@oxyhq/core 19.1.2 → 20.0.0

package/dist/cjs/HttpService.js

@@ -450,32 +450,37 @@ class HttpService {
                             // Failed to parse error body — not a CSRF error
                         }
                     }
-                    // Try to parse error response (handle empty/malformed JSON)
-                    let errorMessage = `HTTP ${response.status}: ${response.statusText}`;
-                    const contentType = response.headers.get('content-type');
-                    if (contentType && contentType.includes('application/json')) {
+                    // Read the error body (may be absent, non-JSON, empty or malformed).
+                    // Anything unreadable leaves `errorBody` undefined and degrades to the
+                    // status-based message — an error path that throws its own error is
+                    // worse than the error it was reporting.
+                    let errorBody;
+                    const errorContentType = response.headers.get('content-type');
+                    if (errorContentType?.includes('application/json')) {
                         try {
-                            const errorData = await response.json();
-                            // Accept either structured error field from API responses.
-                            if (errorData?.message) {
-                                errorMessage = errorData.message;
-                            }
-                            else if (errorData?.error_description) {
-                                // RFC 6749 §5.2 / RFC 6750 §3 — OAuth endpoints surface human text here.
-                                errorMessage = errorData.error_description;
-                            }
-                            else if (errorData?.error) {
-                                errorMessage = errorData.error;
-                            }
+                            errorBody = await response.json();
                         }
                         catch (parseError) {
                             // Malformed JSON or empty response - use status text
                             this.logger.warn('Failed to parse error response JSON:', parseError);
                         }
                     }
-                    const error = new Error(errorMessage);
+                    // `parseHttpErrorBody` handles every envelope in use, including the
+                    // nested `{ error: { code, message } }` shape — assigning that nested
+                    // OBJECT as the message is what produced `"[object Object]"`.
+                    const parsed = (0, errorUtils_1.parseHttpErrorBody)(errorBody);
+                    const error = new Error(parsed.message ?? `HTTP ${response.status}: ${response.statusText}`);
                     error.status = response.status;
-                    error.response = { status: response.status, statusText: response.statusText };
+                    error.response = { status: response.status, statusText: response.statusText, data: errorBody };
+                    // Only set `code`/`details` when the server actually sent them.
+                    // Assigning `undefined` would still create the property, which changes
+                    // how `handleHttpError` classifies the error downstream.
+                    if (parsed.code !== undefined) {
+                        error.code = parsed.code;
+                    }
+                    if (parsed.details !== undefined) {
+                        error.details = parsed.details;
+                    }
                     throw error;
                 }
                 // Handle different response types (optimized - read response once)

package/dist/cjs/i18n/accountCategoryLabels.js

@@ -0,0 +1,44 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EN_ACCOUNT_CATEGORY_LABELS = void 0;
+exports.accountCategoryLabel = accountCategoryLabel;
+const en_US_json_1 = __importDefault(require("./locales/en-US.json"));
+const index_1 = require("./index");
+/**
+ * Every account category's English name, keyed by its stable id.
+ *
+ * **The annotation is the point.** The vocabulary lives in `@oxyhq/contracts`
+ * and the names live in `locales/en-US.json`, so they are two lists that must
+ * agree and nothing but a type can make them. Declaring the JSON node as a
+ * TOTAL `Record<AccountCategoryId, string>` turns "somebody added a category at
+ * Oxy and nobody wrote its English" into a `TS2741` naming the missing id, at
+ * build time, instead of a picker row that paints `accounts.accountCategory.<id>`
+ * at a user trying to choose one.
+ *
+ * That failure is not hypothetical. The screen previously wrote `t(key) || id`,
+ * whose author believed an unnamed id would degrade to its raw slug. It cannot:
+ * {@link translate} echoes the KEY when it resolves nothing, and a non-empty
+ * string is never falsy, so the `|| id` arm was unreachable and the output was
+ * the dotted key. A runtime fallback that cannot run is worse than none,
+ * because it reads as protection.
+ *
+ * Totality is over `ACCOUNT_CATEGORY_IDS`, which RETAINS withdrawn ids, so an
+ * account still carrying a retired category keeps rendering its name while no
+ * picker offers it again. Retired and unknown are different cases: only an id
+ * outside the union is unnameable, which is why this is keyed by
+ * `AccountCategoryId` and not by `string`.
+ */
+/**
+ * Module-scoped, NOT re-exported from the package index: the annotation is the
+ * whole job, and it does that job without being public API. It carries no
+ * `Object.freeze` and no `Readonly<>` for the same reason — those existed only
+ * to make an exported reference safe from a consumer's stray write, and there
+ * is no such consumer. Exported from the MODULE so its own test can name it.
+ */
+exports.EN_ACCOUNT_CATEGORY_LABELS = en_US_json_1.default.accounts.accountCategory;
+function accountCategoryLabel(locale, id) {
+    return (0, index_1.translate)(locale, `accounts.accountCategory.${id}`);
+}

