@oxyhq/core 4.0.1 → 5.1.0

package/dist/types/HttpService.d.ts

@@ -79,7 +79,6 @@ export declare class HttpService {
      * Each listener receives the resulting access token, or `null` when cleared.
      */
     private _tokenChangeListeners;
-    private _actingAsUserId;
     private requestMetrics;
     constructor(config: OxyConfig);
     private syncAccessTokenFromProvider;
@@ -153,9 +152,9 @@ export declare class HttpService {
      * Derive a stable, non-sensitive identity discriminator for cache scoping.
      *
      * Thin instance wrapper over the pure {@link computeIdentityTag} helper —
-     * binds it to this instance's live access token and acting-as id. See that
-     * function's docs for the full resolution contract (anon fallback, decoded
-     * `userId || id`, token-hash fallback for undecodable tokens).
+     * binds it to this instance's live access token. See that function's docs for
+     * the full resolution contract (anon fallback, decoded `userId || id`,
+     * token-hash fallback for undecodable tokens).
      */
     private computeIdentityTag;
     /**
@@ -209,8 +208,6 @@ export declare class HttpService {
     put<T = unknown>(url: string, data?: unknown, config?: Omit<RequestConfig, 'method' | 'url' | 'data'>): Promise<T>;
     patch<T = unknown>(url: string, data?: unknown, config?: Omit<RequestConfig, 'method' | 'url' | 'data'>): Promise<T>;
     delete<T = unknown>(url: string, config?: Omit<RequestConfig, 'method' | 'url'>): Promise<T>;
-    setActingAs(userId: string | null): void;
-    getActingAs(): string | null;
     setTokens(accessToken: string): void;
     setAuthRefreshHandler(handler: AuthRefreshHandler | null): void;
     setAccessTokenProvider(provider: AccessTokenProvider | null): void;

package/dist/types/OxyServices.base.d.ts

@@ -153,23 +153,6 @@ export declare class OxyServicesBase {
      * the per-request preflight refresh; this powers the idle/background timer.
      */
     getAccessTokenExpiry(): number | null;
-    /**
-     * Set the acting-as identity for managed accounts.
-     *
-     * When set, all subsequent API requests will include the `X-Acting-As` header,
-     * causing the server to attribute actions to the managed account. The
-     * authenticated user must be an authorized manager of the target account.
-     *
-     * Pass `null` to clear and revert to the authenticated user's own identity.
-     *
-     * @param userId - The managed account user ID, or null to clear
-     */
-    setActingAs(userId: string | null): void;
-    /**
-     * Get the current acting-as identity (managed account user ID), or null
-     * if operating as the authenticated user's own identity.
-     */
-    getActingAs(): string | null;
     /**
      * Wait for authentication to be ready
      *

package/dist/types/crypto/polyfill.d.ts

@@ -6,8 +6,8 @@
  *
  * - Browser/Node.js: Uses native crypto
  * - React Native: Uses expo-crypto (statically imported via the
- *   per-platform `platformCrypto` module — see that file's doc-comment for
- *   how platform routing works).
+ *   per-platform `platform/crypto` module in `@oxyhq/protocol` — see that
+ *   file's doc-comment for how platform routing works).
  */
 import { Buffer } from 'buffer';
 export { Buffer };

