@oxyhq/core 17.1.0 → 19.0.0

package/dist/cjs/boot/sessionColdBoot.js

@@ -134,10 +134,9 @@ async function runSessionColdBoot(opts) {
     //    origin persisted a deviceId + deviceSecret, mint a short access token with
     //    a single bearer-less POST (no cookie, no navigation). The mint itself runs
     //    through `refreshDeviceSecretArm`, which acquires the client's PROCESS-WIDE
-    //    single-flight, persists the rotated `nextDeviceSecret` BEFORE planting the
-    //    token, and returns a classified outcome — so this step can never
-    //    double-rotate the server against the scheduler/transport/401 lanes, and
-    //    the durable store always converges on the true `current` secret.
+    //    single-flight, persists `nextDeviceSecret` BEFORE planting the token, and
+    //    returns a classified outcome — so concurrent mint lanes share one in-flight
+    //    request and the durable store always converges on the server's credential.
     steps.push({
         id: 'device-secret-mint',
         // Network step — skip entirely when the caller reports the device offline so
@@ -156,7 +155,7 @@ async function runSessionColdBoot(opts) {
             const result = await (0, refresh_1.refreshDeviceSecretArm)({ oxy, store, pin });
             switch (result.status) {
                 case 'ok':
-                    // The arm persisted the rotated secret and planted the token.
+                    // The arm persisted nextDeviceSecret and planted the token.
                     return {
                         kind: 'session',
                         session: {

package/dist/cjs/i18n/locales/en-US.json

@@ -1748,11 +1748,53 @@
                 "description": "A programmatic account with service credentials"
             }
         },
-        "organizationCategory": {
+        "accountCategory": {
+            "news": "News",
+            "politics": "Politics & policy",
+            "business": "Business",
+            "startup": "Startups & entrepreneurship",
+            "finance": "Finance & investing",
+            "crypto": "Crypto & web3",
+            "marketplace": "Marketplace & classifieds",
+            "retail": "Retail & ecommerce",
+            "real_estate": "Real estate",
             "agency": "Real estate agency",
+            "landlord": "Landlord & property management",
             "cooperative": "Housing cooperative",
-            "landlord": "Landlord / property manager",
-            "other": "Other organization"
+            "architecture": "Architecture & construction",
+            "technology": "Technology",
+            "software": "Software & development",
+            "ai": "AI & machine learning",
+            "security": "Security & privacy",
+            "automation": "Automation & tools",
+            "science": "Science & research",
+            "education": "Education & training",
+            "books": "Books & writing",
+            "health": "Health & medicine",
+            "fitness": "Fitness & wellbeing",
+            "sports": "Sports",
+            "gaming": "Gaming & esports",
+            "music": "Music",
+            "film": "Film & TV",
+            "podcast": "Podcasts & audio",
+            "art": "Art & design",
+            "photography": "Photography",
+            "comedy": "Comedy",
+            "food": "Food & drink",
+            "travel": "Travel & places",
+            "fashion": "Fashion & beauty",
+            "home_garden": "Home & garden",
+            "diy": "DIY & making",
+            "automotive": "Cars & motoring",
+            "animals": "Animals & pets",
+            "family": "Family & parenting",
+            "nonprofit": "Non-profit & charity",
+            "government": "Government & public sector",
+            "community": "Local community",
+            "activism": "Activism & advocacy",
+            "environment": "Environment & sustainability",
+            "religion": "Religion & spirituality",
+            "other": "Other"
         },
         "create": {
             "title": "Create account",
@@ -1772,8 +1814,9 @@
                 "invalidChars": "Only letters, numbers, hyphens, and underscores",
                 "checkFailed": "Could not check availability"
             },
-            "organizationCategory": {
-                "label": "Organization type"
+            "accountCategory": {
+                "label": "Categories",
+                "hint": "Pick up to {{max}}. The first one is your main category."
             },
             "toasts": {
                 "success": "Account created",

