@oxy.so/core 1.5.0 → 1.6.0

package/dist/esm/i18n/locales/es-ES.json

@@ -656,6 +656,7 @@
         "scanQr": "Escanear código QR",
         "qrHeadline": "Inicia sesión con tu identidad de Oxy",
         "signInWithOxy": "Inicia sesión con Oxy",
+        "signUpWithOxy": "Regístrate con Oxy",
         "useIdentityOnDevice": "¿No tienes Commons? Usa una clave de acceso en este dispositivo",
         "getCommons": "Descargar Commons",
         "commonsNotInstalled": "¿No tienes Commons? Descarga la app para iniciar sesión con tu Oxy ID.",

package/dist/esm/i18n/locales/fr-FR.json

@@ -108,6 +108,7 @@
         "loading": "Chargement des comptes...",
         "qrHeadline": "Connectez-vous avec votre identité Oxy",
         "signInWithOxy": "Se connecter avec Oxy",
+        "signUpWithOxy": "S'inscrire avec Oxy",
         "useIdentityOnDevice": "Pas de Commons ? Utilisez une clé d'accès sur cet appareil",
         "getCommons": "Obtenir Commons",
         "commonsNotInstalled": "Pas de Commons ? Téléchargez l'app pour vous connecter avec votre Oxy ID.",

package/dist/esm/i18n/locales/it-IT.json

@@ -108,6 +108,7 @@
         "loading": "Caricamento account...",
         "qrHeadline": "Accedi con la tua identità Oxy",
         "signInWithOxy": "Accedi con Oxy",
+        "signUpWithOxy": "Registrati con Oxy",
         "useIdentityOnDevice": "Non hai Commons? Usa una passkey su questo dispositivo",
         "getCommons": "Ottieni Commons",
         "commonsNotInstalled": "Non hai Commons? Scarica l'app per accedere con il tuo Oxy ID.",

package/dist/esm/i18n/locales/ja-JP.json

@@ -108,6 +108,7 @@
         "loading": "アカウントを読み込み中...",
         "qrHeadline": "Oxy IDでサインイン",
         "signInWithOxy": "Oxyでサインイン",
+        "signUpWithOxy": "Oxyで登録",
         "useIdentityOnDevice": "Commonsがありませんか？このデバイスのパスキーを使用",
         "getCommons": "Commonsを入手",
         "commonsNotInstalled": "Commonsがありませんか？アプリを入手してOxy IDでサインインしましょう。",

package/dist/esm/i18n/locales/ko-KR.json

@@ -108,6 +108,7 @@
         "loading": "계정을 불러오는 중...",
         "qrHeadline": "Oxy ID로 로그인",
         "signInWithOxy": "Oxy로 로그인",
+        "signUpWithOxy": "Oxy로 가입하기",
         "useIdentityOnDevice": "Commons가 없으신가요? 이 기기의 패스키를 사용하세요",
         "getCommons": "Commons 다운로드",
         "commonsNotInstalled": "Commons가 없으신가요? 앱을 다운로드하여 Oxy ID로 로그인하세요.",

package/dist/esm/i18n/locales/locales/ar-SA.json

@@ -108,6 +108,7 @@
     "loading": "جارٍ تحميل الحسابات...",
     "qrHeadline": "سجّل الدخول بهوية Oxy الخاصة بك",
     "signInWithOxy": "تسجيل الدخول باستخدام Oxy",
+    "signUpWithOxy": "التسجيل باستخدام Oxy",
     "useIdentityOnDevice": "لا تملك Commons؟ استخدم مفتاح مرور على هذا الجهاز بدلاً من ذلك",
     "getCommons": "احصل على Commons",
     "commonsNotInstalled": "لا تملك Commons؟ احصل على التطبيق لتسجيل الدخول بمعرّف Oxy الخاص بك.",

package/dist/esm/i18n/locales/locales/ca-ES.json

@@ -108,6 +108,7 @@
     "loading": "S'estan carregant els comptes...",
     "qrHeadline": "Inicia sessió amb la teva identitat d'Oxy",
     "signInWithOxy": "Inicia sessió amb Oxy",
+    "signUpWithOxy": "Registra't amb Oxy",
     "useIdentityOnDevice": "No tens Commons? Fes servir una clau d'accés en aquest dispositiu",
     "getCommons": "Descarrega Commons",
     "commonsNotInstalled": "No tens Commons? Descarrega l'app per iniciar sessió amb el teu Oxy ID.",

