@oxyhq/core 10.2.0 → 11.0.1

package/dist/cjs/logger/index.js

@@ -0,0 +1,149 @@
+"use strict";
+/**
+ * @oxyhq/core/logger — the ecosystem-wide logging chokepoint.
+ *
+ * A tiny, dependency-free, universal logger that works unchanged in React
+ * Native, browsers, Node, and Bun. Every Oxy app and package should log
+ * through here instead of calling `console.*` directly, so that level,
+ * formatting, and transport are controlled in ONE place.
+ *
+ * Design goals:
+ *  - Zero dependencies. No Node-only imports, no `process.stdout` assumptions.
+ *  - Four levels (`debug` | `info` | `warn` | `error`) plus `silent`.
+ *  - Namespaced child loggers via `createLogger('mention:feed')` / `.child()`.
+ *  - Structured context objects carried through to the sink.
+ *  - A single pluggable sink so backends can pipe to pino / CloudWatch / etc.
+ *    without touching any call site.
+ *  - Debug is off in production by default (`__DEV__` on RN, `NODE_ENV`
+ *    elsewhere); override globally with `configureLogger({ level })`.
+ *
+ * @module logger
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logger = exports.consoleSink = void 0;
+exports.isDev = isDev;
+exports.configureLogger = configureLogger;
+exports.getLoggerConfig = getLoggerConfig;
+exports.resetLoggerConfig = resetLoggerConfig;
+exports.createLogger = createLogger;
+const LEVEL_WEIGHT = {
+    silent: 0,
+    error: 1,
+    warn: 2,
+    info: 3,
+    debug: 4,
+};
+/**
+ * True in development. Uses React Native's `__DEV__` when present, otherwise
+ * falls back to `process.env.NODE_ENV === 'development'`. Never throws.
+ */
+function isDev() {
+    if (typeof __DEV__ !== 'undefined')
+        return __DEV__ === true;
+    try {
+        return typeof process !== 'undefined' && process.env?.NODE_ENV === 'development';
+    }
+    catch {
+        return false;
+    }
+}
+function formatPrefix(entry) {
+    const parts = [entry.timestamp, entry.level.toUpperCase()];
+    if (entry.namespace)
+        parts.push(`[${entry.namespace}]`);
+    return parts.join(' ');
+}
+/**
+ * Default sink: routes each entry to the matching `console` method. `info` and
+ * `debug` go to `console.log` (RN/browser-safe — `console.debug`/`console.info`
+ * are inconsistently surfaced across runtimes).
+ */
+const consoleSink = (entry) => {
+    const extras = [];
+    if (entry.context && Object.keys(entry.context).length > 0)
+        extras.push(entry.context);
+    if (entry.error !== undefined)
+        extras.push(entry.error);
+    if (entry.args.length > 0)
+        extras.push(...entry.args);
+    const line = `${formatPrefix(entry)} ${entry.message}`;
+    if (entry.level === 'error')
+        console.error(line, ...extras);
+    else if (entry.level === 'warn')
+        console.warn(line, ...extras);
+    else
+        console.log(line, ...extras);
+};
+exports.consoleSink = consoleSink;
+function defaultLevel() {
+    return isDev() ? 'debug' : 'info';
+}
+const config = {
+    level: defaultLevel(),
+    sink: exports.consoleSink,
+};
+/**
+ * Update the global logger configuration. Affects every logger instance
+ * (root and children) immediately. Pass `{ level }` to gate output and/or
+ * `{ sink }` to redirect transport (pino, CloudWatch, a test capture, …).
+ */
+function configureLogger(partial) {
+    if (partial.level !== undefined)
+        config.level = partial.level;
+    if (partial.sink !== undefined)
+        config.sink = partial.sink;
+}
+/** Read a snapshot of the current global configuration. */
+function getLoggerConfig() {
+    return { level: config.level, sink: config.sink };
+}
+/** Restore the default level (env-derived) and the console sink. */
+function resetLoggerConfig() {
+    config.level = defaultLevel();
+    config.sink = exports.consoleSink;
+}
+function mergeContext(base, extra) {
+    if (!base)
+        return extra;
+    if (!extra)
+        return base;
+    return { ...base, ...extra };
+}
+function emit(level, namespace, baseContext, message, error, context, args) {
+    if (LEVEL_WEIGHT[level] > LEVEL_WEIGHT[config.level])
+        return;
+    config.sink({
+        level,
+        message,
+        namespace,
+        context: mergeContext(baseContext, context),
+        error,
+        args,
+        timestamp: new Date().toISOString(),
+    });
+}
+function makeLogger(namespace, baseContext) {
+    return {
+        namespace,
+        debug: (message, context, ...args) => emit('debug', namespace, baseContext, message, undefined, context, args),
+        info: (message, context, ...args) => emit('info', namespace, baseContext, message, undefined, context, args),
+        warn: (message, context, ...args) => emit('warn', namespace, baseContext, message, undefined, context, args),
+        error: (message, error, context, ...args) => emit('error', namespace, baseContext, message, error, context, args),
+        child: (childNamespace, childContext) => makeLogger(namespace ? `${namespace}:${childNamespace}` : childNamespace, mergeContext(baseContext, childContext)),
+    };
+}
+/** The shared root logger. Prefer a namespaced `createLogger(...)` in modules. */
+exports.logger = makeLogger(undefined, undefined);
+/**
+ * Create a namespaced logger.
+ *
+ * @example
+ * ```ts
+ * const log = createLogger('mention:feed');
+ * log.info('loaded', { count: 20 });
+ * const sub = log.child('prefetch'); // namespace → 'mention:feed:prefetch'
+ * ```
+ */
+function createLogger(namespace, context) {
+    return makeLogger(namespace, context);
+}

