@oxyhq/core 3.10.1 → 3.12.0

package/dist/cjs/AuthManager.js

@@ -340,8 +340,15 @@ class AuthManager {
      * Get default storage based on environment.
      */
     getDefaultStorage() {
-        if (typeof window !== 'undefined' && window.localStorage) {
-            return new LocalStorageAdapter();
+        try {
+            if (typeof window !== 'undefined' && window.localStorage) {
+                return new LocalStorageAdapter();
+            }
+        }
+        catch {
+            // Accessing window.localStorage can throw in opaque-origin/sandboxed
+            // browser contexts or when storage is disabled. Fall back to memory so
+            // AuthManager construction remains safe during provider render.
         }
         return new MemoryStorage();
     }

package/dist/cjs/HttpService.js

@@ -351,13 +351,13 @@ class HttpService {
                 // use fetch on every platform.
                 const useXhrForUpload = isFormData && (0, platform_1.isReactNative)() && typeof XMLHttpRequest !== 'undefined';
                 const response = useXhrForUpload
-                    ? await this.uploadViaXHR(fullUrl, method, headers, bodyValue, controller.signal, timeout)
+                    ? await this.uploadViaXHR(fullUrl, method, headers, bodyValue, controller.signal, timeout, this.shouldSendCredentials(fullUrl))
                     : await fetch(fullUrl, {
                         method,
                         headers,
                         body: bodyValue,
                         signal: controller.signal,
-                        credentials: 'include', // Include cookies for cross-origin requests (CSRF, session)
+                        credentials: this.getCredentialsMode(fullUrl),
                     });
                 if (timeoutId)
                     clearTimeout(timeoutId);
@@ -383,7 +383,7 @@ class HttpService {
                             const errBody = await clonedResponse.json();
                             if (errBody?.code === 'CSRF_TOKEN_INVALID' || errBody?.code === 'CSRF_TOKEN_MISSING') {
                                 this.tokenStore.clearCsrfToken();
-                                return this.request({ ...config, _isCsrfRetry: true, retry: false });
+                                return this.request({ ...config, _isCsrfRetry: true, retry: false, deduplicate: false });
                             }
                         }
                         catch {
@@ -417,7 +417,10 @@ class HttpService {
                 // Handle different response types (optimized - read response once)
                 const contentType = response.headers.get('content-type');
                 let responseData;
-                if (contentType && contentType.includes('application/json')) {
+                if (config.responseType === 'blob') {
+                    responseData = await response.blob();
+                }
+                else if (contentType && contentType.includes('application/json')) {
                     // Use response.json() directly for better performance
                     try {
                         responseData = await response.json();
@@ -528,13 +531,14 @@ class HttpService {
      * (status checks, 401/403 retries, JSON/blob/text parsing) is identical
      * to the fetch path.
      */
-    uploadViaXHR(url, method, headers, body, abortSignal, timeout) {
+    uploadViaXHR(url, method, headers, body, abortSignal, timeout, withCredentials) {
         return new Promise((resolve, reject) => {
             const xhr = new XMLHttpRequest();
             xhr.open(method, url, true);
-            // withCredentials mirrors fetch's `credentials: 'include'` so the
-            // session cookie and CSRF cookie continue to flow.
-            xhr.withCredentials = true;
+            // Only send ambient cookies to the configured API origin. Absolute
+            // caller-supplied URLs can target arbitrary origins, so they must not
+            // receive credential-bearing requests by default.
+            xhr.withCredentials = withCredentials;
             // Forward headers but skip Content-Type — XHR sets the multipart
             // boundary automatically and overriding it breaks the upload.
             for (const [key, value] of Object.entries(headers)) {
@@ -687,6 +691,17 @@ class HttpService {
         const queryString = searchParams.toString();
         return queryString ? `${base}${base.includes('?') ? '&' : '?'}${queryString}` : base;
     }
+    getCredentialsMode(url) {
+        return this.shouldSendCredentials(url) ? 'include' : 'omit';
+    }
+    shouldSendCredentials(url) {
+        try {
+            return new URL(url).origin === new URL(this.baseURL).origin;
+        }
+        catch {
+            return false;
+        }
+    }
     /**
      * Fetch CSRF token from server (with deduplication)
      * Required for state-changing requests (POST, PUT, PATCH, DELETE)
@@ -721,8 +736,11 @@ class HttpService {
                     this.logger.debug('CSRF fetch response:', response.status, response.ok);
                     if (response.ok) {
                         const data = await response.json();
-                        this.logger.debug('CSRF response data:', data);
                         const token = data.csrfToken || null;
+                        this.logger.debug('CSRF response data:', {
+                            hasCsrfToken: typeof token === 'string' && token.length > 0,
+                            csrfTokenLength: token?.length,
+                        });
                         this.tokenStore.setCsrfToken(token);
                         this.logger.debug('CSRF token fetched');
                         return token;

