@oxyhq/core 12.5.4 → 12.6.0

package/dist/types/OxyServices.d.ts

@@ -57,7 +57,7 @@
  * See method JSDoc for more details and options.
  */
 import { type LinkedHttpClient, type OxyConfig } from './OxyServices.base';
-import { OxyAuthenticationError, OxyAuthenticationTimeoutError } from './OxyServices.errors';
+import { AssetUrlResolutionError, OxyAuthenticationError, OxyAuthenticationTimeoutError } from './OxyServices.errors';
 import { composeOxyServices } from './mixins';
 /**
  * OxyServices - Unified client library for interacting with the Oxy API
@@ -121,7 +121,7 @@ export interface OxyServices extends InstanceType<ReturnType<typeof composeOxySe
     requireScope(scope: string): (req: unknown, res: unknown, next: (err?: unknown) => void) => void;
     assetUpdateVisibility(fileId: string, visibility: 'private' | 'public' | 'unlisted'): Promise<unknown>;
 }
-export { OxyAuthenticationError, OxyAuthenticationTimeoutError };
+export { AssetUrlResolutionError, OxyAuthenticationError, OxyAuthenticationTimeoutError };
 /**
  * Default Oxy Cloud URL — used when no `cloudURL` is provided to OxyServices.
  */

package/dist/types/OxyServices.errors.d.ts

@@ -6,6 +6,46 @@ export declare class OxyAuthenticationError extends Error {
     readonly status: number;
     constructor(message: string, code?: string, status?: number);
 }
+/**
+ * Thrown when an asset's authorized download URL cannot be resolved.
+ *
+ * `getFileDownloadUrlAsync` asks the API for a URL that is valid for the
+ * CALLER and the asset's actual visibility. When that resolution fails there is
+ * no honest fallback: the public CDN origin only serves `public` assets, so
+ * handing back `https://cloud.oxy.so/<id>` for an unresolved asset produces a
+ * hard 404 at render time and hides the real failure from the caller. This
+ * error surfaces the failure instead.
+ *
+ * The message and fields deliberately carry only the asset id, the requested
+ * variant and the HTTP status — never the resolved URL, which embeds a scoped
+ * media token.
+ *
+ * ## `status` lets a caller decide whether a CDN fallback is safe
+ *
+ * Core itself never falls back to the public CDN builder, because it has no
+ * knowledge of the asset's visibility and that URL is a guaranteed 404 for a
+ * private asset. A CALLER that knows an asset is public MAY choose to fall back
+ * to `getFileDownloadUrl(id, variant)` — but only for a TRANSIENT failure, not
+ * a definitive denial:
+ *   - `status` 401/403/404 → definitive: the asset is private/denied/missing.
+ *     Never CDN-fall-back — it will 404.
+ *   - `status` undefined (network error) or 5xx → transient: resolution itself
+ *     failed. If the caller independently knows the asset is public, a CDN
+ *     fallback is defensible best-effort.
+ */
+export declare class AssetUrlResolutionError extends Error {
+    readonly code = "ASSET_URL_UNRESOLVED";
+    readonly fileId: string;
+    readonly variant?: string;
+    readonly status?: number;
+    /**
+     * The underlying transport/API failure, when there was one. Declared on the
+     * class rather than relying on `Error.cause` because this package targets
+     * ES2020, where `cause` is not part of the `Error` type.
+     */
+    readonly cause?: unknown;
+    constructor(fileId: string, variant: string | undefined, status: number | undefined, cause?: unknown);
+}
 export declare class OxyAuthenticationTimeoutError extends OxyAuthenticationError {
     constructor(operationName: string, timeoutMs: number);
 }

