@oxyhq/core 4.0.1 → 5.1.0

package/dist/types/mixins/OxyServices.nodes.d.ts

@@ -1,45 +1,3 @@
-/**
- * User-Node Methods Mixin (self-sovereign identity layer — Fase 5 user nodes)
- *
- * The client surface for a user's personal data NODE — the decentralised store
- * that holds an authentic copy of their signed-record chain. Commons drives all
- * of this:
- *
- *  - {@link OxyServicesNodesMixin.registerNode} registers (or re-registers) a
- *    SELF-HOSTED node. Registration is NOT a bespoke endpoint — it is a signed
- *    `type:'node'` v2 record (`collection: 'app.oxy.node'`, `rkey: 'self'`,
- *    last-writer-wins) published through the EXISTING `POST /identity/records`
- *    path; the server verifies it and materializes the operational
- *    {@link UserNodeStatus} cache as a side effect, so the registration's
- *    authority is the user's own signature, never an Oxy grant.
- *  - {@link OxyServicesNodesMixin.getMyNode} reads the caller's cached node
- *    status (`GET /nodes/me`) — the fast, stale-but-instant projection plus the
- *    live liveness badge Oxy maintains with background probes.
- *  - {@link OxyServicesNodesMixin.removeMyNode} revokes the registration
- *    (`DELETE /nodes/me`) so the node leaves the DID document and the liveness
- *    sweeps.
- *  - {@link OxyServicesNodesMixin.provisionManagedVault} asks Oxy to operate a
- *    MANAGED vault on the caller's behalf (`POST /nodes/managed`) — the
- *    "Create your vault" convenience for non-technical users (Oxy custodial-signs
- *    the node record; `managed:true, controller:'oxy'`).
- *  - {@link OxyServicesNodesMixin.notifyNodeIngest} sends an unauthenticated
- *    HINT (`POST /nodes/ingest/notify/:userId`) that a user's node has new
- *    records; the server fully re-verifies before ingesting, so the hint can
- *    never inject data.
- *
- * `registerNode` signs on the caller's per-subject hash chain with the on-device
- * identity key (reusing {@link SignatureService.signRecordV2} — the same
- * `ES256K-DER-SHA256` scheme + {@link signedRecordSigningInput} the identity and
- * civic mixins use), so it is NATIVE-ONLY: it throws on web (where `KeyManager`
- * has no key) and when no user is authenticated. Reading the node status,
- * revoking, provisioning a managed vault, and sending an ingest hint are plain
- * authenticated/public requests with no signing.
- *
- * The wire shapes here are API-INTERNAL (the F5 user-node surface is not yet a
- * published `@oxyhq/contracts` schema), so {@link UserNodeStatus} mirrors the
- * server's `serializeNode` projection exactly. Dates cross the wire as ISO
- * strings.
- */
 import type { OxyServicesBase } from '../OxyServices.base';
 /** How Oxy and the node move records: the node pulls (default), or Oxy pushes. */
 export type UserNodeMode = 'pull' | 'push';
@@ -223,8 +181,6 @@ export declare function OxyServicesNodesMixin<T extends typeof OxyServicesBase>(
         hasValidToken(): boolean;
         getAccessToken(): string | null;
         getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;

package/dist/types/mixins/OxyServices.payment.d.ts

@@ -100,8 +100,6 @@ export declare function OxyServicesPaymentMixin<T extends typeof OxyServicesBase
         hasValidToken(): boolean;
         getAccessToken(): string | null;
         getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;

package/dist/types/mixins/OxyServices.privacy.d.ts

@@ -129,8 +129,6 @@ export declare function OxyServicesPrivacyMixin<T extends typeof OxyServicesBase
         hasValidToken(): boolean;
         getAccessToken(): string | null;
         getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;

package/dist/types/mixins/OxyServices.redirect.d.ts

@@ -72,8 +72,6 @@ export declare function OxyServicesRedirectAuthMixin<T extends typeof OxyService
         hasValidToken(): boolean;
         getAccessToken(): string | null;
         getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;

package/dist/types/mixins/OxyServices.reputation.d.ts

@@ -418,8 +418,6 @@ export declare function OxyServicesReputationMixin<T extends typeof OxyServicesB
         hasValidToken(): boolean;
         getAccessToken(): string | null;
         getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;