package/dist/types/crypto/signatureService.d.ts

@@ -1,51 +1,13 @@
 /**
- * Signature Service - ECDSA Digital Signatures
+ * Signature Service - ECDSA Digital Signatures (device-key bound)
  *
- * Handles signing and verification of messages using ECDSA secp256k1.
- * Used for authenticating requests and proving identity ownership.
+ * Handles signing and verification of messages with the user's DEVICE identity
+ * key (read from {@link KeyManager} / secure storage). All cryptography itself —
+ * canonical signing input, SHA-256, secp256k1 sign/verify, envelope assembly —
+ * is delegated to `@oxyhq/protocol`; this service only resolves the key from
+ * storage and orchestrates the protocol primitives.
  */
 import type { SignedRecordEnvelope } from '@oxyhq/contracts';
-/**
- * The signing-input portion of a {@link SignedRecordEnvelope}: every field
- * EXCEPT the `publicKey` and `signature`. Both the client (when signing) and
- * the server (when verifying) canonicalize exactly these fields, so they agree
- * on the bytes that the signature covers.
- *
- * The v2 chain fields (`seq`/`prev`/`collection`/`rkey`) are optional: a v1
- * envelope omits them and is signed over only the base fields; a v2 envelope
- * carries them and includes them in the signed bytes.
- */
-export type SignedRecordSigningFields = Pick<SignedRecordEnvelope, 'version' | 'type' | 'subject' | 'issuer' | 'record' | 'issuedAt'> & Partial<Pick<SignedRecordEnvelope, 'seq' | 'prev' | 'collection' | 'rkey'>>;
-/**
- * Compute the canonical signing input for a signed-record envelope.
- *
- * This is the single definition of "what the signature covers". `@oxyhq/core`
- * (client signing) and `@oxyhq/api` (server verification) both call this, so a
- * record signed by a client and verified by the server cannot drift.
- *
- * - **v1**: the canonical JSON of `{version, type, subject, issuer, record,
- *   issuedAt}` — BYTE-IDENTICAL to the original scheme, so every signature
- *   already in production keeps verifying.
- * - **v2**: the canonical JSON additionally includes the hash-chain fields
- *   `{seq, prev, collection, rkey}`. Because {@link canonicalize} sorts keys,
- *   the on-the-wire field order is irrelevant; the resulting canonical key
- *   order is `collection, issuedAt, issuer, prev, record, rkey, seq, subject,
- *   type, version`. `prev` is `null` at genesis (serialized as `null`, not
- *   omitted), so it is always part of the signed bytes.
- */
-export declare function signedRecordSigningInput(fields: SignedRecordSigningFields): string;
-/**
- * Compute the `recordId` (content address) of a signed record: the SHA-256 hex
- * digest of its canonical {@link signedRecordSigningInput}.
- *
- * Deterministic and stable across runtimes (it reuses the same canonicalization
- * + SHA-256 the signature itself is built on). The recordId is what `prev`
- * references in the per-subject hash chain, so `@oxyhq/core` (client) and
- * `@oxyhq/api` (server) MUST compute it identically — both call this function.
- * It is taken over the SIGNING input (excluding `publicKey`/`signature`), so it
- * is a pure content address of the record's meaning, independent of who signed.
- */
-export declare function computeRecordId(fields: SignedRecordSigningFields): Promise<string>;
 export interface SignedMessage {
     message: string;
     signature: string;
@@ -68,29 +30,10 @@ export declare class SignatureService {
      */
     static hashMessage(message: string): Promise<string>;
     /**
-     * Sign a message using the stored private key
+     * Sign a message using the stored device private key
      * Returns the signature in DER format (hex encoded)
      */
     static sign(message: string): Promise<string>;
-    /**
-     * Sign a message with an explicit private key (without storing)
-     * Useful for one-time operations or testing
-     */
-    static signWithKey(message: string, privateKey: string): Promise<string>;