package/dist/cjs/i18n/locales/es-ES.json

@@ -1748,11 +1748,53 @@
                 "description": "Una cuenta programática con credenciales de servicio"
             }
         },
-        "organizationCategory": {
+        "accountCategory": {
+            "news": "Noticias",
+            "politics": "Política",
+            "business": "Negocios",
+            "startup": "Startups y emprendimiento",
+            "finance": "Finanzas e inversión",
+            "crypto": "Cripto y web3",
+            "marketplace": "Marketplace y anuncios",
+            "retail": "Comercio y ecommerce",
+            "real_estate": "Inmobiliaria",
             "agency": "Agencia inmobiliaria",
+            "landlord": "Casero y gestión de fincas",
             "cooperative": "Cooperativa de vivienda",
-            "landlord": "Propietario / administrador de fincas",
-            "other": "Otra organización"
+            "architecture": "Arquitectura y construcción",
+            "technology": "Tecnología",
+            "software": "Software y desarrollo",
+            "ai": "IA y aprendizaje automático",
+            "security": "Seguridad y privacidad",
+            "automation": "Automatización y herramientas",
+            "science": "Ciencia e investigación",
+            "education": "Educación y formación",
+            "books": "Libros y escritura",
+            "health": "Salud y medicina",
+            "fitness": "Deporte y bienestar",
+            "sports": "Deportes",
+            "gaming": "Videojuegos y esports",
+            "music": "Música",
+            "film": "Cine y TV",
+            "podcast": "Pódcast y audio",
+            "art": "Arte y diseño",
+            "photography": "Fotografía",
+            "comedy": "Comedia",
+            "food": "Comida y bebida",
+            "travel": "Viajes y lugares",
+            "fashion": "Moda y belleza",
+            "home_garden": "Hogar y jardín",
+            "diy": "Bricolaje y manualidades",
+            "automotive": "Coches y motor",
+            "animals": "Animales y mascotas",
+            "family": "Familia y crianza",
+            "nonprofit": "ONG y benéficas",
+            "government": "Gobierno y sector público",
+            "community": "Comunidad local",
+            "activism": "Activismo y defensa",
+            "environment": "Medio ambiente y sostenibilidad",
+            "religion": "Religión y espiritualidad",
+            "other": "Otra"
         },
         "create": {
             "title": "Crear cuenta",
@@ -1772,8 +1814,9 @@
                 "invalidChars": "Solo letras, números, guiones y guiones bajos",
                 "checkFailed": "No se pudo comprobar la disponibilidad"
             },
-            "organizationCategory": {
-                "label": "Tipo de organización"
+            "accountCategory": {
+                "label": "Categorías",
+                "hint": "Elige hasta {{max}}. La primera es tu categoría principal."
             },
             "toasts": {
                 "success": "Cuenta creada",

package/dist/cjs/i18n/locales/locales/en-US.json

@@ -1748,11 +1748,53 @@
         "description": "A programmatic account with service credentials"
       }
     },
-    "organizationCategory": {
+    "accountCategory": {
+      "news": "News",
+      "politics": "Politics & policy",
+      "business": "Business",
+      "startup": "Startups & entrepreneurship",
+      "finance": "Finance & investing",
+      "crypto": "Crypto & web3",
+      "marketplace": "Marketplace & classifieds",
+      "retail": "Retail & ecommerce",
+      "real_estate": "Real estate",
       "agency": "Real estate agency",
+      "landlord": "Landlord & property management",
       "cooperative": "Housing cooperative",
-      "landlord": "Landlord / property manager",
-      "other": "Other organization"
+      "architecture": "Architecture & construction",
+      "technology": "Technology",
+      "software": "Software & development",
+      "ai": "AI & machine learning",
+      "security": "Security & privacy",
+      "automation": "Automation & tools",
+      "science": "Science & research",
+      "education": "Education & training",
+      "books": "Books & writing",
+      "health": "Health & medicine",
+      "fitness": "Fitness & wellbeing",
+      "sports": "Sports",
+      "gaming": "Gaming & esports",
+      "music": "Music",
+      "film": "Film & TV",
+      "podcast": "Podcasts & audio",
+      "art": "Art & design",
+      "photography": "Photography",
+      "comedy": "Comedy",
+      "food": "Food & drink",
+      "travel": "Travel & places",
+      "fashion": "Fashion & beauty",
+      "home_garden": "Home & garden",
+      "diy": "DIY & making",
+      "automotive": "Cars & motoring",
+      "animals": "Animals & pets",
+      "family": "Family & parenting",
+      "nonprofit": "Non-profit & charity",
+      "government": "Government & public sector",
+      "community": "Local community",
+      "activism": "Activism & advocacy",
+      "environment": "Environment & sustainability",
+      "religion": "Religion & spirituality",
+      "other": "Other"
     },
     "create": {
       "title": "Create account",
@@ -1772,8 +1814,9 @@
         "invalidChars": "Only letters, numbers, hyphens, and underscores",
         "checkFailed": "Could not check availability"
       },
-      "organizationCategory": {
-        "label": "Organization type"
+      "accountCategory": {
+        "label": "Categories",
+        "hint": "Pick up to {{max}}. The first one is your main category."
       },
       "toasts": {
         "success": "Account created",