package/dist/cjs/mixins/OxyServices.assets.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OxyServicesAssetsMixin = OxyServicesAssetsMixin;
 const protocol_1 = require("@oxyhq/protocol");
-const loggerUtils_1 = require("../utils/loggerUtils");
+const logger_1 = require("../logger");
 const errorUtils_1 = require("../utils/errorUtils");
 /**
  * Maximum number of ids sent per `POST /assets/service/by-ids` request. Matches
@@ -215,7 +215,7 @@ function OxyServicesAssetsMixin(Base) {
                     return Array.isArray(entries) ? entries : [];
                 }
                 catch (error) {
-                    loggerUtils_1.logger.warn('getServiceAssetMetadataByIds: chunk failed, continuing with remaining chunks', {
+                    logger_1.logger.warn('getServiceAssetMetadataByIds: chunk failed, continuing with remaining chunks', {
                         method: 'getServiceAssetMetadataByIds',
                         chunkSize: chunk.length,
                         status: (0, errorUtils_1.extractErrorStatus)(error),
@@ -278,7 +278,7 @@ function OxyServicesAssetsMixin(Base) {
                     return Array.isArray(entries) ? entries : [];
                 }
                 catch (error) {
-                    loggerUtils_1.logger.warn('getServiceAssetMetadataBySha256: chunk failed, continuing with remaining chunks', {
+                    logger_1.logger.warn('getServiceAssetMetadataBySha256: chunk failed, continuing with remaining chunks', {
                         method: 'getServiceAssetMetadataBySha256',
                         chunkSize: chunk.length,
                         status: (0, errorUtils_1.extractErrorStatus)(error),
@@ -362,7 +362,7 @@ function OxyServicesAssetsMixin(Base) {
                 return response;
             }
             catch (error) {
-                console.error('File upload error:', error);
+                logger_1.logger.error('File upload error', error, { component: 'OxyServices.assets' });
                 let errorMessage = 'File upload failed';
                 if (error instanceof Error) {
                     errorMessage = error.message || errorMessage;