-    /**
-     * Verify a signature against a message and public key
-     *
-     * Returns false on any error (invalid signature, malformed input, etc.).
-     * Errors are logged at debug level so they're available when troubleshooting
-     * signature mismatches but don't surface to the caller.
-     */
-    static verify(message: string, signature: string, publicKey: string): Promise<boolean>;
-    /**
-     * Synchronous verification (for Node.js backend)
-     * Uses crypto module directly for hashing
-     * Note: This method should only be used in Node.js environments
-     */
-    static verifySync(message: string, signature: string, publicKey: string): boolean;
     /**
      * Create a signed message object with metadata
      */
@@ -113,9 +56,10 @@ export declare class SignatureService {
      * Mirrors {@link signChallenge} exactly — same message format
      * (`auth:${publicKey}:${challenge}:${timestamp}`) so the server verification
      * path is unchanged — but sources the shared public/private key from
-     * `KeyManager` and signs with `signWithKey`. Used by "Sign in with Oxy"
-     * same-device shared-keychain SSO (Mechanism A): a sibling native app proves
-     * control of the shared identity to mint its own session.
+     * `KeyManager` and signs with the protocol's explicit-key {@link signMessage}.
+     * Used by "Sign in with Oxy" same-device shared-keychain SSO (Mechanism A): a
+     * sibling native app proves control of the shared identity to mint its own
+     * session.
      *
      * Throws if no shared identity exists (native-only; the shared keychain is
      * unavailable on web).
@@ -149,9 +93,11 @@ export declare class SignatureService {
      *
      * The envelope is self-issued: `issuer` equals `subject` (the signer's DID).
      * The signature covers the canonical JSON of every field EXCEPT `publicKey`
-     * and `signature` (see {@link signedRecordSigningInput}); `alg` is
-     * `ES256K-DER-SHA256` (secp256k1 over the SHA-256 of the canonical bytes,
-     * DER-encoded), the same scheme this service uses everywhere else.
+     * and `signature`; `alg` is `ES256K-DER-SHA256` (secp256k1 over the SHA-256 of
+     * the canonical bytes, DER-encoded). The cryptography is delegated to the
+     * protocol's {@link signEnvelope}, which derives the (uncompressed-hex)
+     * `publicKey` from the stored device key — identical to the registered
+     * verification method.
      *
      * Requires a stored identity (native secure storage); throws if none exists.
      *
@@ -165,8 +111,8 @@ export declare class SignatureService {
      * fields.
      *
      * Identical to {@link signRecord} (self-issued: `issuer === subject`; same
-     * `ES256K-DER-SHA256` scheme over {@link signedRecordSigningInput}) but
-     * `version` is `2` and the signed bytes additionally cover the chain fields:
+     * `ES256K-DER-SHA256` scheme) but `version` is `2` and the signed bytes
+     * additionally cover the chain fields:
      *
      * @param type - The record category.
      * @param subject - The subject DID the record is about (also the issuer).
@@ -186,17 +132,5 @@ export declare class SignatureService {
         collection: string;
         rkey: string;
     }): Promise<SignedRecordEnvelope>;
-    /**
-     * Verify a signed-record envelope: recompute the canonical signing input from
-     * the envelope's own fields and check the signature against the envelope's
-     * `publicKey`.
-     *
-     * Note: this confirms the signature is internally consistent with the
-     * embedded `publicKey`. It does NOT establish that `publicKey` is an
-     * authorized verification method for `subject` — that authorization check is
-     * the server's responsibility (it asserts the key is a current verification
-     * method on the subject's DID).
-     */
-    static verifyRecord(envelope: SignedRecordEnvelope): Promise<boolean>;
 }
 export default SignatureService;