package/dist/cjs/OxyServices.base.js

@@ -232,8 +232,9 @@ class OxyServicesBase {
         }
         try {
             const decoded = (0, jwt_decode_1.jwtDecode)(accessToken);
-            this._cachedUserId = decoded.userId || decoded.id || null;
-            return this._cachedUserId;
+            const userId = decoded.userId || decoded.id || null;
+            this._cachedUserId = userId;
+            return userId;
         }
         catch {
             this._cachedUserId = null;

package/dist/cjs/crypto/canonicalJson.js

@@ -0,0 +1,107 @@
+"use strict";
+/**
+ * Canonical JSON (RFC 8785 / JCS-style) serialization.
+ *
+ * `canonicalize(value)` produces a deterministic string for any JSON-compatible
+ * value so that a client which SIGNS a record and a server which VERIFIES it
+ * agree byte-for-byte on the signing input — regardless of the order in which
+ * object keys happen to be written, how the value was deserialized, or which
+ * runtime built it.
+ *
+ * This is the load-bearing primitive for the self-sovereign identity layer's
+ * signed records (`SignatureService.signRecord` + the API's record-verify path):
+ * both sides import THIS function from `@oxyhq/core`, so cross-implementation
+ * number/string formatting differences cannot cause a verify mismatch.
+ *
+ * Rules (the JSON Canonicalization Scheme subset we need):
+ *  - Objects: keys are sorted (ascending, by UTF-16 code unit — the default
+ *    `Array.prototype.sort` order) and serialized recursively. Properties whose
+ *    value is `undefined`, a function, or a symbol are OMITTED (matching
+ *    `JSON.stringify` object semantics).
+ *  - Arrays: element order is PRESERVED; `undefined`/function/symbol elements
+ *    serialize to `null` (matching `JSON.stringify` array semantics).
+ *  - `null`, booleans, strings, and finite numbers serialize via the standard
+ *    JSON representation.
+ *  - Values exposing a `toJSON()` method (e.g. `Date`) are replaced by its
+ *    result first, then serialized — so a `Date` and its ISO-string equivalent
+ *    canonicalize identically (the wire always carries the string form).
+ *  - Non-finite numbers (`NaN`, `Infinity`) and `bigint` are not part of the
+ *    JSON data model and throw, rather than silently producing `null`.
+ *
+ * Platform-agnostic — zero dependencies, no `require()`, no react/react-native/
+ * expo. Safe in the dual CJS + ESM build.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalize = canonicalize;
+function hasToJSON(value) {
+    return typeof value.toJSON === 'function';
+}
+/**
+ * Serialize a single value into its canonical JSON fragment. Recursive; called
+ * on each nested member. Object keys are sorted at every level.
+ */
+function serialize(value) {
+    if (value === null) {
+        return 'null';
+    }
+    const valueType = typeof value;
+    if (valueType === 'number') {
+        if (!Number.isFinite(value)) {
+            throw new Error('canonicalize: non-finite numbers cannot be serialized');
+        }
+        return JSON.stringify(value);
+    }
+    if (valueType === 'string' || valueType === 'boolean') {
+        return JSON.stringify(value);
+    }
+    if (valueType === 'bigint') {
+        throw new Error('canonicalize: bigint values cannot be serialized');
+    }
+    if (Array.isArray(value)) {
+        const items = value.map((item) => {
+            const itemType = typeof item;
+            // JSON array semantics: undefined / function / symbol become null so the
+            // element positions (and therefore the array length) are preserved.
+            if (item === undefined || itemType === 'function' || itemType === 'symbol') {
+                return 'null';
+            }
+            return serialize(item);
+        });
+        return `[${items.join(',')}]`;
+    }
+    if (valueType === 'object') {
+        const obj = value;
+        if (hasToJSON(obj)) {
+            return serialize(obj.toJSON());
+        }
+        const record = obj;
+        const parts = [];
+        for (const key of Object.keys(record).sort()) {
+            const member = record[key];
+            const memberType = typeof member;
+            // JSON object semantics: properties with undefined / function / symbol
+            // values are omitted entirely.
+            if (member === undefined || memberType === 'function' || memberType === 'symbol') {
+                continue;
+            }
+            parts.push(`${JSON.stringify(key)}:${serialize(member)}`);
+        }
+        return `{${parts.join(',')}}`;
+    }
+    // undefined / function / symbol at the top level have no JSON representation.
+    throw new Error(`canonicalize: cannot serialize a value of type ${valueType}`);
+}
+/**
+ * Produce the canonical JSON string for `value`.
+ *
+ * Deterministic: two structurally-equal values yield identical strings even if
+ * their object keys were written in different orders. Use this — never an
+ * ad-hoc `JSON.stringify` of a hand-sorted object — as the signing input for
+ * signed records, so client signing and server verification cannot drift.
+ *
+ * @throws if `value` (or any nested member used as the top-level/primitive)
+ *   contains a non-finite number or a `bigint`, which have no JSON form.
+ */
+function canonicalize(value) {
+    return serialize(value);
+}