package/dist/cjs/i18n/locales/locales/es-ES.json

@@ -1748,11 +1748,53 @@
         "description": "Una cuenta programática con credenciales de servicio"
       }
     },
-    "organizationCategory": {
+    "accountCategory": {
+      "news": "Noticias",
+      "politics": "Política",
+      "business": "Negocios",
+      "startup": "Startups y emprendimiento",
+      "finance": "Finanzas e inversión",
+      "crypto": "Cripto y web3",
+      "marketplace": "Marketplace y anuncios",
+      "retail": "Comercio y ecommerce",
+      "real_estate": "Inmobiliaria",
       "agency": "Agencia inmobiliaria",
+      "landlord": "Casero y gestión de fincas",
       "cooperative": "Cooperativa de vivienda",
-      "landlord": "Propietario / administrador de fincas",
-      "other": "Otra organización"
+      "architecture": "Arquitectura y construcción",
+      "technology": "Tecnología",
+      "software": "Software y desarrollo",
+      "ai": "IA y aprendizaje automático",
+      "security": "Seguridad y privacidad",
+      "automation": "Automatización y herramientas",
+      "science": "Ciencia e investigación",
+      "education": "Educación y formación",
+      "books": "Libros y escritura",
+      "health": "Salud y medicina",
+      "fitness": "Deporte y bienestar",
+      "sports": "Deportes",
+      "gaming": "Videojuegos y esports",
+      "music": "Música",
+      "film": "Cine y TV",
+      "podcast": "Pódcast y audio",
+      "art": "Arte y diseño",
+      "photography": "Fotografía",
+      "comedy": "Comedia",
+      "food": "Comida y bebida",
+      "travel": "Viajes y lugares",
+      "fashion": "Moda y belleza",
+      "home_garden": "Hogar y jardín",
+      "diy": "Bricolaje y manualidades",
+      "automotive": "Coches y motor",
+      "animals": "Animales y mascotas",
+      "family": "Familia y crianza",
+      "nonprofit": "ONG y benéficas",
+      "government": "Gobierno y sector público",
+      "community": "Comunidad local",
+      "activism": "Activismo y defensa",
+      "environment": "Medio ambiente y sostenibilidad",
+      "religion": "Religión y espiritualidad",
+      "other": "Otra"
     },
     "create": {
       "title": "Crear cuenta",
@@ -1772,8 +1814,9 @@
         "invalidChars": "Solo letras, números, guiones y guiones bajos",
         "checkFailed": "No se pudo comprobar la disponibilidad"
       },
-      "organizationCategory": {
-        "label": "Tipo de organización"
+      "accountCategory": {
+        "label": "Categorías",
+        "hint": "Elige hasta {{max}}. La primera es tu categoría principal."
       },
       "toasts": {
         "success": "Cuenta creada",