package/dist/types/index.d.ts

@@ -42,7 +42,7 @@ export type { CanonicalUserHandleInput, UserHandleInput } from './utils/userHand
 export { normalizeProfileLinks } from './utils/profileLinks';
 export type { ProfileLink, ProfileLinkMetadata } from './utils/profileLinks';
 export type { PublicApplication, ConnectedApp, } from './mixins/OxyServices.connectedApps';
-export type { AccountKind, AccountRelationship, AccountRole, AccountMemberStatus, AccountMemberSource, AccountMember, AccountNode, AccountCredentialType, AccountCredentialEnvironment, AccountCredentialStatus, AccountCredential, AccountCredentialWithSecret, RotateAccountCredentialResult, ListAccountsOptions, CreateAccountInput, UpdateAccountInput, InviteAccountMemberInput, UpdateAccountMemberInput, TransferAccountOwnershipInput, CreateAccountCredentialInput, AccountSuccessResult, Application, ApplicationType, ApplicationStatus, ApplicationCredential, ApplicationCredentialType, ApplicationCredentialStatus, ApplicationEnvironment, CreateApplicationInput, UpdateApplicationInput, CreateApplicationCredentialInput, ApplicationCredentialWithSecret, RotateApplicationCredentialResult, ApplicationUsagePeriod, ApplicationUsageSummary, ApplicationUsageByDay, ApplicationUsageByEndpoint, ApplicationUsageStats, } from './mixins/OxyServices.accounts';
+export type { AccountKind, AccountRelationship, AccountRole, AccountMemberStatus, AccountMemberSource, AccountMember, AccountNode, AccountCredentialType, AccountCredentialEnvironment, AccountCredentialStatus, AccountCredential, AccountCredentialWithSecret, RotateAccountCredentialResult, ListAccountsOptions, CreateAccountInput, UpdateAccountInput, InviteAccountMemberInput, UpdateAccountMemberInput, TransferAccountOwnershipInput, CreateAccountCredentialInput, AccountSuccessResult, SwitchAccountResult, Application, ApplicationType, ApplicationStatus, ApplicationCredential, ApplicationCredentialType, ApplicationCredentialStatus, ApplicationEnvironment, CreateApplicationInput, UpdateApplicationInput, CreateApplicationCredentialInput, ApplicationCredentialWithSecret, RotateApplicationCredentialResult, ApplicationUsagePeriod, ApplicationUsageSummary, ApplicationUsageByDay, ApplicationUsageByEndpoint, ApplicationUsageStats, } from './mixins/OxyServices.accounts';
 export type { ReputationCategory, TrustTier, ReputationTransactionStatus, ReputationTargetEntityType, ReputationDisputeStatus, ReputationInfluenceContext, ReputationTransaction, ReputationBalanceBreakdown, ReputationInfluence, ReputationReliability, ReputationBalance, ReputationDispute, ReputationRule, ReputationLeaderboardEntry, ReputationInfluenceResult, ReverseReputationTransactionResult, AwardReputationInput, CreateReputationDisputeInput, ResolveReputationDisputeInput, UpsertReputationRuleInput, ReverseReputationTransactionInput, } from './mixins/OxyServices.reputation';
 export { buildUserDid } from './mixins/OxyServices.identity';
 export type { IdentityRecordType, UnlinkableAuthMethodType, LinkAuthMethodResult, PublishRecordResult, VerifyRecordResult, VerifyDomainResult, RemoveDomainResult, } from './mixins/OxyServices.identity';
@@ -56,14 +56,13 @@ export type { ClientSession, StorageKeys, MinimalUserData, SessionLoginResponse,