package/dist/types/index.d.ts

@@ -17,7 +17,7 @@
  * If a symbol does not appear here, it is NOT part of the public API.
  */
 import './crypto/polyfill';
-export { OxyServices, OxyAuthenticationError, OxyAuthenticationTimeoutError } from './OxyServices';
+export { OxyServices, AssetUrlResolutionError, OxyAuthenticationError, OxyAuthenticationTimeoutError } from './OxyServices';
 export { OXY_CLOUD_URL, oxyClient } from './OxyServices';
 export type { LinkedHttpClient } from './OxyServices.base';
 export type { AuthRefreshReason, AuthRefreshHandler } from './HttpService';
@@ -58,7 +58,7 @@ export type { AeadResult } from './crypto/aead';
 export { deriveSharedSecret } from './crypto/ecdh';
 export { DeviceManager } from './utils/deviceManager';
 export type { DeviceFingerprint, StoredDeviceInfo } from './utils/deviceManager';
-export type { OxyConfig, PrivacySettings, NotificationPreferences, UserPreferences, User, LoginResponse, Notification, Wallet, Transaction, BlockedUser, RestrictedUser, TransferFundsRequest, PurchaseRequest, WithdrawalRequest, TransactionResponse, PaginationInfo, SearchProfilesResponse, ApiError, PaymentMethod, PaymentRequest, PaymentResponse, AnalyticsData, FollowerDetails, ContentViewer, FileMetadata, FileUploadResponse, FileListResponse, FileUpdateRequest, FileDeleteResponse, RNFileDescriptor, AssetUploadInput, FileVisibility, AssetLink, AssetMetadata, AssetVariant, Asset, AssetInitRequest, AssetInitResponse, AssetCompleteRequest, AssetLinkRequest, AssetUnlinkRequest, AssetUrlResponse, AssetDeleteSummary, AssetUpdateVisibilityRequest, AssetUpdateVisibilityResponse, ServiceAssetMetadata, ServiceAssetMetadataBySha, AccountStorageCategoryUsage, AccountStorageUsageResponse, SecurityEventType, SecurityEventSeverity, SecurityActivity, SecurityActivityResponse, AssetUploadProgress, DeviceLinkedSession, DeviceLinkedSessionsResponse, DeviceLinkedSessionLogoutResponse, UpdateDeviceNameResponse, } from './models/interfaces';
+export type { OxyConfig, PrivacySettings, NotificationPreferences, UserPreferences, User, LoginResponse, Notification, Wallet, Transaction, BlockedUser, RestrictedUser, TransferFundsRequest, PurchaseRequest, WithdrawalRequest, TransactionResponse, PaginationInfo, SearchProfilesResponse, ApiError, PaymentMethod, PaymentRequest, PaymentResponse, AnalyticsData, FollowerDetails, ContentViewer, FileMetadata, FileUploadResponse, FileListResponse, FileUpdateRequest, FileDeleteResponse, RNFileDescriptor, AssetUploadInput, FileVisibility, AssetLink, AssetMetadata, AssetVariant, Asset, AssetInitRequest, AssetInitResponse, AssetCompleteRequest, AssetLinkRequest, AssetUnlinkRequest, AssetUrlResponse, BatchFileAccessEntry, BatchFileAccessResponse, AssetDeleteSummary, AssetUpdateVisibilityRequest, AssetUpdateVisibilityResponse, ServiceAssetMetadata, ServiceAssetMetadataBySha, AccountStorageCategoryUsage, AccountStorageUsageResponse, SecurityEventType, SecurityEventSeverity, SecurityActivity, SecurityActivityResponse, AssetUploadProgress, DeviceLinkedSession, DeviceLinkedSessionsResponse, DeviceLinkedSessionLogoutResponse, UpdateDeviceNameResponse, } from './models/interfaces';
 export { SECURITY_EVENT_SEVERITY_MAP } from './models/interfaces';
 export { TopicType, TopicSource } from './models/Topic';
 export type { TopicData, TopicTranslation, TopicListResult } from './models/Topic';