package/dist/cjs/i18n/accountRoleLabels.js

@@ -0,0 +1,27 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EN_ACCOUNT_ROLE_LABELS = void 0;
+exports.accountRoleLabel = accountRoleLabel;
+const en_US_json_1 = __importDefault(require("./locales/en-US.json"));
+const index_1 = require("./index");
+/**
+ * Every account member role's English name, keyed by its stable id.
+ *
+ * Totality is over the closed `AccountRole` union so a new role without an
+ * English label is a build error, not a members row that paints
+ * `accounts.roles.<role>.label`.
+ */
+exports.EN_ACCOUNT_ROLE_LABELS = {
+    owner: en_US_json_1.default.accounts.roles.owner.label,
+    admin: en_US_json_1.default.accounts.roles.admin.label,
+    editor: en_US_json_1.default.accounts.roles.editor.label,
+    developer: en_US_json_1.default.accounts.roles.developer.label,
+    billing: en_US_json_1.default.accounts.roles.billing.label,
+    viewer: en_US_json_1.default.accounts.roles.viewer.label,
+};
+function accountRoleLabel(locale, role) {
+    return (0, index_1.translate)(locale, `accounts.roles.${role}.label`);
+}

package/dist/cjs/i18n/reputationCategoryLabels.js

@@ -0,0 +1,20 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EN_REPUTATION_CATEGORY_LABELS = void 0;
+exports.reputationCategoryLabel = reputationCategoryLabel;
+const en_US_json_1 = __importDefault(require("./locales/en-US.json"));
+const index_1 = require("./index");
+/**
+ * Every reputation rule category's English name, keyed by its stable id.
+ *
+ * Totality is over `REPUTATION_CATEGORIES` from `@oxyhq/contracts` so a new
+ * category added server-side without an English label is a build error, not a
+ * Trust Rules section title that paints `trust.rules.categories.<id>`.
+ */
+exports.EN_REPUTATION_CATEGORY_LABELS = en_US_json_1.default.trust.rules.categories;
+function reputationCategoryLabel(locale, id) {
+    return (0, index_1.translate)(locale, `trust.rules.categories.${id}`);
+}

package/dist/cjs/i18n/trustTierLabels.js

@@ -0,0 +1,19 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EN_TRUST_TIER_LABELS = void 0;
+exports.trustTierLabel = trustTierLabel;
+const en_US_json_1 = __importDefault(require("./locales/en-US.json"));
+const index_1 = require("./index");
+/**
+ * Every trust tier's English name, keyed by its stable id.
+ *
+ * Totality is over `TRUST_TIERS` from `@oxyhq/contracts` so a new tier without
+ * an English label is a build error, not a chip that paints `trust.tiers.<id>`.
+ */
+exports.EN_TRUST_TIER_LABELS = en_US_json_1.default.trust.tiers;
+function trustTierLabel(locale, tier) {
+    return (0, index_1.translate)(locale, `trust.tiers.${tier}`);
+}