 export type { RefreshAllResponse, RefreshAllAccount, RefreshAllAccountUser, RefreshCookieResponse, } from './models/interfaces';
 export { KeyManager, IdentityAlreadyExistsError, IdentityPersistError, } from './crypto/keyManager';
 export type { KeyPair } from './crypto/keyManager';
-export { SignatureService, signedRecordSigningInput, computeRecordId } from './crypto/signatureService';
-export type { SignedMessage, AuthChallenge, SignedRecordSigningFields } from './crypto/signatureService';
-export { canonicalize } from './crypto/canonicalJson';
+export { SignatureService } from './crypto/signatureService';
+export type { SignedMessage, AuthChallenge } from './crypto/signatureService';
 export { RecoveryPhraseService } from './crypto/recoveryPhrase';
 export type { RecoveryPhraseResult } from './crypto/recoveryPhrase';
 export { DeviceManager } from './utils/deviceManager';
 export type { DeviceFingerprint, StoredDeviceInfo } from './utils/deviceManager';
-export type { OxyConfig, PrivacySettings, NotificationPreferences, UserPreferences, User, LoginResponse, Notification, Wallet, Transaction, BlockedUser, RestrictedUser, TransferFundsRequest, PurchaseRequest, WithdrawalRequest, TransactionResponse, PaginationInfo, SearchProfilesResponse, ApiError, PaymentMethod, PaymentRequest, PaymentResponse, AnalyticsData, FollowerDetails, ContentViewer, FileMetadata, FileUploadResponse, FileListResponse, FileUpdateRequest, FileDeleteResponse, RNFileDescriptor, AssetUploadInput, FileVisibility, AssetLink, AssetMetadata, AssetVariant, Asset, AssetInitRequest, AssetInitResponse, AssetCompleteRequest, AssetLinkRequest, AssetUnlinkRequest, AssetUrlResponse, AssetDeleteSummary, AssetUpdateVisibilityRequest, AssetUpdateVisibilityResponse, AccountStorageCategoryUsage, AccountStorageUsageResponse, SecurityEventType, SecurityEventSeverity, SecurityActivity, SecurityActivityResponse, AssetUploadProgress, DeviceSession, DeviceSessionsResponse, DeviceSessionLogoutResponse, UpdateDeviceNameResponse, } from './models/interfaces';
+export type { OxyConfig, PrivacySettings, NotificationPreferences, UserPreferences, User, LoginResponse, Notification, Wallet, Transaction, BlockedUser, RestrictedUser, TransferFundsRequest, PurchaseRequest, WithdrawalRequest, TransactionResponse, PaginationInfo, SearchProfilesResponse, ApiError, PaymentMethod, PaymentRequest, PaymentResponse, AnalyticsData, FollowerDetails, ContentViewer, FileMetadata, FileUploadResponse, FileListResponse, FileUpdateRequest, FileDeleteResponse, RNFileDescriptor, AssetUploadInput, FileVisibility, AssetLink, AssetMetadata, AssetVariant, Asset, AssetInitRequest, AssetInitResponse, AssetCompleteRequest, AssetLinkRequest, AssetUnlinkRequest, AssetUrlResponse, AssetDeleteSummary, AssetUpdateVisibilityRequest, AssetUpdateVisibilityResponse, ServiceAssetMetadata, AccountStorageCategoryUsage, AccountStorageUsageResponse, SecurityEventType, SecurityEventSeverity, SecurityActivity, SecurityActivityResponse, AssetUploadProgress, DeviceSession, DeviceSessionsResponse, DeviceSessionLogoutResponse, UpdateDeviceNameResponse, } from './models/interfaces';
 export { SECURITY_EVENT_SEVERITY_MAP } from './models/interfaces';
 export { TopicType, TopicSource } from './models/Topic';
 export type { TopicData, TopicTranslation } from './models/Topic';