package/dist/esm/i18n/locales/locales/de-DE.json

@@ -108,6 +108,7 @@
     "loading": "Konten werden geladen...",
     "qrHeadline": "Melden Sie sich mit Ihrer Oxy-Identität an",
     "signInWithOxy": "Mit Oxy anmelden",
+    "signUpWithOxy": "Mit Oxy registrieren",
     "useIdentityOnDevice": "Kein Commons? Verwenden Sie stattdessen einen Passkey auf diesem Gerät",
     "getCommons": "Commons herunterladen",
     "commonsNotInstalled": "Kein Commons? Holen Sie sich die App, um sich mit Ihrer Oxy-ID anzumelden.",

package/dist/esm/i18n/locales/locales/en-US.json

@@ -416,6 +416,7 @@
     "scanQr": "Scan QR code",
     "qrHeadline": "Sign in with your Oxy identity",
     "signInWithOxy": "Sign in with Oxy",
+    "signUpWithOxy": "Sign up with Oxy",
     "useIdentityOnDevice": "No Commons? Use a passkey on this device instead",
     "getCommons": "Get Commons",
     "commonsNotInstalled": "Don't have Commons? Get the app to sign in with your Oxy ID.",

package/dist/esm/i18n/locales/locales/es-ES.json

@@ -656,6 +656,7 @@
     "scanQr": "Escanear código QR",
     "qrHeadline": "Inicia sesión con tu identidad de Oxy",
     "signInWithOxy": "Inicia sesión con Oxy",
+    "signUpWithOxy": "Regístrate con Oxy",
     "useIdentityOnDevice": "¿No tienes Commons? Usa una clave de acceso en este dispositivo",
     "getCommons": "Descargar Commons",
     "commonsNotInstalled": "¿No tienes Commons? Descarga la app para iniciar sesión con tu Oxy ID.",

package/dist/esm/i18n/locales/locales/fr-FR.json

@@ -108,6 +108,7 @@
     "loading": "Chargement des comptes...",
     "qrHeadline": "Connectez-vous avec votre identité Oxy",
     "signInWithOxy": "Se connecter avec Oxy",
+    "signUpWithOxy": "S'inscrire avec Oxy",
     "useIdentityOnDevice": "Pas de Commons ? Utilisez une clé d'accès sur cet appareil",
     "getCommons": "Obtenir Commons",
     "commonsNotInstalled": "Pas de Commons ? Téléchargez l'app pour vous connecter avec votre Oxy ID.",

package/dist/esm/i18n/locales/locales/it-IT.json

@@ -108,6 +108,7 @@
     "loading": "Caricamento account...",
     "qrHeadline": "Accedi con la tua identità Oxy",
     "signInWithOxy": "Accedi con Oxy",
+    "signUpWithOxy": "Registrati con Oxy",
     "useIdentityOnDevice": "Non hai Commons? Usa una passkey su questo dispositivo",
     "getCommons": "Ottieni Commons",
     "commonsNotInstalled": "Non hai Commons? Scarica l'app per accedere con il tuo Oxy ID.",

package/dist/esm/i18n/locales/locales/ja-JP.json

@@ -108,6 +108,7 @@
     "loading": "アカウントを読み込み中...",
     "qrHeadline": "Oxy IDでサインイン",
     "signInWithOxy": "Oxyでサインイン",
+    "signUpWithOxy": "Oxyで登録",
     "useIdentityOnDevice": "Commonsがありませんか？このデバイスのパスキーを使用",
     "getCommons": "Commonsを入手",
     "commonsNotInstalled": "Commonsがありませんか？アプリを入手してOxy IDでサインインしましょう。",

package/dist/esm/i18n/locales/locales/ko-KR.json

@@ -108,6 +108,7 @@
     "loading": "계정을 불러오는 중...",
     "qrHeadline": "Oxy ID로 로그인",
     "signInWithOxy": "Oxy로 로그인",
+    "signUpWithOxy": "Oxy로 가입하기",
     "useIdentityOnDevice": "Commons가 없으신가요? 이 기기의 패스키를 사용하세요",
     "getCommons": "Commons 다운로드",
     "commonsNotInstalled": "Commons가 없으신가요? 앱을 다운로드하여 Oxy ID로 로그인하세요.",

