@oxyhq/core 12.4.0 → 12.5.0

package/dist/types/mixins/OxyServices.user.d.ts

@@ -2,7 +2,7 @@
  * User Management Methods Mixin
  */
 import type { User, Notification, NotificationPreferences, UserPreferences, SearchProfilesResponse, PrivacySettings } from '../models/interfaces';
-import type { UserNameResponse, UserProfileUpdate, RecommendationRequest, RecommendationItem } from '@oxyhq/contracts';
+import type { UserNameResponse, UserProfileUpdate, RecommendationRequest, RecommendationItem, ThemePreference } from '@oxyhq/contracts';
 import type { OxyServicesBase } from '../OxyServices.base';
 import { type PaginationParams } from '../utils/apiUtils';
 /**
@@ -292,6 +292,15 @@ export declare function OxyServicesUserMixin<T extends typeof OxyServicesBase>(B
          * `PUT /users/me` — same cache-invalidation behaviour as `updateProfile`.
          */
         updateUserPreferences(preferences: Partial<UserPreferences>): Promise<User>;
+        /**
+         * Update the authenticated user's portable theme preference (light/dark/
+         * system + Bloom color-preset key). Persisted on the User document via the
+         * SAME `PUT /users/me` settings path as the other preferences — same cache
+         * invalidation — so the next cold boot serves it on the self/session payload
+         * with no extra network call. The full object is written (both `mode` and
+         * `colorPreset` are required by the API).
+         */
+        updateThemePreference(themePreference: ThemePreference): Promise<User>;
         /**
          * Request account verification
          */

package/dist/types/models/interfaces.d.ts

@@ -1,4 +1,4 @@
-import type { OrganizationCategory, UserNameResponse } from '@oxyhq/contracts';
+import type { OrganizationCategory, UserNameResponse, UserRelationship, ThemePreference } from '@oxyhq/contracts';
 export interface OxyConfig {
     baseURL: string;
     cloudURL?: string;
@@ -147,6 +147,20 @@ export interface User {
     languages?: string[];
     notificationPreferences?: NotificationPreferences;
     userPreferences?: UserPreferences;
+    /**
+     * Portable theme preference (mode + Bloom color-preset key). Rides the
+     * self/session payload so it is present on the current-user DTO at cold boot
+     * (`useAuth().user.themePreference`) with no extra fetch. Absent until the
+     * user sets it. Updated via `updateThemePreference` / `updateProfile`.
+     */
+    themePreference?: ThemePreference;
+    /**
+     * The authenticated viewer's relationship to THIS profile. Populated ONLY on
+     * single-profile fetches (`getProfileByUsername` / `getUserById`) when the
+     * request is authenticated; absent for anonymous requests, self-views, and
+     * bulk fetches — so `undefined` means "unknown", not "not following".
+     */
+    relationship?: UserRelationship;
     [key: string]: unknown;
 }
 /**

package/dist/types/server/safeFetch.d.ts

@@ -91,6 +91,8 @@ export interface SafeFetchOptions {
     method?: string;
     /** Extra request headers. A `User-Agent` is added if none is provided. */
     headers?: Record<string, string>;
+    /** Request body for POST/PUT/PATCH. */
+    body?: string | Buffer;
     /**
      * Maximum number of redirects to follow (each re-validated). Defaults to
      * {@link MAX_REDIRECTS}. Set to `0` to disallow redirects.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "12.4.0",
+  "version": "12.5.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -111,7 +111,7 @@
   "dependencies": {
     "@noble/ciphers": "^1.3.0",
     "@noble/hashes": "^1.8.0",
-    "@oxyhq/contracts": "^0.16.0",
+    "@oxyhq/contracts": "^0.17.0",
     "@oxyhq/protocol": "^0.1.5",
     "bip39": "^3.1.0",
     "buffer": "^6.0.3",

package/src/mixins/OxyServices.user.ts

@@ -15,6 +15,7 @@ import type {
   UserProfileUpdate,
   RecommendationRequest,
   RecommendationItem,
+  ThemePreference,
 } from '@oxyhq/contracts';
 import { recommendationRequestSchema } from '@oxyhq/contracts';
 import type { OxyServicesBase } from '../OxyServices.base';
@@ -628,6 +629,20 @@ export function OxyServicesUserMixin<T extends typeof OxyServicesBase>(Base: T)
       return this.updateProfile({ userPreferences: preferences });
     }
 
+    /**
+     * Update the authenticated user's portable theme preference (light/dark/
+     * system + Bloom color-preset key). Persisted on the User document via the
+     * SAME `PUT /users/me` settings path as the other preferences — same cache
+     * invalidation — so the next cold boot serves it on the self/session payload
+     * with no extra network call. The full object is written (both `mode` and
+     * `colorPreset` are required by the API).
+     */
+    async updateThemePreference(
+      themePreference: ThemePreference
+    ): Promise<User> {
+      return this.updateProfile({ themePreference });
+    }
+
     /**
      * Request account verification
      */

package/src/models/interfaces.ts

@@ -1,4 +1,9 @@
-import type { OrganizationCategory, UserNameResponse } from '@oxyhq/contracts';
+import type {
+  OrganizationCategory,
+  UserNameResponse,
+  UserRelationship,
+  ThemePreference,
+} from '@oxyhq/contracts';
 