package/dist/cjs/mixins/OxyServices.auth.js

@@ -7,7 +7,7 @@ const OxyServices_errors_1 = require("../OxyServices.errors");
 const keyManager_1 = require("../crypto/keyManager");
 const signatureService_1 = require("../crypto/signatureService");
 const protocol_1 = require("@oxyhq/protocol");
-const loggerUtils_1 = require("../utils/loggerUtils");
+const logger_1 = require("../logger");
 const userIdentity_1 = require("../utils/userIdentity");
 /**
  * Default lifetime of a "Sign in with Oxy" device-flow session / authorize code.
@@ -125,7 +125,7 @@ function OxyServicesAuthMixin(Base) {
                     : Buffer.alloc(storedSecretBuf.length);
                 const compareResult = nodeCrypto.timingSafeEqual(storedSecretBuf, compareBuf);
                 if (!lengthMatch || !compareResult) {
-                    loggerUtils_1.logger.warn('[oxy.auth] Service token cache hit with mismatched secret', {
+                    logger_1.logger.warn('[oxy.auth] Service token cache hit with mismatched secret', {
                         component: 'auth',
                         method: 'getServiceToken',
                     });
@@ -852,6 +852,108 @@ function OxyServicesAuthMixin(Base) {
                 throw this.handleError(error);
             }
         }
+        /**
+         * Begin a WebAuthn / passkey REGISTRATION ceremony. Requests the
+         * `PublicKeyCredentialCreationOptions` the browser's `navigator.credentials
+         * .create()` (or `@simplewebauthn/browser`'s `startRegistration`) needs.
+         *
+         * With a bearer token planted this links a passkey to the signed-in account
+         * (`username` ignored); without one it is a prospective signup and `username`
+         * is the desired handle. The returned options are OPAQUE — Oxy does not own
+         * their shape (the browser / `@simplewebauthn` does), so they pass through
+         * as `unknown` for the caller to hand straight to the ceremony.
+         */
+        async webauthnRegisterOptions(username) {
+            try {
+                return await this.makeRequest('POST', '/auth/webauthn/register/options', { ...(username !== undefined ? { username } : {}) }, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Finish a WebAuthn / passkey REGISTRATION ceremony. Forwards the opaque
+         * browser `RegistrationResponseJSON` (`response`) alongside the Oxy envelope
+         * (desired `username` for signup + the device-session naming fields).
+         *
+         * Two server branches, disambiguated by the response shape:
+         *  - **Signup** (no bearer): the account is created and a session minted —
+         *    the response carries `sessionId`, is the SAME {@link LoginResult}
+         *    contract as `POST /auth/verify`, and its access token is planted here.
+         *  - **Link** (bearer present): the passkey is attached to the signed-in
+         *    account and the server returns `{ success, message }` with no session,
+         *    which is returned verbatim (no token planting).
+         */
+        async webauthnRegisterVerify(response, envelope = {}) {
+            try {
+                const res = await this.makeRequest('POST', '/auth/webauthn/register/verify', { response, ...envelope }, { cache: false });
+                if (res && typeof res === 'object') {
+                    const record = res;
+                    // Signup branch: mints a session (LoginSessionResult, carries
+                    // `sessionId`). Parse against the login contract and plant the token.
+                    if ('sessionId' in record) {
+                        const parsed = (0, contracts_1.safeParseContract)(contracts_1.loginResultSchema, record);
+                        if (!parsed) {
+                            throw new Error('auth/webauthn/register/verify returned an unexpected response shape');
+                        }
+                        if (!('twoFactorRequired' in parsed) && parsed.accessToken) {
+                            this.setTokens(parsed.accessToken);
+                        }
+                        return parsed;
+                    }
+                    // Link branch: passkey attached to the signed-in account, no session.
+                    if (record.success === true && typeof record.message === 'string') {
+                        return { success: true, message: record.message };
+                    }
+                }
+                throw new Error('auth/webauthn/register/verify returned an unexpected response shape');
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Begin a WebAuthn / passkey AUTHENTICATION ceremony. Requests the
+         * `PublicKeyCredentialRequestOptions` the browser's `navigator.credentials
+         * .get()` (or `@simplewebauthn/browser`'s `startAuthentication`) needs.
+         *
+         * When `username` is present the server scopes `allowCredentials` to that
+         * user's passkeys (username-first); when omitted it returns an empty
+         * allow-list for the usernameless / discoverable-credential flow. The
+         * returned options are OPAQUE and pass through as `unknown`.
+         */
+        async webauthnLoginOptions(username) {
+            try {
+                return await this.makeRequest('POST', '/auth/webauthn/login/options', { ...(username !== undefined ? { username } : {}) }, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Finish a WebAuthn / passkey AUTHENTICATION ceremony. Forwards the opaque
+         * browser `AuthenticationResponseJSON` (`response`) alongside the
+         * device-session envelope. Resolves to the SAME {@link LoginResult} contract
+         * as `POST /auth/verify`; on the session arm the access token is planted
+         * immediately (mirroring {@link passwordSignIn}), and the response's
+         * `deviceId` + `deviceSecret` are the zero-cookie restore credential.
+         */
+        async webauthnLoginVerify(response, envelope = {}) {
+            try {
+                const res = await this.makeRequest('POST', '/auth/webauthn/login/verify', { response, ...envelope }, { cache: false });
+                const parsed = (0, contracts_1.safeParseContract)(contracts_1.loginResultSchema, res);
+                if (!parsed) {
+                    throw new Error('auth/webauthn/login/verify returned an unexpected response shape');
+                }
+                if (!('twoFactorRequired' in parsed) && parsed.accessToken) {
+                    this.setTokens(parsed.accessToken);
+                }
+                return parsed;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
         /**
          * Exchange an OAuth authorization code (returned to the RP redirect URI
          * after password sign-in at auth.oxy.so) for a device-first session.

