }
 }
 
-export interface AccountInvitation {
-  id: string;
-  accountId: string;
-  email: string;
-  role: Exclude<AccountRole, 'owner'>;
-  status: 'pending' | 'expired' | 'accepted' | 'cancelled';
-  expiresAt: string;
-  createdAt: string;
-}
-export interface AccountInvitationPreview {
-  invitation: AccountInvitation;
-  account: { id: string; username: string | null; displayName: string | null };
-}
-
-/** Consent-based invitations; never cached or queued as offline mutations. */
-export class AccountInvitationsApi {
-  constructor(private readonly ctx: OxyContext) {}
-  async list(accountId: string): Promise<AccountInvitation[]> {
-    return (
-      await this.ctx.request<{ invitations: AccountInvitation[] }>(
-        'GET',
-        `/accounts/${enc(accountId)}/invitations`,
-        undefined,
-        { cache: false },
-      )
-    ).invitations;
-  }
-  async create(
-    accountId: string,
-    data: { email: string; role: Exclude<AccountRole, 'owner'>; inherit?: boolean },
-  ): Promise<AccountInvitation> {
-    return (
-      await this.ctx.request<{ invitation: AccountInvitation }>(
-        'POST',
-        `/accounts/${enc(accountId)}/invitations`,
-        data,
-        { cache: false },
-      )
-    ).invitation;
-  }
-  async resend(accountId: string, id: string): Promise<AccountInvitation> {
-    return (
-      await this.ctx.request<{ invitation: AccountInvitation }>(
-        'POST',
-        `/accounts/${enc(accountId)}/invitations/${enc(id)}/resend`,
-        undefined,
-        { cache: false },
-      )
-    ).invitation;
-  }
-  async cancel(accountId: string, id: string): Promise<AccountSuccessResult> {
-    return this.ctx.request(
-      'DELETE',
-      `/accounts/${enc(accountId)}/invitations/${enc(id)}`,
-      undefined,
-      { cache: false },
-    );
-  }
-  async preview(token: string): Promise<AccountInvitationPreview> {
-    return this.ctx.request('POST', '/accounts/invitations/preview', { token }, { cache: false });
-  }
-  /** selectedUserId must equal the currently authenticated personal account. */
-  async accept(
-    token: string,
-    selectedUserId: string,
-  ): Promise<AccountSuccessResult & { accountId: string }> {
-    const result = await this.ctx.request<AccountSuccessResult & { accountId: string }>(
-      'POST',
-      '/accounts/invitations/accept',
-      { token, selectedUserId, confirmed: true },
-      { cache: false },
-    );
-    invalidateAccountMembership(this.ctx, result.accountId);
-    evictOxyAccountForestCache(this.ctx.http);
-    return result;
-  }
-}
-
 export class AccountsApi {
   /** Who can act on an account, and with what role. */
   readonly members: AccountMembersApi;
-  readonly invitations: AccountInvitationsApi;
   readonly agentKeys: AccountAgentKeysApi;
 
   constructor(private readonly ctx: OxyContext) {
     this.members = new AccountMembersApi(ctx);
-    this.invitations = new AccountInvitationsApi(ctx);
     this.agentKeys = new AccountAgentKeysApi(ctx);
   }
 

package/src/api/billing.ts

@@ -1,11 +1,5 @@
 import {
   personalPlanCheckoutRequestSchema,
-  productPlanCheckoutRequestSchema,
-  productSubscriptionRenewalRequestSchema,
-  type ProductSubscriptionRenewalRequest,
-  productPlanCatalogueSchema,
-  type ProductPlanCheckoutRequest,
-  type ProductPlanCatalogue,
   personalPlanCheckoutResultSchema,
   type PersonalPlanCheckoutRequest,
   type PersonalPlanCheckoutResult,
@@ -133,43 +127,6 @@ export interface WalletTransactionsPage {
 export class BillingApi {
   constructor(protected readonly ctx: OxyContext) {}
 
-  async renewProductSubscription(
-    request: ProductSubscriptionRenewalRequest,
-  ): Promise<PersonalPlanCheckoutResult> {
-    return personalPlanCheckoutResultSchema.parse(
-      await this.ctx.request<unknown>(
-        'POST',
-        '/billing/product-subscriptions/renew',
-        productSubscriptionRenewalRequestSchema.parse(request),
-        { cache: false },
-      ),
-    );
-  }
-
-  async startProductPlanCheckout(
-    request: ProductPlanCheckoutRequest,
-  ): Promise<PersonalPlanCheckoutResult> {
-    return personalPlanCheckoutResultSchema.parse(
-      await this.ctx.request<unknown>(
-        'POST',
-        '/billing/checkout/product-plan',
-        productPlanCheckoutRequestSchema.parse(request),
-        { cache: false },
-      ),
-    );
-  }
-
-  async productPlans(productId: string): Promise<ProductPlanCatalogue> {
-    return productPlanCatalogueSchema.parse(
-      await this.ctx.request<unknown>(
-        'GET',
-        `/billing/product-plans/${encodeURIComponent(productId)}`,
-        undefined,
-        { cache: false },
-      ),
-    );
-  }
-
   async startPersonalPlanCheckout(
     request: PersonalPlanCheckoutRequest,
   ): Promise<PersonalPlanCheckoutResult> {