@oxyhq/core 18.0.0 → 19.1.0

package/dist/esm/i18n/locales/en-US.json

@@ -1748,11 +1748,53 @@
                 "description": "A programmatic account with service credentials"
             }
         },
-        "organizationCategory": {
+        "accountCategory": {
+            "news": "News",
+            "politics": "Politics & policy",
+            "business": "Business",
+            "startup": "Startups & entrepreneurship",
+            "finance": "Finance & investing",
+            "crypto": "Crypto & web3",
+            "marketplace": "Marketplace & classifieds",
+            "retail": "Retail & ecommerce",
+            "real_estate": "Real estate",
             "agency": "Real estate agency",
+            "landlord": "Landlord & property management",
             "cooperative": "Housing cooperative",
-            "landlord": "Landlord / property manager",
-            "other": "Other organization"
+            "architecture": "Architecture & construction",
+            "technology": "Technology",
+            "software": "Software & development",
+            "ai": "AI & machine learning",
+            "security": "Security & privacy",
+            "automation": "Automation & tools",
+            "science": "Science & research",
+            "education": "Education & training",
+            "books": "Books & writing",
+            "health": "Health & medicine",
+            "fitness": "Fitness & wellbeing",
+            "sports": "Sports",
+            "gaming": "Gaming & esports",
+            "music": "Music",
+            "film": "Film & TV",
+            "podcast": "Podcasts & audio",
+            "art": "Art & design",
+            "photography": "Photography",
+            "comedy": "Comedy",
+            "food": "Food & drink",
+            "travel": "Travel & places",
+            "fashion": "Fashion & beauty",
+            "home_garden": "Home & garden",
+            "diy": "DIY & making",
+            "automotive": "Cars & motoring",
+            "animals": "Animals & pets",
+            "family": "Family & parenting",
+            "nonprofit": "Non-profit & charity",
+            "government": "Government & public sector",
+            "community": "Local community",
+            "activism": "Activism & advocacy",
+            "environment": "Environment & sustainability",
+            "religion": "Religion & spirituality",
+            "other": "Other"
         },
         "create": {
             "title": "Create account",
@@ -1772,8 +1814,9 @@
                 "invalidChars": "Only letters, numbers, hyphens, and underscores",
                 "checkFailed": "Could not check availability"
             },
-            "organizationCategory": {
-                "label": "Organization type"
+            "accountCategory": {
+                "label": "Categories",
+                "hint": "Pick up to {{max}}. The first one is your main category."
             },
             "toasts": {
                 "success": "Account created",
@@ -1796,6 +1839,7 @@
             "title": "Members",
             "subtitle": "People with access to this account.",
             "empty": "No members yet.",
+            "inherited": "Inherited",
             "actions": {
                 "remove": "Remove member",
                 "transfer": "Transfer ownership"