package/dist/cjs/mixins/OxyServices.language.js

@@ -6,7 +6,7 @@ exports.OxyServicesLanguageMixin = OxyServicesLanguageMixin;
  */
 const languageUtils_1 = require("../utils/languageUtils");
 const protocol_1 = require("@oxyhq/protocol");
-const debugUtils_1 = require("../shared/utils/debugUtils");
+const logger_1 = require("../logger");
 function OxyServicesLanguageMixin(Base) {
     return class extends Base {
         constructor(...args) {
@@ -31,7 +31,7 @@ function OxyServicesLanguageMixin(Base) {
                     };
                 }
                 catch (error) {
-                    console.error('AsyncStorage not available in React Native:', error);
+                    logger_1.logger.error('AsyncStorage not available in React Native', error, { component: 'OxyServices.language' });
                     throw new Error('AsyncStorage is required in React Native environment');
                 }
             }
@@ -86,9 +86,7 @@ function OxyServicesLanguageMixin(Base) {
                 return null;
             }
             catch (error) {
-                if ((0, debugUtils_1.isDev)()) {
-                    console.warn('Failed to get current language:', error);
-                }
+                logger_1.logger.warn('Failed to get current language', { component: 'OxyServices.language' }, error);
                 return null;
             }
         }

package/dist/cjs/mixins/OxyServices.privacy.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OxyServicesPrivacyMixin = OxyServicesPrivacyMixin;
-const debugUtils_1 = require("../shared/utils/debugUtils");
+const logger_1 = require("../logger");
 function OxyServicesPrivacyMixin(Base) {
     return class extends Base {
         constructor(...args) {
@@ -29,9 +29,7 @@ function OxyServicesPrivacyMixin(Base) {
             }
             catch (error) {
                 // If there's an error, assume not in list to avoid breaking functionality
-                if ((0, debugUtils_1.isDev)()) {
-                    console.warn('Error checking user list:', error);
-                }
+                logger_1.logger.warn('Error checking user list', { component: 'OxyServices.privacy' }, error);
                 return false;
             }
         }

