@oxyhq/core 20.0.0 → 21.0.0

package/dist/esm/mixins/OxyServices.store.js

@@ -0,0 +1,263 @@
+import { CACHE_TIMES } from './mixinHelpers.js';
+/** Read one page out of that envelope. */
+function pageOf(res) {
+    return {
+        items: res.data ?? [],
+        total: res.pagination?.total ?? 0,
+        hasMore: res.pagination?.hasMore ?? false,
+    };
+}
+/**
+ * Build a query string from the options that were actually supplied.
+ *
+ * Generic over the options object rather than taking a `Record`: an interface
+ * has no implicit index signature in TypeScript, so `StoreReviewsOptions` would
+ * not be assignable to one and every call site would need a cast.
+ */
+function queryOf(params) {
+    const search = new URLSearchParams();
+    for (const [key, value] of Object.entries(params)) {
+        if (value !== undefined)
+            search.set(key, String(value));
+    }
+    const rendered = search.toString();
+    return rendered ? `?${rendered}` : '';
+}
+export function OxyServicesStoreMixin(Base) {
+    return class extends Base {
+        constructor(...args) {
+            super(...args);
+        }
+        // =========================================================================
+        // The storefront — /store. No authentication: everything served is public.
+        // =========================================================================
+        /** The shelves, in the order the store curates them. */
+        async listStoreCategories() {
+            try {
+                const res = await this.makeRequest('GET', '/store/categories', undefined, { cache: true, cacheTTL: CACHE_TIMES.MEDIUM });
+                return res.data ?? [];
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Published listings, newest first, optionally one shelf.
+         *
+         * An unknown category slug is an EMPTY shelf, not every app on the store —
+         * so a typo shows nothing rather than showing everything.
+         *
+         * @param options - `category` is a category slug; `limit` defaults to 24.
+         */
+        async listStoreApps(options = {}) {
+            try {
+                const res = await this.makeRequest('GET', `/store/apps${queryOf(options)}`, undefined, { cache: true, cacheTTL: CACHE_TIMES.SHORT });
+                return pageOf(res);
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * One store page.
+         *
+         * A draft answers 404 exactly as an unknown slug does: whether an
+         * unpublished page exists under a name is not something a visitor learns.
+         *
+         * @param slug - The listing's public slug, not an application id.
+         */
+        async getStoreApp(slug) {
+            try {
+                const res = await this.makeRequest('GET', `/store/apps/${encodeURIComponent(slug)}`, undefined, { cache: true, cacheTTL: CACHE_TIMES.SHORT });
+                return res.data;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /** Visible reviews for a published app, each with the publisher's reply. */
+        async listStoreReviews(slug, options = {}) {
+            try {
+                const res = await this.makeRequest('GET', `/store/apps/${encodeURIComponent(slug)}/reviews${queryOf(options)}`, undefined, { cache: true, cacheTTL: CACHE_TIMES.SHORT });
+                return pageOf(res);
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        // =========================================================================
+        // Reviewing — any signed-in Oxy account
+        // =========================================================================
+        /** The caller's own review of an app, or `null` if they have not written one. */
+        async getMyStoreReview(slug) {
+            try {
+                const res = await this.makeRequest('GET', `/store/apps/${encodeURIComponent(slug)}/review`, undefined, { cache: false });
+                return res.data ?? null;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Write the caller's review, or replace what they said before.
+         *
+         * A person has one review per app, so this sets it rather than adding one.
+         * Rewriting does not clear a moderator's decision: a hidden review stays
+         * hidden when its author edits it.
+         */
+        async writeStoreReview(slug, input) {
+            try {
+                const res = await this.makeRequest('PUT', `/store/apps/${encodeURIComponent(slug)}/review`, input, { cache: false });
+                return res.data;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /** Withdraw the caller's own review. A real delete — the words were theirs. */
+        async deleteMyStoreReview(slug) {
+            try {
+                await this.makeRequest('DELETE', `/store/apps/${encodeURIComponent(slug)}/review`, undefined, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Answer a review on the publisher's behalf.
+         *
+         * Requires `app:update` over the application's owning account — the same
+         * permission that guards every other write to that application. Addressed
+         * by review id because the reply belongs to the review, and a listing can be
+         * renamed or withdrawn out from under it.