package/dist/cjs/index.js

@@ -20,9 +20,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AEAD_KEY_LENGTH = exports.decryptAead = exports.encryptAead = exports.hkdfSha256 = exports.RecoveryPhraseService = exports.SignatureService = exports.updateIdentityMarker = exports.readIdentityMarker = exports.IdentityUnavailableError = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.verifyPublicCardAttestation = exports.parseAttestPayload = exports.parseIdPayload = exports.buildUserDid = exports.kindAcceptsAccountCategories = exports.isSelectableAccountCategoryId = exports.SELECTABLE_ACCOUNT_CATEGORY_IDS = exports.MAX_ACCOUNT_CATEGORIES = exports.ACCOUNT_CATEGORY_IDS = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.commonsDeliveryPlatform = exports.pushTargetsFromDelivery = exports.selectCommonsDelivery = exports.parseCommonsApprovalExpiresAt = exports.getCommonsApprovalBlockingReason = exports.ServiceCredentialMismatchError = exports.oxyClient = exports.OXY_CLOUD_URL = exports.ServiceAssetMetadataError = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.AssetUrlResolutionError = exports.OxyServices = void 0;
 exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isWebBrowser = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.getPrimaryLanguage = exports.getUserLanguages = exports.isRTLLocale = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.isSupportedLocale = exports.normalizeLocale = exports.getBaseLanguage = exports.FALLBACK_LOCALE = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.deriveSharedSecret = exports.AEAD_NONCE_LENGTH = void 0;
-exports.resetLoggerConfig = exports.getLoggerConfig = exports.configureLogger = exports.createLogger = exports.logger = exports.normalizeMultilineText = exports.normalizeInlineText = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE = exports.DISPLAY_NAME_ORPHANED_MARK_SOURCE = exports.DISPLAY_NAME_DISALLOWED_SOURCE = exports.DISPLAY_NAME_ALLOWED_SCRIPTS = exports.isValidDisplayName = exports.isValidPassword = exports.isValidUsername = exports.isValidEmail = exports.DISPLAY_NAME_INVALID_MESSAGE = exports.MAX_DISPLAY_NAME_LENGTH = exports.PASSWORD_REGEX = exports.USERNAME_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.buildQueryParams = exports.translate = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = void 0;
-exports.createWebIdentityPinStore = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = exports.switchableAccountIds = exports.projectSwitchableAccounts = exports.isSwitchTargetAccount = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isLoopbackOrigin = exports.consumeOAuthReturnPath = exports.persistOAuthReturnPath = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.canonicalizeOAuthRedirectUri = exports.normalizeOAuthRedirectUri = exports.OXY_OAUTH_RETURN_PATH_STORAGE_KEY = exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.runColdBoot = exports.isOxyRpOrigin = exports.CENTRAL_IDP_APEX = exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.isDev = exports.consoleSink = void 0;
-exports.packageInfo = exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.AccountNotOnDeviceError = exports.establishIdentitySession = exports.resolveIdentityPin = exports.IDENTITY_PIN_STORAGE_KEY = exports.identityPinMatches = exports.createMemoryIdentityPinStore = exports.createNativeIdentityPinStore = void 0;