package/dist/types/mixins/OxyServices.security.d.ts

@@ -67,8 +67,6 @@ export declare function OxyServicesSecurityMixin<T extends typeof OxyServicesBas
         hasValidToken(): boolean;
         getAccessToken(): string | null;
         getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;

package/dist/types/mixins/OxyServices.silent.d.ts

@@ -110,8 +110,6 @@ export declare function OxyServicesSilentAuthMixin<T extends typeof OxyServicesB
         hasValidToken(): boolean;
         getAccessToken(): string | null;
         getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;

package/dist/types/mixins/OxyServices.sso.d.ts

@@ -95,8 +95,6 @@ export declare function OxyServicesSsoMixin<T extends typeof OxyServicesBase>(Ba
         hasValidToken(): boolean;
         getAccessToken(): string | null;
         getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;

package/dist/types/mixins/OxyServices.topics.d.ts

@@ -93,8 +93,6 @@ export declare function OxyServicesTopicsMixin<T extends typeof OxyServicesBase>
         hasValidToken(): boolean;
         getAccessToken(): string | null;
         getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;

package/dist/types/mixins/OxyServices.user.d.ts

@@ -364,8 +364,6 @@ export declare function OxyServicesUserMixin<T extends typeof OxyServicesBase>(B
         hasValidToken(): boolean;
         getAccessToken(): string | null;
         getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;

package/dist/types/mixins/OxyServices.utility.d.ts

@@ -1,15 +1,5 @@
 import type { ApiError, User } from '../models/interfaces';
 import type { OxyServicesBase } from '../OxyServices.base';
-/**
- * Result from the account acting-as verification endpoint
- * (`GET /accounts/verify-acting-as`). Indicates whether a user is authorized to
- * act as a given account. The `account:act_as` capability is granted only to the
- * `owner`, `admin`, and `editor` account roles.
- */
-interface ActingAsVerification {
-    authorized: boolean;
-    role: 'owner' | 'admin' | 'editor';
-}
 /**
  * Result from the service-acting-as verification endpoint.
  * Confirms that a given service app holds an active delegation grant for
@@ -76,11 +66,6 @@ interface AuthMiddlewareOptions {
 }
 export declare function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base: T): {
     new (...args: any[]): {
-        /** @internal In-memory cache for acting-as verification results (TTL: 5 min) */
-        _actingAsCache: Map<string, {
-            result: ActingAsVerification | null;
-            expiresAt: number;
-        }>;
         /**
          * In-memory cache for service-acting-as verification.
          * Negative results are cached for 1min to avoid hammering the verify
@@ -92,14 +77,6 @@ export declare function OxyServicesUtilityMixin<T extends typeof OxyServicesBase
             result: ServiceActingAsVerification | null;
             expiresAt: number;
         }>;
-        /**
-         * Verify that a user is authorized to act as an account (direct membership
-         * or inherited via an ancestor). Backed by `GET /accounts/verify-acting-as`.
-         * Results are cached in-memory for 5 minutes to avoid repeated API calls.
-         *
-         * @internal Used by the auth() middleware — not part of the public API
-         */
-        verifyActingAs(userId: string, accountId: string): Promise<ActingAsVerification | null>;
         /**
          * Verify that a service app holds an active delegation grant authorising
          * it to act on behalf of `userId`. Returns the grant (with allowed scopes)
@@ -281,8 +258,6 @@ export declare function OxyServicesUtilityMixin<T extends typeof OxyServicesBase
         hasValidToken(): boolean;
         getAccessToken(): string | null;
         getAccessTokenExpiry(): number | null;
-        setActingAs(userId: string | null): void;
-        getActingAs(): string | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
             maxRetries?: number;
@@ -313,13 +288,6 @@ interface AuthReq {
         userId: string;
         scopes: string[];
     };
-    actingAs?: {
-        userId: string;
-        role: string;
-    };
-    originalUser?: {
-        id: string;
-    } & Partial<User>;
 }
 interface AuthRes {
     status(code: number): AuthRes;

package/dist/types/models/interfaces.d.ts

@@ -447,6 +447,24 @@ export interface AssetUpdateVisibilityResponse {
         updatedAt: string;
     };
 }
+/**
+ * Minimal, service-token-scoped asset metadata returned by
+ * `POST /assets/service/by-ids`.
+ *
+ * Resolves an Oxy asset `id` to its content-addressed identity (`sha256`),
+ * MIME type, byte `size`, and storage `status`. Used by server-to-server
+ * callers (e.g. Mention's MTN Protocol blob-ref resolution) that hold a
+ * `files:read`-scoped service token rather than a user session. Unknown or
+ * deleted ids are omitted from the response (never error the whole batch),
+ * so the result may be shorter than the requested id list.
+ */
+export interface ServiceAssetMetadata {
+    id: string;
+    sha256: string;
+    mime: string;
+    size: number;
+    status: 'active' | 'trash';
+}
 /**
  * Account storage usage (server-side usage, not local AsyncStorage)
  */