package/dist/esm/i18n/locales/locales/pt-PT.json

@@ -108,6 +108,7 @@
     "loading": "A carregar contas...",
     "qrHeadline": "Inicie sessão com a sua identidade Oxy",
     "signInWithOxy": "Iniciar sessão com Oxy",
+    "signUpWithOxy": "Registar-se com Oxy",
     "useIdentityOnDevice": "Não tem o Commons? Use uma chave de acesso neste dispositivo",
     "getCommons": "Obter o Commons",
     "commonsNotInstalled": "Não tem o Commons? Obtenha a app para iniciar sessão com o seu Oxy ID.",

package/dist/esm/i18n/locales/locales/zh-CN.json

@@ -108,6 +108,7 @@
     "loading": "正在加载账户...",
     "qrHeadline": "使用您的 Oxy 身份登录",
     "signInWithOxy": "使用 Oxy 登录",
+    "signUpWithOxy": "使用 Oxy 注册",
     "useIdentityOnDevice": "没有 Commons？改用此设备上的通行密钥",
     "getCommons": "获取 Commons",
     "commonsNotInstalled": "没有 Commons？获取应用以使用您的 Oxy ID 登录。",

package/dist/esm/i18n/locales/pt-PT.json

@@ -108,6 +108,7 @@
         "loading": "A carregar contas...",
         "qrHeadline": "Inicie sessão com a sua identidade Oxy",
         "signInWithOxy": "Iniciar sessão com Oxy",
+        "signUpWithOxy": "Registar-se com Oxy",
         "useIdentityOnDevice": "Não tem o Commons? Use uma chave de acesso neste dispositivo",
         "getCommons": "Obter o Commons",
         "commonsNotInstalled": "Não tem o Commons? Obtenha a app para iniciar sessão com o seu Oxy ID.",

package/dist/esm/i18n/locales/zh-CN.json

@@ -108,6 +108,7 @@
         "loading": "正在加载账户...",
         "qrHeadline": "使用您的 Oxy 身份登录",
         "signInWithOxy": "使用 Oxy 登录",
+        "signUpWithOxy": "使用 Oxy 注册",
         "useIdentityOnDevice": "没有 Commons？改用此设备上的通行密钥",
         "getCommons": "获取 Commons",
         "commonsNotInstalled": "没有 Commons？获取应用以使用您的 Oxy ID 登录。",

package/dist/esm/index.js

@@ -81,10 +81,11 @@ export { RecoveryPhraseService } from './crypto/recoveryPhrase.js';
 export { hkdfSha256 } from './crypto/kdf.js';
 export { encryptAead, decryptAead, AEAD_KEY_LENGTH, AEAD_NONCE_LENGTH, } from './crypto/aead.js';
 export { deriveSharedSecret } from './crypto/ecdh.js';
-// Web identity carrier — the same identity as Commons, sealed under a passkey's
-// PRF output (docs/superpowers/specs/2026-09-15-one-identity-two-carriers-design.md)
-export { WEB_IDENTITY_PRF_INPUT, WebIdentityUnlockError, addWrap, buildIdentityActionMessage, deriveIdentityFromMnemonic, deriveKeyEncryptionKey, deriveTransferSas, generateDataKey, generateWebIdentity, openWebIdentity, removeWrap, sealWebIdentity, signIdentityAction, unlockWebIdentity, unwrapDataKey, wipeBytes, wrapDataKey, } from './crypto/webIdentityCarrier.js';
-export { IDENTITY_MOVE_ACTIONS, buildMoveMessage, buildMoveQrPayload, deriveMoveKey, deriveMoveSas, generateMoveEphemeralKeyPair, openMovedIdentity, parseMoveQrPayload, sealIdentityForMove, signMoveAction, verifyMoveReceipt, } from './crypto/identityMove.js';
+// Web identity holder — the same root as Commons, sealed under a passkey's PRF
+// output; identity proofs; transfer to Commons (docs/adr/0024-one-oxy-account-root-holders.md)
+export { WEB_IDENTITY_PRF_INPUT, WebIdentityUnlockError, WEB_IDENTITY_PRF_OUTPUT_LENGTH, addWrap, deriveIdentityFromMnemonic, deriveIdentityFromPrivateKey, deriveIdentityFromRecoveryMaterial, deriveKeyEncryptionKey, generateDataKey, generateWebIdentity, isUsablePrfOutput, markWrapVerified, normalizeMnemonic, openWebIdentity, parseRecoveryMaterial, removeWrap, sealWebIdentity, unlockWebIdentity, unwrapDataKey, wipeBytes, wipeOpenedIdentity, } from './crypto/webIdentityCarrier.js';
+export { digestIdentityPayload, signIdentityProof } from './crypto/identityProof.js';
+export { buildMoveQrPayload, createMoveCommitment, deriveMoveKey, deriveMoveSas, digestMoveCiphertext, generateMoveEphemeralKeyPair, openMovedIdentity, parseMoveQrPayload, sealIdentityForMove, signMoveReceipt, verifyMoveCommitment, verifyMoveReceipt, } from './crypto/identityMove.js';
 // ---------------------------------------------------------------------------
 // Devices
 // ---------------------------------------------------------------------------