package/dist/types/mixins/OxyServices.assets.d.ts

@@ -1,4 +1,4 @@
-import type { AccountStorageUsageResponse, AssetUploadInput, AssetUrlResponse, AssetVariant, ServiceAssetMetadata, ServiceAssetMetadataBySha } from '../models/interfaces';
+import type { AccountStorageUsageResponse, AssetUploadInput, AssetUrlResponse, AssetVariant, BatchFileAccessResponse, ServiceAssetMetadata, ServiceAssetMetadataBySha } from '../models/interfaces';
 import type { OxyServicesBase } from '../OxyServices.base';
 export declare function OxyServicesAssetsMixin<T extends typeof OxyServicesBase>(Base: T): {
     new (...args: any[]): {
@@ -17,18 +17,57 @@ export declare function OxyServicesAssetsMixin<T extends typeof OxyServicesBase>
          */
         deleteFile(fileId: string): Promise<any>;
         /**
-         * Build a synchronous, `<img src>`-ready file URL from an Oxy asset id.
+         * Build a synchronous, `<img src>`-ready URL for a **PUBLIC** Oxy asset.
          *
-         * This method must never embed the caller's general access token in the
-         * returned URL. The URL is commonly rendered into DOM attributes, browser
-         * network panels, caches, and logs. Public asset URLs use the clean CDN
-         * origin; callers that need authorized/private access should use
-         * {@link getFileDownloadUrlAsync}, which asks the API for a scoped download
-         * URL instead of exposing the in-memory bearer token in a query string.
+         * ## Contract — read before calling
+         *
+         * This is a pure string builder. It performs no network call and therefore
+         * has **no knowledge of the asset's visibility**. It always produces the
+         * public form: `${cloudURL}/<id>[?variant=…]`, which the CDN serves from
+         * the public media origin only.
+         *
+         * Consequently:
+         *  - Call it ONLY when the asset is known to be `public` — e.g. avatars and
+         *    profile banners, which {@link uploadAvatar} / {@link uploadProfileBanner}
+         *    upload with `visibility: 'public'`.
+         *  - For an asset that may be `private` or `unlisted` — anything uploaded
+         *    through the generic {@link assetUpload} path, whose server-side default
+         *    is private — this URL resolves to a hard **404**. Use
+         *    {@link getFileDownloadUrlAsync}, which asks the API for a URL scoped to
+         *    the current caller.
+         *  - It must never guess visibility, and must never embed the caller's
+         *    bearer token: the returned string is rendered into DOM attributes,
+         *    browser network panels, HTTP caches, and logs.
+         *
+         * Passing `expiresIn` switches to the API-origin stream form
+         * (`${baseURL}/assets/<id>/stream?…`) WITHOUT any credential. That form
+         * still only serves what an unauthenticated request may see — it is not a
+         * synchronous private-asset path, and none exists: authorization for a
+         * private asset requires the round-trip in {@link getFileDownloadUrlAsync}.
          */
         getFileDownloadUrl(fileId: string, variant?: string, expiresIn?: number): string;
         /**
-         * Get file download URL asynchronously (returns signed URL directly from CDN)
+         * Resolve an asset id to a URL that is valid for the CURRENT caller,
+         * whatever the asset's visibility.
+         *
+         * Asks the API (`GET /assets/:id/url`) rather than guessing: a `public`
+         * asset resolves to the CDN form, while a `private`/`unlisted` asset the
+         * caller may read resolves to an API-origin stream URL carrying a scoped,
+         * short-lived media token. The returned URL is passed through **unchanged**
+         * — the SDK never rewrites, re-signs, or strips it.
+         *
+         * ## Failure behaviour — no CDN fallback
+         *
+         * Throws {@link AssetUrlResolutionError} when the API returns no URL or the
+         * request fails (including 401/403/404). It deliberately does NOT fall back
+         * to {@link getFileDownloadUrl}: that builder only produces the public CDN
+         * form, so falling back would hand the caller a URL that renders as a hard
+         * 404 for every private asset and would silently swallow the real failure.
+         * A caller that knows an asset is public should call the synchronous
+         * builder directly instead of relying on a fallback here.
+         *
+         * The resolved URL is cached per identity for well under the media token's
+         * lifetime — see {@link getAssetUrlCacheTTL}.
          */
         getFileDownloadUrlAsync(fileId: string, variant?: string, expiresIn?: number): Promise<string>;