package/dist/types/server/auth.d.ts

@@ -8,10 +8,6 @@ export interface OxyRequestUser {
     avatar?: string;
     [key: string]: unknown;
 }
-export interface OxyActingAsContext {
-    userId: string;
-    role: 'owner' | 'admin' | 'editor';
-}
 export interface OxyServiceAppContext {
     appId: string;
     appName: string;
@@ -25,8 +21,6 @@ export interface OxyServiceActingAsContext {
 export interface OxyAuthRequest extends Request {
     userId?: string | null;
     user?: OxyRequestUser | null;
-    originalUser?: OxyRequestUser | null;
-    actingAs?: OxyActingAsContext;
     accessToken?: string;
     sessionId?: string | null;
     serviceApp?: OxyServiceAppContext;

package/dist/types/server/index.d.ts

@@ -15,7 +15,7 @@
  * ```
  */
 export { createOptionalOxyAuth, createOxyAuthMiddleware, getOxyUserId, getRequiredOxyUserId, isOxyAuthenticated, requireOxyAuth, } from './auth';
-export type { OxyActingAsContext, OxyAuthenticatedRequest, OxyAuthMiddlewareOptions, OxyAuthRequest, OxyRequestUser, OxyServiceActingAsContext, OxyServiceAppContext, } from './auth';
+export type { OxyAuthenticatedRequest, OxyAuthMiddlewareOptions, OxyAuthRequest, OxyRequestUser, OxyServiceActingAsContext, OxyServiceAppContext, } from './auth';
 export { createOxyRateLimit } from './rateLimit';
 export type { OxyRateLimitOptions } from './rateLimit';
 export { assertSafePublicUrl, isBlockedIp, safeFetch, SsrfRejection, UpstreamError, ALLOWED_PORTS, ALLOWED_PROTOCOLS, BLOCKED_HOSTNAMES, DEFAULT_USER_AGENT, MAX_REDIRECTS, MAX_URL_LENGTH, UPSTREAM_HEADERS_TIMEOUT_MS, } from './safeFetch';

package/dist/types/utils/cacheKey.d.ts

@@ -3,8 +3,8 @@
  *
  * Extracted from {@link HttpService} so the identity-tag derivation is a pure,
  * independently testable function with no dependency on instance/token state.
- * The HTTP service injects the live access token and acting-as id; everything
- * here is referentially transparent given those inputs.
+ * The HTTP service injects the live access token; everything here is
+ * referentially transparent given that input.
  */
 /**
  * Minimal JWT payload shape we read for cache scoping. The identity discriminator
@@ -57,11 +57,10 @@ export declare function fnv1a32(str: string): string;
  *
  * We use the decoded user id rather than the raw JWT so the token never lands
  * in a cache key (no token leakage through any cache-key logging, no key bloat).
- * The acting-as id is folded in because managed-account responses differ per
- * acting identity — and `X-Acting-As` already changes the server response for
- * the same bearer token.
+ * Switching into a managed account mints a REAL new session whose access token
+ * carries the target account's id, so the identity tag changes naturally on a
+ * switch — there is no separate acting-as discriminator to fold in.
  *
  * @param accessToken The current bearer access token, or `null` when anonymous.
- * @param actingAsUserId The active managed-account id, or `null`.
  */
-export declare function computeIdentityTag(accessToken: string | null, actingAsUserId: string | null): string;
+export declare function computeIdentityTag(accessToken: string | null): string;

package/dist/types/utils/platform.d.ts

@@ -27,14 +27,6 @@ export declare function isIOS(): boolean;
  * Check if running on Android
  */
 export declare function isAndroid(): boolean;
-/**
- * Check if running in React Native
- */
-export declare function isReactNative(): boolean;
-/**
- * Check if running in Node.js
- */
-export declare function isNodeJS(): boolean;
 /**
  * Set the platform OS explicitly
  * Called by React Native entry point to register the platform

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "4.0.1",
+  "version": "5.1.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -43,10 +43,6 @@
     },
     "./package.json": "./package.json"
   },
-  "react-native": {
-    "./dist/esm/utils/platformCrypto.js": "./dist/esm/utils/platformCrypto.native.js",