package/dist/esm/inference/OxyInferenceClient.js

@@ -61,7 +61,7 @@ var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (
     return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
 };
 var _OxyInferenceClient_instances, _OxyInferenceClient_baseURL, _OxyInferenceClient_credential, _OxyInferenceClient_fetch, _OxyInferenceClient_bearer, _OxyInferenceClient_headers, _OxyInferenceClient_request;
-import { INFERENCE_ERROR_CODES, inferenceStreamEventSchema, modelIdSchema } from '@oxy.so/contracts';
+import { INFERENCE_ERROR_CODES, MAX_INFERENCE_AUDIO_BYTES, inferenceAudioMediaTypeSchema, inferenceStreamEventSchema, modelIdSchema, } from '@oxy.so/contracts';
 /** The base URL of the Oxy API, when a caller names none. */
 export const OXY_INFERENCE_BASE_URL = 'https://api.oxy.so';
 /**
@@ -202,6 +202,63 @@ export class OxyInferenceClient {
                 : { delegatedUserId: options.delegatedUserId }),
         });
     }
+    /** Generate audio bytes through Oxy's authenticated inference edge. */
+    async speech(request, options = {}) {
+        const response = await __classPrivateFieldGet(this, _OxyInferenceClient_fetch, "f").call(this, `${__classPrivateFieldGet(this, _OxyInferenceClient_baseURL, "f")}/v1/audio/speech`, {
+            method: 'POST',
+            headers: await __classPrivateFieldGet(this, _OxyInferenceClient_instances, "m", _OxyInferenceClient_headers).call(this, 'audio/*', {
+                hasBody: true,
+                ...(options.idempotencyKey === undefined
+                    ? {}
+                    : { idempotencyKey: options.idempotencyKey }),
+                ...(options.delegatedUserId === undefined
+                    ? {}
+                    : { delegatedUserId: options.delegatedUserId }),
+            }),
+            body: JSON.stringify(request),
+            ...(options.signal === undefined ? {} : { signal: options.signal }),
+        });
+        const requestId = response.headers.get('X-Oxy-Request-Id') ?? '';
+        if (!response.ok) {
+            throw toInferenceError(await response.json().catch(() => undefined), response.status, requestId);
+        }
+        const mediaType = inferenceAudioMediaTypeSchema.safeParse(mediaTypeOf(response));
+        if (!mediaType.success || !response.body) {
+            await cancelUnreadResponse(response);
+            throw protocolError('The inference API returned no supported audio body.', requestId);
+        }
+        const reader = response.body.getReader();
+        const chunks = [];
+        let size = 0;
+        let completed = false;
+        try {
+            while (true) {
+                const next = await reader.read();
+                if (next.done) {
+                    completed = true;
+                    break;
+                }
+                size += next.value.byteLength;
+                if (size > MAX_INFERENCE_AUDIO_BYTES)
+                    throw protocolError('The inference audio exceeds the response limit.', requestId);
+                chunks.push(next.value);
+            }
+        }
+        finally {
+            if (!completed)
+                await reader.cancel().catch(() => undefined);
+            reader.releaseLock();
+        }
+        if (size === 0)
+            throw protocolError('The inference API returned empty audio.', requestId);
+        const audio = new Uint8Array(size);
+        let offset = 0;
+        for (const chunk of chunks) {
+            audio.set(chunk, offset);
+            offset += chunk.byteLength;
+        }
+        return { audio, mediaType: mediaType.data, requestId };
+    }
     /**
      * Stream one inference request from `POST /v1/responses`.
      *
@@ -240,11 +297,7 @@ export class OxyInferenceClient {
             throw toInferenceError(payload, response.status, response.headers.get('X-Oxy-Request-Id'));
         }
         const requestId = response.headers.get('X-Oxy-Request-Id') ?? undefined;
-        const mediaType = response.headers
-            .get('Content-Type')
-            ?.split(';', 1)[0]
-            ?.trim()
-            .toLowerCase();
+        const mediaType = mediaTypeOf(response);
         if (mediaType !== 'text/event-stream') {
             await cancelUnreadResponse(response);
             throw protocolError(`The inference API answered a streaming request with ${mediaType ?? 'no Content-Type'} instead of text/event-stream.`, requestId);
@@ -373,6 +426,10 @@ const MAX_INFERENCE_STREAM_EVENT_DATA_LINES = 4096;
 function protocolError(message, requestId) {
     return new OxyInferenceProtocolError(message, requestId);
 }
+/** The bare, lowercased media type of a response's `Content-Type`, if any. */
+function mediaTypeOf(response) {
+    return response.headers.get('Content-Type')?.split(';', 1)[0]?.trim().toLowerCase();
+}
 /** Cancel a nominally successful response whose stream contract is unreadable. */
 async function cancelUnreadResponse(response) {
     await response.body?.cancel().catch(() => undefined);

