@oxy.so/core 7.23.1 → 7.24.0

package/dist/esm/i18n/locales/en-US.js

@@ -679,6 +679,16 @@ const dict = {
                 add: 'Add your links',
                 placeholder: 'Enter URL',
                 yourLinks: 'Your Links',
+                linkTitle: 'Title',
+                moveUp: 'Move up',
+                moveDown: 'Move down',
+                errors: {
+                    empty: 'Enter a link.',
+                    invalid: 'Enter a valid link.',
+                    insecure: 'Links must start with https://.',
+                    duplicate: 'That link is already on your profile.',
+                    limit: 'You can add up to {{count}} links.',
+                },
                 count: '{{count}} link added',
                 count_plural: '{{count}} links added',
             },

package/dist/esm/i18n/locales/es-ES.js

@@ -381,6 +381,16 @@ const dict = {
                 add: 'Añade tus enlaces',
                 placeholder: 'Introduce la URL',
                 yourLinks: 'Tus enlaces',
+                linkTitle: 'Título',
+                moveUp: 'Subir',
+                moveDown: 'Bajar',
+                errors: {
+                    empty: 'Introduce un enlace.',
+                    invalid: 'Introduce un enlace válido.',
+                    insecure: 'Los enlaces deben empezar por https://.',
+                    duplicate: 'Ese enlace ya está en tu perfil.',
+                    limit: 'Puedes añadir hasta {{count}} enlaces.',
+                },
                 count: '{{count}} enlace añadido',
                 count_plural: '{{count}} enlaces añadidos',
             },

package/dist/esm/index.js

@@ -35,7 +35,7 @@ export { ASSET_MULTIPART_UPLOAD_MAX_BYTES, assetUrlCacheTTL, MAX_UPLOAD_BYTES }
 export { DirectUploadInterruptedError } from './api/directUpload.js';
 export { buildUserDid } from './api/identity.js';
 export { ACCOUNT_CATEGORY_IDS, MAX_ACCOUNT_CATEGORIES, SELECTABLE_ACCOUNT_CATEGORY_IDS, isSelectableAccountCategoryId, kindAcceptsAccountCategories, } from './api/accounts.js';
-// The store's installer (ADR 0053): what a runtime that installs applications registers beside
+// The store's installer (ADR 0059): what a runtime that installs applications registers beside
 // `oxy.store`, and what a store asks it.
 export { getStoreInstaller, setStoreInstaller, StoreInstallerError, } from './api/storeInstaller.js';
 export { REPUTATION_CACHE_PREFIX } from './api/reputation.js';