+         */
+        async replyToStoreReview(reviewId, body) {
+            try {
+                const res = await this.makeRequest('PUT', `/store/reviews/${encodeURIComponent(reviewId)}/reply`, { body }, { cache: false });
+                return res.data;
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /** Withdraw the publisher's answer. Same permission that wrote it. */
+        async deleteStoreReviewReply(reviewId) {
+            try {
+                await this.makeRequest('DELETE', `/store/reviews/${encodeURIComponent(reviewId)}/reply`, undefined, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        // =========================================================================
+        // The publisher's listing — /applications/:appId/listing
+        // =========================================================================
+        /** The application's store page in whatever state, or `null` if it has none. */
+        async getAppListing(applicationId) {
+            try {
+                return await this.makeRequest('GET', `/applications/${encodeURIComponent(applicationId)}/listing`, undefined, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Create the page or replace its content. Never its status.
+         *
+         * Editing does not move a page: correcting a typo on a live listing leaves
+         * it live, and fixing a rejected one does not re-submit it.
+         */
+        async writeAppListing(applicationId, input) {
+            try {
+                return await this.makeRequest('PUT', `/applications/${encodeURIComponent(applicationId)}/listing`, input, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /** Hand the page to the store for review. From a draft, or a rejected page once fixed. */
+        async submitAppListing(applicationId) {
+            try {
+                return await this.makeRequest('POST', `/applications/${encodeURIComponent(applicationId)}/listing/submit`, undefined, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Take the page down, or withdraw it from the queue.
+         *
+         * Back to a draft, never deleted: the slug, the words and the screenshots
+         * are the publisher's work, and the reviews were never the listing's to take
+         * with them.
+         */
+        async unpublishAppListing(applicationId) {
+            try {
+                return await this.makeRequest('POST', `/applications/${encodeURIComponent(applicationId)}/listing/unpublish`, undefined, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        // =========================================================================
+        // Screenshots
+        // =========================================================================
+        /** Every picture on the listing, in the author's order. */
+        async listAppListingScreenshots(applicationId) {
+            try {
+                return await this.makeRequest('GET', `/applications/${encodeURIComponent(applicationId)}/listing/screenshots`, undefined, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Attach an already-uploaded image, appended to the end.
+         *
+         * Upload through the assets surface first; the store keeps a reference
+         * rather than a second copy of the asset pipeline. The file must be live, an
+         * image, and one the caller is entitled to.
+         */
+        async addAppListingScreenshot(applicationId, input) {
+            try {
+                return await this.makeRequest('POST', `/applications/${encodeURIComponent(applicationId)}/listing/screenshots`, input, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /** Edit a picture's caption or the frame it was taken in. Order is {@link reorderAppListingScreenshots}. */
+        async updateAppListingScreenshot(applicationId, screenshotId, input) {
+            try {
+                return await this.makeRequest('PATCH', `/applications/${encodeURIComponent(applicationId)}/listing/screenshots/${encodeURIComponent(screenshotId)}`, input, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /** Remove a picture. The uploaded file stays — it may be in use elsewhere. */
+        async deleteAppListingScreenshot(applicationId, screenshotId) {
+            try {
+                await this.makeRequest('DELETE', `/applications/${encodeURIComponent(applicationId)}/listing/screenshots/${encodeURIComponent(screenshotId)}`, undefined, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+        /**
+         * Set the order of every picture at once.
+         *
+         * Send EVERY id on the listing, exactly once, in the order they should
+         * appear. A partial list is rejected rather than applied: it would leave the
+         * pictures it omits at their old positions, interleaved with the new ones.
+         */
+        async reorderAppListingScreenshots(applicationId, screenshotIds) {
+            try {
+                return await this.makeRequest('PUT', `/applications/${encodeURIComponent(applicationId)}/listing/screenshots/order`, { screenshotIds }, { cache: false });
+            }
+            catch (error) {
+                throw this.handleError(error);
+            }
+        }
+    };
+}

package/dist/esm/mixins/OxyServices.utility.js

@@ -133,18 +133,41 @@ export function OxyServicesUtilityMixin(Base) {
          * Uses server-side session validation for security (not just JWT decode).
