@oxyhq/core 18.0.0 → 19.0.0

package/dist/esm/i18n/locales/en-US.json

@@ -1748,11 +1748,53 @@
                 "description": "A programmatic account with service credentials"
             }
         },
-        "organizationCategory": {
+        "accountCategory": {
+            "news": "News",
+            "politics": "Politics & policy",
+            "business": "Business",
+            "startup": "Startups & entrepreneurship",
+            "finance": "Finance & investing",
+            "crypto": "Crypto & web3",
+            "marketplace": "Marketplace & classifieds",
+            "retail": "Retail & ecommerce",
+            "real_estate": "Real estate",
             "agency": "Real estate agency",
+            "landlord": "Landlord & property management",
             "cooperative": "Housing cooperative",
-            "landlord": "Landlord / property manager",
-            "other": "Other organization"
+            "architecture": "Architecture & construction",
+            "technology": "Technology",
+            "software": "Software & development",
+            "ai": "AI & machine learning",
+            "security": "Security & privacy",
+            "automation": "Automation & tools",
+            "science": "Science & research",
+            "education": "Education & training",
+            "books": "Books & writing",
+            "health": "Health & medicine",
+            "fitness": "Fitness & wellbeing",
+            "sports": "Sports",
+            "gaming": "Gaming & esports",
+            "music": "Music",
+            "film": "Film & TV",
+            "podcast": "Podcasts & audio",
+            "art": "Art & design",
+            "photography": "Photography",
+            "comedy": "Comedy",
+            "food": "Food & drink",
+            "travel": "Travel & places",
+            "fashion": "Fashion & beauty",
+            "home_garden": "Home & garden",
+            "diy": "DIY & making",
+            "automotive": "Cars & motoring",
+            "animals": "Animals & pets",
+            "family": "Family & parenting",
+            "nonprofit": "Non-profit & charity",
+            "government": "Government & public sector",
+            "community": "Local community",
+            "activism": "Activism & advocacy",
+            "environment": "Environment & sustainability",
+            "religion": "Religion & spirituality",
+            "other": "Other"
         },
         "create": {
             "title": "Create account",
@@ -1772,8 +1814,9 @@
                 "invalidChars": "Only letters, numbers, hyphens, and underscores",
                 "checkFailed": "Could not check availability"
             },
-            "organizationCategory": {
-                "label": "Organization type"
+            "accountCategory": {
+                "label": "Categories",
+                "hint": "Pick up to {{max}}. The first one is your main category."
             },
             "toasts": {
                 "success": "Account created",

package/dist/esm/i18n/locales/es-ES.json

@@ -1748,11 +1748,53 @@
                 "description": "Una cuenta programática con credenciales de servicio"
             }
         },
-        "organizationCategory": {
+        "accountCategory": {
+            "news": "Noticias",
+            "politics": "Política",
+            "business": "Negocios",
+            "startup": "Startups y emprendimiento",
+            "finance": "Finanzas e inversión",
+            "crypto": "Cripto y web3",
+            "marketplace": "Marketplace y anuncios",
+            "retail": "Comercio y ecommerce",
+            "real_estate": "Inmobiliaria",
             "agency": "Agencia inmobiliaria",
+            "landlord": "Casero y gestión de fincas",
             "cooperative": "Cooperativa de vivienda",
-            "landlord": "Propietario / administrador de fincas",
-            "other": "Otra organización"
+            "architecture": "Arquitectura y construcción",
+            "technology": "Tecnología",
+            "software": "Software y desarrollo",
+            "ai": "IA y aprendizaje automático",
+            "security": "Seguridad y privacidad",
+            "automation": "Automatización y herramientas",
+            "science": "Ciencia e investigación",
+            "education": "Educación y formación",
+            "books": "Libros y escritura",
+            "health": "Salud y medicina",
+            "fitness": "Deporte y bienestar",
+            "sports": "Deportes",
+            "gaming": "Videojuegos y esports",
+            "music": "Música",
+            "film": "Cine y TV",
+            "podcast": "Pódcast y audio",
+            "art": "Arte y diseño",
+            "photography": "Fotografía",
+            "comedy": "Comedia",
+            "food": "Comida y bebida",
+            "travel": "Viajes y lugares",
+            "fashion": "Moda y belleza",
+            "home_garden": "Hogar y jardín",
+            "diy": "Bricolaje y manualidades",
+            "automotive": "Coches y motor",
+            "animals": "Animales y mascotas",
+            "family": "Familia y crianza",
+            "nonprofit": "ONG y benéficas",
+            "government": "Gobierno y sector público",
+            "community": "Comunidad local",
+            "activism": "Activismo y defensa",
+            "environment": "Medio ambiente y sostenibilidad",
+            "religion": "Religión y espiritualidad",
+            "other": "Otra"
         },
         "create": {
             "title": "Crear cuenta",
@@ -1772,8 +1814,9 @@
                 "invalidChars": "Solo letras, números, guiones y guiones bajos",
                 "checkFailed": "No se pudo comprobar la disponibilidad"
             },
-            "organizationCategory": {
-                "label": "Tipo de organización"
+            "accountCategory": {
+                "label": "Categorías",
+                "hint": "Elige hasta {{max}}. La primera es tu categoría principal."
             },
             "toasts": {
                 "success": "Cuenta creada",