package/dist/cjs/crypto/keyManager.js

@@ -61,9 +61,9 @@ const STORAGE_KEYS = {
 /**
  * iOS Keychain Access Group for sharing identities across Oxy apps
  * All Oxy apps must have this access group enabled in their entitlements
- * Format: [Team ID].com.oxy.shared or group.com.oxy.shared
+ * Format: [Team ID].so.oxy.shared or group.so.oxy.shared
  */
-const IOS_KEYCHAIN_GROUP = 'group.com.oxy.shared';
+const IOS_KEYCHAIN_GROUP = 'group.so.oxy.shared';
 /**
  * Android Account Manager type for shared authentication
  * Used with sharedUserId to share sessions across apps
@@ -695,11 +695,25 @@ class KeyManager {
             throw new IdentityPersistError('Stored identity failed crypto self-test', error);
         }
         // Step 3: The new primary is durable and functional. NOW it is safe to
-        // refresh the backup to the new key. If this final backup write fails the
-        // user still has a fully working primary, and the backup still holds the
-        // PREVIOUS good identity — so we log and continue rather than failing the
-        // whole operation (failing here would be strictly worse: a working
-        // primary would be reported as an error to the caller).
+        // refresh the backup to the new key. This is part of the successful write
+        // contract: returning success while the backup still belongs to the
+        // previous identity would allow a later restore with an absent primary to
+        // silently switch the device back to the previous account. Snapshot the
+        // backup first so a partial backup refresh can be rolled back along with
+        // the primary before surfacing the failure.
+        let priorBackupPrivate;
+        let priorBackupPublic;
+        let priorBackupTimestamp;
+        try {
+            priorBackupPrivate = await store.getItemAsync(STORAGE_KEYS.BACKUP_PRIVATE_KEY);
+            priorBackupPublic = await store.getItemAsync(STORAGE_KEYS.BACKUP_PUBLIC_KEY);
+            priorBackupTimestamp = await store.getItemAsync(STORAGE_KEYS.BACKUP_TIMESTAMP);
+        }
+        catch (error) {
+            loggerUtils_1.logger.error('Failed to snapshot identity backup before refresh', error, { component: 'KeyManager' });
+            await KeyManager._rollbackPrimary(store, priorPrivate, priorPublic);
+            throw new IdentityPersistError('Failed to snapshot identity backup before refresh', error);
+        }
         try {
             await store.setItemAsync(STORAGE_KEYS.BACKUP_PRIVATE_KEY, canonicalPrivate, {
                 keychainAccessible: store.WHEN_UNLOCKED_THIS_DEVICE_ONLY,
@@ -708,12 +722,57 @@ class KeyManager {
             await store.setItemAsync(STORAGE_KEYS.BACKUP_TIMESTAMP, Date.now().toString());