          *
          * **Design note — jwtDecode vs jwt.verify:**
-         * This middleware intentionally uses `jwtDecode()` (decode-only, no signature
-         * verification) for user tokens. This is by design, NOT a security gap:
-         * - Third-party apps using `oxy.auth()` don't have the Oxy JWT secret
-         * - Security comes from API-based session validation (`validateSession()`)
-         *   which checks the session server-side on every request
-         * - Service tokens (type: 'service') DO use cryptographic HMAC verification
-         *   via the `jwtSecret` option, since they are stateless. Service tokens
-         *   are additionally checked for `aud`, `iss`, and `type` claims to prevent
+         * This middleware uses `jwtDecode()` (decode-only, NO signature check) for
+         * user tokens, because third-party apps mounting `oxy.auth()` do not hold
+         * the Oxy signing secret. **Every claim in a user token is therefore
+         * attacker-controlled and proves nothing on its own.** The identity comes
+         * from somewhere else entirely:
+         * - A user token MUST carry a `sessionId`. That session is validated
+         *   server-side on every request via `validateSession()`, and the user id
+         *   is read off the VALIDATED SESSION — never off the token. A token whose
+         *   `userId` claim disagrees with the session is refused
+         *   (`SESSION_USER_MISMATCH`); a token with no `sessionId` at all is
+         *   refused outright (`SESSION_REQUIRED`). There is no local-claims path.
+         * - Service tokens (type: 'service') ARE stateless, so they use
+         *   cryptographic HMAC verification via the `jwtSecret` option, and are
+         *   additionally checked for `aud`, `iss`, and `type` claims to prevent
          *   cross-token-type confusion attacks.
          * - The backend's own `authMiddleware` uses `jwt.verify()` because it has
          *   direct access to `SERVICE_TOKEN_SECRET` / `ACCESS_TOKEN_SECRET`.
          *
+         * **Why session-less user tokens are refused rather than trusted:**
+         * every user access token the Oxy API issues carries a `sessionId` (see
+         * `packages/api/src/utils/sessionUtils.ts`, `generateSessionTokens` — the
+         * only mint site for user tokens, including the OAuth code exchange). So
+         * refusing session-less user tokens costs nothing legitimate, while
+         * accepting them let anyone authenticate as anyone by hand-rolling a JWT
+         * with a `userId` claim and a garbage signature.
+         *
+         * **Why the claimed user id is cross-checked against the session:**
+         * `GET /session/validate/:sessionId` is UNAUTHENTICATED and does not bind
+         * the bearer token — it returns whoever owns the session id it was handed.
+         * Trusting the token's `userId` claim after a successful validation would
+         * therefore let a caller holding ANY live session id (their own, for
+         * instance) pair it with a forged `userId` and be trusted as that user.
+         * `authSocket()` has always cross-checked this; the HTTP middleware now
+         * does too.
+         *
          * **Service-token delegation (X-Oxy-User-Id):**
          * When a service token is accompanied by `X-Oxy-User-Id`, the SDK calls
          * `verifyServiceActingAs(appId, userId)` to confirm an explicit delegation
@@ -407,8 +430,10 @@ export function OxyServicesUtilityMixin(Base) {
                         }
                         return next();
                     }
-                    const userId = decoded.userId || decoded.id;
-                    if (!userId) {
+                    // The CLAIMED user id. Never trusted as an identity — it is only ever
+                    // compared against the id the validated session resolves to.