package/dist/esm/mixins/OxyServices.auth.js

@@ -162,6 +162,24 @@ export function OxyServicesAuthMixin(Base) {
             const key = apiKey || this._serviceApiKey;
             const secret = apiSecret || this._serviceApiSecret;
             if (!key || !secret) {
+                /**
+                 * No credential configured — so prove what this process IS instead
+                 * (ADR 0026).
+                 *
+                 * This is what lets an official service drop its api key and secret
+                 * WITHOUT a code change: remove the two environment variables, and the
+                 * next token comes from the workload path. It is deliberately the
+                 * fallback rather than the preference, so a deployment that still has a
+                 * credential keeps using it and the migration is one service at a time.
+                 *
+                 * A process with no credential AND no attestation still gets the
+                 * original error: "nothing to authenticate with" is the truth there, and
+                 * a local checkout must not be told to go looking for a container
+                 * credentials endpoint that is not there.
+                 */
+                if (await this._canUseWorkloadIdentity()) {
+                    return this._getWorkloadServiceToken();
+                }
                 throw new Error('Service credentials not provided. Call configureServiceAuth() or pass apiKey and apiSecret.');
             }
             const cacheKey = await this._hashApiKey(key);
@@ -237,6 +255,84 @@ export function OxyServicesAuthMixin(Base) {
                 }
             }
         }
+        /**
+         * Whether this process can prove what it is (ADR 0026).
+         *
+         * The check and the module that performs it are loaded LAZILY and only on a
+         * Node host. `@oxy.so/core`'s root barrel reaches React Native and Expo, and
+         * `server/workloadIdentity` imports `node:crypto` — a static import here
+         * would pull it into every mobile bundle for a path a phone can never take.
+         *
+         * @internal
+         */
+        async _canUseWorkloadIdentity() {
+            if (typeof process === 'undefined' || !process.versions?.node)
+                return false;
+            try {
+                const { canAttestWorkloadIdentity } = await import('../server/workloadIdentity');
+                return canAttestWorkloadIdentity();
+            }
+            catch {
+                // A bundler that dropped the server subpath, or a runtime without it.
+                // "We cannot attest here" is the correct reading, and the caller falls
+                // back to the credential error it would have thrown anyway.
+                return false;
+            }
+        }
+        /**
+         * A service token obtained by attestation, cached like a credential's.
+         *
+         * The cache key is a constant, not a credential hash: a process has exactly
+         * one identity, so there is nothing to key on and nothing to keep separate.
+         * The secret-comparison guard the credential path applies has nothing to
+         * compare here, which is the point — there is no secret.
+         *
+         * @internal
+         */
+        async _getWorkloadServiceToken() {
+            const cacheKey = 'workload-identity';
+            const entry = this._serviceTokenCache.get(cacheKey);
+            const now = Date.now();
+            if (entry?.token && entry.expiresAt > now + 60000)
+                return entry.token;
+            if (entry?.pending)
+                return entry.pending;
+            const { requestWorkloadServiceToken } = await import('../server/workloadIdentity');
+            const seeded = entry ?? {
+                token: '',
+                expiresAt: 0,
+                secretBuf: Buffer.alloc(0),
+                pending: null,
+                apiKey: cacheKey,
+            };
+            this._serviceTokenCache.set(cacheKey, seeded);
+            const pending = (async () => {
+                const granted = await requestWorkloadServiceToken({ baseUrl: this.getBaseURL() });
+                const current = this._serviceTokenCache.get(cacheKey);
+                if (current) {
+                    current.token = granted.token;
+                    current.expiresAt = Date.now() + granted.expiresIn * 1000;
+                }
+                return granted.token;
+            })();
+            seeded.pending = pending;
+            try {
+                return await pending;
+            }
+            catch (error) {
+                // Never keep an entry that never held a token: the next caller must try
+                // again rather than inherit a failure.
+                const failed = this._serviceTokenCache.get(cacheKey);
+                if (failed?.pending === pending && !failed.token)
+                    this._serviceTokenCache.delete(cacheKey);
+                throw error;
+            }
+            finally {
+                const settled = this._serviceTokenCache.get(cacheKey);
+                if (settled?.pending === pending)
+                    settled.pending = null;
+            }
+        }
         /**
          * Perform the actual /auth/service-token request and cache the result.
          * Separated so getServiceToken() can deduplicate concurrent calls.