package/dist/esm/i18n/locales/locales/en-US.json

@@ -1748,11 +1748,53 @@
         "description": "A programmatic account with service credentials"
       }
     },
-    "organizationCategory": {
+    "accountCategory": {
+      "news": "News",
+      "politics": "Politics & policy",
+      "business": "Business",
+      "startup": "Startups & entrepreneurship",
+      "finance": "Finance & investing",
+      "crypto": "Crypto & web3",
+      "marketplace": "Marketplace & classifieds",
+      "retail": "Retail & ecommerce",
+      "real_estate": "Real estate",
       "agency": "Real estate agency",
+      "landlord": "Landlord & property management",
       "cooperative": "Housing cooperative",
-      "landlord": "Landlord / property manager",
-      "other": "Other organization"
+      "architecture": "Architecture & construction",
+      "technology": "Technology",
+      "software": "Software & development",
+      "ai": "AI & machine learning",
+      "security": "Security & privacy",
+      "automation": "Automation & tools",
+      "science": "Science & research",
+      "education": "Education & training",
+      "books": "Books & writing",
+      "health": "Health & medicine",
+      "fitness": "Fitness & wellbeing",
+      "sports": "Sports",
+      "gaming": "Gaming & esports",
+      "music": "Music",
+      "film": "Film & TV",
+      "podcast": "Podcasts & audio",
+      "art": "Art & design",
+      "photography": "Photography",
+      "comedy": "Comedy",
+      "food": "Food & drink",
+      "travel": "Travel & places",
+      "fashion": "Fashion & beauty",
+      "home_garden": "Home & garden",
+      "diy": "DIY & making",
+      "automotive": "Cars & motoring",
+      "animals": "Animals & pets",
+      "family": "Family & parenting",
+      "nonprofit": "Non-profit & charity",
+      "government": "Government & public sector",
+      "community": "Local community",
+      "activism": "Activism & advocacy",
+      "environment": "Environment & sustainability",
+      "religion": "Religion & spirituality",
+      "other": "Other"
     },
     "create": {
       "title": "Create account",
@@ -1772,8 +1814,9 @@
         "invalidChars": "Only letters, numbers, hyphens, and underscores",
         "checkFailed": "Could not check availability"
       },
-      "organizationCategory": {
-        "label": "Organization type"
+      "accountCategory": {
+        "label": "Categories",
+        "hint": "Pick up to {{max}}. The first one is your main category."
       },
       "toasts": {
         "success": "Account created",