+                    const claimedUserId = readStringClaim(decoded.userId) ?? readStringClaim(decoded.id);
+                    if (!claimedUserId) {
                         if (optional) {
                             req.userId = null;
                             req.user = null;
@@ -442,111 +467,129 @@ export function OxyServicesUtilityMixin(Base) {
                             return onError(error);
                         return res.status(401).json(error);
                     }
-                    // Validate token against the Oxy API for session-based verification
-                    // This ensures the session hasn't been revoked server-side
-                    if (decoded.sessionId) {
-                        try {
-                            const validationResult = await oxyInstance.validateSession(decoded.sessionId, {
-                                useHeaderValidation: true,
-                            });
-                            if (!validationResult || !validationResult.valid) {
-                                if (optional) {
-                                    req.userId = null;
-                                    req.user = null;
-                                    return next();
-                                }
-                                const error = {
-                                    error: 'INVALID_SESSION',
-                                    message: 'Session invalid or expired',
-                                    code: 'INVALID_SESSION',
-                                    status: 401
-                                };
-                                if (onError)
-                                    return onError(error);
-                                return res.status(401).json(error);
-                            }
-                            // Use validated user data from session validation (already has full user)
-                            req.userId = userId;
-                            req.accessToken = token;
-                            req.sessionId = decoded.sessionId;
-                            if (loadUser && validationResult.user) {
-                                // Session validation already returns full user data
-                                req.user = validationResult.user;
-                            }
-                            else {
-                                req.user = { id: userId };
-                            }
-                            if (debug) {
-                                logger.debug(`[oxy.auth] OK user=${userId} session=${decoded.sessionId}`, {
-                                    component: 'auth',
-                                    method: 'auth',
-                                });
-                            }
+                    // A server-validated session is MANDATORY for a user token. The JWT
+                    // signature is not verified on this path, so a bare decoded token
+                    // proves nothing: without the session round-trip a forged token could
+                    // claim any user id. Mirrors `authSocket()`, which has always
+                    // required this.
+                    const sessionId = readStringClaim(decoded.sessionId);
+                    if (!sessionId) {
+                        if (optional) {
+                            req.userId = null;
+                            req.user = null;
                             return next();
                         }
-                        catch (validationError) {
-                            if (debug) {
-                                logger.debug('[oxy.auth] Session validation failed', {
-                                    component: 'auth',
-                                    method: 'auth',
-                                }, validationError);
-                            }
+                        const error = {
+                            error: 'SESSION_REQUIRED',
+                            message: 'Access token is not bound to a session',
+                            code: 'SESSION_REQUIRED',
+                            status: 401
+                        };
+                        if (onError)
+                            return onError(error);
+                        return res.status(401).json(error);
+                    }
+                    // Validate the token against the Oxy API. This proves the session is
+                    // real and unrevoked, AND yields the identity it belongs to.
+                    try {
+                        const validationResult = await oxyInstance.validateSession(sessionId, {
+                            useHeaderValidation: true,
+                        });
+                        if (!validationResult || !validationResult.valid || !validationResult.user) {
                             if (optional) {
                                 req.userId = null;
                                 req.user = null;
                                 return next();
                             }
                             const error = {
-                                error: 'SESSION_VALIDATION_ERROR',
-                                message: 'Session validation failed',
-                                code: 'SESSION_VALIDATION_ERROR',
+                                error: 'INVALID_SESSION',
+                                message: 'Session invalid or expired',
+                                code: 'INVALID_SESSION',
                                 status: 401
                             };
                             if (onError)
                                 return onError(error);
                             return res.status(401).json(error);
                         }
-                    }
-                    // Non-session token: use local validation only (userId from JWT)
-                    req.userId = userId;
-                    req.accessToken = token;
-                    req.user = { id: userId };
-                    // If loadUser requested with non-session token, fetch from API
-                    if (loadUser) {
-                        try {
-                            // Temporarily set token to make the API call
-                            const prevToken = oxyInstance.getAccessToken();
-                            oxyInstance.setTokens(token);
-                            const fullUser = await oxyInstance.getCurrentUser();
-                            // Restore previous token
-                            if (prevToken) {
-                                oxyInstance.setTokens(prevToken);
-                            }
-                            else {
-                                oxyInstance.clearTokens();
+                        // The session — not the token — is the source of truth for identity.
+                        const validatedUserId = getUserIdentityId(validationResult.user);
+                        if (!validatedUserId) {
+                            if (optional) {
+                                req.userId = null;
+                                req.user = null;
+                                return next();
                             }
-                            if (fullUser) {
-                                req.user = fullUser;
+                            const error = {
+                                error: 'INVALID_SESSION',
+                                message: 'Session did not resolve to a usable identity',
+                                code: 'INVALID_SESSION',
+                                status: 401
+                            };
+                            if (onError)
+                                return onError(error);
+                            return res.status(401).json(error);
+                        }
+                        if (validatedUserId !== claimedUserId) {
+                            // Session-id/claim confusion: the caller presented a live session
+                            // that belongs to somebody else. Worth a warning — it has no
+                            // benign cause. Ids only; never the token or the payload.