-    "./dist/cjs/utils/platformCrypto.js": "./dist/cjs/utils/platformCrypto.native.js"
-  },
   "files": [
     "dist",
     "src"
@@ -98,14 +94,15 @@
     }
   },
   "dependencies": {
-    "@oxyhq/contracts": "^0.6.0",
+    "@oxyhq/contracts": "^0.7.0",
+    "@oxyhq/protocol": "^0.1.1",
     "bip39": "^3.1.0",
     "buffer": "^6.0.3",
     "elliptic": "^6.6.1",
     "invariant": "^2.2.4",
     "jwt-decode": "^4.0.0",
     "socket.io-client": "^4.8.1",
-    "tldts": "^7.0.22",
+    "tldts": "^7.4.5",
     "zod": "^3.25.64"
   },
   "peerDependencies": {

package/src/HttpService.ts

@@ -18,7 +18,8 @@ import { RequestDeduplicator, RequestQueue, SimpleLogger } from './utils/request
 import { retryAsync } from './utils/asyncUtils';
 import { handleHttpError } from './utils/errorUtils';
 import { jwtDecode } from 'jwt-decode';
-import { isNative, isReactNative, getPlatformOS } from './utils/platform';
+import { isNative, getPlatformOS } from './utils/platform';
+import { isReactNative } from '@oxyhq/protocol';
 import { computeIdentityTag, fnv1a32 } from './utils/cacheKey';
 import type { OxyConfig } from './models/interfaces';
 
@@ -238,9 +239,6 @@ export class HttpService {
    */
   private _tokenChangeListeners = new Set<(accessToken: string | null) => void>();
 
-  // Acting-as identity for managed accounts
-  private _actingAsUserId: string | null = null;
-
   // Performance monitoring
   private requestMetrics = {
     totalRequests: 0,
@@ -466,11 +464,6 @@ export class HttpService {
           });
         }
 
-        // Add X-Acting-As header for managed account identity delegation
-        if (this._actingAsUserId) {
-          headers['X-Acting-As'] = this._actingAsUserId;
-        }
-
         // Merge custom headers if provided
         if (config.headers) {
           Object.entries(config.headers).forEach(([key, value]) => {
@@ -820,12 +813,12 @@ export class HttpService {
    * Derive a stable, non-sensitive identity discriminator for cache scoping.
    *
    * Thin instance wrapper over the pure {@link computeIdentityTag} helper —
-   * binds it to this instance's live access token and acting-as id. See that
-   * function's docs for the full resolution contract (anon fallback, decoded
-   * `userId || id`, token-hash fallback for undecodable tokens).
+   * binds it to this instance's live access token. See that function's docs for
+   * the full resolution contract (anon fallback, decoded `userId || id`,
+   * token-hash fallback for undecodable tokens).
    */
   private computeIdentityTag(): string {
-    return computeIdentityTag(this.tokenStore.getAccessToken(), this._actingAsUserId);
+    return computeIdentityTag(this.tokenStore.getAccessToken());
   }
 
   /**
@@ -1107,15 +1100,6 @@ export class HttpService {
     return this.request<T>({ method: 'DELETE', url, ...config });
   }
 
-  // Acting-as identity management (managed accounts)
-  setActingAs(userId: string | null): void {
-    this._actingAsUserId = userId;
-  }
-
-  getActingAs(): string | null {
-    return this._actingAsUserId;
-  }
-
   // Token management
   setTokens(accessToken: string): void {
     this.tokenStore.setTokens(accessToken);

package/src/OxyServices.base.ts

@@ -335,29 +335,6 @@ export class OxyServicesBase {
     }
   }
 
-  /**
-   * Set the acting-as identity for managed accounts.
-   *
-   * When set, all subsequent API requests will include the `X-Acting-As` header,
-   * causing the server to attribute actions to the managed account. The
-   * authenticated user must be an authorized manager of the target account.
-   *
-   * Pass `null` to clear and revert to the authenticated user's own identity.
-   *
-   * @param userId - The managed account user ID, or null to clear
-   */
-  public setActingAs(userId: string | null): void {
-    this.httpService.setActingAs(userId);
-  }
-
-  /**
-   * Get the current acting-as identity (managed account user ID), or null
-   * if operating as the authenticated user's own identity.