package/dist/esm/i18n/locales/locales/es-ES.json

@@ -1748,11 +1748,53 @@
         "description": "Una cuenta programática con credenciales de servicio"
       }
     },
-    "organizationCategory": {
+    "accountCategory": {
+      "news": "Noticias",
+      "politics": "Política",
+      "business": "Negocios",
+      "startup": "Startups y emprendimiento",
+      "finance": "Finanzas e inversión",
+      "crypto": "Cripto y web3",
+      "marketplace": "Marketplace y anuncios",
+      "retail": "Comercio y ecommerce",
+      "real_estate": "Inmobiliaria",
       "agency": "Agencia inmobiliaria",
+      "landlord": "Casero y gestión de fincas",
       "cooperative": "Cooperativa de vivienda",
-      "landlord": "Propietario / administrador de fincas",
-      "other": "Otra organización"
+      "architecture": "Arquitectura y construcción",
+      "technology": "Tecnología",
+      "software": "Software y desarrollo",
+      "ai": "IA y aprendizaje automático",
+      "security": "Seguridad y privacidad",
+      "automation": "Automatización y herramientas",
+      "science": "Ciencia e investigación",
+      "education": "Educación y formación",
+      "books": "Libros y escritura",
+      "health": "Salud y medicina",
+      "fitness": "Deporte y bienestar",
+      "sports": "Deportes",
+      "gaming": "Videojuegos y esports",
+      "music": "Música",
+      "film": "Cine y TV",
+      "podcast": "Pódcast y audio",
+      "art": "Arte y diseño",
+      "photography": "Fotografía",
+      "comedy": "Comedia",
+      "food": "Comida y bebida",
+      "travel": "Viajes y lugares",
+      "fashion": "Moda y belleza",
+      "home_garden": "Hogar y jardín",
+      "diy": "Bricolaje y manualidades",
+      "automotive": "Coches y motor",
+      "animals": "Animales y mascotas",
+      "family": "Familia y crianza",
+      "nonprofit": "ONG y benéficas",
+      "government": "Gobierno y sector público",
+      "community": "Comunidad local",
+      "activism": "Activismo y defensa",
+      "environment": "Medio ambiente y sostenibilidad",
+      "religion": "Religión y espiritualidad",
+      "other": "Otra"
     },
     "create": {
       "title": "Crear cuenta",
@@ -1772,8 +1814,9 @@
         "invalidChars": "Solo letras, números, guiones y guiones bajos",
         "checkFailed": "No se pudo comprobar la disponibilidad"
       },
-      "organizationCategory": {
-        "label": "Tipo de organización"
+      "accountCategory": {
+        "label": "Categorías",
+        "hint": "Elige hasta {{max}}. La primera es tu categoría principal."
       },
       "toasts": {
         "success": "Cuenta creada",

package/dist/esm/index.js

@@ -38,7 +38,7 @@ export { OxyAppDataIdentifierError } from './mixins/OxyServices.appData.js';
 export { getNormalizedUserId, normalizeUserIdentity, normalizeUserIdentityOrNull, } from './utils/userIdentity.js';
 export { getCanonicalUserHandle, getNormalizedUserHandle, } from './utils/userHandle.js';
 export { normalizeProfileLinks } from './utils/profileLinks.js';
-export { ORGANIZATION_CATEGORIES } from './mixins/OxyServices.accounts.js';
+export { ACCOUNT_CATEGORY_IDS, MAX_ACCOUNT_CATEGORIES, SELECTABLE_ACCOUNT_CATEGORY_IDS, isSelectableAccountCategoryId, kindAcceptsAccountCategories, } from './mixins/OxyServices.accounts.js';
 // ---------------------------------------------------------------------------
 // Reputation (Oxy Trust: ledger, balances, disputes, rules, influence).
 // The whole type family — the closed value sets, the two balance views and the

package/dist/esm/mixins/OxyServices.accounts.js

@@ -1,6 +1,7 @@
 import { normalizeUserIdentity } from '../utils/userIdentity.js';
+import { evictOxyIdentityCache } from '../utils/identityCacheSweep.js';
 import { CACHE_TIMES } from './mixinHelpers.js';
-export { ACCOUNT_KINDS, ORGANIZATION_CATEGORIES, isActAsEligibleKind } from '@oxyhq/contracts';
+export { ACCOUNT_CATEGORY_IDS, ACCOUNT_KINDS, MAX_ACCOUNT_CATEGORIES, SELECTABLE_ACCOUNT_CATEGORY_IDS, isActAsEligibleKind, isSelectableAccountCategoryId, kindAcceptsAccountCategories, } from '@oxyhq/contracts';
 export function OxyServicesAccountsMixin(Base) {
     return class extends Base {
         constructor(...args) {
@@ -158,6 +159,18 @@ export function OxyServicesAccountsMixin(Base) {
         /**
          * Update an account's mutable profile fields. Tree placement changes
          * (reparenting) go through the dedicated move endpoint, not here.
+         *
+         * An account IS a user, so this write changes identity — and a profile
+         * screen never reads `/accounts/<id>`. It reads `GET /users/<id>` and
+         * `GET /profiles/username/<handle>`, both cached for 5 minutes in the
+         * CALLER'S OWN process, so busting only the account-graph keys left every
+         * profile surface serving the pre-edit avatar and name for the full TTL
+         * with a perfectly healthy server (the cross-service `oxy:user:invalidate`
+         * signal does not help: it evicts BACKEND caches, and cannot reach a cache
+         * living in a browser tab). {@link evictOxyIdentityCache} owns that key
+         * list — see its docs for why the handle-keyed entries are prefix-swept
+         * (a RENAME leaves the old handle's entry unreachable by any targeted key).
+         *
          * @param accountId - The account's Mongo `_id`.
          * @param data - Subset of updatable profile fields.
          */
@@ -168,6 +181,14 @@ export function OxyServicesAccountsMixin(Base) {
                 // data) so neither serves the pre-update snapshot.
                 this.clearCacheEntry(`GET:/accounts/${encodeURIComponent(accountId)}`);
                 this._invalidateAccountLists();
+                // The parent's children list embeds this account's profile and is keyed
+                // by the PARENT id, so it is reachable only from the response node.
+                const parentAccountId = res.account?.parentAccountId;
+                if (parentAccountId) {
+                    this.clearCacheEntry(`GET:/accounts/${encodeURIComponent(parentAccountId)}/children`);
+                }
+                // Every identity read of this account, whichever key it lands under.
+                evictOxyIdentityCache(this, accountId);
                 return res.account;
             }
             catch (error) {