+                            logger.warn('[oxy.auth] Token rejected — claimed user does not own the session', {
+                                component: 'auth',
+                                method: 'auth',
+                                claimedUserId,
+                                validatedUserId,
+                            });
+                            if (optional) {
+                                req.userId = null;
+                                req.user = null;
+                                return next();
                             }
+                            const error = {
+                                error: 'SESSION_USER_MISMATCH',
+                                message: 'Token user does not match the session',
+                                code: 'SESSION_USER_MISMATCH',
+                                status: 401
+                            };
+                            if (onError)
+                                return onError(error);
+                            return res.status(401).json(error);
                         }
-                        catch (loadUserError) {
-                            // Loading the full user is best-effort here; the basic { id }
-                            // object is already attached. Log so misconfigured deployments
-                            // can be diagnosed instead of silently failing.
-                            logger.warn('[oxy.auth] loadUser fallback — could not fetch full profile', {
+                        req.userId = validatedUserId;
+                        req.accessToken = token;
+                        req.sessionId = sessionId;
+                        // Session validation already returned the full user, so `loadUser`
+                        // costs no extra round-trip.
+                        req.user = loadUser ? validationResult.user : { id: validatedUserId };
+                        if (debug) {
+                            logger.debug(`[oxy.auth] OK user=${validatedUserId} session=${sessionId}`, {
                                 component: 'auth',
-                                method: 'auth.loadUser',
-                                userId,
-                            }, loadUserError);
+                                method: 'auth',
+                            });
                         }
+                        return next();
                     }
-                    if (debug) {
-                        logger.debug(`[oxy.auth] OK user=${userId} (no session)`, {
-                            component: 'auth',
-                            method: 'auth',
-                        });
+                    catch (validationError) {
+                        if (debug) {
+                            logger.debug('[oxy.auth] Session validation failed', {
+                                component: 'auth',
+                                method: 'auth',
+                            }, validationError);
+                        }
+                        if (optional) {
+                            req.userId = null;
+                            req.user = null;
+                            return next();
+                        }
+                        const error = {
+                            error: 'SESSION_VALIDATION_ERROR',
+                            message: 'Session validation failed',
+                            code: 'SESSION_VALIDATION_ERROR',
+                            status: 401
+                        };
+                        if (onError)
+                            return onError(error);
+                        return res.status(401).json(error);
                     }
-                    next();
                 }
                 catch (error) {
                     const handled = oxyInstance.handleError(error);
@@ -615,7 +658,7 @@ export function OxyServicesUtilityMixin(Base) {
                         }
                         return next(new Error('Invalid token'));
                     }
-                    const claimedUserId = decoded.userId || decoded.id;
+                    const claimedUserId = readStringClaim(decoded.userId) ?? readStringClaim(decoded.id);
                     if (!claimedUserId) {
                         return next(new Error('Invalid token payload'));
                     }
@@ -626,12 +669,13 @@ export function OxyServicesUtilityMixin(Base) {
                     // A server-validated session is mandatory. A bare decoded JWT proves
                     // nothing — the signature is not verified here, so without a session
                     // round-trip a forged token could claim any user id.
-                    if (!decoded.sessionId) {
+                    const sessionId = readStringClaim(decoded.sessionId);
+                    if (!sessionId) {
                         return next(new Error('Session required'));
                     }
                     let userId = claimedUserId;
                     try {
-                        const result = await oxyInstance.validateSession(decoded.sessionId, {
+                        const result = await oxyInstance.validateSession(sessionId, {
                             useHeaderValidation: true,
                         });
                         if (!result || !result.valid || !result.user) {
@@ -661,9 +705,9 @@ export function OxyServicesUtilityMixin(Base) {
                     // reads from `socket.user.id`.
                     socket.data = socket.data || {};
                     socket.data.userId = userId;
-                    socket.data.sessionId = decoded.sessionId || null;
+                    socket.data.sessionId = sessionId;
                     socket.data.token = token;
-                    socket.user = { id: userId, userId, sessionId: decoded.sessionId };
+                    socket.user = { id: userId, userId, sessionId };
                     if (debug) {
                         logger.debug(`[oxy.authSocket] OK user=${userId}`, {
                             component: 'auth',
@@ -807,12 +851,16 @@ async function verifyServiceTokenSignature(token, secret) {
     }
 }
 /**
- * Verify that a decoded service-token payload carries the expected `aud`,
- * `iss`, and `type` claims. Throws `ServiceTokenClaimError` on mismatch.
