@oxyhq/core 9.2.0 → 9.2.1

package/dist/types/index.d.ts

@@ -34,7 +34,8 @@ export type { CanonicalUserHandleInput, UserHandleInput } from './utils/userHand
 export { normalizeProfileLinks } from './utils/profileLinks';
 export type { ProfileLink, ProfileLinkMetadata } from './utils/profileLinks';
 export type { PublicApplication, ConnectedApp, } from './mixins/OxyServices.connectedApps';
-export type { AccountKind, AccountRelationship, AccountRole, AccountMemberStatus, AccountMemberSource, AccountMember, AccountNode, AccountCredentialType, AccountCredentialEnvironment, AccountCredentialStatus, AccountCredential, AccountCredentialWithSecret, RotateAccountCredentialResult, ListAccountsOptions, CreateAccountInput, UpdateAccountInput, InviteAccountMemberInput, UpdateAccountMemberInput, TransferAccountOwnershipInput, CreateAccountCredentialInput, AccountSuccessResult, SwitchAccountResult, Application, ApplicationType, ApplicationStatus, ApplicationCredential, ApplicationCredentialType, ApplicationCredentialStatus, ApplicationEnvironment, CreateApplicationInput, UpdateApplicationInput, CreateApplicationCredentialInput, ApplicationCredentialWithSecret, RotateApplicationCredentialResult, ApplicationUsagePeriod, ApplicationUsageSummary, ApplicationUsageByDay, ApplicationUsageByEndpoint, ApplicationUsageStats, } from './mixins/OxyServices.accounts';
+export type { AccountKind, OrganizationCategory, AccountRelationship, AccountRole, AccountMemberStatus, AccountMemberSource, AccountMember, AccountNode, AccountCredentialType, AccountCredentialEnvironment, AccountCredentialStatus, AccountCredential, AccountCredentialWithSecret, RotateAccountCredentialResult, ListAccountsOptions, CreateAccountInput, UpdateAccountInput, InviteAccountMemberInput, UpdateAccountMemberInput, TransferAccountOwnershipInput, CreateAccountCredentialInput, AccountSuccessResult, SwitchAccountResult, Application, ApplicationType, ApplicationStatus, ApplicationCredential, ApplicationCredentialType, ApplicationCredentialStatus, ApplicationEnvironment, CreateApplicationInput, UpdateApplicationInput, CreateApplicationCredentialInput, ApplicationCredentialWithSecret, RotateApplicationCredentialResult, ApplicationUsagePeriod, ApplicationUsageSummary, ApplicationUsageByDay, ApplicationUsageByEndpoint, ApplicationUsageStats, } from './mixins/OxyServices.accounts';
+export { ORGANIZATION_CATEGORIES } from './mixins/OxyServices.accounts';
 export type { ReputationCategory, TrustTier, ReputationTransactionStatus, ReputationTargetEntityType, ReputationDisputeStatus, ReputationInfluenceContext, ReputationTransaction, ReputationBalanceBreakdown, ReputationInfluence, ReputationReliability, ReputationBalance, ReputationDispute, ReputationRule, ReputationLeaderboardEntry, ReputationInfluenceResult, ReverseReputationTransactionResult, AwardReputationInput, CreateReputationDisputeInput, ResolveReputationDisputeInput, UpsertReputationRuleInput, ReverseReputationTransactionInput, } from './mixins/OxyServices.reputation';
 export { buildUserDid } from './mixins/OxyServices.identity';
 export type { IdentityRecordType, UnlinkableAuthMethodType, LinkAuthMethodResult, PublishRecordResult, VerifyRecordResult, VerifyDomainResult, RemoveDomainResult, } from './mixins/OxyServices.identity';

package/dist/types/mixins/OxyServices.accounts.d.ts

@@ -33,6 +33,7 @@
  * registers the switched session into the operator's device-set directly).
  */
 import type { User } from '../models/interfaces';
+import type { OrganizationCategory } from '@oxyhq/contracts';
 import type { SessionLoginResponse } from '../models/session';
 import type { OxyServicesBase } from '../OxyServices.base';
 /**
@@ -42,6 +43,9 @@ import type { OxyServicesBase } from '../OxyServices.base';
  * and have no direct login.
  */
 export type AccountKind = 'personal' | 'organization' | 'project' | 'bot';
+/** Real-estate / team taxonomy for `kind: 'organization'` accounts. */
+export type { OrganizationCategory } from '@oxyhq/contracts';
+export { ORGANIZATION_CATEGORIES } from '@oxyhq/contracts';
 /**
  * The calling user's relationship to an account node, as resolved by the API:
  * - `self` — the caller's own personal (root) account.
@@ -143,6 +147,8 @@ export interface CreateAccountInput {
     };
     bio?: string;
     avatar?: string;
+    /** Meaningful only when `kind` is `organization`. */
+    organizationCategory?: OrganizationCategory;
 }
 /** Input accepted by `updateAccount`. Tree placement changes go through `/move`. */
 export interface UpdateAccountInput {
@@ -153,6 +159,8 @@ export interface UpdateAccountInput {
     };
     bio?: string | null;
     avatar?: string | null;
+    /** Clears the category when `null`; only valid on `kind: 'organization'`. */
+    organizationCategory?: OrganizationCategory | null;
 }
 /** Input accepted by `inviteAccountMember`. The owner role cannot be invited. */
 export interface InviteAccountMemberInput {

package/dist/types/mixins/OxyServices.auth.d.ts

@@ -319,6 +319,7 @@ export declare function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(B
             deviceId: string;
             expiresAt: string;
             user: User;
+            deviceSecret?: string;
         }>;
         /**
          * MECHANISM A — same-device shared-keychain SSO.