package/dist/types/api/accounts.d.ts

@@ -18,7 +18,7 @@ import type { AccountAccessGrant, OrganizationType } from '@oxy.so/contracts';
  * no per-request "acting-as" header. Identity is carried by the session/token,
  * so a switch propagates through reload and cross-domain exactly like a login.
  */
-import type { AgentKeyOperation, AgentKeyOperationProof } from '@oxy.so/contracts';
+import type { AgentKeyOperation, AgentKeyOperationProof, OrganizationIdentityKeyState, OrganizationKeyApplyRequest, OrganizationKeyChallenge, OrganizationKeyChallengeRequest, OrganizationKeyOperation } from '@oxy.so/contracts';
 import type { User } from '../models/interfaces';
 import type { AccountCategoryId, AccountKind, AvatarCharacter, ChildAccountKind } from '@oxy.so/contracts';
 import type { SessionLoginResponse } from '../models/session';
@@ -384,6 +384,44 @@ export declare class AccountAgentKeysApi {
         revokedMethodIds: string[];
     }>;
 }
+/** A secp256k1 key pair held on this device: lowercase hex, the public key uncompressed. */
+export interface OrganizationKeyPair {
+    privateKey: string;
+    publicKey: string;
+}
+/**
+ * `oxy.accounts.identityKey` — an organization's identity key (ADR 0061): its
+ * DID `#key-1`, the key Peable derives its FairCoin receive addresses from.
+ * Only the organization's owners and admins may read or change it; the key is
+ * created and held in Commons and never signs anybody in.
+ *
+ * `get` answers `publicKey: null` for an organization that has no key yet (its
+ * DID lists no `#key-1`): that is when a client shows its owners "Set up the
+ * organization's Peable wallet". A 403 (`ORGANIZATION_KEY_FORBIDDEN`) means the
+ * signed-in person is not an owner or admin of a claimed, active organization.
+ */
+export declare class AccountIdentityKeyApi {
+    private readonly ctx;
+    constructor(ctx: OxyContext);
+    /** The organization's key (`null` without one) and every key it has had, oldest first. */
+    get(accountId: string): Promise<OrganizationIdentityKeyState>;
+    /** A one-use challenge for one change, with the claims every signer signs. */
+    requestChallenge(accountId: string, request: OrganizationKeyChallengeRequest): Promise<OrganizationKeyChallenge>;
+    /** Apply a change with its signatures (see {@link link} for the whole ceremony). */
+    apply(accountId: string, request: OrganizationKeyApplyRequest): Promise<OrganizationIdentityKeyState>;
+    /**
+     * Commons' whole ceremony. NATIVE-ONLY: the actor is THIS device's personal
+     * root (`KeyManager`), which must be the signed-in person's. `key` is the
+     * organization key the device generated (`create`, or `replace` with a new
+     * one); `previousKey` is the current organization key when the device holds
+     * it, so the replacement is recorded as proven by it.
+     */
+    link(accountId: string, input: {
+        operation: OrganizationKeyOperation;
+        key: OrganizationKeyPair;
+        previousKey?: OrganizationKeyPair;
+    }): Promise<OrganizationIdentityKeyState>;
+}
 export interface AccountInvitation {
     id: string;
     accountId: string;
@@ -425,6 +463,8 @@ export declare class AccountsApi {
     readonly members: AccountMembersApi;
     readonly invitations: AccountInvitationsApi;
     readonly agentKeys: AccountAgentKeysApi;
+    /** An organization's identity key: its DID `#key-1` and Peable wallet key (ADR 0061). */
+    readonly identityKey: AccountIdentityKeyApi;
     constructor(ctx: OxyContext);
     /**
      * List the accounts the caller can access: their own personal (root)

package/dist/types/api/storeInstaller.d.ts

@@ -5,7 +5,7 @@
  * `oxy.store` says what the store lists; an installer says what the machine can do with a
  * listing. A runtime that installs applications registers one (OxyOS's Bloom host registers one
  * backed by the system's install service before the application's code runs, OxyOS ADR 0030
- * decision 9; ADR 0053 here). Where none is registered — the web, iOS, Android — there is
+ * decision 9; ADR 0059 here). Where none is registered — the web, iOS, Android — there is
  * nothing to install, and a store shows what it shows without one. An application never asks
  * which platform it runs on: it asks whether there is an installer.
  *

package/dist/types/i18n/locales/en-US.d.ts

@@ -670,6 +670,16 @@ declare const dict: {
                 add: string;
                 placeholder: string;
                 yourLinks: string;
+                linkTitle: string;
+                moveUp: string;
+                moveDown: string;
+                errors: {
+                    empty: string;
+                    invalid: string;
+                    insecure: string;
+                    duplicate: string;
+                    limit: string;
+                };
                 count: string;
                 count_plural: string;
             };

package/dist/types/i18n/locales/es-ES.d.ts

@@ -381,6 +381,16 @@ declare const dict: {
                 add: string;
                 placeholder: string;
                 yourLinks: string;
+                linkTitle: string;
+                moveUp: string;
+                moveDown: string;
+                errors: {
+                    empty: string;
+                    invalid: string;
+                    insecure: string;
+                    duplicate: string;
+                    limit: string;
+                };
                 count: string;
                 count_plural: string;
             };