- * This is the defence against the H4 vulnerability where a recovery / 2FA /
- * access token signed by the same shared secret could be replayed as a
- * service token because no claim binding existed.
+ * Read a JWT claim that is only usable as a non-empty string.
+ *
+ * A decoded payload is attacker-controlled JSON: a claim the type declares as
+ * `string` can arrive as a number, an object, or `null`. Narrowing here keeps
+ * those values out of URL construction and identity comparison, so an
+ * unexpected shape becomes a 401 rather than a stringified surprise.
  */
+function readStringClaim(value) {
+    return typeof value === 'string' && value.length > 0 ? value : null;
+}
 /**
  * Resolve the canonical user id from a validated session's user object.
  *
@@ -825,6 +873,13 @@ function getUserIdentityId(user) {
         ?? user._id;
     return typeof candidate === 'string' && candidate.length > 0 ? candidate : null;
 }
+/**
+ * Verify that a decoded service-token payload carries the expected `aud`,
+ * `iss`, and `type` claims. Throws `ServiceTokenClaimError` on mismatch.
+ * This is the defence against the H4 vulnerability where a recovery / 2FA /
+ * access token signed by the same shared secret could be replayed as a
+ * service token because no claim binding existed.
+ */
 function verifyServiceTokenClaims(decoded, expected) {
     if (decoded.type !== 'service') {
         throw new ServiceTokenClaimError(`Service token has unexpected type '${String(decoded.type)}'`);

package/dist/esm/mixins/index.js

@@ -16,6 +16,7 @@ import { OxyServicesReputationMixin } from './OxyServices.reputation.js';
 import { OxyServicesAssetsMixin } from './OxyServices.assets.js';
 import { OxyServicesAccountsMixin } from './OxyServices.accounts.js';
 import { OxyServicesConnectedAppsMixin } from './OxyServices.connectedApps.js';
+import { OxyServicesStoreMixin } from './OxyServices.store.js';
 import { OxyServicesLocationMixin } from './OxyServices.location.js';
 import { OxyServicesAnalyticsMixin } from './OxyServices.analytics.js';
 import { OxyServicesDevicesMixin } from './OxyServices.devices.js';
@@ -27,6 +28,7 @@ import { OxyServicesContactsMixin } from './OxyServices.contacts.js';
 import { OxyServicesNotificationsMixin } from './OxyServices.notifications.js';
 import { OxyServicesAppDataMixin } from './OxyServices.appData.js';
 import { OxyServicesCivicMixin } from './OxyServices.civic.js';
+import { OxyServicesChainsMixin } from './OxyServices.chains.js';
 import { OxyServicesNodesMixin } from './OxyServices.nodes.js';
 import { OxyServicesLinksMixin } from './OxyServices.links.js';
 import { OxyServicesFollowGraphMixin } from './OxyServices.followGraph.js';
@@ -66,6 +68,10 @@ const MIXIN_PIPELINE = [
     // OAuth-consent surface (public app identity + connected-app grants). Kept
     // separate from account ownership.
     OxyServicesConnectedAppsMixin,
+    // The app store: the public storefront, the reviews on it, and the listing a
+    // publisher edits. A module OVER the platform — turn it off and OAuth still
+    // works — so it is its own surface rather than more of `accounts`.
+    OxyServicesStoreMixin,
     OxyServicesLocationMixin,
     OxyServicesAnalyticsMixin,
     OxyServicesDevicesMixin,
@@ -80,6 +86,7 @@ const MIXIN_PIPELINE = [
     OxyServicesAppDataMixin,
     // Civic / Commons "Oxy ID" (public signed cards, Oxy ID QR payload)
     OxyServicesCivicMixin,
+    OxyServicesChainsMixin,
     // User nodes / decentralization (Fase 5): register/read/revoke/manage the
     // caller's personal data node + ingest hint.
     OxyServicesNodesMixin,