         /**
@@ -52,13 +91,53 @@ export declare function OxyServicesAssetsMixin<T extends typeof OxyServicesBase>
          */
         getFileContentAsBlob(fileId: string, variant?: string): Promise<Blob>;
         /**
-         * Get batch access to multiple files
+         * Resolve access + a caller-scoped URL for many assets — each with its OWN
+         * requested variant — in ONE round trip via `POST /assets/batch-access`.
+         *
+         * `requests` is a per-file `{ fileId, variant? }` list (a `variant` of
+         * `undefined` asks for the original). `options.expiresIn` sets the requested
+         * media-token / signed-URL lifetime (seconds); `options.context` is the
+         * server-side access-check context. Entries with a blank `fileId` are
+         * dropped and exact `(fileId, variant)` duplicates are collapsed before the
+         * request; an empty effective list performs no network call.
+         *
+         * The server caps the batch at 100 entries — callers that page beyond that
+         * must chunk. Returns the raw per-file envelope (see
+         * {@link BatchFileAccessResponse}); most callers want {@link getFileDownloadUrls},
+         * which flattens it to just the usable URLs.
          */
-        getBatchFileAccess(fileIds: string[], context?: string): Promise<Record<string, any>>;
+        getBatchFileAccess(requests: Array<{
+            fileId: string;
+            variant?: string;
+        }>, options?: {
+            expiresIn?: number;
+            context?: string;
+        }): Promise<BatchFileAccessResponse>;
         /**
-         * Get download URLs for multiple files efficiently
+         * Resolve many assets — each with its OWN variant — to caller-scoped,
+         * `<img src>`-ready URLs in one round trip. The batch counterpart of
+         * {@link getFileDownloadUrlAsync}, built to resolve a whole grid page at once.
+         *
+         * `requests` is a per-file `{ fileId, variant? }` list (e.g. `poster` for a
+         * video, `thumb` for an image); the per-file variant RULE lives in the
+         * caller — core just forwards what it is given. `options.expiresIn` /
+         * `options.context` are passed through to the endpoint.
+         *
+         * Each returned URL is the API's own scoped form, passed through unchanged:
+         * the public CDN URL for a public asset, or an API-origin
+         * `/assets/:id/stream?…&mt=<media token>` URL for a private asset the caller
+         * may read. Ids the caller cannot access (or that do not exist) are simply
+         * OMITTED from the returned map — there is NO public-CDN fallback, so a grid
+         * never renders a known-404 URL. Callers detect a miss by the absent key
+         * (the map never contains an empty-string value). Keyed by `fileId`.
          */
-        getFileDownloadUrls(fileIds: string[], context?: string): Promise<Record<string, string>>;
+        getFileDownloadUrls(requests: Array<{
+            fileId: string;
+            variant?: string;
+        }>, options?: {
+            expiresIn?: number;
+            context?: string;
+        }): Promise<Record<string, string>>;
         /**
          * Resolve many Oxy asset ids to their content-addressed metadata in one
          * round-trip per chunk via `POST /assets/service/by-ids` (body `{ ids }`).
@@ -170,6 +249,17 @@ export declare function OxyServicesAssetsMixin<T extends typeof OxyServicesBase>
         assetUpdateVisibility(fileId: string, visibility: "private" | "public" | "unlisted"): Promise<any>;
         uploadAvatar(file: AssetUploadInput, userId: string, app?: string): Promise<any>;
         uploadProfileBanner(file: AssetUploadInput, userId: string, app?: string): Promise<any>;
+        /**
+         * How long a resolved asset URL may stay in the SDK's GET cache, in ms.
+         *
+         * A resolved private-asset URL dies the instant its scoped media token
+         * expires (~{@link ASSET_MEDIA_TOKEN_TTL_MS}). Caching it for its full
+         * nominal lifetime would leave a window where the cache serves an
+         * already-dead URL (clock skew, render-pipeline latency, an image request
+         * queued behind others). So the TTL is (a) never longer than the token's
+         * lifetime and (b) discounted to {@link ASSET_URL_CACHE_LIFETIME_FRACTION}
+         * of that bound — comfortably below the token TTL by construction.
+         */
         getAssetUrlCacheTTL(expiresIn?: number): number;
         fetchAssetDownloadUrl(fileId: string, variant?: string, cacheTTL?: number, expiresIn?: number): Promise<string | null>;
         fetchAssetContent(url: string, type: "text"): Promise<string>;

