@oxy.so/core 7.26.0 → 7.28.0

package/dist/esm/i18n/locales/en-US.js

@@ -664,6 +664,20 @@ const dict = {
                 month: 'Month',
                 year: 'Year',
             },
+            pronouns: {
+                title: 'Pronouns',
+                subtitle: 'How people should refer to you',
+                label: 'Pronouns',
+                options: {
+                    unspecified: 'Not set',
+                    he_him: 'He/him',
+                    she_her: 'She/her',
+                    they_them: 'They/them',
+                    he_they: 'He/they',
+                    she_they: 'She/they',
+                    it_its: 'It/its',
+                },
+            },
             locations: {
                 title: 'Locations',
                 subtitle: "Places you've been or live",

package/dist/esm/i18n/locales/es-ES.js

@@ -366,6 +366,20 @@ const dict = {
                 month: 'Mes',
                 year: 'Año',
             },
+            pronouns: {
+                title: 'Pronombres',
+                subtitle: 'Cómo deben referirse a ti las personas',
+                label: 'Pronombres',
+                options: {
+                    unspecified: 'Sin definir',
+                    he_him: 'He/him',
+                    she_her: 'She/her',
+                    they_them: 'They/them',
+                    he_they: 'He/they',
+                    she_they: 'She/they',
+                    it_its: 'It/its',
+                },
+            },
             locations: {
                 title: 'Ubicaciones',
                 subtitle: 'Lugares donde has estado o vives',

package/dist/types/api/identity.d.ts

@@ -10,6 +10,15 @@ export interface VerifyDomainResult {
 export interface RemoveDomainResult {
     success: boolean;
 }
+/** Options for {@link IdentityApi.resolveDid}. */
+export interface ResolveDidOptions {
+    /**
+     * Read the document from the origin now, never from a cache. Required when
+     * `#key-1` decides where money goes (deriving a Peable receive address): the
+     * key changes on a rotation or an organization key replacement.
+     */
+    fresh?: boolean;
+}
 /** How the caller proves control of the CURRENT key during a key rotation. */
 export type RotateKeyProof = 'device' | 'phrase';
 /** Options for {@link IdentityApi.rotateKey}. */
@@ -93,8 +102,16 @@ export declare class IdentityApi {
      * Resolve the W3C DID document for any user. The API derives it on demand
      * from the account's `authMethods` + `publicKey` — there is no stored
      * document. Public (no auth required); short-TTL cached.
+     *
+     * `{ fresh: true }` reads the document as it is NOW: it skips (and drops)
+     * this client's cached copy, is not joined to an in-flight read, and sends
+     * `Cache-Control: no-cache` so no HTTP cache on the way answers for the
+     * origin. Use it whenever the answer decides where money goes: `#key-1` is
+     * the account's Peable receive key and changes on a rotation or an
+     * organization key replacement, and a cached copy would derive an address
+     * from the previous key for up to the cache TTL.
      */
-    resolveDid(userId: string): Promise<DidDocument>;
+    resolveDid(userId: string, options?: ResolveDidOptions): Promise<DidDocument>;
     /**
      * The signed-in user's linked authentication methods plus their DID. Each
      * `identity` method carries a `verificationMethodId` linking it to its DID

package/dist/types/crypto/identityDerivations.d.ts

@@ -37,6 +37,12 @@ export declare function deriveScopedSeedFromKey(privateKeyHex: string, info: str
  * `HMAC-SHA256(SOCIAL_RECEIVE_CHAIN_CODE_KEY, compressed identity public key)`.
  * Identical to `@fairco.in/core`'s `deriveSocialReceiveSpendingKey`.
  *
+ * INTERNAL to `@oxy.so/core` (not exported from `@oxy.so/core/crypto`): the
+ * derivation is non-hardened and the chain code is a public function of the
+ * identity public key, so `identity = child - I_L mod n` — whoever holds one
+ * child private key and the public key holds the identity key. Callers get
+ * signatures ({@link signSocialReceiveDigest}), never the child key.
+ *
  * @returns the child private key and its compressed public key, lowercase hex.
  */
 export declare function deriveSocialReceiveKey(privateKeyHex: string, index: number): {