-   */
-  public getActingAs(): string | null {
-    return this.httpService.getActingAs();
-  }
-
   /**
    * Wait for authentication to be ready
    * 

package/src/__tests__/httpServiceCache.test.ts

@@ -112,25 +112,6 @@ describe('HttpService identity-scoped response cache', () => {
     expect(u2.profiles).toEqual(['for-user-2']);
   });
 
-  it('partitions the cache by acting-as identity for the same bearer token', async () => {
-    const http = newService();
-    http.setTokens(makeJwt({ userId: 'owner-1' }));
-
-    // Acting as managed account A.
-    http.setActingAs('managed-a');
-    fetchMock.mockResolvedValueOnce(jsonResponse({ items: ['a-only'] }));
-    const a = await http.get<{ items: string[] }>('/some/managed-resource', { cache: true });
-    expect(a.items).toEqual(['a-only']);
-
-    // Acting as managed account B — different content, must miss the cache.
-    http.setActingAs('managed-b');
-    fetchMock.mockResolvedValueOnce(jsonResponse({ items: ['b-only'] }));
-    const b = await http.get<{ items: string[] }>('/some/managed-resource', { cache: true });
-
-    expect(fetchMock).toHaveBeenCalledTimes(2);
-    expect(b.items).toEqual(['b-only']);
-  });
-
   it('does NOT serve an authenticated cached response to an anonymous caller after clearTokens()', async () => {
     const http = newService();
     http.setTokens(makeJwt({ userId: 'user-1' }));

package/src/crypto/__tests__/keyManager.atomicity.test.ts

@@ -83,8 +83,9 @@ jest.mock(
   { virtual: true },
 );
 
-jest.mock('../../utils/platformCrypto', () => ({
+jest.mock('@oxyhq/protocol', () => ({
   __esModule: true,
+  ...jest.requireActual('@oxyhq/protocol'),
   // eslint-disable-next-line @typescript-eslint/no-require-imports
   loadExpoCrypto: async () => require('expo-crypto'),
   // eslint-disable-next-line @typescript-eslint/no-require-imports

package/src/crypto/__tests__/keyManager.test.ts

@@ -66,14 +66,16 @@ jest.mock(
 );
 
 // Production code routes platform-specific module loads through
-// `platformCrypto`, which ships in two physical variants on disk
-// (`platformCrypto.ts` / `platformCrypto.react-native.ts`) selected by the
-// consumer's bundler. Jest runs on Node — it picks the default variant,
-// which references Node's built-in `crypto`, not `expo-*`. For the test
-// suite to exercise the RN code paths, we mock the helper module to
-// delegate to the virtual `expo-*` modules registered above.
-jest.mock('../../utils/platformCrypto', () => ({
+// `@oxyhq/protocol`'s `platform/crypto`, which ships in two physical variants
+// on disk (`crypto.ts` / `crypto.native.ts`) selected by the consumer's
+// bundler. Jest runs on Node — it picks the default variant, which references
+// Node's built-in `crypto`, not `expo-*`. For the test suite to exercise the
+// RN code paths, we override only the platform loaders to delegate to the
+// virtual `expo-*` modules registered above, keeping every other protocol
+// export (canonical bytes, signing, the platform predicates) real.
+jest.mock('@oxyhq/protocol', () => ({
   __esModule: true,
+  ...jest.requireActual('@oxyhq/protocol'),
   loadExpoCrypto: async () => {
     // eslint-disable-next-line @typescript-eslint/no-require-imports
     return require('expo-crypto');

package/src/crypto/__tests__/signChallengeShared.test.ts

@@ -9,6 +9,7 @@
  */
 
 import { ec as EC } from 'elliptic';
+import { verifySignature } from '@oxyhq/protocol';
 import { KeyManager } from '../keyManager';
 import { SignatureService } from '../signatureService';
 
@@ -40,7 +41,7 @@ describe('SignatureService.signChallengeWithSharedKey', () => {
     // uses, proving the format is unchanged and the shared key signed it.
     const message = `auth:${sharedPublicKey}:chal-123:${result.timestamp}`;
     await expect(
-      SignatureService.verify(message, result.challenge, sharedPublicKey),
+      verifySignature(message, result.challenge, sharedPublicKey),
     ).resolves.toBe(true);
   });