package/dist/types/mixins/OxyServices.accounts.d.ts

@@ -25,11 +25,14 @@
  * member `_id`, and credentials by their `credentialId`. Never by name, slug, or
  * handle.
  *
- * NOTE: acting-as (delegated identity) is NOT part of this mixin — `setActingAs`
- * / `getActingAs` live on `OxyServices.base` and `verifyActingAs` on the utility
- * mixin (it verifies against `GET /accounts/verify-acting-as`).
+ * SWITCHING INTO AN ACCOUNT: `switchToAccount(accountId)` mints a REAL session
+ * for the target account and plants it as the active session — there is no
+ * per-request "acting-as" header. Identity is carried by the session/token, not
+ * a delegation header, so a switch propagates through reload and `refresh-all`
+ * exactly like a login.
  */
 import type { User } from '../models/interfaces';
+import type { SessionLoginResponse } from '../models/session';
 import type { OxyServicesBase } from '../OxyServices.base';
 /**
  * Account classification, orthogonal to the federation `type`
@@ -381,6 +384,28 @@ export interface ApplicationUsageStats {
 export interface AccountSuccessResult {
     success: boolean;
 }
+/**
+ * Result of {@link OxyServicesAccountsMixin.switchToAccount} — the freshly
+ * minted session for the target account, in the SAME shape the canonical login
+ * / `claimSessionByToken` responses use (`SessionLoginResponse`), plus the
+ * device-local refresh-cookie slot index.
+ *
+ * `accessToken` is the first access token for the new session (already planted
+ * as the active token by `switchToAccount`). The refresh token is NOT in the
+ * body — the server sets it as the httpOnly `oxy_rt_<authuser>` cookie, which
+ * joins the device multi-account set so the switched session survives reload and
+ * propagates cross-domain via `/auth/refresh-all`. `user` is the target account.
+ */
+export interface SwitchAccountResult extends SessionLoginResponse {
+    /**
+     * The device-local refresh-cookie slot index (`oxy_rt_<authuser>`) the server
+     * assigned to the minted session. Surfaced so the consumer can register the
+     * new session in its device multi-account set exactly like a login response.
+     * Absent only when the server could not set the cookie (best-effort — the
+     * switch itself still succeeds).
+     */
+    authuser?: number;
+}
 export declare function OxyServicesAccountsMixin<T extends typeof OxyServicesBase>(Base: T): {
     new (...args: any[]): {
         /**
@@ -399,6 +424,44 @@ export declare function OxyServicesAccountsMixin<T extends typeof OxyServicesBas
          * @param accountId - The account's Mongo `_id`.
          */
         getAccount(accountId: string): Promise<AccountNode>;
+        /**
+         * Switch the active session INTO a managed account.
+         *
+         * Calls `POST /accounts/:id/switch` with the signed-in operator's bearer.
+         * The server authorises the operator (must hold `account:act_as` over the
+         * target, directly or inherited — else 403; 404 if missing/archived; 403 if
+         * the target is a personal account), then mints a REAL session for the
+         * target account and returns it in the canonical login / `claimSessionByToken`
+         * shape (`{ sessionId, deviceId, expiresAt, accessToken, user, authuser }`).
+         *
+         * Unlike the removed `X-Acting-As` delegation header, the returned session
+         * IS the new identity: this plants `accessToken` as the active token —
+         * exactly like `claimSessionByToken` / `verifyChallenge` — so every
+         * subsequent request authenticates as the target account.
+         *
+         * Joining the device multi-account set (so the switch survives a reload and
+         * propagates cross-domain via `/auth/refresh-all`) requires a SECOND call, to
+         * `POST /auth/session`, made here after the token is planted. The switch route
+         * lives at `/accounts/*`, OUTSIDE the `oxy_rt_<authuser>` cookie's `Path=/auth`
+         * scope, so the server never sees the device's existing slots from it and
+         * would clobber slot 0 (destroying the operator's own session). `/auth/session`
+         * runs where those cookies ARE visible, so the server allocates a NEW slot that
+         * coexists with the operator's and returns its `authuser`. This step is
+         * web-only (native multi-account uses stored sessions, not cookies) and
+         * best-effort — a failure leaves the in-session switch intact; the switched
+         * account simply won't survive a reload until the cookie is next established.
+         *
+         * After planting, the SDK's identity-scoped GET cache is fully cleared so
+         * every cached read re-fetches as the new account. (The consuming
+         * `OxyContext` additionally invalidates its React Query cache and updates
+         * session state from the returned `user`; this clears the SDK's own HTTP
+         * cache at the source — `setTokens` deliberately preserves the warm cache for
+         * same-user silent refreshes, so the sweep here is explicit.)
+         *
+         * @param accountId - The target account's Mongo `_id`.
+         * @returns The minted session (planted) plus the device `authuser` slot.
+         */
+        switchToAccount(accountId: string): Promise<SwitchAccountResult>;
         /**
          * Create a new (non-personal) account. The caller becomes its `owner`.
          * @param data - Account configuration: kind, optional parent, and profile.
@@ -622,8 +685,6 @@ export declare function OxyServicesAccountsMixin<T extends typeof OxyServicesBas
         hasValidToken(): boolean;
         getAccessToken(): string | null;
         getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;