package/dist/esm/i18n/locales/es-ES.json

@@ -1748,11 +1748,53 @@
                 "description": "Una cuenta programática con credenciales de servicio"
             }
         },
-        "organizationCategory": {
+        "accountCategory": {
+            "news": "Noticias",
+            "politics": "Política",
+            "business": "Negocios",
+            "startup": "Startups y emprendimiento",
+            "finance": "Finanzas e inversión",
+            "crypto": "Cripto y web3",
+            "marketplace": "Marketplace y anuncios",
+            "retail": "Comercio y ecommerce",
+            "real_estate": "Inmobiliaria",
             "agency": "Agencia inmobiliaria",
+            "landlord": "Casero y gestión de fincas",
             "cooperative": "Cooperativa de vivienda",
-            "landlord": "Propietario / administrador de fincas",
-            "other": "Otra organización"
+            "architecture": "Arquitectura y construcción",
+            "technology": "Tecnología",
+            "software": "Software y desarrollo",
+            "ai": "IA y aprendizaje automático",
+            "security": "Seguridad y privacidad",
+            "automation": "Automatización y herramientas",
+            "science": "Ciencia e investigación",
+            "education": "Educación y formación",
+            "books": "Libros y escritura",
+            "health": "Salud y medicina",
+            "fitness": "Deporte y bienestar",
+            "sports": "Deportes",
+            "gaming": "Videojuegos y esports",
+            "music": "Música",
+            "film": "Cine y TV",
+            "podcast": "Pódcast y audio",
+            "art": "Arte y diseño",
+            "photography": "Fotografía",
+            "comedy": "Comedia",
+            "food": "Comida y bebida",
+            "travel": "Viajes y lugares",
+            "fashion": "Moda y belleza",
+            "home_garden": "Hogar y jardín",
+            "diy": "Bricolaje y manualidades",
+            "automotive": "Coches y motor",
+            "animals": "Animales y mascotas",
+            "family": "Familia y crianza",
+            "nonprofit": "ONG y benéficas",
+            "government": "Gobierno y sector público",
+            "community": "Comunidad local",
+            "activism": "Activismo y defensa",
+            "environment": "Medio ambiente y sostenibilidad",
+            "religion": "Religión y espiritualidad",
+            "other": "Otra"
         },
         "create": {
             "title": "Crear cuenta",
@@ -1772,8 +1814,9 @@
                 "invalidChars": "Solo letras, números, guiones y guiones bajos",
                 "checkFailed": "No se pudo comprobar la disponibilidad"
             },
-            "organizationCategory": {
-                "label": "Tipo de organización"
+            "accountCategory": {
+                "label": "Categorías",
+                "hint": "Elige hasta {{max}}. La primera es tu categoría principal."
             },
             "toasts": {
                 "success": "Cuenta creada",
@@ -1796,6 +1839,7 @@
             "title": "Miembros",
             "subtitle": "Personas con acceso a esta cuenta.",
             "empty": "Aún no hay miembros.",
+            "inherited": "Heredado",
             "actions": {
                 "remove": "Eliminar miembro",
                 "transfer": "Transferir propiedad"

package/dist/esm/i18n/locales/locales/en-US.json

@@ -1748,11 +1748,53 @@
         "description": "A programmatic account with service credentials"
       }
     },
-    "organizationCategory": {
+    "accountCategory": {
+      "news": "News",
+      "politics": "Politics & policy",
+      "business": "Business",
+      "startup": "Startups & entrepreneurship",
+      "finance": "Finance & investing",
+      "crypto": "Crypto & web3",
+      "marketplace": "Marketplace & classifieds",
+      "retail": "Retail & ecommerce",
+      "real_estate": "Real estate",
       "agency": "Real estate agency",
+      "landlord": "Landlord & property management",
       "cooperative": "Housing cooperative",
-      "landlord": "Landlord / property manager",
-      "other": "Other organization"
+      "architecture": "Architecture & construction",
+      "technology": "Technology",
+      "software": "Software & development",
+      "ai": "AI & machine learning",
+      "security": "Security & privacy",
+      "automation": "Automation & tools",
+      "science": "Science & research",
+      "education": "Education & training",
+      "books": "Books & writing",
+      "health": "Health & medicine",
+      "fitness": "Fitness & wellbeing",
+      "sports": "Sports",
+      "gaming": "Gaming & esports",
+      "music": "Music",
+      "film": "Film & TV",
+      "podcast": "Podcasts & audio",
+      "art": "Art & design",
+      "photography": "Photography",
+      "comedy": "Comedy",
+      "food": "Food & drink",
+      "travel": "Travel & places",
+      "fashion": "Fashion & beauty",
+      "home_garden": "Home & garden",
+      "diy": "DIY & making",
+      "automotive": "Cars & motoring",
+      "animals": "Animals & pets",
+      "family": "Family & parenting",
+      "nonprofit": "Non-profit & charity",
+      "government": "Government & public sector",
+      "community": "Local community",
+      "activism": "Activism & advocacy",
+      "environment": "Environment & sustainability",
+      "religion": "Religion & spirituality",
+      "other": "Other"
     },
     "create": {
       "title": "Create account",
@@ -1772,8 +1814,9 @@
         "invalidChars": "Only letters, numbers, hyphens, and underscores",
         "checkFailed": "Could not check availability"
       },
-      "organizationCategory": {
-        "label": "Organization type"
+      "accountCategory": {
+        "label": "Categories",
+        "hint": "Pick up to {{max}}. The first one is your main category."
       },
       "toasts": {
         "success": "Account created",
@@ -1796,6 +1839,7 @@
       "title": "Members",
       "subtitle": "People with access to this account.",
       "empty": "No members yet.",
+      "inherited": "Inherited",
       "actions": {
         "remove": "Remove member",
         "transfer": "Transfer ownership"