+exports.normalizeInlineText = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE = exports.DISPLAY_NAME_ORPHANED_MARK_SOURCE = exports.DISPLAY_NAME_DISALLOWED_SOURCE = exports.DISPLAY_NAME_ALLOWED_SCRIPTS = exports.isValidDisplayName = exports.isValidPassword = exports.isValidUsername = exports.isValidEmail = exports.DISPLAY_NAME_INVALID_MESSAGE = exports.MAX_DISPLAY_NAME_LENGTH = exports.PASSWORD_REGEX = exports.USERNAME_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.parseHttpErrorBody = exports.isHttpRequestError = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.buildQueryParams = exports.trustTierLabel = exports.reputationCategoryLabel = exports.accountRoleLabel = exports.accountCategoryLabel = exports.translate = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = void 0;
+exports.switchableAccountIds = exports.projectSwitchableAccounts = exports.canSwitchIntoAccount = exports.isSwitchTargetAccount = exports.accountIdsOf = exports.activeUserOf = exports.activeSessionIdOf = exports.deviceStateToClientSessions = exports.createSessionClient = exports.createSessionClientHost = exports.SessionClient = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isLoopbackOrigin = exports.consumeOAuthReturnPath = exports.persistOAuthReturnPath = exports.clearOAuthHandshake = exports.readOAuthHandshake = exports.persistOAuthHandshake = exports.canonicalizeOAuthRedirectUri = exports.normalizeOAuthRedirectUri = exports.OXY_OAUTH_RETURN_PATH_STORAGE_KEY = exports.OXY_OAUTH_REDIRECT_URI_STORAGE_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.OXY_AUTHORIZE_URL = exports.DEFAULT_OAUTH_SCOPE = exports.generatePkcePair = exports.generateOAuthState = exports.computeCodeChallenge = exports.buildOAuthAuthorizeUrl = exports.runColdBoot = exports.isOxyRpOrigin = exports.CENTRAL_IDP_APEX = exports.registrableApex = exports.getAccountColor = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.isDev = exports.consoleSink = exports.resetLoggerConfig = exports.getLoggerConfig = exports.configureLogger = exports.createLogger = exports.logger = exports.normalizeMultilineText = void 0;
+exports.packageInfo = exports.runSessionColdBoot = exports.TOKEN_REFRESH_LEAD_MS = exports.startTokenRefreshScheduler = exports.installAuthRefreshHandler = exports.createAuthRefreshHandler = exports.refreshDeviceSecretArm = exports.refreshPersistedSession = exports.AccountNotOnDeviceError = exports.establishIdentitySession = exports.resolveIdentityPin = exports.IDENTITY_PIN_STORAGE_KEY = exports.identityPinMatches = exports.createMemoryIdentityPinStore = exports.createNativeIdentityPinStore = exports.createWebIdentityPinStore = exports.AUTH_STATE_STORAGE_KEY = exports.createMemoryAuthStateStore = exports.createNativeAuthStateStore = exports.createWebAuthStateStore = exports.createAccountDialogController = exports.AccountDialogController = void 0;
 // Ensure crypto polyfills are loaded before anything else
 require("./crypto/polyfill");
 // ---------------------------------------------------------------------------
@@ -223,6 +223,14 @@ Object.defineProperty(exports, "withRetry", { enumerable: true, get: function ()
 // ---------------------------------------------------------------------------
 var i18n_1 = require("./i18n");
 Object.defineProperty(exports, "translate", { enumerable: true, get: function () { return i18n_1.translate; } });
+var accountCategoryLabels_1 = require("./i18n/accountCategoryLabels");
+Object.defineProperty(exports, "accountCategoryLabel", { enumerable: true, get: function () { return accountCategoryLabels_1.accountCategoryLabel; } });
+var accountRoleLabels_1 = require("./i18n/accountRoleLabels");
+Object.defineProperty(exports, "accountRoleLabel", { enumerable: true, get: function () { return accountRoleLabels_1.accountRoleLabel; } });