         }
         catch (error) {
-            loggerUtils_1.logger.warn('Primary identity persisted successfully but refreshing the backup failed; primary is usable, backup may be stale', { component: 'KeyManager' }, error);
+            loggerUtils_1.logger.error('Failed to refresh identity backup after primary write', error, { component: 'KeyManager' });
+            await KeyManager._rollbackBackup(store, priorBackupPrivate, priorBackupPublic, priorBackupTimestamp);
+            await KeyManager._rollbackPrimary(store, priorPrivate, priorPublic);
+            throw new IdentityPersistError('Failed to refresh identity backup after primary write', error);
         }
         // Update cache only after we are certain the identity is durable.
         KeyManager.cachedPublicKey = canonicalPublic;
         KeyManager.cachedHasIdentity = true;
     }
+    /**
+     * Restore the backup slot to a previously-snapshotted state. Best-effort so
+     * the original persistence error remains the one surfaced to the caller.
+     *
+     * @internal
+     */
+    static async _rollbackBackup(store, priorBackupPrivate, priorBackupPublic, priorBackupTimestamp) {
+        try {
+            if (priorBackupPrivate) {
+                await store.setItemAsync(STORAGE_KEYS.BACKUP_PRIVATE_KEY, priorBackupPrivate, {
+                    keychainAccessible: store.WHEN_UNLOCKED_THIS_DEVICE_ONLY,
+                });
+            }
+            else {
+                try {
+                    await store.deleteItemAsync(STORAGE_KEYS.BACKUP_PRIVATE_KEY);
+                }
+                catch { /* best effort */ }
+            }
+            if (priorBackupPublic) {
+                await store.setItemAsync(STORAGE_KEYS.BACKUP_PUBLIC_KEY, priorBackupPublic);
+            }
+            else {
+                try {
+                    await store.deleteItemAsync(STORAGE_KEYS.BACKUP_PUBLIC_KEY);
+                }
+                catch { /* best effort */ }
+            }
+            if (priorBackupTimestamp) {
+                await store.setItemAsync(STORAGE_KEYS.BACKUP_TIMESTAMP, priorBackupTimestamp);
+            }
+            else {
+                try {
+                    await store.deleteItemAsync(STORAGE_KEYS.BACKUP_TIMESTAMP);
+                }
+                catch { /* best effort */ }
+            }
+        }
+        catch (rollbackError) {
+            loggerUtils_1.logger.error('Failed to roll back identity backup after a failed refresh', rollbackError, { component: 'KeyManager' });
+        }
+    }
     /**
      * Restore the primary slot to a previously-snapshotted (privA, pubA) pair,
      * or delete it entirely if there was no prior identity. Best-effort: every