package/dist/types/server/appAssertion.d.ts

@@ -23,8 +23,8 @@ export declare const oxyAppAssertionClaimsSchema: z.ZodObject<{
     sid: z.ZodString;
     app: z.ZodString;
     platform: z.ZodEnum<{
-        android: "android";
         ios: "ios";
+        android: "android";
         web: "web";
     }>;
     iat: z.ZodNumber;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/core",
-  "version": "7.23.1",
+  "version": "7.24.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -181,7 +181,7 @@
   "dependencies": {
     "@noble/ciphers": "^2.4.0",
     "@noble/hashes": "^2.4.0",
-    "@oxy.so/contracts": "^6.9.0",
+    "@oxy.so/contracts": "^6.11.0",
     "@oxy.so/protocol": "^1.6.1",
     "@oxy.so/telemetry": "^2.1.0",
     "@scure/bip39": "^2.4.0",

package/src/api/accounts.ts

@@ -18,13 +18,26 @@ import type { AccountAccessGrant, OrganizationType } from '@oxy.so/contracts';
  * no per-request "acting-as" header. Identity is carried by the session/token,
  * so a switch propagates through reload and cross-domain exactly like a login.
  */
-import type { AgentKeyOperation, AgentKeyOperationProof } from '@oxy.so/contracts';
+import type {
+  AgentKeyOperation,
+  AgentKeyOperationProof,
+  OrganizationIdentityKeyState,
+  OrganizationKeyApplyRequest,
+  OrganizationKeyChallenge,
+  OrganizationKeyChallengeRequest,
+  OrganizationKeyOperation,
+} from '@oxy.so/contracts';
 import {
   agentKeyListResponseCheck,
   agentKeyOperationChallengeCheck,
   agentKeyOperationCheck,
   agentKeyOperationResultCheck,
   executeAgentKeyOperationCheck,
+  organizationIdentityKeyStateCheck,
+  organizationKeyApplyRequestCheck,
+  organizationKeyChallengeCheck,
+  organizationKeyChallengeRequestCheck,
+  organizationKeyProofClaims,
   parseContract,
 } from '@oxy.so/contracts/client';
 import type { User } from '../models/interfaces';
@@ -457,6 +470,124 @@ export class AccountAgentKeysApi {
   }
 }
 