package/dist/cjs/index.js

@@ -18,11 +18,11 @@
  * If a symbol does not appear here, it is NOT part of the public API.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.deriveSharedSecret = exports.AEAD_NONCE_LENGTH = exports.AEAD_KEY_LENGTH = exports.decryptAead = exports.encryptAead = exports.hkdfSha256 = exports.RecoveryPhraseService = exports.SignatureService = exports.updateIdentityMarker = exports.readIdentityMarker = exports.IdentityUnavailableError = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.verifyPublicCardAttestation = exports.parseAttestPayload = exports.parseIdPayload = exports.buildUserDid = exports.ORGANIZATION_CATEGORIES = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.commonsDeliveryPlatform = exports.pushTargetsFromDelivery = exports.selectCommonsDelivery = exports.parseCommonsApprovalExpiresAt = exports.getCommonsApprovalBlockingReason = exports.ServiceCredentialMismatchError = exports.oxyClient = exports.OXY_CLOUD_URL = exports.ServiceAssetMetadataError = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.AssetUrlResolutionError = exports.OxyServices = void 0;
-exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.getPrimaryLanguage = exports.getUserLanguages = exports.isRTLLocale = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.isSupportedLocale = exports.normalizeLocale = exports.getBaseLanguage = exports.FALLBACK_LOCALE = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = void 0;
-exports.buildAccountsArray = exports.updateAvatarVisibility = exports.isDev = exports.consoleSink = exports.resetLoggerConfig = exports.getLoggerConfig = exports.configureLogger = exports.createLogger = exports.logger = exports.normalizeMultilineText = exports.normalizeInlineText = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE = exports.DISPLAY_NAME_ORPHANED_MARK_SOURCE = exports.DISPLAY_NAME_DISALLOWED_SOURCE = exports.DISPLAY_NAME_ALLOWED_SCRIPTS = exports.isValidDisplayName = exports.isValidPassword = exports.isValidUsername = exports.isValidEmail = exports.DISPLAY_NAME_INVALID_MESSAGE = exports.MAX_DISPLAY_NAME_LENGTH = exports.PASSWORD_REGEX = exports.USERNAME_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.buildQueryParams = exports.translate = exports.withRetry = void 0;
-exports.resolveIdentityPin = exports.IDENTITY_PIN_STORAGE_KEY = exports.identityPinMatches = exports.createMemoryIdentityPinStore = exports.createNativeIdentityPinStore = exports.createWebIdentityPinStore = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.switchableAccountIds = exports.projectSwitchableAccounts = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isLoopbackOrigin = exports.consumeOAuthReturnPath = exports.persistOAuthReturnPath = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.canonicalizeOAuthRedirectUri = exports.normalizeOAuthRedirectUri = exports.OXY_OAUTH_RETURN_PATH_STORAGE_KEY = exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.runColdBoot = exports.isOxyRpOrigin = exports.CENTRAL_IDP_APEX = exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = void 0;
-exports.packageInfo = exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.AccountNotOnDeviceError = exports.establishIdentitySession = void 0;
+exports.AEAD_KEY_LENGTH = exports.decryptAead = exports.encryptAead = exports.hkdfSha256 = exports.RecoveryPhraseService = exports.SignatureService = exports.updateIdentityMarker = exports.readIdentityMarker = exports.IdentityUnavailableError = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.verifyPublicCardAttestation = exports.parseAttestPayload = exports.parseIdPayload = exports.buildUserDid = exports.kindAcceptsAccountCategories = exports.isSelectableAccountCategoryId = exports.SELECTABLE_ACCOUNT_CATEGORY_IDS = exports.MAX_ACCOUNT_CATEGORIES = exports.ACCOUNT_CATEGORY_IDS = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.commonsDeliveryPlatform = exports.pushTargetsFromDelivery = exports.selectCommonsDelivery = exports.parseCommonsApprovalExpiresAt = exports.getCommonsApprovalBlockingReason = exports.ServiceCredentialMismatchError = exports.oxyClient = exports.OXY_CLOUD_URL = exports.ServiceAssetMetadataError = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.AssetUrlResolutionError = exports.OxyServices = void 0;
+exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.getPrimaryLanguage = exports.getUserLanguages = exports.isRTLLocale = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.isSupportedLocale = exports.normalizeLocale = exports.getBaseLanguage = exports.FALLBACK_LOCALE = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.deriveSharedSecret = exports.AEAD_NONCE_LENGTH = void 0;
+exports.resetLoggerConfig = exports.getLoggerConfig = exports.configureLogger = exports.createLogger = exports.logger = exports.normalizeMultilineText = exports.normalizeInlineText = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE = exports.DISPLAY_NAME_ORPHANED_MARK_SOURCE = exports.DISPLAY_NAME_DISALLOWED_SOURCE = exports.DISPLAY_NAME_ALLOWED_SCRIPTS = exports.isValidDisplayName = exports.isValidPassword = exports.isValidUsername = exports.isValidEmail = exports.DISPLAY_NAME_INVALID_MESSAGE = exports.MAX_DISPLAY_NAME_LENGTH = exports.PASSWORD_REGEX = exports.USERNAME_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.buildQueryParams = exports.translate = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = void 0;
+exports.createNativeIdentityPinStore = exports.createWebIdentityPinStore = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.switchableAccountIds = exports.projectSwitchableAccounts = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isLoopbackOrigin = exports.consumeOAuthReturnPath = exports.persistOAuthReturnPath = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.canonicalizeOAuthRedirectUri = exports.normalizeOAuthRedirectUri = exports.OXY_OAUTH_RETURN_PATH_STORAGE_KEY = exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.runColdBoot = exports.isOxyRpOrigin = exports.CENTRAL_IDP_APEX = exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.isDev = exports.consoleSink = void 0;
+exports.packageInfo = exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.AccountNotOnDeviceError = exports.establishIdentitySession = exports.resolveIdentityPin = exports.IDENTITY_PIN_STORAGE_KEY = exports.identityPinMatches = exports.createMemoryIdentityPinStore = void 0;
 // Ensure crypto polyfills are loaded before anything else
 require("./crypto/polyfill");
 // ---------------------------------------------------------------------------
@@ -66,7 +66,11 @@ Object.defineProperty(exports, "getNormalizedUserHandle", { enumerable: true, ge
 var profileLinks_1 = require("./utils/profileLinks");
 Object.defineProperty(exports, "normalizeProfileLinks", { enumerable: true, get: function () { return profileLinks_1.normalizeProfileLinks; } });
 var OxyServices_accounts_1 = require("./mixins/OxyServices.accounts");
-Object.defineProperty(exports, "ORGANIZATION_CATEGORIES", { enumerable: true, get: function () { return OxyServices_accounts_1.ORGANIZATION_CATEGORIES; } });
+Object.defineProperty(exports, "ACCOUNT_CATEGORY_IDS", { enumerable: true, get: function () { return OxyServices_accounts_1.ACCOUNT_CATEGORY_IDS; } });
+Object.defineProperty(exports, "MAX_ACCOUNT_CATEGORIES", { enumerable: true, get: function () { return OxyServices_accounts_1.MAX_ACCOUNT_CATEGORIES; } });
+Object.defineProperty(exports, "SELECTABLE_ACCOUNT_CATEGORY_IDS", { enumerable: true, get: function () { return OxyServices_accounts_1.SELECTABLE_ACCOUNT_CATEGORY_IDS; } });
+Object.defineProperty(exports, "isSelectableAccountCategoryId", { enumerable: true, get: function () { return OxyServices_accounts_1.isSelectableAccountCategoryId; } });
+Object.defineProperty(exports, "kindAcceptsAccountCategories", { enumerable: true, get: function () { return OxyServices_accounts_1.kindAcceptsAccountCategories; } });
 // ---------------------------------------------------------------------------
 // Reputation (Oxy Trust: ledger, balances, disputes, rules, influence).
 // The whole type family — the closed value sets, the two balance views and the