package/dist/types/models/interfaces.d.ts

@@ -1,4 +1,4 @@
-import type { UserNameResponse } from '@oxyhq/contracts';
+import type { OrganizationCategory, UserNameResponse } from '@oxyhq/contracts';
 export interface OxyConfig {
     baseURL: string;
     cloudURL?: string;
@@ -129,6 +129,8 @@ export interface User {
     };
     isManagedAccount?: boolean;
     managedBy?: string;
+    /** Real-estate taxonomy when this user is a `kind: 'organization'` account. */
+    organizationCategory?: OrganizationCategory;
     notificationPreferences?: NotificationPreferences;
     userPreferences?: UserPreferences;
     [key: string]: unknown;

package/dist/types/models/session.d.ts

@@ -31,4 +31,10 @@ export interface SessionLoginResponse {
     user: MinimalUserData;
     /** JWT access token for API authentication */
     accessToken?: string;
+    /**
+     * Rotating zero-cookie device credential minted on sign-in / claim. Persisted
+     * first-party alongside `deviceId` so cold boot can re-mint via
+     * `POST /session/device/token`.
+     */
+    deviceSecret?: string;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "9.2.0",
+  "version": "9.2.1",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/boot/__tests__/sessionColdBoot.test.ts

@@ -258,6 +258,26 @@ describe('runSessionColdBoot — shared-key-signin (native)', () => {
     );
   });
 
+  it('persists deviceSecret from shared-key verifyChallenge for the next mint lane', async () => {
+    const store = createMemoryAuthStateStore();
+    const signInWithSharedIdentity = jest.fn(async () => ({
+      ...sharedSession,
+      deviceSecret: 'shared-mint-secret',
+    }));
+    const { oxy } = makeOxy({ signInWithSharedIdentity });
+
+    await runSessionColdBoot({ oxy, store, platform: NATIVE });
+
+    const persisted = await store.load();
+    expect(persisted).toMatchObject({
+      sessionId: 'sess-shared',
+      userId: 'user-shared',
+      deviceId: 'dev-1',
+      deviceSecret: 'shared-mint-secret',
+      accessToken: 'access-shared',
+    });
+  });
+
   it('does NOT run the shared-key lane on web', async () => {
     const store = createMemoryAuthStateStore();
     const signInWithSharedIdentity = jest.fn(async () => sharedSession);

package/src/boot/sessionColdBoot.ts

@@ -156,6 +156,19 @@ export async function runSessionColdBoot(
       if (!session?.accessToken) {
         return { kind: 'skip' };
       }
+      // `verifyChallenge` mints a rotating deviceSecret; persist it so the next
+      // boot can use the faster device-secret-mint lane (sockets + tab-focus
+      // re-mint depend on the credential being in the store).
+      if (session.deviceId && session.deviceSecret) {
+        await store.save({
+          sessionId: session.sessionId,
+          userId: session.user.id,
+          deviceId: session.deviceId,
+          deviceSecret: session.deviceSecret,
+          accessToken: session.accessToken,
+          expiresAt: session.expiresAt,
+        });
+      }
       return {
         kind: 'session',
         session: {

package/src/index.ts

@@ -86,6 +86,7 @@ export type {
 // ---------------------------------------------------------------------------
 export type {
     AccountKind,
+    OrganizationCategory,
     AccountRelationship,
     AccountRole,
     AccountMemberStatus,
@@ -127,6 +128,8 @@ export type {
     ApplicationUsageStats,
 } from './mixins/OxyServices.accounts';
 
+export { ORGANIZATION_CATEGORIES } from './mixins/OxyServices.accounts';
+
 // ---------------------------------------------------------------------------
 // Reputation (Oxy Trust: ledger, balances, disputes, rules, influence)
 // ---------------------------------------------------------------------------

package/src/mixins/OxyServices.accounts.ts

@@ -33,6 +33,7 @@
  * registers the switched session into the operator's device-set directly).
  */
 import type { User } from '../models/interfaces';
+import type { OrganizationCategory } from '@oxyhq/contracts';
 import type { SessionLoginResponse } from '../models/session';
 import type { OxyServicesBase } from '../OxyServices.base';
 import { normalizeUserIdentity } from '../utils/userIdentity';
@@ -50,6 +51,10 @@ import { CACHE_TIMES } from './mixinHelpers';
  */
 export type AccountKind = 'personal' | 'organization' | 'project' | 'bot';
 