package/dist/esm/mixins/OxyServices.user.js

@@ -3,6 +3,7 @@ import { buildQueryParams, buildPaginationParams, } from '../utils/apiUtils.js';
 import { KeyManager } from '../crypto/keyManager.js';
 import { SignatureService } from '../crypto/signatureService.js';
 import { normalizeUserIdentity, normalizeUserIdentityOrNull } from '../utils/userIdentity.js';
+import { evictOxyIdentityCache } from '../utils/identityCacheSweep.js';
 import { logger } from '../logger/index.js';
 import { extractErrorStatus } from '../utils/errorUtils.js';
 /**
@@ -344,28 +345,22 @@ export function OxyServicesUserMixin(Base) {
         /**
          * Update user profile.
          *
-         * Invalidates the SDK-side response cache for every endpoint that
-         * returns the current user (`GET /users/me`, `GET /session/user/*`,
-         * `GET /users/<id>`, `GET /profiles/username/*`) so the next read
-         * doesn't return a stale snapshot. Without this, a follow-up
-         * `getUserBySession` call inside the 2-minute cache window can return
-         * the pre-update user — most visibly during onboarding, where it
-         * causes the username step to flicker back as if nothing was saved.
+         * Invalidates the SDK-side response cache for every endpoint that can
+         * return this user — the list is owned by {@link evictOxyIdentityCache}, so
+         * a new identity read is added in one place instead of to each writer
+         * separately (this method's own hand-written copy had already drifted from
+         * the server-side one, missing `GET /auth/lookup/*` and
+         * `GET /profiles/resolve`). Without the sweep a follow-up
+         * `getUserBySession` inside the cache window returns the pre-update user —
+         * most visibly during onboarding, where the username step flickers back as
+         * if nothing was saved.
          *
          * TanStack Query handles offline queuing automatically.
          */
         async updateProfile(updates) {
             try {
                 const result = normalizeUserIdentity(await this.makeRequest('PUT', '/users/me', updates, { cache: false }));
-                // Bust every cached representation of the current user. We use a
-                // prefix sweep rather than an enumeration because the SDK never
-                // tracks the set of active session IDs centrally.
-                this.clearCacheByPrefix('GET:/session/user/');
-                this.clearCacheByPrefix('GET:/users/me');
-                this.clearCacheByPrefix('GET:/profiles/username/');
-                if (result?.id) {
-                    this.clearCacheEntry(`GET:/users/${result.id}`);
-                }
+                evictOxyIdentityCache(this, result?.id);
                 return result;
             }
             catch (error) {
@@ -418,10 +413,9 @@ export function OxyServicesUserMixin(Base) {
                 const result = await this.makeRequest('PATCH', `/privacy/${id}/privacy`, settings, {
                     cache: false,
                 });
-                this.clearCacheByPrefix('GET:/session/user/');
-                this.clearCacheByPrefix('GET:/users/me');
-                this.clearCacheByPrefix('GET:/profiles/username/');
-                this.clearCacheEntry(`GET:/users/${id}`);
+                // Privacy settings ride the user DTO, so every identity read goes stale
+                // too — same key list as any other profile write.
+                evictOxyIdentityCache(this, id);
                 this.clearCacheEntry(`GET:/privacy/${id}/privacy`);
                 return result;
             }