package/dist/cjs/mixins/OxyServices.security.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OxyServicesSecurityMixin = OxyServicesSecurityMixin;
-const debugUtils_1 = require("../shared/utils/debugUtils");
+const logger_1 = require("../logger");
 function OxyServicesSecurityMixin(Base) {
     return class extends Base {
         constructor(...args) {
@@ -65,11 +65,9 @@ function OxyServicesSecurityMixin(Base) {
                 await this.makeRequest('POST', '/security/activity/private-key-exported', { deviceId }, { cache: false });
             }
             catch (error) {
-                // Don't throw - logging failures shouldn't break user flow
-                // But log for monitoring
-                if ((0, debugUtils_1.isDev)()) {
-                    console.warn('[OxyServices] Failed to log private key exported event:', error);
-                }
+                // Don't throw - logging failures shouldn't break user flow, but surface
+                // for monitoring via the shared logger sink.
+                logger_1.logger.warn('[OxyServices] Failed to log private key exported event', { component: 'OxyServices.security' }, error);
             }
         }
         /**
@@ -82,11 +80,9 @@ function OxyServicesSecurityMixin(Base) {
                 await this.makeRequest('POST', '/security/activity/backup-created', { deviceId }, { cache: false });
             }
             catch (error) {
-                // Don't throw - logging failures shouldn't break user flow
-                // But log for monitoring
-                if ((0, debugUtils_1.isDev)()) {
-                    console.warn('[OxyServices] Failed to log backup created event:', error);
-                }
+                // Don't throw - logging failures shouldn't break user flow, but surface
+                // for monitoring via the shared logger sink.
+                logger_1.logger.warn('[OxyServices] Failed to log backup created event', { component: 'OxyServices.security' }, error);
             }
         }
     };

package/dist/cjs/mixins/OxyServices.topics.js

@@ -17,10 +17,10 @@ function OxyServicesTopicsMixin(Base) {
                 const params = {};
                 if (locale)
                     params.locale = locale;
-                return await this.makeRequest('GET', '/topics/categories', params, {
-                    cache: true,
-                    cacheTTL: mixinHelpers_1.CACHE_TIMES.EXTRA_LONG,
-                });
+                // `GET /topics/categories` returns `{ categories: TopicData[] }` — the
+                // SDK's `unwrapResponse` only unwraps `{ data }`, so unwrap here.
+                const response = await this.makeRequest('GET', '/topics/categories', params, { cache: true, cacheTTL: mixinHelpers_1.CACHE_TIMES.EXTRA_LONG });
+                return response.categories ?? [];
             }
             catch (error) {
                 throw this.handleError(error);
@@ -37,9 +37,9 @@ function OxyServicesTopicsMixin(Base) {
                 const params = { q: query };
                 if (limit)
                     params.limit = limit;
-                return await this.makeRequest('GET', '/topics/search', params, {
-                    cache: false,
-                });
+                // `GET /topics/search` returns `{ topics: TopicData[] }` — unwrap it.
+                const response = await this.makeRequest('GET', '/topics/search', params, { cache: false });
+                return response.topics ?? [];
             }
             catch (error) {
                 throw this.handleError(error);
@@ -48,7 +48,7 @@ function OxyServicesTopicsMixin(Base) {
         /**
          * List topics with optional filters
          * @param options - Filter and pagination options
-         * @returns List of topics
+         * @returns Paginated topics envelope (`topics` plus `total`/`limit`/`offset`)
          */
         async listTopics(options) {
             try {
@@ -63,10 +63,18 @@ function OxyServicesTopicsMixin(Base) {
                     params.offset = options.offset;
                 if (options?.locale)
                     params.locale = options.locale;
-                return await this.makeRequest('GET', '/topics', params, {
-                    cache: true,
-                    cacheTTL: mixinHelpers_1.CACHE_TIMES.SHORT,
-                });
+                // `GET /topics` returns `{ topics, total, limit, offset }`. The pagination
+                // fields matter to callers, so return the whole envelope (typed) rather
+                // than throwing them away.
+                const response = await this.makeRequest('GET', '/topics', params, { cache: true, cacheTTL: mixinHelpers_1.CACHE_TIMES.SHORT });
+                const requestedLimit = typeof params.limit === 'number' ? params.limit : 0;
+                const requestedOffset = typeof params.offset === 'number' ? params.offset : 0;
+                return {
+                    topics: response.topics ?? [],
+                    total: response.total ?? response.topics?.length ?? 0,
+                    limit: response.limit ?? requestedLimit,
+                    offset: response.offset ?? requestedOffset,
+                };
             }
             catch (error) {
                 throw this.handleError(error);
@@ -95,9 +103,11 @@ function OxyServicesTopicsMixin(Base) {
          */
         async resolveTopicNames(names) {
             try {
-                return await this.makeRequest('POST', '/topics/resolve', { names }, {
-                    cache: false,
-                });
+                // `POST /topics/resolve` returns `{ topics: Record<name, TopicData> }`
+                // (a name-keyed map, not an array). Unwrap and flatten to the resolved
+                // topics; each TopicData carries its own `name` for re-keying.
+                const response = await this.makeRequest('POST', '/topics/resolve', { names }, { cache: false });
+                return Object.values(response.topics ?? {});
             }
             catch (error) {
                 throw this.handleError(error);