+/** Real-estate / team taxonomy for `kind: 'organization'` accounts. */
+export type { OrganizationCategory } from '@oxyhq/contracts';
+export { ORGANIZATION_CATEGORIES } from '@oxyhq/contracts';
+
 /**
  * The calling user's relationship to an account node, as resolved by the API:
  * - `self` — the caller's own personal (root) account.
@@ -155,6 +160,8 @@ export interface CreateAccountInput {
   name?: { first?: string; last?: string };
   bio?: string;
   avatar?: string;
+  /** Meaningful only when `kind` is `organization`. */
+  organizationCategory?: OrganizationCategory;
 }
 
 /** Input accepted by `updateAccount`. Tree placement changes go through `/move`. */
@@ -163,6 +170,8 @@ export interface UpdateAccountInput {
   name?: { first?: string; last?: string };
   bio?: string | null;
   avatar?: string | null;
+  /** Clears the category when `null`; only valid on `kind: 'organization'`. */
+  organizationCategory?: OrganizationCategory | null;
 }
 
 /** Input accepted by `inviteAccountMember`. The owner role cannot be invited. */

package/src/mixins/OxyServices.auth.ts

@@ -664,6 +664,7 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
       deviceId: string;
       expiresAt: string;
       user: User;
+      deviceSecret?: string;
     }> {
       try {
         const res = await this.makeRequest<{
@@ -672,6 +673,7 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           deviceId: string;
           expiresAt: string;
           user: User;
+          deviceSecret?: string;
         }>(
           'POST',
           '/auth/session/claim',

package/src/models/interfaces.ts

@@ -1,4 +1,4 @@
-import type { UserNameResponse } from '@oxyhq/contracts';
+import type { OrganizationCategory, UserNameResponse } from '@oxyhq/contracts';
 
 export interface OxyConfig {
   baseURL: string;
@@ -142,6 +142,8 @@ export interface User {
   // Managed account fields
   isManagedAccount?: boolean;
   managedBy?: string;
+  /** Real-estate taxonomy when this user is a `kind: 'organization'` account. */
+  organizationCategory?: OrganizationCategory;
   // User-controlled notification preferences. All channels default to on; users
   // opt out per-channel. Updated via `PUT /users/me`.
   notificationPreferences?: NotificationPreferences;

package/src/models/session.ts

@@ -35,4 +35,10 @@ export interface SessionLoginResponse {
   user: MinimalUserData;
   /** JWT access token for API authentication */
   accessToken?: string;
+  /**
+   * Rotating zero-cookie device credential minted on sign-in / claim. Persisted
+   * first-party alongside `deviceId` so cold boot can re-mint via
+   * `POST /session/device/token`.
+   */
+  deviceSecret?: string;
 }

package/src/session/__tests__/accountDialogController.test.ts

@@ -461,6 +461,7 @@ describe('AccountDialogController — sign in with Oxy', () => {
         accessToken: 'access-1',
         sessionId: 'sess-1',
         deviceId: 'device-1',
+        deviceSecret: 'claimed-secret',
         expiresAt: '2030-01-01T00:00:00Z',
         user: user('a1'),
       });
@@ -473,7 +474,13 @@ describe('AccountDialogController — sign in with Oxy', () => {
 
       await jest.advanceTimersByTimeAsync(1000); // second poll → authorized → claim
       expect(oxy.claimSessionByToken).toHaveBeenCalledWith('secret-tok');
-      expect(commitSession).toHaveBeenCalledWith(expect.objectContaining({ sessionId: 'sess-1', accessToken: 'access-1' }));
+      expect(commitSession).toHaveBeenCalledWith(
+        expect.objectContaining({
+          sessionId: 'sess-1',
+          accessToken: 'access-1',
+          deviceSecret: 'claimed-secret',
+        }),
+      );
       expect(onSignedIn).toHaveBeenCalledWith(expect.objectContaining({ id: 'a1' }));
       expect(controller.getSnapshot().view).toBe('accounts');
     } finally {

package/src/session/accountDialogController.ts

@@ -638,7 +638,14 @@ export class AccountDialogController {
 
   private async claimAndComplete(sessionId: string, sessionToken: string): Promise<void> {
     this.setSignIn({ ...this.signIn, phase: 'authorized' });
-    let claimed: { accessToken: string; sessionId: string; deviceId: string; expiresAt: string; user: User };
+    let claimed: {
+      accessToken: string;
+      sessionId: string;
+      deviceId: string;
+      expiresAt: string;
+      user: User;
+      deviceSecret?: string;
+    };
     try {
       claimed = await this.oxyServices.claimSessionByToken(sessionToken);
     } catch (error) {
@@ -666,6 +673,7 @@ export class AccountDialogController {
           expiresAt: claimed.expiresAt ?? '',
           user: minimalUser,
           accessToken: claimed.accessToken,
+          ...(claimed.deviceSecret ? { deviceSecret: claimed.deviceSecret } : {}),
         },
         minimalUser,
       );