package/dist/cjs/crypto/signatureService.js

@@ -7,13 +7,55 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SignatureService = void 0;
+exports.signedRecordSigningInput = signedRecordSigningInput;
+exports.computeRecordId = computeRecordId;
 const elliptic_1 = require("elliptic");
 const keyManager_1 = require("./keyManager");
+const canonicalJson_1 = require("./canonicalJson");
 const platform_1 = require("../utils/platform");
 const platformCrypto_1 = require("../utils/platformCrypto");
 const loggerUtils_1 = require("../utils/loggerUtils");
 const debugUtils_1 = require("../shared/utils/debugUtils");
 const ec = new elliptic_1.ec('secp256k1');
+/**
+ * Compute the canonical signing input for a signed-record envelope.
+ *
+ * This is the single definition of "what the signature covers". `@oxyhq/core`
+ * (client signing) and `@oxyhq/api` (server verification) both call this, so a
+ * record signed by a client and verified by the server cannot drift.
+ *
+ * - **v1**: the canonical JSON of `{version, type, subject, issuer, record,
+ *   issuedAt}` — BYTE-IDENTICAL to the original scheme, so every signature
+ *   already in production keeps verifying.
+ * - **v2**: the canonical JSON additionally includes the hash-chain fields
+ *   `{seq, prev, collection, rkey}`. Because {@link canonicalize} sorts keys,
+ *   the on-the-wire field order is irrelevant; the resulting canonical key
+ *   order is `collection, issuedAt, issuer, prev, record, rkey, seq, subject,
+ *   type, version`. `prev` is `null` at genesis (serialized as `null`, not
+ *   omitted), so it is always part of the signed bytes.
+ */
+function signedRecordSigningInput(fields) {
+    const { version, type, subject, issuer, record, issuedAt } = fields;
+    if (version === 2) {
+        const { seq, prev, collection, rkey } = fields;
+        return (0, canonicalJson_1.canonicalize)({ version, type, subject, issuer, record, issuedAt, seq, prev, collection, rkey });
+    }
+    return (0, canonicalJson_1.canonicalize)({ version, type, subject, issuer, record, issuedAt });
+}
+/**
+ * Compute the `recordId` (content address) of a signed record: the SHA-256 hex
+ * digest of its canonical {@link signedRecordSigningInput}.
+ *
+ * Deterministic and stable across runtimes (it reuses the same canonicalization
+ * + SHA-256 the signature itself is built on). The recordId is what `prev`
+ * references in the per-subject hash chain, so `@oxyhq/core` (client) and
+ * `@oxyhq/api` (server) MUST compute it identically — both call this function.
+ * It is taken over the SIGNING input (excluding `publicKey`/`signature`), so it
+ * is a pure content address of the record's meaning, independent of who signed.
+ */
+async function computeRecordId(fields) {
+    return sha256(signedRecordSigningInput(fields));
+}
 /**
  * Compute SHA-256 hash of a string
  */
@@ -201,6 +243,36 @@ class SignatureService {
             timestamp,
         };
     }
+    /**
+     * Create a signed authentication challenge response using the SHARED identity
+     * key (the cross-app `group.so.oxy.shared` keychain key), not the primary
+     * device key.
+     *
+     * Mirrors {@link signChallenge} exactly — same message format
+     * (`auth:${publicKey}:${challenge}:${timestamp}`) so the server verification
+     * path is unchanged — but sources the shared public/private key from
+     * `KeyManager` and signs with `signWithKey`. Used by "Sign in with Oxy"
+     * same-device shared-keychain SSO (Mechanism A): a sibling native app proves
+     * control of the shared identity to mint its own session.
+     *
+     * Throws if no shared identity exists (native-only; the shared keychain is
+     * unavailable on web).
+     */
+    static async signChallengeWithSharedKey(challenge) {
+        const publicKey = await keyManager_1.KeyManager.getSharedPublicKey();
+        const privateKey = await keyManager_1.KeyManager.getSharedPrivateKey();
+        if (!publicKey || !privateKey) {
+            throw new Error('No shared identity found. Cannot sign with the shared key.');
+        }
+        const timestamp = Date.now();
+        const message = `auth:${publicKey}:${challenge}:${timestamp}`;
+        const signature = await SignatureService.signWithKey(message, privateKey);
+        return {
+            challenge: signature,
+            publicKey,
+            timestamp,
+        };
+    }
     /**
      * Verify a challenge response
      */
@@ -255,6 +327,123 @@ class SignatureService {
             timestamp,
         };
     }
+    /**
+     * Build a signed-record envelope for a self-issued identity/profile record.