package/dist/cjs/mixins/OxyServices.accounts.js

@@ -1,13 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isActAsEligibleKind = exports.ORGANIZATION_CATEGORIES = exports.ACCOUNT_KINDS = void 0;
+exports.kindAcceptsAccountCategories = exports.isSelectableAccountCategoryId = exports.isActAsEligibleKind = exports.SELECTABLE_ACCOUNT_CATEGORY_IDS = exports.MAX_ACCOUNT_CATEGORIES = exports.ACCOUNT_KINDS = exports.ACCOUNT_CATEGORY_IDS = void 0;
 exports.OxyServicesAccountsMixin = OxyServicesAccountsMixin;
 const userIdentity_1 = require("../utils/userIdentity");
+const identityCacheSweep_1 = require("../utils/identityCacheSweep");
 const mixinHelpers_1 = require("./mixinHelpers");
 var contracts_1 = require("@oxyhq/contracts");
+Object.defineProperty(exports, "ACCOUNT_CATEGORY_IDS", { enumerable: true, get: function () { return contracts_1.ACCOUNT_CATEGORY_IDS; } });
 Object.defineProperty(exports, "ACCOUNT_KINDS", { enumerable: true, get: function () { return contracts_1.ACCOUNT_KINDS; } });
-Object.defineProperty(exports, "ORGANIZATION_CATEGORIES", { enumerable: true, get: function () { return contracts_1.ORGANIZATION_CATEGORIES; } });
+Object.defineProperty(exports, "MAX_ACCOUNT_CATEGORIES", { enumerable: true, get: function () { return contracts_1.MAX_ACCOUNT_CATEGORIES; } });
+Object.defineProperty(exports, "SELECTABLE_ACCOUNT_CATEGORY_IDS", { enumerable: true, get: function () { return contracts_1.SELECTABLE_ACCOUNT_CATEGORY_IDS; } });
 Object.defineProperty(exports, "isActAsEligibleKind", { enumerable: true, get: function () { return contracts_1.isActAsEligibleKind; } });
+Object.defineProperty(exports, "isSelectableAccountCategoryId", { enumerable: true, get: function () { return contracts_1.isSelectableAccountCategoryId; } });
+Object.defineProperty(exports, "kindAcceptsAccountCategories", { enumerable: true, get: function () { return contracts_1.kindAcceptsAccountCategories; } });
 function OxyServicesAccountsMixin(Base) {
     return class extends Base {
         constructor(...args) {
@@ -165,6 +170,18 @@ function OxyServicesAccountsMixin(Base) {
         /**
          * Update an account's mutable profile fields. Tree placement changes
          * (reparenting) go through the dedicated move endpoint, not here.
+         *
+         * An account IS a user, so this write changes identity — and a profile
+         * screen never reads `/accounts/<id>`. It reads `GET /users/<id>` and
+         * `GET /profiles/username/<handle>`, both cached for 5 minutes in the
+         * CALLER'S OWN process, so busting only the account-graph keys left every
+         * profile surface serving the pre-edit avatar and name for the full TTL
+         * with a perfectly healthy server (the cross-service `oxy:user:invalidate`
+         * signal does not help: it evicts BACKEND caches, and cannot reach a cache
+         * living in a browser tab). {@link evictOxyIdentityCache} owns that key
+         * list — see its docs for why the handle-keyed entries are prefix-swept
+         * (a RENAME leaves the old handle's entry unreachable by any targeted key).
+         *
          * @param accountId - The account's Mongo `_id`.
          * @param data - Subset of updatable profile fields.
          */
@@ -175,6 +192,14 @@ function OxyServicesAccountsMixin(Base) {
                 // data) so neither serves the pre-update snapshot.
                 this.clearCacheEntry(`GET:/accounts/${encodeURIComponent(accountId)}`);
                 this._invalidateAccountLists();
+                // The parent's children list embeds this account's profile and is keyed
+                // by the PARENT id, so it is reachable only from the response node.
+                const parentAccountId = res.account?.parentAccountId;
+                if (parentAccountId) {
+                    this.clearCacheEntry(`GET:/accounts/${encodeURIComponent(parentAccountId)}/children`);
+                }
+                // Every identity read of this account, whichever key it lands under.
+                (0, identityCacheSweep_1.evictOxyIdentityCache)(this, accountId);
                 return res.account;
             }
             catch (error) {