+var reputationCategoryLabels_1 = require("./i18n/reputationCategoryLabels");
+Object.defineProperty(exports, "reputationCategoryLabel", { enumerable: true, get: function () { return reputationCategoryLabels_1.reputationCategoryLabel; } });
+var trustTierLabels_1 = require("./i18n/trustTierLabels");
+Object.defineProperty(exports, "trustTierLabel", { enumerable: true, get: function () { return trustTierLabels_1.trustTierLabel; } });
 // ---------------------------------------------------------------------------
 // API request / URL helpers
 // ---------------------------------------------------------------------------
@@ -236,6 +244,8 @@ var errorUtils_2 = require("./utils/errorUtils");
 Object.defineProperty(exports, "ErrorCodes", { enumerable: true, get: function () { return errorUtils_2.ErrorCodes; } });
 Object.defineProperty(exports, "createApiError", { enumerable: true, get: function () { return errorUtils_2.createApiError; } });
 Object.defineProperty(exports, "handleHttpError", { enumerable: true, get: function () { return errorUtils_2.handleHttpError; } });
+Object.defineProperty(exports, "isHttpRequestError", { enumerable: true, get: function () { return errorUtils_2.isHttpRequestError; } });
+Object.defineProperty(exports, "parseHttpErrorBody", { enumerable: true, get: function () { return errorUtils_2.parseHttpErrorBody; } });
 Object.defineProperty(exports, "validateRequiredFields", { enumerable: true, get: function () { return errorUtils_2.validateRequiredFields; } });
 var asyncUtils_1 = require("./utils/asyncUtils");
 Object.defineProperty(exports, "retryAsync", { enumerable: true, get: function () { return asyncUtils_1.retryAsync; } });
@@ -370,14 +380,14 @@ Object.defineProperty(exports, "accountIdsOf", { enumerable: true, get: function
 // chooser: device sign-ins ∪ account graph, deduped by accountId). Pure +
 // I/O-free — the caller hydrates profiles via `getUsersByIds`. Shared by
 // `@oxyhq/services` and auth.oxy.so so the list can't diverge.
-// `isSwitchTargetAccount` is the switcher's own question ("can I become this
-// account?"), exported so a surface that renders `AccountNode`s rather than the
-// projection — the Console's workspace switcher, the accounts app's
-// managed-accounts rows — asks the SAME question instead of testing a kind
-// literal. It is NOT `isActAsEligibleKind`: that one is false for `personal`
-// too, so gating a switcher on it alone empties the list.
+// `isSwitchTargetAccount` is the structural half ("is this kind switchable at
+// all?"); `canSwitchIntoAccount` adds the caller's `account:act_as` permission.
+// Both are exported so surfaces that render `AccountNode`s rather than the
+// projection — the Console workspace switcher, managed-accounts rows — ask the
+// SAME questions instead of testing a kind literal.
 var accountProjection_1 = require("./session/accountProjection");
 Object.defineProperty(exports, "isSwitchTargetAccount", { enumerable: true, get: function () { return accountProjection_1.isSwitchTargetAccount; } });
+Object.defineProperty(exports, "canSwitchIntoAccount", { enumerable: true, get: function () { return accountProjection_1.canSwitchIntoAccount; } });
 Object.defineProperty(exports, "projectSwitchableAccounts", { enumerable: true, get: function () { return accountProjection_1.projectSwitchableAccounts; } });
 Object.defineProperty(exports, "switchableAccountIds", { enumerable: true, get: function () { return accountProjection_1.switchableAccountIds; } });
 // Headless controller for the unified account dialog. Framework-agnostic