package/dist/cjs/mixins/OxyServices.user.js

@@ -6,7 +6,7 @@ const apiUtils_1 = require("../utils/apiUtils");
 const keyManager_1 = require("../crypto/keyManager");
 const signatureService_1 = require("../crypto/signatureService");
 const userIdentity_1 = require("../utils/userIdentity");
-const loggerUtils_1 = require("../utils/loggerUtils");
+const logger_1 = require("../logger");
 const errorUtils_1 = require("../utils/errorUtils");
 /**
  * Maximum number of ids sent per `POST /users/by-ids` request. Matches the
@@ -113,7 +113,7 @@ function OxyServicesUserMixin(Base) {
                 // noise. Return contract is unchanged.
                 const status = (0, errorUtils_1.extractErrorStatus)(error);
                 const isNotFound = status === 404;
-                loggerUtils_1.logger.debug(isNotFound ? 'resolveProfile: handle not found' : 'resolveProfile: discovery failed', {
+                logger_1.logger.debug(isNotFound ? 'resolveProfile: handle not found' : 'resolveProfile: discovery failed', {
                     method: 'resolveProfile',
                     handle,
                     status,
@@ -194,7 +194,7 @@ function OxyServicesUserMixin(Base) {
                 // caller (contract unchanged: rethrow via `handleError`). Add debug
                 // observability first so a recurring upstream failure is diagnosable
                 // — distinguishing an auth/transport problem from a server 5xx.
-                loggerUtils_1.logger.debug('getProfileRecommendations: discovery read failed', {
+                logger_1.logger.debug('getProfileRecommendations: discovery read failed', {
                     method: 'getProfileRecommendations',
                     path: usesScoredPath ? 'POST' : 'GET',
                     excludeTypes: options?.excludeTypes,
@@ -308,7 +308,7 @@ function OxyServicesUserMixin(Base) {
                     return Array.isArray(users) ? users.map((user) => (0, userIdentity_1.normalizeUserIdentity)(user)) : [];
                 }
                 catch (error) {
-                    loggerUtils_1.logger.warn('getUsersByIds: chunk failed, continuing with remaining chunks', {
+                    logger_1.logger.warn('getUsersByIds: chunk failed, continuing with remaining chunks', {
                         method: 'getUsersByIds',
                         mode: useServiceAuth ? 'service' : 'user',
                         chunkSize: chunk.length,