+     *
+     * The envelope is self-issued: `issuer` equals `subject` (the signer's DID).
+     * The signature covers the canonical JSON of every field EXCEPT `publicKey`
+     * and `signature` (see {@link signedRecordSigningInput}); `alg` is
+     * `ES256K-DER-SHA256` (secp256k1 over the SHA-256 of the canonical bytes,
+     * DER-encoded), the same scheme this service uses everywhere else.
+     *
+     * Requires a stored identity (native secure storage); throws if none exists.
+     *
+     * @param type - The record category (`'identity'` or `'profile'`).
+     * @param subject - The subject DID the record is about (also the issuer).
+     * @param record - The arbitrary record payload to attest to.
+     */
+    static async signRecord(type, subject, record) {
+        const publicKey = await keyManager_1.KeyManager.getPublicKey();
+        if (!publicKey) {
+            throw new Error('No identity found. Please create or import an identity first.');
+        }
+        const version = 1;
+        const issuer = subject;
+        const issuedAt = Date.now();
+        const signingInput = signedRecordSigningInput({
+            version,
+            type,
+            subject,
+            issuer,
+            record,
+            issuedAt,
+        });
+        const signature = await SignatureService.sign(signingInput);
+        return {
+            version,
+            type,
+            subject,
+            issuer,
+            record,
+            issuedAt,
+            publicKey,
+            alg: 'ES256K-DER-SHA256',
+            signature,
+        };
+    }
+    /**
+     * Build a signed-record envelope (v2) carrying the per-subject hash-chain
+     * fields.
+     *
+     * Identical to {@link signRecord} (self-issued: `issuer === subject`; same
+     * `ES256K-DER-SHA256` scheme over {@link signedRecordSigningInput}) but
+     * `version` is `2` and the signed bytes additionally cover the chain fields:
+     *
+     * @param type - The record category.
+     * @param subject - The subject DID the record is about (also the issuer).
+     * @param record - The arbitrary record payload to attest to.
+     * @param chain - The hash-chain coordinates:
+     *   - `seq` — strictly-increasing sequence number for this subject's chain.
+     *   - `prev` — the `recordId` of the previous record, or `null` at genesis.
+     *   - `collection` + `rkey` — the AtProto-style record key.
+     *
+     * The caller is responsible for fetching the current chain head (so `seq` /
+     * `prev` are correct) before signing. Requires a stored identity; throws if
+     * none exists.
+     */
+    static async signRecordV2(type, subject, record, chain) {
+        const publicKey = await keyManager_1.KeyManager.getPublicKey();
+        if (!publicKey) {
+            throw new Error('No identity found. Please create or import an identity first.');
+        }
+        const version = 2;
+        const issuer = subject;
+        const issuedAt = Date.now();
+        const { seq, prev, collection, rkey } = chain;
+        const signingInput = signedRecordSigningInput({
+            version,
+            type,
+            subject,
+            issuer,
+            record,
+            issuedAt,
+            seq,
+            prev,
+            collection,
+            rkey,
+        });
+        const signature = await SignatureService.sign(signingInput);
+        return {
+            version,
+            type,
+            subject,
+            issuer,
+            record,
+            issuedAt,
+            seq,
+            prev,
+            collection,
+            rkey,
+            publicKey,
+            alg: 'ES256K-DER-SHA256',
+            signature,
+        };
+    }
+    /**
+     * Verify a signed-record envelope: recompute the canonical signing input from
+     * the envelope's own fields and check the signature against the envelope's
+     * `publicKey`.
+     *
+     * Note: this confirms the signature is internally consistent with the
+     * embedded `publicKey`. It does NOT establish that `publicKey` is an
+     * authorized verification method for `subject` — that authorization check is
+     * the server's responsibility (it asserts the key is a current verification
+     * method on the subject's DID).
+     */
+    static async verifyRecord(envelope) {
+        const signingInput = signedRecordSigningInput(envelope);
+        return SignatureService.verify(signingInput, envelope.signature, envelope.publicKey);
+    }
 }
 exports.SignatureService = SignatureService;
 exports.default = SignatureService;