package/dist/types/models/interfaces.d.ts

@@ -448,6 +448,24 @@ export interface AssetUrlResponse {
     variant?: string;
     expiresIn: number;
 }
+/**
+ * Per-file result of `POST /assets/batch-access`. `allowed` is authoritative:
+ * when `false` the entry carries an `error` string (e.g. `'Access denied'`,
+ * `'File not found'`) and no `url`. When `true`, `url` is a caller-scoped,
+ * `<img src>`-ready URL — the public CDN form for a public asset or an
+ * API-origin stream URL carrying a short-lived media token for a private one.
+ */
+export interface BatchFileAccessEntry {
+    allowed: boolean;
+    url?: string;
+    visibility?: FileVisibility;
+    mime?: string;
+    error?: string;
+}
+/** Envelope returned by `POST /assets/batch-access`, keyed by file id. */
+export interface BatchFileAccessResponse {
+    results: Record<string, BatchFileAccessEntry>;
+}
 export interface AssetDeleteSummary {
     fileId: string;
     wouldDelete: boolean;

package/dist/types/session/SessionClient.d.ts

@@ -93,8 +93,25 @@ export declare class SessionClient {
     onServerEvent(event: string, listener: (payload: unknown) => void): () => void;
     private bindServerEvent;
     protected notify(): void;
-    /** Validate + last-writer-wins by revision. Returns true if applied. */
-    protected applyState(raw: unknown, origin?: SessionStateOrigin): boolean;
+    /**
+     * Validate + last-writer-wins by revision. Returns true if applied.
+     *
+     * `activeToken` (sync path only) is the server-issued access token for
+     * `raw.activeAccountId`. When present and the state is applied, it is planted
+     * BEFORE any subscriber is notified so the bearer already belongs to the new
+     * active account — the local switch/bootstrap path then needs no redundant
+     * device-secret mint. Push-origin applies carry no token and rely on the
+     * mint-before-notify gate below.
+     *
+     * ORDERING INVARIANT: a subscriber must NEVER observe a newly-active account
+     * while the planted bearer still identifies the PREVIOUS one — otherwise a
+     * `useCurrentUser`-style refetch fires under the wrong account's token (the
+     * account-switch 404 race). So when a transport is available and the planted
+     * bearer does not already belong to `next.activeAccountId`, minting is awaited
+     * BEFORE `notify()`. This covers EVERY notify source (a switch push, a
+     * cross-device push, a cold mint), not just the initial "no bearer yet" case.
+     */
+    protected applyState(raw: unknown, origin?: SessionStateOrigin, activeToken?: string): boolean;
     /**
      * Validate `{ state, activeToken }`, apply the state, and plant the active token host-side.
      * Token-planting is decoupled from whether `applyState` advanced the revision: a socket push

package/dist/types/utils/redactUrl.d.ts

@@ -0,0 +1,17 @@
+/**
+ * URL redaction for logging.
+ *
+ * Asset URLs the API hands back for private assets carry a scoped, short-lived
+ * media token (`mt=…`) in their query string. That token is a bearer credential
+ * for the underlying object, so it must never land in a log line, breadcrumb,
+ * or metric — a captured log would otherwise grant read access until the token
+ * expires. Query strings on API URLs can also carry other sensitive params, so
+ * we redact the whole query rather than allow-listing one key.
+ *
+ * `redactUrlQuery` returns the URL's path portion with a `?<redacted>` marker
+ * when a query string is present, and the input unchanged otherwise. It is
+ * defensive: any input that does not parse as a URL is passed through as-is,
+ * except that a bare `?query` tail is still stripped so a relative path with a
+ * query never leaks.
+ */
+export declare function redactUrlQuery(url: string): string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "12.5.4",
+  "version": "12.6.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/HttpService.ts

@@ -21,6 +21,7 @@ import { jwtDecode } from 'jwt-decode';
 import { isNative, getPlatformOS } from './utils/platform';
 import { isReactNative } from '@oxyhq/protocol';
 import { computeIdentityTag, fnv1a32 } from './utils/cacheKey';
+import { redactUrlQuery } from './utils/redactUrl';
 import type { OxyConfig } from './models/interfaces';
 import type { DeviceSecretMintOutcome } from './session/refresh';
 
@@ -405,7 +406,9 @@ export class HttpService {
       const cached = this.cache.get(cacheKey) as T | null;
       if (cached !== null) {
         this.requestMetrics.cacheHits++;
-        this.logger.debug('Cache hit:', url);
+        // Redact the query string: an asset stream URL passed here carries a
+        // scoped `mt=` media token that must never reach a log sink.
+        this.logger.debug('Cache hit:', redactUrlQuery(url));
         return cached;
       }
       this.requestMetrics.cacheMisses++;