package/dist/esm/mixins/OxyServices.identity.js

@@ -71,50 +71,15 @@ export function OxyServicesIdentityMixin(Base) {
             }
         }
         /**
-         * Link the on-device cryptographic identity to the current account,
-         * upgrading it from custodial to self-sovereign. Signs a proof of private
-         * key ownership and posts it to `POST /auth/link`.
-         *
-         * NATIVE-ONLY: requires a stored identity (throws if `KeyManager` has no key
-         * or no user is authenticated). The signed payload is
-         * `JSON.stringify({ action: 'link_identity', userId, timestamp })` — the
-         * exact bytes the server reconstructs and verifies.
+         * The signed-in account's root readiness (ADR 0024 D5): whether a root is
+         * linked, how many passkeys can open the web holder, whether the root has a
+         * phrase and whether it is saved and was shown to recover it. Metadata only —
+         * nothing here can open the root — so any first-party surface may show a
+         * "save your recovery phrase" reminder from it.
          */
-        async linkIdentityKey() {
+        async getIdentityRootStatus() {
             try {
-                const userId = this.getCurrentUserId();
-                if (!userId) {
-                    throw new Error('No authenticated user — sign in before linking an identity key.');
-                }
-                const publicKey = await KeyManager.getPublicKey();
-                if (!publicKey) {
-                    throw new Error('No identity found on this device. Create or import an identity first.');
-                }
-                const timestamp = Date.now();
-                // The signed message MUST match the server's reconstruction byte-for-byte:
-                // JSON.stringify with this exact key order (action, userId, timestamp).
-                const message = JSON.stringify({ action: 'link_identity', userId, timestamp });
-                const signature = await SignatureService.sign(message);
-                const result = await this.makeRequest('POST', '/auth/link', { type: 'identity', publicKey, signature, timestamp }, { cache: false });
-                this._invalidateIdentityCaches(userId);
-                return result;
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Unlink an authentication method from the current account. The server
-         * refuses to remove the last remaining method (the account would become
-         * inaccessible). Unlinking `identity` downgrades the account to custodial.
-         *
-         * @param type - The auth-method type to remove.
-         */
-        async unlinkAuthMethod(type) {
-            try {
-                const result = await this.makeRequest('DELETE', `/auth/link/${encodeURIComponent(type)}`, undefined, { cache: false });
-                this._invalidateIdentityCaches(this.getCurrentUserId());
-                return result;
+                return await this.makeRequest('GET', '/identity/root-status', undefined, { cache: false });
             }
             catch (error) {
                 throw this.handleError(error);
@@ -123,10 +88,12 @@ export function OxyServicesIdentityMixin(Base) {
         /**
          * Remove ONE passkey (WebAuthn credential) from the current account.
          *
-         * Passkeys are per-credential, so unlike {@link unlinkAuthMethod} (which
-         * removes an auth method by type) this targets a specific credential id.
+         * Passkeys are per-credential, so this targets a specific credential id.
          * The server refuses to remove the last remaining auth method (the account
          * would become inaccessible) and deletes the stored `WebauthnCredential`.
+         * A passkey that also opens the account's root on the web takes its wrap with
+         * it, and the ONLY such passkey is refused with
+         * `code: 'IDENTITY_LAST_WEB_HOLDER'` (ADR 0024 D6).
          *
          * @param credentialId - The passkey's public credential id
          *   (`AuthMethodEntry.credentialId`).