package/dist/types/crypto/index.d.ts

@@ -27,7 +27,7 @@ export { hkdfSha256 } from './kdf';
 export { encryptAead, decryptAead, AEAD_KEY_LENGTH, AEAD_NONCE_LENGTH } from './aead';
 export type { AeadResult } from './aead';
 export { deriveSharedSecret } from './ecdh';
-export { SCOPED_SEED_KDF_SALT, SOCIAL_RECEIVE_CHAIN_CODE_KEY, MAX_SOCIAL_RECEIVE_INDEX, deriveScopedSeedFromKey, deriveSocialReceiveKey, signSocialReceiveDigest, authChallengeDigest, } from './identityDerivations';
+export { SCOPED_SEED_KDF_SALT, SOCIAL_RECEIVE_CHAIN_CODE_KEY, MAX_SOCIAL_RECEIVE_INDEX, deriveScopedSeedFromKey, signSocialReceiveDigest, authChallengeDigest, } from './identityDerivations';
 export { digestIdentityPayload, signIdentityProof } from './identityProof';
 export { deriveIdentityLinkCode } from './identityLink';
 export { solveRegistrationPow } from './registrationPow';

package/dist/types/i18n/locales/en-US.d.ts

@@ -655,6 +655,20 @@ declare const dict: {
                 month: string;
                 year: string;
             };
+            pronouns: {
+                title: string;
+                subtitle: string;
+                label: string;
+                options: {
+                    unspecified: string;
+                    he_him: string;
+                    she_her: string;
+                    they_them: string;
+                    he_they: string;
+                    she_they: string;
+                    it_its: string;
+                };
+            };
             locations: {
                 title: string;
                 subtitle: string;

package/dist/types/i18n/locales/es-ES.d.ts

@@ -366,6 +366,20 @@ declare const dict: {
                 month: string;
                 year: string;
             };
+            pronouns: {
+                title: string;
+                subtitle: string;
+                label: string;
+                options: {
+                    unspecified: string;
+                    he_him: string;
+                    she_her: string;
+                    they_them: string;
+                    he_they: string;
+                    she_they: string;
+                    it_its: string;
+                };
+            };
             locations: {
                 title: string;
                 subtitle: string;

package/dist/types/index.d.ts

@@ -41,7 +41,7 @@ export { DirectUploadInterruptedError } from './api/directUpload';
 export type { DirectUploadProgress } from './api/directUpload';
 export type { AssetsApi, AssetRecord, UploadedAsset, AssetLinkState, AssetUploadOptions, AssetUploadStageProgress, AssetLinkTarget, AssetDeleteResult, CompletedAssetUpload, LargeUploadOptions, LargeUploadProgress, LargeUploadResult, } from './api/assets';
 export { buildUserDid } from './api/identity';
-export type { IdentityApi, VerifyDomainResult, RemoveDomainResult, RotateKeyProof, RotateKeyOptions, RotateKeyResult, } from './api/identity';
+export type { IdentityApi, VerifyDomainResult, RemoveDomainResult, ResolveDidOptions, RotateKeyProof, RotateKeyOptions, RotateKeyResult, } from './api/identity';
 export { ACCOUNT_CATEGORY_IDS, MAX_ACCOUNT_CATEGORIES, SELECTABLE_ACCOUNT_CATEGORY_IDS, isSelectableAccountCategoryId, kindAcceptsAccountCategories, } from './api/accounts';
 export type { AccountsApi, AccountKind, AccountCategoryId, AccountRelationship, AccountRole, AccountMemberStatus, AccountMemberSource, AccountMember, AccountNode, ListAccountsOptions, CreateAccountInput, UpdateAccountInput, UpdateAccountMemberInput, TransferAccountOwnershipInput, AccountSuccessResult, SwitchAccountResult, } from './api/accounts';
 export type { AppsApi, AppAssertionsApi, Application, ApplicationCallerMembership, ApplicationType, ApplicationStatus, ApplicationCredential, ApplicationCredentialType, ApplicationCredentialStatus, ApplicationEnvironment, CreateApplicationInput, UpdateApplicationInput, CreateApplicationCredentialInput, RotateApplicationCredentialInput, ApplicationCredentialWithSecret, RotateApplicationCredentialResult, ApplicationUsagePeriod, ApplicationUsageSummary, ApplicationUsageByDay, ApplicationUsageByEndpoint, ApplicationUsageStats, PublicApplication, ConnectedApp, ConnectedMcpClient, ApplicationDeleteResult, ApplicationFilesWebhook, } from './api/apps';

package/dist/types/models/interfaces.d.ts

@@ -1,4 +1,4 @@
-import type { AccountKind, AccountCategoryId, AvatarCharacter, UserNameResponse, UserRelationship, ThemePreference, OxyNotificationEntityType, OxyNotificationType } from '@oxy.so/contracts';
+import type { AccountKind, AccountCategoryId, AvatarCharacter, UserNameResponse, UserRelationship, ThemePreference, OxyNotificationEntityType, OxyNotificationType, Pronouns } from '@oxy.so/contracts';
 export interface OxyConfig {
     baseURL: string;
     cloudURL?: string;
@@ -135,6 +135,11 @@ export interface User {
         image?: string;
         id?: string;
     }>;
+    /**
+     * How a person account names its pronouns, from the closed list. An account
+     * that is not a person (organization, channel, bot, …) is always `unspecified`.
+     */
+    pronouns?: Pronouns;
     _count?: {
         followers?: number;
         following?: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/core",
-  "version": "7.26.0",
+  "version": "7.28.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/api/identity.ts