package/dist/cjs/mixins/OxyServices.followGraph.js

@@ -159,6 +159,23 @@ function OxyServicesFollowGraphMixin(Base) {
                 throw this.handleError(error);
             }
         }
+        /**
+         * Release a namespace the calling application holds, when nothing is
+         registered inside it yet.
+         *
+         * Idempotent when the namespace is already unowned (`released: false`).
+         * Exists because claims are first-come and registration runs on boot — a
+         * development build with the wrong client id can bind a name permanently
+         * unless the holder can give it back.
+         */
+        async releaseFollowNamespace(namespace) {
+            try {
+                return await this.makeRequest('DELETE', `/v2/follow-targets/namespaces/${encodeURIComponent(namespace)}`, undefined, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
         /**
          * Declare what following a kind of thing MEANS: the verb clients render,
          * whether reverse lookups are public, whether it federates.

package/dist/cjs/session/accountProjection.js

@@ -19,6 +19,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isSwitchTargetAccount = isSwitchTargetAccount;
+exports.canSwitchIntoAccount = canSwitchIntoAccount;
 exports.projectSwitchableAccounts = projectSwitchableAccounts;
 exports.switchableAccountIds = switchableAccountIds;
 const contracts_1 = require("@oxyhq/contracts");
@@ -53,6 +54,30 @@ const userHandle_1 = require("../utils/userHandle");
 function isSwitchTargetAccount(node) {
     return node.relationship === 'self' || (0, contracts_1.isActAsEligibleKind)(node.kind);
 }
+/**
+ * Whether the caller may switch INTO this account — the server-side
+ * `account:act_as` gate plus the structural {@link isSwitchTargetAccount} rule.
+ *
+ * `relationship: 'self'` always passes (returning to the caller's own personal
+ * account). Every other ground requires a switch-eligible kind AND
+ * `account:act_as` in the resolved membership permissions. When permissions are
+ * absent but the relationship is `owner`, the owner baseline is assumed — the
+ * API always resolves effective permissions for owned accounts, but test
+ * fixtures and stale rows may omit the membership blob.
+ */
+function canSwitchIntoAccount(node) {
+    if (node.relationship === 'self') {
+        return true;
+    }
+    if (!isSwitchTargetAccount(node)) {
+        return false;
+    }
+    const permissions = node.callerMembership?.permissions;
+    if (permissions) {
+        return permissions.includes('account:act_as');
+    }
+    return node.relationship === 'owner';
+}
 /**
  * Pure union of device sign-ins and account-graph nodes into the flat
  * {@link SwitchableAccount}[] every switcher renders.
@@ -62,9 +87,9 @@ function isSwitchTargetAccount(node) {
  * and a graph node is deduped into ONE device row enriched with the graph
  * metadata (relationship / kind / parent / membership).
  *
- * Graph nodes that are not switch targets — a `channel`, which nobody may act
- * as — are omitted. {@link isSwitchTargetAccount} is the rule; see the filter
- * below.
+ * Graph nodes the caller cannot switch into — a `channel`, or a managed account
+ * whose membership lacks `account:act_as` — are omitted.
+ * {@link canSwitchIntoAccount} is the rule; see the filter below.
  */
 function projectSwitchableAccounts(input) {
     const { state, graph, profilesById, activeUser, locale, resolveAvatarUrl } = input;
@@ -144,7 +169,7 @@ function projectSwitchableAccounts(input) {
         // An account already on the device skipped this check via the branch above,
         // and correctly: whatever its kind, the caller is signed into it, so
         // switching is a local activation that asks the server for nothing.
-        if (!isSwitchTargetAccount(node)) {
+        if (!canSwitchIntoAccount(node)) {
             continue;
         }
         remember(toRow(node.account, {
@@ -166,7 +191,7 @@ function projectSwitchableAccounts(input) {
  * document, but including their ids lets the caller pass one id set and lets the
  * projection prefer freshly-fetched profiles uniformly.
  *
- * Applies the SAME {@link isSwitchTargetAccount} filter as
+ * Applies the SAME {@link canSwitchIntoAccount} filter as
  * {@link projectSwitchableAccounts} to graph nodes, so this never fetches a
  * profile for a row the projection will drop — and, just as importantly, never
  * SKIPS one the projection will keep, which would leave that row unrendered
@@ -180,7 +205,7 @@ function switchableAccountIds(state, graph) {
         }
     }
     for (const node of graph) {
-        if (node.accountId && isSwitchTargetAccount(node)) {
+        if (node.accountId && canSwitchIntoAccount(node)) {
             ids.add(node.accountId);
         }
     }