package/dist/esm/i18n/locales/locales/es-ES.json

@@ -1748,11 +1748,53 @@
         "description": "Una cuenta programática con credenciales de servicio"
       }
     },
-    "organizationCategory": {
+    "accountCategory": {
+      "news": "Noticias",
+      "politics": "Política",
+      "business": "Negocios",
+      "startup": "Startups y emprendimiento",
+      "finance": "Finanzas e inversión",
+      "crypto": "Cripto y web3",
+      "marketplace": "Marketplace y anuncios",
+      "retail": "Comercio y ecommerce",
+      "real_estate": "Inmobiliaria",
       "agency": "Agencia inmobiliaria",
+      "landlord": "Casero y gestión de fincas",
       "cooperative": "Cooperativa de vivienda",
-      "landlord": "Propietario / administrador de fincas",
-      "other": "Otra organización"
+      "architecture": "Arquitectura y construcción",
+      "technology": "Tecnología",
+      "software": "Software y desarrollo",
+      "ai": "IA y aprendizaje automático",
+      "security": "Seguridad y privacidad",
+      "automation": "Automatización y herramientas",
+      "science": "Ciencia e investigación",
+      "education": "Educación y formación",
+      "books": "Libros y escritura",
+      "health": "Salud y medicina",
+      "fitness": "Deporte y bienestar",
+      "sports": "Deportes",
+      "gaming": "Videojuegos y esports",
+      "music": "Música",
+      "film": "Cine y TV",
+      "podcast": "Pódcast y audio",
+      "art": "Arte y diseño",
+      "photography": "Fotografía",
+      "comedy": "Comedia",
+      "food": "Comida y bebida",
+      "travel": "Viajes y lugares",
+      "fashion": "Moda y belleza",
+      "home_garden": "Hogar y jardín",
+      "diy": "Bricolaje y manualidades",
+      "automotive": "Coches y motor",
+      "animals": "Animales y mascotas",
+      "family": "Familia y crianza",
+      "nonprofit": "ONG y benéficas",
+      "government": "Gobierno y sector público",
+      "community": "Comunidad local",
+      "activism": "Activismo y defensa",
+      "environment": "Medio ambiente y sostenibilidad",
+      "religion": "Religión y espiritualidad",
+      "other": "Otra"
     },
     "create": {
       "title": "Crear cuenta",
@@ -1772,8 +1814,9 @@
         "invalidChars": "Solo letras, números, guiones y guiones bajos",
         "checkFailed": "No se pudo comprobar la disponibilidad"
       },
-      "organizationCategory": {
-        "label": "Tipo de organización"
+      "accountCategory": {
+        "label": "Categorías",
+        "hint": "Elige hasta {{max}}. La primera es tu categoría principal."
       },
       "toasts": {
         "success": "Cuenta creada",
@@ -1796,6 +1839,7 @@
       "title": "Miembros",
       "subtitle": "Personas con acceso a esta cuenta.",
       "empty": "Aún no hay miembros.",
+      "inherited": "Heredado",
       "actions": {
         "remove": "Eliminar miembro",
         "transfer": "Transferir propiedad"