package/dist/esm/mixins/index.js

@@ -34,7 +34,6 @@ import { OxyServicesNodesMixin } from './OxyServices.nodes.js';
 import { OxyServicesFollowGraphMixin } from './OxyServices.followGraph.js';
 import { OxyServicesInferenceMixin } from './OxyServices.inference.js';
 import { OxyServicesDeviceBootMixin } from './OxyServices.deviceBoot.js';
-import { OxyServicesDeviceTransferMixin } from './OxyServices.deviceTransfer.js';
 /**
  * Mixin pipeline - applied in order from first to last.
  *
@@ -106,7 +105,6 @@ const MIXIN_PIPELINE = [
     OxyServicesDeviceBootMixin,
     // Device-to-device identity transfer ("add a device"): E2E-encrypted key
     // clone over a short-lived relay (b3 Feature 2).
-    OxyServicesDeviceTransferMixin,
     // Utility (last, can use all above)
     OxyServicesUtilityMixin,
 ];

package/dist/esm/server/index.js

@@ -50,3 +50,10 @@ export { registrableApex } from '../utils/registrableApex.js';
 export { isOfficialWebOrigin } from '../utils/officialOrigins.js';
 export { createEcosystemTraffic } from './traffic.js';
 export { observeNodeHttp, withoutNodeHttpObservation } from './trafficNodeHttp.js';
+/**
+ * Workload identity (ADR 0026): a first-party service asks Oxy for a service
+ * token by proving what it IS, with no api key and no secret. Server-only, and
+ * exported from this subpath rather than the root barrel because it reaches the
+ * container credentials endpoint.
+ */
+export { canAttestWorkloadIdentity, requestWorkloadServiceToken } from './workloadIdentity.js';

package/dist/esm/server/securityHeaders.js

@@ -320,9 +320,16 @@ export function buildOxyPagesHeaders(options = {}) {
     if (hashes.length > MAX_INLINE_SCRIPT_HASHES) {
         throw new RangeError(`Oxy CSP: ${hashes.length} distinct inline scripts in the built HTML exceeds the ${MAX_INLINE_SCRIPT_HASHES}-hash ceiling. A per-route inline data block (e.g. an Expo Router loader) is the likely cause; allow it deliberately rather than by raising this.`);
     }
-    const csp = formatOxyCspPolicy(buildOxyCspDirectives(hashes.length === 0
+    const directives = buildOxyCspDirectives(hashes.length === 0
         ? options.csp
-        : { ...options.csp, scriptSrc: [...(options.csp?.scriptSrc ?? []), ...hashes] }));
+        : { ...options.csp, scriptSrc: [...(options.csp?.scriptSrc ?? []), ...hashes] });
+    if (options.sensitive) {
+        const beacon = new Set([CLOUDFLARE_INSIGHTS_SCRIPT_ORIGIN, CLOUDFLARE_INSIGHTS_REPORT_ORIGIN]);
+        for (const name of ['script-src', 'connect-src']) {
+            directives[name] = (directives[name] ?? []).filter((source) => !beacon.has(source));
+        }
+    }
+    const csp = formatOxyCspPolicy(directives);
     const lines = [
         '/*',
         `  Content-Security-Policy: ${csp}`,