package/dist/esm/server/index.js

@@ -27,7 +27,11 @@ export { buildOxyCspDirectives, buildOxyPagesHeaders, createOxySecurityHeaders,
 export { verifySecret } from './verifySecret.js';
 // Cross-service user-invalidation signal: oxy-api publishes when identity
 // changes, every consuming backend sweeps its caches instead of waiting out a TTL.
-export { createOxyUserInvalidationHandler, evictOxyIdentityCache, publishOxyUserInvalidation, } from './userInvalidation.js';
+export { createOxyUserInvalidationHandler, publishOxyUserInvalidation, } from './userInvalidation.js';
+// The identity-key enumeration itself is platform-neutral (`src/utils/`) so the
+// client mixins and this Node-only subscriber sweep the SAME list — a second
+// copy is what let `updateAccount` and `updateProfile` drift apart.
+export { evictOxyIdentityCache, oxyUserByIdCacheKey, OXY_IDENTITY_CACHE_PREFIXES } from '../utils/identityCacheSweep.js';
 // Registrable-apex (eTLD+1) derivation via the Public Suffix List — the SINGLE
 // SOURCE OF TRUTH shared with the IdP worker and the client FAPI auto-detect.
 // Pure host handling (no browser deps), so it is safe on the server subpath and

package/dist/esm/server/userInvalidation.js

@@ -6,10 +6,10 @@
  * Every Oxy backend caches Oxy identity, and none of them find out when it
  * changes. The `OxyServices` GET response cache holds `GET /users/:id` and
  * `GET /profiles/username/:name` for five minutes; it is swept when THIS process
- * writes the profile (see the `clearCacheEntry` calls in the user mixin) and
- * never when somebody else does — which is the normal case, since profiles are
- * edited in Oxy's own apps. So an avatar or display-name change is invisible to
- * every consuming backend for up to five minutes, per process.
+ * writes the profile (the `evictOxyIdentityCache` calls in the user and accounts
+ * mixins) and never when somebody else does — which is the normal case, since
+ * profiles are edited in Oxy's own apps. So an avatar or display-name change is
+ * invisible to every consuming backend for up to five minutes, per process.
  *
  * oxy-api broadcasts {@link OXY_USER_INVALIDATION_CHANNEL} on the shared Valkey
  * when a user's identity changes. This module is the consumer half: it parses
@@ -51,6 +51,7 @@
  * Node-only; exported solely from `@oxyhq/core/server`.
  */
 import { OXY_USER_INVALIDATION_CHANNEL, isPublishedOxyUserChangeReason, oxyUserInvalidationEventSchema, } from '@oxyhq/contracts';
+import { evictOxyIdentityCache, } from '../utils/identityCacheSweep.js';
 /**
  * Broadcast that an Oxy user's record changed.
  *
@@ -149,25 +150,3 @@ export function createOxyUserInvalidationHandler(options = {}) {
         }
     };
 }
-/**
- * Sweep an `OxyServices` GET response cache of everything that could carry the
- * given user's identity.
- *
- * The by-id entry is exact. The by-username and resolve entries are keyed by
- * HANDLE, which cannot be derived from an id without the very lookup we are
- * invalidating, so those are swept by prefix — the same imprecision the SDK
- * already accepts when it sweeps its own cache after a local profile write, and
- * bounded by the fact that over-eviction costs a refetch and can never serve
- * wrong data.
- */
-export function evictOxyIdentityCache(oxy, userId) {
-    // Match the sweep the user mixin runs after a local profile write — session-
-    // bound and /users/me entries are keyed without the user id, so they must be
-    // prefix-swept on cross-service invalidation too.
-    oxy.clearCacheByPrefix('GET:/session/user/');
-    oxy.clearCacheByPrefix('GET:/users/me');
-    oxy.clearCacheByPrefix('GET:/auth/lookup/');
-    oxy.clearCacheEntry(`GET:/users/${userId}`);
-    oxy.clearCacheByPrefix('GET:/profiles/username/');
-    oxy.clearCacheByPrefix('GET:/profiles/resolve');
-}