package/dist/cjs/index.js

@@ -18,10 +18,10 @@
  * If a symbol does not appear here, it is NOT part of the public API.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.isRTLLocale = exports.normalizeLanguageCode = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.RecoveryPhraseService = exports.SignatureService = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.ServiceCredentialMismatchError = exports.createCrossDomainAuth = exports.CrossDomainAuth = exports.createAuthManager = exports.AuthManager = exports.oxyClient = exports.OXY_CLOUD_URL = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.OxyServices = void 0;
-exports.isRequiredNumber = exports.isRequiredString = exports.isValidPassword = exports.isValidUsername = exports.isValidEmail = exports.PASSWORD_REGEX = exports.USERNAME_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.translate = exports.createDebugLogger = exports.debugError = exports.debugWarn = exports.debugLog = exports.isDev = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = void 0;
-exports.guardActive = exports.isCentralIdPOrigin = exports.buildSsoBounceUrl = exports.getSsoCallbackBootstrapScript = exports.ssoNavigate = exports.ssoCallbackBootstrapKey = exports.ssoAttemptedKey = exports.ssoNoSessionKey = exports.ssoDestKey = exports.ssoGuardKey = exports.ssoStateKey = exports.SSO_GUARD_TTL_MS = exports.SSO_CALLBACK_PATH = exports.generateSsoState = exports.consumeSsoReturn = exports.parseSsoReturnFragment = exports.resolveCentralAuthUrl = exports.CENTRAL_IDP_APEX = exports.CENTRAL_AUTH_URL = exports.registrableApex = exports.autoDetectAuthWebUrl = exports.getAccountColor = exports.mergeAccountsFromRefreshAll = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.logPerformance = exports.logPayment = exports.logDevice = exports.logUser = exports.logSession = exports.logApi = exports.logAuth = exports.LogLevel = exports.logger = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = void 0;
-exports.packageInfo = exports.runColdBoot = void 0;
+exports.setPlatformOS = exports.getPlatformOS = exports.isRTLLocale = exports.normalizeLanguageCode = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.RecoveryPhraseService = exports.canonicalize = exports.computeRecordId = exports.signedRecordSigningInput = exports.SignatureService = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.verifyPublicCardAttestation = exports.parseAttestPayload = exports.parseIdPayload = exports.buildUserDid = exports.normalizeProfileLinks = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.ServiceCredentialMismatchError = exports.createCrossDomainAuth = exports.CrossDomainAuth = exports.createAuthManager = exports.AuthManager = exports.oxyClient = exports.OXY_CLOUD_URL = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.OxyServices = void 0;
+exports.retryAsync = exports.validateRequiredFields = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.translate = exports.createDebugLogger = exports.debugError = exports.debugWarn = exports.debugLog = exports.isDev = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = void 0;
+exports.ssoDestKey = exports.ssoGuardKey = exports.ssoStateKey = exports.SSO_GUARD_TTL_MS = exports.SSO_CALLBACK_PATH = exports.generateSsoState = exports.consumeSsoReturn = exports.parseSsoReturnFragment = exports.resolveCentralAuthUrl = exports.CENTRAL_IDP_APEX = exports.CENTRAL_AUTH_URL = exports.registrableApex = exports.autoDetectAuthWebUrl = exports.getAccountColor = exports.mergeAccountsFromRefreshAll = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.logPerformance = exports.logPayment = exports.logDevice = exports.logUser = exports.logSession = exports.logApi = exports.logAuth = exports.LogLevel = exports.logger = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = exports.isRequiredNumber = exports.isRequiredString = exports.isValidPassword = exports.isValidUsername = exports.isValidEmail = exports.PASSWORD_REGEX = exports.USERNAME_REGEX = exports.EMAIL_REGEX = void 0;
+exports.packageInfo = exports.runColdBoot = exports.guardActive = exports.isCentralIdPOrigin = exports.buildSsoBounceUrl = exports.getSsoCallbackBootstrapScript = exports.ssoNavigate = exports.ssoCallbackBootstrapKey = exports.ssoAttemptedKey = exports.ssoNoSessionKey = void 0;
 // Ensure crypto polyfills are loaded before anything else
 require("./crypto/polyfill");
 // ---------------------------------------------------------------------------
@@ -57,6 +57,28 @@ Object.defineProperty(exports, "normalizeUserIdentityOrNull", { enumerable: true
 var userHandle_1 = require("./utils/userHandle");
 Object.defineProperty(exports, "getCanonicalUserHandle", { enumerable: true, get: function () { return userHandle_1.getCanonicalUserHandle; } });