package/dist/types/mixins/OxyServices.analytics.d.ts

@@ -55,8 +55,6 @@ export declare function OxyServicesAnalyticsMixin<T extends typeof OxyServicesBa
         hasValidToken(): boolean;
         getAccessToken(): string | null;
         getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;

package/dist/types/mixins/OxyServices.appData.d.ts

@@ -91,8 +91,6 @@ export declare function OxyServicesAppDataMixin<T extends typeof OxyServicesBase
         hasValidToken(): boolean;
         getAccessToken(): string | null;
         getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;

package/dist/types/mixins/OxyServices.assets.d.ts

@@ -1,7 +1,17 @@
-import type { AccountStorageUsageResponse, AssetUploadInput, AssetUrlResponse, AssetVariant } from '../models/interfaces';
+import type { AccountStorageUsageResponse, AssetUploadInput, AssetUrlResponse, AssetVariant, ServiceAssetMetadata } from '../models/interfaces';
 import type { OxyServicesBase } from '../OxyServices.base';
 export declare function OxyServicesAssetsMixin<T extends typeof OxyServicesBase>(Base: T): {
     new (...args: any[]): {
+        /**
+         * Service-token request, implemented by the auth mixin earlier in the
+         * composition pipeline (see `mixins/index.ts`). The assets mixin is typed
+         * against `OxyServicesBase`, which does not carry the auth mixin's methods,
+         * so this `declare` surfaces the inherited runtime method to TypeScript
+         * without re-implementing it. Used by
+         * {@link getServiceAssetMetadataByIds} to authenticate the server-to-server
+         * `/assets/service/by-ids` bulk fetch with a bearer service token.
+         */
+        makeServiceRequest: <R = unknown>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: unknown, userId?: string) => Promise<R>;
         /**
          * Delete file
          */
@@ -49,6 +59,37 @@ export declare function OxyServicesAssetsMixin<T extends typeof OxyServicesBase>
          * Get download URLs for multiple files efficiently
          */
         getFileDownloadUrls(fileIds: string[], context?: string): Promise<Record<string, string>>;
+        /**
+         * Resolve many Oxy asset ids to their content-addressed metadata in one
+         * round-trip per chunk via `POST /assets/service/by-ids` (body `{ ids }`).
+         *
+         * Returns each asset's `sha256`, `mime`, byte `size`, and `status` — built
+         * for server-to-server callers (e.g. Mention's MTN Protocol blob-ref
+         * resolution) that need the content hash for an asset id. Ids are
+         * deduplicated and validated (empty/blank ids dropped) before being split
+         * into chunks of {@link SERVICE_ASSET_METADATA_CHUNK_SIZE} (the server-side
+         * cap). The server omits unknown/deleted ids from each chunk's `data`, so
+         * the merged result may be shorter than the requested id list and the caller
+         * is expected to map by `id`.
+         *
+         * **Service-token auth (required).** `/assets/service/by-ids` is guarded by
+         * `serviceAuthMiddleware` + the `files:read` scope and is called via
+         * `makeServiceRequest`, which attaches `Authorization: Bearer <serviceToken>`
+         * (the same client that calls `POST /assets/service/cache`). The calling
+         * client MUST be service-configured (`configureServiceAuth(apiKey,
+         * apiSecret)`) before invoking this method; otherwise `getServiceToken()`
+         * throws because no credentials are available. A plain user-session request
+         * is rejected by the route's service-auth guard.
+         *
+         * Resilience: chunks are independent. A failed chunk is logged and skipped —
+         * the method returns every entry that resolved successfully rather than
+         * discarding the whole call on one chunk's failure. An empty/whitespace-only
+         * input resolves immediately with `[]` and performs no network call.
+         *
+         * Not cached at the SDK layer: it's a POST keyed on a multi-id body (low hit
+         * rate), mirroring the sibling service/POST methods which never cache.
+         */
+        getServiceAssetMetadataByIds(ids: string[]): Promise<ServiceAssetMetadata[]>;
         /**
          * Upload raw file data
          */
@@ -135,8 +176,6 @@ export declare function OxyServicesAssetsMixin<T extends typeof OxyServicesBase>
         hasValidToken(): boolean;
         getAccessToken(): string | null;
         getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;

package/dist/types/mixins/OxyServices.auth.d.ts

@@ -570,8 +570,6 @@ export declare function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(B
         hasValidToken(): boolean;
         getAccessToken(): string | null;
         getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;

package/dist/types/mixins/OxyServices.civic.d.ts

@@ -48,7 +48,7 @@
  * platform-agnostic; deriving the current user's DID requires an authenticated
  * session.
  */
-import type { CredentialIssueResult, CredentialListResult, CredentialStatus, CredentialVerifyResult, ExportAttestation, PersonhoodStatusResult, PublicCard, RealLifeAttestationResult, SignedPublicCard, SignedRecordEnvelope, SignedRecordType, ValidationRequestSummary, ValidationVerdict, ValidationVoteResult, VerifiableCredentialResponse, VouchResult } from '@oxyhq/contracts';
+import type { CredentialIssueResult, CredentialListResult, CredentialStatus, CredentialVerifyResult, ExportAttestation, OxySignedRecordType, PersonhoodStatusResult, PublicCard, RealLifeAttestationResult, SignedPublicCard, SignedRecordEnvelope, ValidationRequestSummary, ValidationVerdict, ValidationVoteResult, VerifiableCredentialResponse, VouchResult } from '@oxyhq/contracts';
 import type { OxyServicesBase } from '../OxyServices.base';
 /**
  * A {@link SignedPublicCard} augmented with the client's verification verdict.
@@ -132,7 +132,7 @@ export declare function parseAttestPayload(raw: string): ParsedAttestPayload | n
  * key, matching the server which omits absent keys entirely) and checks the
  * `ES256K-DER-SHA256` signature against `attestation.publicKey`.
  *
- * NEVER throws: `SignatureService.verify` already swallows malformed-input
+ * NEVER throws: `verifySignature` already swallows malformed-input
  * errors and returns `false`, and an absent attestation short-circuits to
  * `false`. A pure, reusable helper (Commons can call it on a cached card).
  *
@@ -456,7 +456,7 @@ export declare function OxyServicesCivicMixin<T extends typeof OxyServicesBase>(
          * @param collection - The AtProto-style collection namespace.
          * @param rkey - The AtProto-style record key within the collection.
          */
-        _signMyCivicRecordV2(type: SignedRecordType, record: Record<string, unknown>, collection: string, rkey: string): Promise<SignedRecordEnvelope>;
+        _signMyCivicRecordV2(type: OxySignedRecordType, record: Record<string, unknown>, collection: string, rkey: string): Promise<SignedRecordEnvelope>;
         httpService: import("../HttpService").HttpService;
         cloudURL: string;
         config: import("../OxyServices.base").OxyConfig;
@@ -493,8 +493,6 @@ export declare function OxyServicesCivicMixin<T extends typeof OxyServicesBase>(
         hasValidToken(): boolean;
         getAccessToken(): string | null;
         getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;