package/dist/cjs/mixins/OxyServices.deviceBoot.js

@@ -65,8 +65,9 @@ function OxyServicesDeviceBootMixin(Base) {
          * Zero-cookie mint. Present the first-party `deviceId` + `deviceSecret` to
          * `POST /session/device/token` — NO bearer, NO cookies: possession of the
          * secret IS the device-ownership proof. Returns a fresh short access token
-         * for the device's active account plus `nextDeviceSecret` (rotation-in-use)
-         * and the projected device-session `state`.
+         * for the device's active account plus `nextDeviceSecret` (on mint, the same
+         * proven secret echoed back — rotation happens on sign-in, not mint) and
+         * the projected device-session `state`.
          *
          * `skipAuth`: this call carries no bearer, so a 401 must surface DIRECTLY —
          * never trigger `HttpService`'s 401→refresh→retry dance. The cold boot / re-

package/dist/cjs/mixins/OxyServices.user.js

@@ -6,6 +6,7 @@ const apiUtils_1 = require("../utils/apiUtils");
 const keyManager_1 = require("../crypto/keyManager");
 const signatureService_1 = require("../crypto/signatureService");
 const userIdentity_1 = require("../utils/userIdentity");
+const identityCacheSweep_1 = require("../utils/identityCacheSweep");
 const logger_1 = require("../logger");
 const errorUtils_1 = require("../utils/errorUtils");
 /**
@@ -347,28 +348,22 @@ function OxyServicesUserMixin(Base) {
         /**
          * Update user profile.
          *
-         * Invalidates the SDK-side response cache for every endpoint that
-         * returns the current user (`GET /users/me`, `GET /session/user/*`,
-         * `GET /users/<id>`, `GET /profiles/username/*`) so the next read
-         * doesn't return a stale snapshot. Without this, a follow-up
-         * `getUserBySession` call inside the 2-minute cache window can return
-         * the pre-update user — most visibly during onboarding, where it
-         * causes the username step to flicker back as if nothing was saved.
+         * Invalidates the SDK-side response cache for every endpoint that can
+         * return this user — the list is owned by {@link evictOxyIdentityCache}, so
+         * a new identity read is added in one place instead of to each writer
+         * separately (this method's own hand-written copy had already drifted from
+         * the server-side one, missing `GET /auth/lookup/*` and
+         * `GET /profiles/resolve`). Without the sweep a follow-up
+         * `getUserBySession` inside the cache window returns the pre-update user —
+         * most visibly during onboarding, where the username step flickers back as
+         * if nothing was saved.
          *
          * TanStack Query handles offline queuing automatically.
          */
         async updateProfile(updates) {
             try {
                 const result = (0, userIdentity_1.normalizeUserIdentity)(await this.makeRequest('PUT', '/users/me', updates, { cache: false }));
-                // Bust every cached representation of the current user. We use a
-                // prefix sweep rather than an enumeration because the SDK never
-                // tracks the set of active session IDs centrally.
-                this.clearCacheByPrefix('GET:/session/user/');
-                this.clearCacheByPrefix('GET:/users/me');
-                this.clearCacheByPrefix('GET:/profiles/username/');
-                if (result?.id) {
-                    this.clearCacheEntry(`GET:/users/${result.id}`);
-                }
+                (0, identityCacheSweep_1.evictOxyIdentityCache)(this, result?.id);
                 return result;
             }
             catch (error) {
@@ -421,10 +416,9 @@ function OxyServicesUserMixin(Base) {
                 const result = await this.makeRequest('PATCH', `/privacy/${id}/privacy`, settings, {
                     cache: false,
                 });
-                this.clearCacheByPrefix('GET:/session/user/');
-                this.clearCacheByPrefix('GET:/users/me');
-                this.clearCacheByPrefix('GET:/profiles/username/');
-                this.clearCacheEntry(`GET:/users/${id}`);
+                // Privacy settings ride the user DTO, so every identity read goes stale
+                // too — same key list as any other profile write.
+                (0, identityCacheSweep_1.evictOxyIdentityCache)(this, id);
                 this.clearCacheEntry(`GET:/privacy/${id}/privacy`);
                 return result;
             }