+/** A secp256k1 key pair held on this device: lowercase hex, the public key uncompressed. */
+export interface OrganizationKeyPair {
+  privateKey: string;
+  publicKey: string;
+}
+
+/**
+ * `oxy.accounts.identityKey` — an organization's identity key (ADR 0061): its
+ * DID `#key-1`, the key Peable derives its FairCoin receive addresses from.
+ * Only the organization's owners and admins may read or change it; the key is
+ * created and held in Commons and never signs anybody in.
+ *
+ * `get` answers `publicKey: null` for an organization that has no key yet (its
+ * DID lists no `#key-1`): that is when a client shows its owners "Set up the
+ * organization's Peable wallet". A 403 (`ORGANIZATION_KEY_FORBIDDEN`) means the
+ * signed-in person is not an owner or admin of a claimed, active organization.
+ */
+export class AccountIdentityKeyApi {
+  constructor(private readonly ctx: OxyContext) {}
+
+  /** The organization's key (`null` without one) and every key it has had, oldest first. */
+  async get(accountId: string): Promise<OrganizationIdentityKeyState> {
+    return parseContract(
+      organizationIdentityKeyStateCheck,
+      await this.ctx.request<unknown>(
+        'GET',
+        `/accounts/${enc(accountId)}/identity-key`,
+        undefined,
+        { cache: false },
+      ),
+    );
+  }
+
+  /** A one-use challenge for one change, with the claims every signer signs. */
+  async requestChallenge(
+    accountId: string,
+    request: OrganizationKeyChallengeRequest,
+  ): Promise<OrganizationKeyChallenge> {
+    return parseContract(
+      organizationKeyChallengeCheck,
+      await this.ctx.request<unknown>(
+        'POST',
+        `/accounts/${enc(accountId)}/identity-key/challenge`,
+        parseContract(organizationKeyChallengeRequestCheck, request),
+        { cache: false },
+      ),
+    );
+  }
+
+  /** Apply a change with its signatures (see {@link link} for the whole ceremony). */
+  async apply(
+    accountId: string,
+    request: OrganizationKeyApplyRequest,
+  ): Promise<OrganizationIdentityKeyState> {
+    return parseContract(
+      organizationIdentityKeyStateCheck,
+      await this.ctx.request<unknown>(
+        'POST',
+        `/accounts/${enc(accountId)}/identity-key`,
+        parseContract(organizationKeyApplyRequestCheck, request),
+        { cache: false },
+      ),
+    );
+  }
+
+  /**
+   * Commons' whole ceremony. NATIVE-ONLY: the actor is THIS device's personal
+   * root (`KeyManager`), which must be the signed-in person's. `key` is the
+   * organization key the device generated (`create`, or `replace` with a new
+   * one); `previousKey` is the current organization key when the device holds
+   * it, so the replacement is recorded as proven by it.
+   */
+  async link(
+    accountId: string,
+    input: {
+      operation: OrganizationKeyOperation;
+      key: OrganizationKeyPair;
+      previousKey?: OrganizationKeyPair;
+    },
+  ): Promise<OrganizationIdentityKeyState> {
+    const { KeyManager, signIdentityProof } = await import('../crypto/index');
+    const [rootPrivateKey, rootPublicKey] = await Promise.all([
+      KeyManager.getPrivateKey(),
+      KeyManager.getPublicKey(),
+    ]);
+    if (!rootPrivateKey || !rootPublicKey) {
+      throw new Error('No identity on this device to sign with');
+    }
+    const challenge = await this.requestChallenge(accountId, {
+      operation: input.operation,
+      publicKey: input.key.publicKey,
+    });
+    const root = rootPublicKey.trim().toLowerCase();
+    if (challenge.actorPublicKey !== root) {
+      throw new Error("This device's identity is not the signed-in account's");
+    }
+    const sign = async (signer: OrganizationKeyPair, publicKey: string) =>
+      (
+        await signIdentityProof(
+          { privateKey: signer.privateKey, publicKey },
+          organizationKeyProofClaims(challenge, publicKey),
+        )
+      ).signature;
+    const previousPublicKey = challenge.previousPublicKey;
+    return this.apply(accountId, {
+      operation: input.operation,
+      publicKey: challenge.publicKey,
+      challenge: challenge.challenge,
+      expiresAt: challenge.expiresAt,
+      actorSignature: await sign({ privateKey: rootPrivateKey, publicKey: root }, root),
+      keySignature: await sign(input.key, challenge.publicKey),
+      ...(input.previousKey && previousPublicKey
+        ? { previousKeySignature: await sign(input.previousKey, previousPublicKey) }
+        : {}),
+    });
+  }
+}
+
 export interface AccountInvitation {
   id: string;
   accountId: string;
@@ -540,11 +671,14 @@ export class AccountsApi {
   readonly members: AccountMembersApi;
   readonly invitations: AccountInvitationsApi;
   readonly agentKeys: AccountAgentKeysApi;
+  /** An organization's identity key: its DID `#key-1` and Peable wallet key (ADR 0061). */
+  readonly identityKey: AccountIdentityKeyApi;
 
   constructor(private readonly ctx: OxyContext) {
     this.members = new AccountMembersApi(ctx);
     this.invitations = new AccountInvitationsApi(ctx);
     this.agentKeys = new AccountAgentKeysApi(ctx);
+    this.identityKey = new AccountIdentityKeyApi(ctx);
   }
 
   /**

package/src/api/storeInstaller.ts

@@ -5,7 +5,7 @@
  * `oxy.store` says what the store lists; an installer says what the machine can do with a
  * listing. A runtime that installs applications registers one (OxyOS's Bloom host registers one
  * backed by the system's install service before the application's code runs, OxyOS ADR 0030
- * decision 9; ADR 0053 here). Where none is registered — the web, iOS, Android — there is
+ * decision 9; ADR 0059 here). Where none is registered — the web, iOS, Android — there is
  * nothing to install, and a store shows what it shows without one. An application never asks
  * which platform it runs on: it asks whether there is an installer.
  *