@@ -68,6 +68,16 @@ export interface RemoveDomainResult {
   success: boolean;
 }
 
+/** Options for {@link IdentityApi.resolveDid}. */
+export interface ResolveDidOptions {
+  /**
+   * Read the document from the origin now, never from a cache. Required when
+   * `#key-1` decides where money goes (deriving a Peable receive address): the
+   * key changes on a rotation or an organization key replacement.
+   */
+  fresh?: boolean;
+}
+
 /** How the caller proves control of the CURRENT key during a key rotation. */
 export type RotateKeyProof = 'device' | 'phrase';
 
@@ -191,17 +201,29 @@ export class IdentityApi {
    * Resolve the W3C DID document for any user. The API derives it on demand
    * from the account's `authMethods` + `publicKey` — there is no stored
    * document. Public (no auth required); short-TTL cached.
+   *
+   * `{ fresh: true }` reads the document as it is NOW: it skips (and drops)
+   * this client's cached copy, is not joined to an in-flight read, and sends
+   * `Cache-Control: no-cache` so no HTTP cache on the way answers for the
+   * origin. Use it whenever the answer decides where money goes: `#key-1` is
+   * the account's Peable receive key and changes on a rotation or an
+   * organization key replacement, and a cached copy would derive an address
+   * from the previous key for up to the cache TTL.
    */
-  async resolveDid(userId: string): Promise<DidDocument> {
-    return this.ctx.request<DidDocument>(
-      'GET',
-      `/u/${encodeURIComponent(userId)}/did.json`,
-      undefined,
-      {
-        cache: true,
-        cacheTTL: SHORT_TTL,
-      },
-    );
+  async resolveDid(userId: string, options: ResolveDidOptions = {}): Promise<DidDocument> {
+    const path = `/u/${encodeURIComponent(userId)}/did.json`;
+    if (options.fresh) {
+      this.ctx.http.invalidateCache({ keys: [`GET:${path}`] });
+      return this.ctx.request<DidDocument>('GET', path, undefined, {
+        cache: false,
+        deduplicate: false,
+        headers: { 'Cache-Control': 'no-cache' },
+      });
+    }
+    return this.ctx.request<DidDocument>('GET', path, undefined, {
+      cache: true,
+      cacheTTL: SHORT_TTL,
+    });
   }
 
   /**

package/src/crypto/identityDerivations.ts

@@ -73,6 +73,12 @@ export function deriveScopedSeedFromKey(privateKeyHex: string, info: string): Ui
  * `HMAC-SHA256(SOCIAL_RECEIVE_CHAIN_CODE_KEY, compressed identity public key)`.
  * Identical to `@fairco.in/core`'s `deriveSocialReceiveSpendingKey`.
  *
+ * INTERNAL to `@oxy.so/core` (not exported from `@oxy.so/core/crypto`): the
+ * derivation is non-hardened and the chain code is a public function of the
+ * identity public key, so `identity = child - I_L mod n` — whoever holds one
+ * child private key and the public key holds the identity key. Callers get
+ * signatures ({@link signSocialReceiveDigest}), never the child key.
+ *
  * @returns the child private key and its compressed public key, lowercase hex.
  */
 export function deriveSocialReceiveKey(

package/src/crypto/index.ts

@@ -57,13 +57,16 @@ export type { AeadResult } from './aead';
 export { deriveSharedSecret } from './ecdh';
 
 // What the identity key computes without leaving its holder: the same functions
-// Commons' identity host implements natively on Android.
+// Commons' identity host implements natively on Android. The social-receive
+// CHILD private key (`deriveSocialReceiveKey`) is deliberately not here: the
+// derivation is non-hardened under a chain code anyone can compute from the
+// public key, so one leaked child private key reveals the identity key. Only
+// signatures (`signSocialReceiveDigest`) leave this module.
 export {
   SCOPED_SEED_KDF_SALT,
   SOCIAL_RECEIVE_CHAIN_CODE_KEY,
   MAX_SOCIAL_RECEIVE_INDEX,
   deriveScopedSeedFromKey,
-  deriveSocialReceiveKey,
   signSocialReceiveDigest,
   authChallengeDigest,
 } from './identityDerivations';