package/dist/esm/index.js

@@ -38,7 +38,7 @@ export { OxyAppDataIdentifierError } from './mixins/OxyServices.appData.js';
 export { getNormalizedUserId, normalizeUserIdentity, normalizeUserIdentityOrNull, } from './utils/userIdentity.js';
 export { getCanonicalUserHandle, getNormalizedUserHandle, } from './utils/userHandle.js';
 export { normalizeProfileLinks } from './utils/profileLinks.js';
-export { ORGANIZATION_CATEGORIES } from './mixins/OxyServices.accounts.js';
+export { ACCOUNT_CATEGORY_IDS, MAX_ACCOUNT_CATEGORIES, SELECTABLE_ACCOUNT_CATEGORY_IDS, isSelectableAccountCategoryId, kindAcceptsAccountCategories, } from './mixins/OxyServices.accounts.js';
 // ---------------------------------------------------------------------------
 // Reputation (Oxy Trust: ledger, balances, disputes, rules, influence).
 // The whole type family — the closed value sets, the two balance views and the
@@ -173,7 +173,13 @@ export { deviceStateToClientSessions, activeSessionIdOf, activeUserOf, accountId
 // chooser: device sign-ins ∪ account graph, deduped by accountId). Pure +
 // I/O-free — the caller hydrates profiles via `getUsersByIds`. Shared by
 // `@oxyhq/services` and auth.oxy.so so the list can't diverge.
-export { projectSwitchableAccounts, switchableAccountIds, } from './session/accountProjection.js';
+// `isSwitchTargetAccount` is the switcher's own question ("can I become this
+// account?"), exported so a surface that renders `AccountNode`s rather than the
+// projection — the Console's workspace switcher, the accounts app's
+// managed-accounts rows — asks the SAME question instead of testing a kind
+// literal. It is NOT `isActAsEligibleKind`: that one is false for `personal`
+// too, so gating a switcher on it alone empties the list.
+export { isSwitchTargetAccount, projectSwitchableAccounts, switchableAccountIds, } from './session/accountProjection.js';
 // Headless controller for the unified account dialog. Framework-agnostic
 // state machine + subscribe/getSnapshot store (bind via `useSyncExternalStore`)
 // — sign-in is passkey (WebAuthn) or the Commons QR / shared-keychain handoff;