package/dist/cjs/server/index.js

@@ -16,7 +16,7 @@
  * ```
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isOfficialWebOrigin = exports.registrableApex = exports.publishOxyUserInvalidation = exports.evictOxyIdentityCache = exports.createOxyUserInvalidationHandler = exports.verifySecret = exports.OXY_CSP_BASELINE = exports.formatOxyCspPolicy = exports.createOxySecurityHeaders = exports.buildOxyPagesHeaders = exports.buildOxyCspDirectives = exports.createOxyCors = exports.UPSTREAM_HEADERS_TIMEOUT_MS = exports.MAX_URL_LENGTH = exports.MAX_REDIRECTS = exports.DEFAULT_USER_AGENT = exports.BLOCKED_HOSTNAMES = exports.ALLOWED_PROTOCOLS = exports.ALLOWED_PORTS = exports.UpstreamError = exports.SsrfRejection = exports.safeFetch = exports.isBlockedIp = exports.assertSafePublicUrl = exports.createOxyRateLimit = exports.OXY_SERVICE_ENVIRONMENTS = exports.requireOxyAuth = exports.isOxyAuthenticated = exports.getRequiredOxyUserId = exports.getOxyUserId = exports.createOxyAuthMiddleware = exports.createOptionalOxyAuth = void 0;
+exports.isOfficialWebOrigin = exports.registrableApex = exports.OXY_IDENTITY_CACHE_PREFIXES = exports.oxyUserByIdCacheKey = exports.evictOxyIdentityCache = exports.publishOxyUserInvalidation = exports.createOxyUserInvalidationHandler = exports.verifySecret = exports.OXY_CSP_BASELINE = exports.formatOxyCspPolicy = exports.createOxySecurityHeaders = exports.buildOxyPagesHeaders = exports.buildOxyCspDirectives = exports.createOxyCors = exports.UPSTREAM_HEADERS_TIMEOUT_MS = exports.MAX_URL_LENGTH = exports.MAX_REDIRECTS = exports.DEFAULT_USER_AGENT = exports.BLOCKED_HOSTNAMES = exports.ALLOWED_PROTOCOLS = exports.ALLOWED_PORTS = exports.UpstreamError = exports.SsrfRejection = exports.safeFetch = exports.isBlockedIp = exports.assertSafePublicUrl = exports.createOxyRateLimit = exports.OXY_SERVICE_ENVIRONMENTS = exports.requireOxyAuth = exports.isOxyAuthenticated = exports.getRequiredOxyUserId = exports.getOxyUserId = exports.createOxyAuthMiddleware = exports.createOptionalOxyAuth = void 0;
 var auth_1 = require("./auth");
 Object.defineProperty(exports, "createOptionalOxyAuth", { enumerable: true, get: function () { return auth_1.createOptionalOxyAuth; } });
 Object.defineProperty(exports, "createOxyAuthMiddleware", { enumerable: true, get: function () { return auth_1.createOxyAuthMiddleware; } });
@@ -59,8 +59,14 @@ Object.defineProperty(exports, "verifySecret", { enumerable: true, get: function
 // changes, every consuming backend sweeps its caches instead of waiting out a TTL.
 var userInvalidation_1 = require("./userInvalidation");
 Object.defineProperty(exports, "createOxyUserInvalidationHandler", { enumerable: true, get: function () { return userInvalidation_1.createOxyUserInvalidationHandler; } });
-Object.defineProperty(exports, "evictOxyIdentityCache", { enumerable: true, get: function () { return userInvalidation_1.evictOxyIdentityCache; } });
 Object.defineProperty(exports, "publishOxyUserInvalidation", { enumerable: true, get: function () { return userInvalidation_1.publishOxyUserInvalidation; } });
+// The identity-key enumeration itself is platform-neutral (`src/utils/`) so the
+// client mixins and this Node-only subscriber sweep the SAME list — a second
+// copy is what let `updateAccount` and `updateProfile` drift apart.
+var identityCacheSweep_1 = require("../utils/identityCacheSweep");
+Object.defineProperty(exports, "evictOxyIdentityCache", { enumerable: true, get: function () { return identityCacheSweep_1.evictOxyIdentityCache; } });
+Object.defineProperty(exports, "oxyUserByIdCacheKey", { enumerable: true, get: function () { return identityCacheSweep_1.oxyUserByIdCacheKey; } });
+Object.defineProperty(exports, "OXY_IDENTITY_CACHE_PREFIXES", { enumerable: true, get: function () { return identityCacheSweep_1.OXY_IDENTITY_CACHE_PREFIXES; } });
 // Registrable-apex (eTLD+1) derivation via the Public Suffix List — the SINGLE
 // SOURCE OF TRUTH shared with the IdP worker and the client FAPI auto-detect.
 // Pure host handling (no browser deps), so it is safe on the server subpath and

package/dist/cjs/server/userInvalidation.js

@@ -7,10 +7,10 @@
  * Every Oxy backend caches Oxy identity, and none of them find out when it
  * changes. The `OxyServices` GET response cache holds `GET /users/:id` and
  * `GET /profiles/username/:name` for five minutes; it is swept when THIS process
- * writes the profile (see the `clearCacheEntry` calls in the user mixin) and
- * never when somebody else does — which is the normal case, since profiles are
- * edited in Oxy's own apps. So an avatar or display-name change is invisible to
- * every consuming backend for up to five minutes, per process.
+ * writes the profile (the `evictOxyIdentityCache` calls in the user and accounts
+ * mixins) and never when somebody else does — which is the normal case, since