package/dist/types/mixins/OxyServices.connectedApps.d.ts

@@ -148,8 +148,6 @@ export declare function OxyServicesConnectedAppsMixin<T extends typeof OxyServic
         hasValidToken(): boolean;
         getAccessToken(): string | null;
         getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;

package/dist/types/mixins/OxyServices.contacts.d.ts

@@ -83,8 +83,6 @@ export declare function OxyServicesContactsMixin<T extends typeof OxyServicesBas
         hasValidToken(): boolean;
         getAccessToken(): string | null;
         getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;

package/dist/types/mixins/OxyServices.devices.d.ts

@@ -85,8 +85,6 @@ export declare function OxyServicesDevicesMixin<T extends typeof OxyServicesBase
         hasValidToken(): boolean;
         getAccessToken(): string | null;
         getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;

package/dist/types/mixins/OxyServices.features.d.ts

@@ -233,8 +233,6 @@ export declare function OxyServicesFeaturesMixin<T extends typeof OxyServicesBas
         hasValidToken(): boolean;
         getAccessToken(): string | null;
         getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;

package/dist/types/mixins/OxyServices.fedcm.d.ts

@@ -287,8 +287,6 @@ export declare function OxyServicesFedCMMixin<T extends typeof OxyServicesBase>(
         hasValidToken(): boolean;
         getAccessToken(): string | null;
         getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;

package/dist/types/mixins/OxyServices.identity.d.ts

@@ -23,10 +23,15 @@
  * on-device identity and throw on web (where `KeyManager.getPublicKey()` is
  * always `null`).
  */
-import type { AuthMethodsResponse, DidDocument, DomainVerificationInstructions, ExportBundle, SignedRecordEnvelope, VerifiedDomain } from '@oxyhq/contracts';
+import type { AuthMethodsResponse, DidDocument, DomainVerificationInstructions, ExportBundle, OxySignedRecordType, SignedRecordEnvelope, VerifiedDomain } from '@oxyhq/contracts';
 import type { OxyServicesBase } from '../OxyServices.base';
-/** Record categories a client may sign and publish. */
-export type IdentityRecordType = SignedRecordEnvelope['type'];
+/**
+ * Record categories a client may sign and publish to the Oxy store. The base
+ * envelope `type` is now an open string (any app may define its own records on
+ * the shared grammar); the Oxy identity store re-narrows it to the closed Oxy
+ * record set.
+ */
+export type IdentityRecordType = OxySignedRecordType;
 /** Auth-method types that can be unlinked via {@link OxyServicesIdentityMixin}. */
 export type UnlinkableAuthMethodType = 'identity' | 'password' | 'google' | 'apple' | 'github';
 /**
@@ -230,8 +235,6 @@ export declare function OxyServicesIdentityMixin<T extends typeof OxyServicesBas
         hasValidToken(): boolean;
         getAccessToken(): string | null;
         getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;

package/dist/types/mixins/OxyServices.language.d.ts

@@ -70,8 +70,6 @@ export declare function OxyServicesLanguageMixin<T extends typeof OxyServicesBas
         hasValidToken(): boolean;
         getAccessToken(): string | null;
         getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;

package/dist/types/mixins/OxyServices.links.d.ts

@@ -87,8 +87,6 @@ export declare function OxyServicesLinksMixin<T extends typeof OxyServicesBase>(
         hasValidToken(): boolean;
         getAccessToken(): string | null;
         getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;

package/dist/types/mixins/OxyServices.location.d.ts

@@ -53,8 +53,6 @@ export declare function OxyServicesLocationMixin<T extends typeof OxyServicesBas
         hasValidToken(): boolean;
         getAccessToken(): string | null;
         getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;