package/dist/esm/mixins/OxyServices.accounts.js

@@ -1,6 +1,8 @@
 import { normalizeUserIdentity } from '../utils/userIdentity.js';
+import { evictOxyIdentityCache } from '../utils/identityCacheSweep.js';
+import { evictOxyAccountForestCache, oxyAccountDetailCacheKey, OXY_ACCOUNT_PER_ACCOUNT_CACHE_PREFIX } from '../utils/accountCacheSweep.js';
 import { CACHE_TIMES } from './mixinHelpers.js';
-export { ACCOUNT_KINDS, ORGANIZATION_CATEGORIES, isActAsEligibleKind } from '@oxyhq/contracts';
+export { ACCOUNT_CATEGORY_IDS, ACCOUNT_KINDS, MAX_ACCOUNT_CATEGORIES, SELECTABLE_ACCOUNT_CATEGORY_IDS, isActAsEligibleKind, isSelectableAccountCategoryId, kindAcceptsAccountCategories, } from '@oxyhq/contracts';
 export function OxyServicesAccountsMixin(Base) {
     return class extends Base {
         constructor(...args) {
@@ -112,7 +114,7 @@ export function OxyServicesAccountsMixin(Base) {
                 const res = await this.makeRequest('POST', '/accounts', data, { cache: false });
                 // A new account changes the accessible forest — bust every cached list
                 // (flat + tree) so it appears on the next `listAccounts()` read.
-                this._invalidateAccountLists();
+                evictOxyAccountForestCache(this);
                 return res.account;
             }
             catch (error) {
@@ -158,6 +160,18 @@ export function OxyServicesAccountsMixin(Base) {
         /**
          * Update an account's mutable profile fields. Tree placement changes
          * (reparenting) go through the dedicated move endpoint, not here.
+         *
+         * An account IS a user, so this write changes identity — and a profile
+         * screen never reads `/accounts/<id>`. It reads `GET /users/<id>` and
+         * `GET /profiles/username/<handle>`, both cached for 5 minutes in the
+         * CALLER'S OWN process, so busting only the account-graph keys left every
+         * profile surface serving the pre-edit avatar and name for the full TTL
+         * with a perfectly healthy server (the cross-service `oxy:user:invalidate`
+         * signal does not help: it evicts BACKEND caches, and cannot reach a cache
+         * living in a browser tab). {@link evictOxyIdentityCache} owns that key
+         * list — see its docs for why the handle-keyed entries are prefix-swept
+         * (a RENAME leaves the old handle's entry unreachable by any targeted key).
+         *
          * @param accountId - The account's Mongo `_id`.
          * @param data - Subset of updatable profile fields.
          */
@@ -166,8 +180,15 @@ export function OxyServicesAccountsMixin(Base) {
                 const res = await this.makeRequest('PATCH', `/accounts/${encodeURIComponent(accountId)}`, data, { cache: false });
                 // Bust the cached detail and every list (which embeds account profile
                 // data) so neither serves the pre-update snapshot.
-                this.clearCacheEntry(`GET:/accounts/${encodeURIComponent(accountId)}`);
-                this._invalidateAccountLists();
+                evictOxyAccountForestCache(this, accountId);
+                // The parent's children list embeds this account's profile and is keyed
+                // by the PARENT id, so it is reachable only from the response node.
+                const parentAccountId = res.account?.parentAccountId;
+                if (parentAccountId) {
+                    this.clearCacheEntry(`GET:/accounts/${encodeURIComponent(parentAccountId)}/children`);
+                }
+                // Every identity read of this account, whichever key it lands under.
+                evictOxyIdentityCache(this, accountId);
                 return res.account;
             }
             catch (error) {
@@ -184,10 +205,9 @@ export function OxyServicesAccountsMixin(Base) {
             try {
                 const result = await this.makeRequest('DELETE', `/accounts/${encodeURIComponent(accountId)}`, undefined, { cache: false });
                 // Bust every cached representation of the archived account.
-                this.clearCacheEntry(`GET:/accounts/${encodeURIComponent(accountId)}`);
                 this.clearCacheEntry(`GET:/accounts/${encodeURIComponent(accountId)}/members`);
                 this.clearCacheEntry(`GET:/accounts/${encodeURIComponent(accountId)}/credentials`);
-                this._invalidateAccountLists();
+                evictOxyAccountForestCache(this, accountId);
                 return result;
             }
             catch (error) {
@@ -211,7 +231,27 @@ export function OxyServicesAccountsMixin(Base) {
         // Account members
         // =========================================================================
         /**
-         * List members of an account (direct membership rows on the account).
+         * List the members of an account: the membership rows ON it, plus the rows
+         * on its ancestors that cascade into it. Each entry carries `source`
+         * (`direct` | `inherited`) saying which it is.
+         *
+         * Inherited entries are members in every sense the server enforces — an
+         * ancestor row with `inherit: true` resolves through
+         * `resolveEffectiveAccess` and confers every account permission on the