package/src/OxyServices.errors.ts

@@ -13,6 +13,57 @@ export class OxyAuthenticationError extends Error {
   }
 }
 
+/**
+ * Thrown when an asset's authorized download URL cannot be resolved.
+ *
+ * `getFileDownloadUrlAsync` asks the API for a URL that is valid for the
+ * CALLER and the asset's actual visibility. When that resolution fails there is
+ * no honest fallback: the public CDN origin only serves `public` assets, so
+ * handing back `https://cloud.oxy.so/<id>` for an unresolved asset produces a
+ * hard 404 at render time and hides the real failure from the caller. This
+ * error surfaces the failure instead.
+ *
+ * The message and fields deliberately carry only the asset id, the requested
+ * variant and the HTTP status — never the resolved URL, which embeds a scoped
+ * media token.
+ *
+ * ## `status` lets a caller decide whether a CDN fallback is safe
+ *
+ * Core itself never falls back to the public CDN builder, because it has no
+ * knowledge of the asset's visibility and that URL is a guaranteed 404 for a
+ * private asset. A CALLER that knows an asset is public MAY choose to fall back
+ * to `getFileDownloadUrl(id, variant)` — but only for a TRANSIENT failure, not
+ * a definitive denial:
+ *   - `status` 401/403/404 → definitive: the asset is private/denied/missing.
+ *     Never CDN-fall-back — it will 404.
+ *   - `status` undefined (network error) or 5xx → transient: resolution itself
+ *     failed. If the caller independently knows the asset is public, a CDN
+ *     fallback is defensible best-effort.
+ */
+export class AssetUrlResolutionError extends Error {
+  public readonly code = 'ASSET_URL_UNRESOLVED';
+  public readonly fileId: string;
+  public readonly variant?: string;
+  public readonly status?: number;
+  /**
+   * The underlying transport/API failure, when there was one. Declared on the
+   * class rather than relying on `Error.cause` because this package targets
+   * ES2020, where `cause` is not part of the `Error` type.
+   */
+  public readonly cause?: unknown;
+
+  constructor(fileId: string, variant: string | undefined, status: number | undefined, cause?: unknown) {
+    const variantSuffix = variant ? ` (variant "${variant}")` : '';
+    const statusSuffix = typeof status === 'number' ? ` — status ${status}` : '';
+    super(`Could not resolve a download URL for asset "${fileId}"${variantSuffix}${statusSuffix}`);
+    this.name = 'AssetUrlResolutionError';
+    this.fileId = fileId;
+    this.variant = variant;
+    this.status = status;
+    this.cause = cause;
+  }
+}
+
 export class OxyAuthenticationTimeoutError extends OxyAuthenticationError {
   constructor(operationName: string, timeoutMs: number) {
     super(

package/src/OxyServices.ts

@@ -57,7 +57,7 @@
  * See method JSDoc for more details and options.
  */
 import { OxyServicesBase, type LinkedHttpClient, type OxyConfig } from './OxyServices.base';
-import { OxyAuthenticationError, OxyAuthenticationTimeoutError } from './OxyServices.errors';
+import { AssetUrlResolutionError, OxyAuthenticationError, OxyAuthenticationTimeoutError } from './OxyServices.errors';
 
 // Import mixin composition helper
 import { composeOxyServices } from './mixins';
@@ -151,7 +151,7 @@ export interface OxyServices extends InstanceType<ReturnType<typeof composeOxySe
 }
 
 // Re-export error classes for convenience
-export { OxyAuthenticationError, OxyAuthenticationTimeoutError };
+export { AssetUrlResolutionError, OxyAuthenticationError, OxyAuthenticationTimeoutError };
 
 /**
  * Default Oxy Cloud URL — used when no `cloudURL` is provided to OxyServices.

package/src/index.ts

@@ -23,7 +23,7 @@ import './crypto/polyfill';
 // ---------------------------------------------------------------------------
 // API client
 // ---------------------------------------------------------------------------
-export { OxyServices, OxyAuthenticationError, OxyAuthenticationTimeoutError } from './OxyServices';
+export { OxyServices, AssetUrlResolutionError, OxyAuthenticationError, OxyAuthenticationTimeoutError } from './OxyServices';
 export { OXY_CLOUD_URL, oxyClient } from './OxyServices';
 export type { LinkedHttpClient } from './OxyServices.base';
 // Auth-refresh handler surface — consumed by `@oxyhq/services`'s OxyContext to
@@ -311,6 +311,8 @@ export type {
     AssetLinkRequest,
     AssetUnlinkRequest,
     AssetUrlResponse,
+    BatchFileAccessEntry,
+    BatchFileAccessResponse,
     AssetDeleteSummary,
     AssetUpdateVisibilityRequest,
     AssetUpdateVisibilityResponse,