 export interface OxyConfig {
   baseURL: string;
@@ -163,6 +168,20 @@ export interface User {
   notificationPreferences?: NotificationPreferences;
   // General app-wide user preferences. Updated via `PUT /users/me`.
   userPreferences?: UserPreferences;
+  /**
+   * Portable theme preference (mode + Bloom color-preset key). Rides the
+   * self/session payload so it is present on the current-user DTO at cold boot
+   * (`useAuth().user.themePreference`) with no extra fetch. Absent until the
+   * user sets it. Updated via `updateThemePreference` / `updateProfile`.
+   */
+  themePreference?: ThemePreference;
+  /**
+   * The authenticated viewer's relationship to THIS profile. Populated ONLY on
+   * single-profile fetches (`getProfileByUsername` / `getUserById`) when the
+   * request is authenticated; absent for anonymous requests, self-views, and
+   * bulk fetches — so `undefined` means "unknown", not "not following".
+   */
+  relationship?: UserRelationship;
   [key: string]: unknown;
 }
 

package/src/server/safeFetch.ts

@@ -390,6 +390,8 @@ export interface SafeFetchOptions {
   method?: string;
   /** Extra request headers. A `User-Agent` is added if none is provided. */
   headers?: Record<string, string>;
+  /** Request body for POST/PUT/PATCH. */
+  body?: string | Buffer;
   /**
    * Maximum number of redirects to follow (each re-validated). Defaults to
    * {@link MAX_REDIRECTS}. Set to `0` to disallow redirects.
@@ -475,6 +477,7 @@ function fetchOnce(
   options: https.RequestOptions,
   isHttps: boolean,
   headersTimeoutMs: number,
+  body?: string | Buffer,
 ): Promise<IncomingMessage> {
   return new Promise<IncomingMessage>((resolve, reject) => {
     const transport = isHttps ? https : http;
@@ -484,7 +487,7 @@ function fetchOnce(
       req.destroy(new UpstreamError('upstream headers timeout'));
     });
     req.on('error', (err) => reject(err));
-    req.end();
+    req.end(body);
   });
 }
 
@@ -506,6 +509,7 @@ export async function safeFetch(
   const {
     method = 'GET',
     headers: callerHeaders,
+    body,
     maxRedirects = MAX_REDIRECTS,
     headersTimeoutMs = UPSTREAM_HEADERS_TIMEOUT_MS,
     signal,
@@ -548,6 +552,7 @@ export async function safeFetch(
       requestOptions,
       target.protocol === 'https:',
       headersTimeoutMs,
+      body,
     );
 
     const status = response.statusCode ?? 0;

package/src/session/__tests__/refresh.test.ts

@@ -159,6 +159,26 @@ describe('refreshPersistedSession — arm 1 (device-secret mint)', () => {
     expect(await store.load()).toEqual(STORED);
     expect(signInWithSharedIdentity).not.toHaveBeenCalled();
   });
+
+  it('KEEPS the store on an UNRECOGNIZED 401 (proxy / middleware / deploy-window) — never wipes the credential on an ambiguous 401', async () => {
+    const store = createMemoryAuthStateStore();
+    await store.save(STORED);
+    const signInWithSharedIdentity = jest.fn(async () => null);
+    const { oxy } = makeOxy({
+      mintFromDeviceSecret: async () => {
+        // A 401 whose body is NEITHER `invalid_device_secret` NOR `no_active_session`
+        // — an auth-layer / proxy / starting-instance 401 common during a deploy
+        // window. It is NOT proof the secret diverged, so the durable device
+        // credential must survive (treated as transient) and a later attempt self-heals.
+        throw Object.assign(new Error('Unauthorized'), { status: 401 });
+      },
+      signInWithSharedIdentity,
+    });
+
+    expect(await refreshPersistedSession({ oxy, store, allowSharedKeyFallback: true })).toBeNull();
+    expect(await store.load()).toEqual(STORED);
+    expect(signInWithSharedIdentity).not.toHaveBeenCalled();
+  });
 });
 
 describe('refreshPersistedSession — arm 2 (native shared-key fallback)', () => {

package/src/session/refresh.ts

@@ -136,9 +136,18 @@ export async function refreshDeviceSecretArm(deps: {
         // Structural read (not `instanceof Error`): the thrown value can be a
         // plain ApiError-shaped object or come from another realm.
         const message = (error as { message?: unknown })?.message;
-        return typeof message === 'string' && message.includes('no_active_session')
-          ? { status: 'no-session' }
-          : { status: 'invalid-secret' };
+        const body = typeof message === 'string' ? message : '';
+        // ONLY the server's explicit `invalid_device_secret` proves the presented
+        // secret is bad and may clear the durable device credential. `no_active_session`
+        // is an authoritative signed-out. ANY OTHER 401 — a middleware/CSRF/proxy 401,
+        // an ALB/starting-instance 401, a CORS error page, etc., all common during a
+        // deploy/restart window — is NOT proof the secret diverged: treat it as
+        // transient and KEEP the credential so a later attempt self-heals. Wiping the
+        // credential on an ambiguous 401 is what logged users out on every deploy,
+        // ecosystem-wide.
+        if (body.includes('invalid_device_secret')) return { status: 'invalid-secret' };
+        if (body.includes('no_active_session')) return { status: 'no-session' };
+        return { status: 'transient' };
       }
       return { status: 'transient' };
     }