+ * profiles are edited in Oxy's own apps. So an avatar or display-name change is
+ * invisible to every consuming backend for up to five minutes, per process.
  *
  * oxy-api broadcasts {@link OXY_USER_INVALIDATION_CHANNEL} on the shared Valkey
  * when a user's identity changes. This module is the consumer half: it parses
@@ -54,8 +54,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.publishOxyUserInvalidation = publishOxyUserInvalidation;
 exports.createOxyUserInvalidationHandler = createOxyUserInvalidationHandler;
-exports.evictOxyIdentityCache = evictOxyIdentityCache;
 const contracts_1 = require("@oxyhq/contracts");
+const identityCacheSweep_1 = require("../utils/identityCacheSweep");
 /**
  * Broadcast that an Oxy user's record changed.
  *
@@ -134,7 +134,7 @@ function createOxyUserInvalidationHandler(options = {}) {
         }
         if (oxy) {
             try {
-                evictOxyIdentityCache(oxy, event.userId);
+                (0, identityCacheSweep_1.evictOxyIdentityCache)(oxy, event.userId);
             }
             catch (error) {
                 // A cache sweep must never cost us the app-specific eviction below.
@@ -154,25 +154,3 @@ function createOxyUserInvalidationHandler(options = {}) {
         }
     };
 }
-/**
- * Sweep an `OxyServices` GET response cache of everything that could carry the
- * given user's identity.
- *
- * The by-id entry is exact. The by-username and resolve entries are keyed by
- * HANDLE, which cannot be derived from an id without the very lookup we are
- * invalidating, so those are swept by prefix — the same imprecision the SDK
- * already accepts when it sweeps its own cache after a local profile write, and
- * bounded by the fact that over-eviction costs a refetch and can never serve
- * wrong data.
- */
-function evictOxyIdentityCache(oxy, userId) {
-    // Match the sweep the user mixin runs after a local profile write — session-
-    // bound and /users/me entries are keyed without the user id, so they must be
-    // prefix-swept on cross-service invalidation too.
-    oxy.clearCacheByPrefix('GET:/session/user/');
-    oxy.clearCacheByPrefix('GET:/users/me');
-    oxy.clearCacheByPrefix('GET:/auth/lookup/');
-    oxy.clearCacheEntry(`GET:/users/${userId}`);
-    oxy.clearCacheByPrefix('GET:/profiles/username/');
-    oxy.clearCacheByPrefix('GET:/profiles/resolve');
-}

package/dist/cjs/session/refresh.js

@@ -40,19 +40,14 @@ const MIN_SCHEDULE_DELAY_MS = 1000;
 const MIN_FAILURE_BACKOFF_MS = 5000;
 const MAX_FAILURE_BACKOFF_MS = 5 * 60000;
 /**
- * Arm 1 — the rotating device-secret mint, run under the owning client's
- * PROCESS-WIDE single-flight (`httpService.runSingleFlightDeviceSecretMint`).
+ * Arm 1 — the device-secret mint, run under the owning client's PROCESS-WIDE
+ * single-flight (`httpService.runSingleFlightDeviceSecretMint`).
  *
- * The server ROTATES the presented `deviceSecret` on every successful mint and
- * the just-presented secret is valid only for a short grace window. If two lanes
- * (cold boot, the proactive scheduler, a request-time preflight, a 401 retry,
- * the socket token transport, or a tab-focus reconcile) minted concurrently they
- * would double-rotate the server and the durable store could converge on the
- * SUPERSEDED secret — after the grace window the next cold boot mint 401s and the
- * user is signed out. Routing EVERY lane through this one single-flight makes
- * concurrent callers await the SAME in-flight mint and all receive its result, so
- * there is exactly one rotation and the store always converges on the true
- * `current` secret.
+ * Concurrent lanes (cold boot, the proactive scheduler, a request-time preflight,
+ * a 401 retry, the socket token transport, or a tab-focus reconcile) must not
+ * each persist a different view of the mint response. Routing EVERY lane through
+ * this one single-flight makes concurrent callers await the SAME in-flight mint
+ * and all receive its result, so the durable store converges on one credential.
  *
  * On success it persists `nextDeviceSecret` (read-back-verified) BEFORE planting
  * the access token; a failed durable persist yields `persist-failed` WITHOUT
@@ -123,8 +118,8 @@ async function refreshDeviceSecretArm(deps) {
             expiresAt: mint.expiresAt,
             ...(bound ? { sessionId: bound.sessionId, userId: bound.accountId } : {}),
         };
-        // Rotation-in-use anti-loss: persist the NEXT secret and read-back-VERIFY it
-        // landed BEFORE planting the token. A failed durable persist must NOT plant.
+        // Persist nextDeviceSecret (read-back-verified) BEFORE planting the token.
+        // A failed durable persist must NOT plant.
         const persistedOk = await store.save(next);
         if (!persistedOk) {
             return { status: 'persist-failed' };