package/dist/esm/utils/identityCacheSweep.js

@@ -0,0 +1,92 @@
+/**
+ * THE enumeration of `OxyServices` GET-cache keys that can carry a single
+ * account's identity, and the one sweep that clears them.
+ *
+ * WHY THIS IS ONE LIST
+ * --------------------
+ * An Oxy account is readable under SEVERAL cache keys, and a write that only
+ * busts the key it happens to know about leaves every other one serving the
+ * pre-write snapshot for up to its TTL — from the caller's OWN in-memory cache,
+ * with a perfectly healthy server. That failure has already shipped twice with
+ * two different sets of keys:
+ *
+ *   - `updateAccount` busted `GET:/accounts/<id>` and the account lists, but a
+ *     profile screen reads `GET:/profiles/username/<name>` and
+ *     `GET:/users/<id>`, so a channel's new picture stayed invisible for the
+ *     full 5-minute profile TTL.
+ *   - `updateProfile` busted four of the six keys below, missing
+ *     `GET:/auth/lookup/` (the login-flow avatar/display-name lookup) and
+ *     `GET:/profiles/resolve` (handle resolution) — two independently-drifted
+ *     copies of a list that has to agree.
+ *
+ * So the list lives here, once, and every writer calls
+ * {@link evictOxyIdentityCache}. Adding a new identity read means adding its key
+ * HERE and every writer inherits it.
+ *
+ * WHERE THE LINE IS DRAWN
+ * -----------------------
+ * These are the SINGLE-PROFILE reads — the account is the subject of the
+ * response and is addressable by id, handle, or session. Reads that merely
+ * CONTAIN an account among many (`GET:/profiles/search`,
+ * `GET:/users/<other>/followers`, `GET:/profiles/<other>/similar`) are
+ * deliberately NOT swept: an account cannot be located in them without the very
+ * lookup being invalidated, so sweeping them means sweeping the whole namespace
+ * on every identity change — a real cost on a backend consuming the
+ * cross-service invalidation signal, for a surface where a stale thumbnail
+ * expires on its own in ~2 minutes.
+ *
+ * WHY PREFIXES RATHER THAN EXACT KEYS
+ * -----------------------------------
+ * Only the by-id key can be built from a user id. The handle-keyed and
+ * session-keyed entries cannot — deriving a handle from an id needs the lookup
+ * we are invalidating, and the SDK never tracks active session ids centrally.
+ * Prefix sweeping is also what makes a USERNAME CHANGE correct: the entry under
+ * the OLD handle is unreachable by construction (nothing in the write response
+ * carries it), and a sweep targeted at the new handle alone would leave the old
+ * one serving the pre-rename profile until its TTL. Over-eviction costs a
+ * refetch; under-eviction serves wrong data.
+ *
+ * Platform-neutral by construction (no imports, no `OxyServices` reference) so
+ * the client mixins and the Node-only `@oxyhq/core/server` invalidation
+ * subscriber can share it without either pulling in the other.
+ */
+/**
+ * Cache-key PREFIXES under which an account's identity can be served, for the
+ * reads whose key cannot be derived from a user id. Swept wholesale.
+ */
+export const OXY_IDENTITY_CACHE_PREFIXES = [
+    // `getUserBySession` — keyed by session id, which the SDK never enumerates.
+    'GET:/session/user/',
+    // `getCurrentUser` (and `GET:/users/me/graph`, harmlessly included).
+    'GET:/users/me',
+    // `lookupUsername` — the pre-session login lookup; carries avatar + display name.
+    'GET:/auth/lookup/',
+    // `getProfileByUsername` — keyed by handle, including the pre-rename handle.
+    'GET:/profiles/username/',
+    // `resolveProfile` — keyed by fediverse handle in the query payload.
+    'GET:/profiles/resolve',
+];
+/**
+ * Build the exact cache key `getUserById` reads under. The only identity key
+ * derivable from a user id, so the only one that does not need a prefix sweep.
+ */
+export function oxyUserByIdCacheKey(userId) {
+    return `GET:/users/${userId}`;
+}
+/**
+ * Sweep an `OxyServices` GET response cache of everything that could carry the
+ * given account's identity.
+ *
+ * @param oxy    - Anything exposing the SDK's two eviction methods.
+ * @param userId - The account whose by-id entry to drop. Optional: a caller
+ *                 that does not know the id still clears every handle-, session-
+ *                 and self-keyed entry, which is the majority of the surface.
+ */
+export function evictOxyIdentityCache(oxy, userId) {
+    for (const prefix of OXY_IDENTITY_CACHE_PREFIXES) {
+        oxy.clearCacheByPrefix(prefix);
+    }
+    if (userId) {
+        oxy.clearCacheEntry(oxyUserByIdCacheKey(userId));
+    }
+}