 Object.defineProperty(exports, "getNormalizedUserHandle", { enumerable: true, get: function () { return userHandle_1.getNormalizedUserHandle; } });
+var profileLinks_1 = require("./utils/profileLinks");
+Object.defineProperty(exports, "normalizeProfileLinks", { enumerable: true, get: function () { return profileLinks_1.normalizeProfileLinks; } });
+// ---------------------------------------------------------------------------
+// Self-sovereign identity (DID, signed records, auth-method ↔ VM mapping,
+// verified domains). Wire shapes (DidDocument, SignedRecordEnvelope,
+// AuthMethodsResponse, VerifiedDomain, DomainVerificationInstructions,
+// ExportBundle) live in `@oxyhq/contracts` — import them directly from there.
+// ---------------------------------------------------------------------------
+var OxyServices_identity_1 = require("./mixins/OxyServices.identity");
+Object.defineProperty(exports, "buildUserDid", { enumerable: true, get: function () { return OxyServices_identity_1.buildUserDid; } });
+// ---------------------------------------------------------------------------
+// Civic / Commons "Oxy ID" (public signed cards + Oxy ID QR payload) and Fase 2
+// anti-gaming (real-life attestation QR + validator/jury). Wire shapes
+// (PublicCard, SignedPublicCard, RealLifeAttestationResult,
+// ValidationRequestSummary, ValidationVoteResult, ValidationVerdict, …) live in
+// `@oxyhq/contracts` — import them from there. The SDK adds the client verdict
+// wrapper, the QR payload parsers/builders, and the submit inputs/results.
+// ---------------------------------------------------------------------------
+var OxyServices_civic_1 = require("./mixins/OxyServices.civic");
+Object.defineProperty(exports, "parseIdPayload", { enumerable: true, get: function () { return OxyServices_civic_1.parseIdPayload; } });
+Object.defineProperty(exports, "parseAttestPayload", { enumerable: true, get: function () { return OxyServices_civic_1.parseAttestPayload; } });
+Object.defineProperty(exports, "verifyPublicCardAttestation", { enumerable: true, get: function () { return OxyServices_civic_1.verifyPublicCardAttestation; } });
 // ---------------------------------------------------------------------------
 // Auth helpers (token refresh, error normalisation, retry policies)
 // ---------------------------------------------------------------------------
@@ -83,6 +105,10 @@ Object.defineProperty(exports, "IdentityAlreadyExistsError", { enumerable: true,
 Object.defineProperty(exports, "IdentityPersistError", { enumerable: true, get: function () { return keyManager_1.IdentityPersistError; } });
 var signatureService_1 = require("./crypto/signatureService");
 Object.defineProperty(exports, "SignatureService", { enumerable: true, get: function () { return signatureService_1.SignatureService; } });
+Object.defineProperty(exports, "signedRecordSigningInput", { enumerable: true, get: function () { return signatureService_1.signedRecordSigningInput; } });
+Object.defineProperty(exports, "computeRecordId", { enumerable: true, get: function () { return signatureService_1.computeRecordId; } });
+var canonicalJson_1 = require("./crypto/canonicalJson");
+Object.defineProperty(exports, "canonicalize", { enumerable: true, get: function () { return canonicalJson_1.canonicalize; } });
 var recoveryPhrase_1 = require("./crypto/recoveryPhrase");
 Object.defineProperty(exports, "RecoveryPhraseService", { enumerable: true, get: function () { return recoveryPhrase_1.RecoveryPhraseService; } });
 // ---------------------------------------------------------------------------

package/dist/cjs/mixins/OxyServices.assets.js

@@ -441,7 +441,9 @@ function OxyServicesAssetsMixin(Base) {
             return urlRes?.url || null;
         }
         async fetchAssetContent(url, type) {
-            const response = await fetch(url, { credentials: 'include' });
+            const response = await fetch(url, {
+                credentials: shouldSendAssetCredentials(url, this.getBaseURL()) ? 'include' : 'omit',
+            });
             if (!response?.ok) {
                 throw new Error(`Failed to fetch asset content (status ${response?.status})`);
             }
@@ -449,3 +451,16 @@ function OxyServicesAssetsMixin(Base) {
         }
     };
 }
+/**
+ * Only send ambient credentials (cookies) when the asset URL is same-origin with
+ * the configured API base. Caller-supplied cross-origin asset URLs must not leak
+ * the user's cookies to arbitrary hosts.
+ */
+function shouldSendAssetCredentials(url, baseURL) {
+    try {
+        return new URL(url).origin === new URL(baseURL).origin;
+    }
+    catch {
+        return false;
+    }
+}