+         * descendant, `account:act_as` included — so a roster that omitted them
+         * answered `[]` for accounts several people could act on.
+         *
+         * Two things follow for a caller. An entry's `accountId` is the account its
+         * ROW lives on, so an inherited entry names an ancestor rather than the
+         * account you asked about; and the member-mutation endpoints only accept
+         * rows on the account in the path, so gate any edit/remove/transfer
+         * affordance on `source === 'direct'`.
+         *
+         * Asking what the CALLER holds over an account is a different question, and
+         * scanning this list for yourself is the wrong way to answer it — use
+         * {@link OxyServicesAccountsMixin.getAccount}, whose `callerMembership` is
+         * the server's own resolution.
+         *
          * @param accountId - The account's Mongo `_id`.
          */
         async listAccountMembers(accountId) {
@@ -282,7 +322,7 @@ export function OxyServicesAccountsMixin(Base) {
                 // Ownership change alters roles in the member list AND the detail, and
                 // can change which accounts the caller "owns" in the list view.
                 this._invalidateAccountMembership(accountId);
-                this._invalidateAccountLists();
+                evictOxyAccountForestCache(this);
                 return result;
             }
             catch (error) {
@@ -526,35 +566,29 @@ export function OxyServicesAccountsMixin(Base) {
         // Cache-invalidation helpers
         // =========================================================================
         /**
-         * Bust every cached account list. `listAccounts({tree?})` keys the flat list
-         * as `GET:/accounts` and the tree variant as `GET:/accounts?tree=true` (the
-         * query string is part of the URL path). A change to the accessible forest
-         * (create/archive/ownership transfer) invalidates both, so we clear the
-         * unscoped entry plus every `?`-query variant via a prefix sweep. The prefix
-         * `GET:/accounts?` matches only the query-string list variants, never the
-         * `GET:/accounts/<id>…` detail/sub-resource keys.
+         * Bust the cached member list and detail for an account after a membership
+         * mutation. The member list (`listAccountMembers`) and the detail
+         * (`getAccount`, which can embed the caller's membership) both go stale when
+         * the member set or a member's role changes.
          *
          * Internal helper (leading underscore); not part of the supported public
          * surface. Public rather than `private` because mixins compose into an
          * exported anonymous class, where TypeScript cannot represent a private
          * member in the emitted declaration file (TS4094).
-         */
-        _invalidateAccountLists() {
-            this.clearCacheEntry('GET:/accounts');
-            this.clearCacheByPrefix('GET:/accounts?');
-        }
-        /**
-         * Bust the cached member list and detail for an account after a membership
-         * mutation. The member list (`listAccountMembers`) and the detail
-         * (`getAccount`, which can embed the caller's membership) both go stale when
-         * the member set or a member's role changes.
          *
-         * Internal helper (leading underscore); see `_invalidateAccountLists` for why
-         * this is public rather than `private`.
+         * The forest keys themselves are NOT owned here — see
+         * `utils/accountCacheSweep`, which the user mixin has to reach as well.
          */
         _invalidateAccountMembership(accountId) {
             this.clearCacheEntry(`GET:/accounts/${encodeURIComponent(accountId)}/members`);
-            this.clearCacheEntry(`GET:/accounts/${encodeURIComponent(accountId)}`);
+            this.clearCacheEntry(oxyAccountDetailCacheKey(accountId));
+            // Inherited rows on descendant rosters are derived from this account's
+            // membership table — a targeted clear of only the mutated account's keys
+            // leaves every other cached `…/members` list serving stale inherited
+            // roles until MEDIUM TTL. Sweep all per-account sub-resource keys instead;
+            // the forest list keys (`GET:/accounts`, `GET:/accounts?…`) are excluded
+            // by the trailing slash on the prefix (see accountCacheSweep).
+            this.clearCacheByPrefix(OXY_ACCOUNT_PER_ACCOUNT_CACHE_PREFIX);
         }
         /**
          * Bust every cached application list. `listAccountApps(accountId)` keys each
@@ -565,8 +599,8 @@ export function OxyServicesAccountsMixin(Base) {
          * query-string list variants, never the `GET:/applications/<id>…`
          * detail/sub-resource keys.
          *
-         * Internal helper (leading underscore); see `_invalidateAccountLists` for why
-         * this is public rather than `private`.
+         * Internal helper (leading underscore); see `_invalidateAccountMembership`
+         * for why this is public rather than `private`.
          */
         _invalidateAppLists() {
             this.clearCacheEntry('GET:/applications');