package/dist/cjs/utils/errorUtils.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ErrorCodes = void 0;
+exports.isHttpRequestError = isHttpRequestError;
+exports.parseHttpErrorBody = parseHttpErrorBody;
 exports.createApiError = createApiError;
 exports.handleHttpError = handleHttpError;
 exports.getErrorCodeFromStatus = getErrorCodeFromStatus;
@@ -37,6 +39,63 @@ exports.ErrorCodes = {
     NETWORK_ERROR: 'NETWORK_ERROR',
     CONNECTION_FAILED: 'CONNECTION_FAILED'
 };
+/**
+ * Narrow a caught value to {@link HttpRequestError}.
+ *
+ * Returns `false` for a plain {@link ApiError} object (those are objects, not
+ * `Error`s) — run an arbitrary thrown value through {@link handleHttpError}
+ * first if you need one normalized.
+ */
+function isHttpRequestError(value) {
+    if (!(value instanceof Error)) {
+        return false;
+    }
+    return typeof value.status === 'number';
+}
+const isPlainRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+const nonEmptyString = (value) => typeof value === 'string' && value.trim().length > 0 ? value : undefined;
+/**
+ * Extract `message` / `code` / `details` from a parsed HTTP error response body.
+ *
+ * Handles every error envelope in use across the Oxy ecosystem:
+ *
+ * - `{ error: { code, message, details? } }` — nested envelope (CrowdSource and
+ *   other Oxy services). Never stringify the nested object: `new Error(obj)`
+ *   yields the literal message `"[object Object]"`.
+ * - `{ error: '<CODE>', message, details? }` — oxy-api's canonical shape
+ *   (`ApiError.toJSON`), where the top-level `error` field IS the code.
+ * - `{ error: '<CODE>', error_description }` — RFC 6749 §5.2 / RFC 6750 §3, the
+ *   OAuth token and userinfo endpoints. `error_description` is the human text
+ *   and `error` is the machine code, so both survive.
+ * - `{ message, code }` — e.g. the API's CSRF rejections.
+ * - `{ error: '<human message>' }` — legacy hand-rolled routes. With no sibling
+ *   `message`/`error_description` the string is the message, not a code: a bare
+ *   `error` string is not machine-readable enough to promote to `code`.
+ *
+ * Anything else — a non-object body (`null`, `[]`, `"str"`, `42`), or an object
+ * carrying none of these fields — yields an empty result, leaving the caller on
+ * its status-based fallback message. Total function: never throws.
+ */
+function parseHttpErrorBody(body) {
+    if (!isPlainRecord(body)) {
+        return {};
+    }
+    const nested = isPlainRecord(body.error) ? body.error : undefined;
+    const errorString = nonEmptyString(body.error);
+    // A sibling that proves the top-level `error` is a CODE rather than prose.
+    const siblingMessage = nonEmptyString(body.message) ?? nonEmptyString(body.error_description);
+    return {
+        message: siblingMessage ?? (nested ? nonEmptyString(nested.message) : errorString),
+        code: (nested ? nonEmptyString(nested.code) : undefined) ??
+            nonEmptyString(body.code) ??
+            (siblingMessage ? errorString : undefined),
+        details: isPlainRecord(body.details)
+            ? body.details
+            : nested && isPlainRecord(nested.details)
+                ? nested.details
+                : undefined,
+    };
+}
 /**
  * Create a standardized API error
  */
@@ -81,7 +140,12 @@ function handleHttpError(error) {
         const fetchError = error;
         const status = fetchError.response?.status || fetchError.status;
         if (status) {
-            return createApiError(fetchError.message || `HTTP ${status} error`, getErrorCodeFromStatus(status), status);
+            // `details` is carried through when present: a body may ship structured
+            // detail without a machine-readable `code` (which is what routes the
+            // error to the already-an-ApiError branch above), and dropping it here
+            // would make it unreachable to every caller that rethrows via
+            // `OxyServices.handleError`.
+            return createApiError(fetchError.message || `HTTP ${status} error`, getErrorCodeFromStatus(status), status, isPlainRecord(fetchError.details) ? fetchError.details : undefined);
         }
     }
     // Handle standard errors