@oxy.so/core 1.7.0 → 1.7.3

package/dist/cjs/crypto/registrationPow.js

@@ -0,0 +1,53 @@
+"use strict";
+/**
+ * Registration proof-of-work — the CLIENT half of the anti-automation nonce
+ * `register()` (`mixins/OxyServices.auth.ts`) submits alongside the
+ * registration signature. The message format, difficulty and the full design
+ * rationale (why 16 bits, why sequential nonces are fine, what this is and
+ * isn't a defense against) live in `@oxy.so/protocol`'s
+ * `auth/registrationPow.ts` — this file is only the solve loop.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.solveRegistrationPow = solveRegistrationPow;
+require("./polyfill");
+const sha256_1 = require("@noble/hashes/sha256");
+const utils_1 = require("@noble/hashes/utils");
+const protocol_1 = require("@oxy.so/protocol");
+/**
+ * How many attempts the grind loop runs before yielding to the event loop.
+ *
+ * A synchronous hot loop long enough to matter (an average solve at 16 bits
+ * is 65,536 attempts) would otherwise block the JS thread for its entire
+ * duration — on a mobile app that means no touch response, no animation, for
+ * up to roughly a second. Yielding periodically keeps the UI responsive
+ * during the grind at the cost of a handful of event-loop round trips, which
+ * is imperceptible next to the grind itself.
+ */
+const YIELD_EVERY_N_ATTEMPTS = 2000;
+function yieldToEventLoop() {
+    return new Promise((resolve) => setTimeout(resolve, 0));
+}
+/**
+ * Grind a nonce for `publicKey`/`timestamp` that clears
+ * {@link REGISTRATION_POW_DIFFICULTY_BITS}, returned as a decimal counter.
+ *
+ * Hashes with `@noble/hashes/sha256` — pure JS, synchronous, identical output
+ * on web/Node/React Native with no native module and no per-attempt bridge
+ * crossing (see the difficulty constant's own doc for why that distinction is
+ * the whole point). Nonces are sequential (0, 1, 2, …) rather than random: the
+ * candidate space a hash function spreads solutions across is dense either
+ * way, so a counter finds one exactly as reliably as randomness would, without
+ * needing a randomness source at all.
+ */
+async function solveRegistrationPow(publicKey, timestamp) {
+    for (let nonce = 0;; nonce += 1) {
+        const candidate = String(nonce);
+        const digest = (0, utils_1.bytesToHex)((0, sha256_1.sha256)((0, utils_1.utf8ToBytes)((0, protocol_1.registrationPowMessage)(publicKey, timestamp, candidate))));
+        if ((0, protocol_1.meetsRegistrationPowDifficulty)(digest, protocol_1.REGISTRATION_POW_DIFFICULTY_BITS)) {
+            return candidate;
+        }
+        if (nonce % YIELD_EVERY_N_ATTEMPTS === YIELD_EVERY_N_ATTEMPTS - 1) {
+            await yieldToEventLoop();
+        }
+    }
+}

package/dist/cjs/mixins/OxyServices.auth.js

@@ -41,6 +41,7 @@ Object.defineProperty(exports, "getCommonsApprovalBlockingReason", { enumerable:
 Object.defineProperty(exports, "parseCommonsApprovalExpiresAt", { enumerable: true, get: function () { return commonsApproval_1.parseCommonsApprovalExpiresAt; } });
 const OxyServices_errors_1 = require("../OxyServices.errors");
 const keyManager_1 = require("../crypto/keyManager");
+const registrationPow_1 = require("../crypto/registrationPow");
 const signatureService_1 = require("../crypto/signatureService");
 const protocol_1 = require("@oxy.so/protocol");
 const logger_1 = require("../logger");
@@ -298,10 +299,10 @@ function OxyServicesAuthMixin(Base) {
         /**
          * Whether this process can prove what it is (ADR 0026).
          *
-         * The check and the module that performs it are loaded LAZILY and only on a
-         * Node host. `@oxy.so/core`'s root barrel reaches React Native and Expo, and
-         * `server/workloadIdentity` imports `node:crypto` — a static import here
-         * would pull it into every mobile bundle for a path a phone can never take.
+         * The internal package subpath selects a client implementation for native
+         * and browser bundlers, and the signer only for Node hosts. The runtime
+         * Node guard avoids calling attestation on clients; the module boundary
+         * keeps node:crypto out of their bundle graphs (a guard alone cannot).
          *
          * @internal
          */
@@ -309,7 +310,7 @@ function OxyServicesAuthMixin(Base) {
             if (typeof process === 'undefined' || !process.versions?.node)
                 return false;
             try {
-                const { canAttestWorkloadIdentity } = await Promise.resolve().then(() => __importStar(require('../server/workloadIdentity')));
+                const { canAttestWorkloadIdentity } = await Promise.resolve().then(() => __importStar(require('@oxy.so/core/internal/workload-identity')));
                 return canAttestWorkloadIdentity();
             }
             catch {
@@ -337,7 +338,7 @@ function OxyServicesAuthMixin(Base) {
                 return entry.token;
             if (entry?.pending)
                 return entry.pending;
-            const { requestWorkloadServiceToken } = await Promise.resolve().then(() => __importStar(require('../server/workloadIdentity')));
+            const { requestWorkloadServiceToken } = await Promise.resolve().then(() => __importStar(require('@oxy.so/core/internal/workload-identity')));
             const seeded = entry ?? {
                 token: '',
                 expiresAt: 0,
@@ -472,10 +473,15 @@ function OxyServicesAuthMixin(Base) {
          */
         async register(publicKey, signature, timestamp) {
             try {
+                // Advisory for now (server soft-enforces — see
+                // `SessionController.register`), but solved unconditionally so every
+                // client is already sending it once the server starts requiring it.
+                const powNonce = await (0, registrationPow_1.solveRegistrationPow)(publicKey, timestamp);
                 const res = await this.makeRequest('POST', '/auth/register', {
                     publicKey,
                     signature,
                     timestamp,
+                    powNonce,
                 }, { cache: false, skipAuth: true });
                 if (!res || (typeof res === 'object' && Object.keys(res).length === 0)) {
                     throw new OxyServices_errors_1.OxyAuthenticationError('Registration failed', 'REGISTER_FAILED', 400);

package/dist/cjs/server/workloadIdentity.client.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canAttestWorkloadIdentity = canAttestWorkloadIdentity;
+exports.requestWorkloadServiceToken = requestWorkloadServiceToken;
+/** Workload attestation belongs to a Node host, never a browser or device. */
+function canAttestWorkloadIdentity() {
+    return false;
+}
+async function requestWorkloadServiceToken(_options) {
+    throw new Error('Workload identity is only available on a Node host');
+}