@oxy.so/core 1.7.1 → 1.7.3

package/dist/cjs/mixins/OxyServices.auth.js

@@ -299,10 +299,10 @@ function OxyServicesAuthMixin(Base) {
         /**
          * Whether this process can prove what it is (ADR 0026).
          *
-         * The check and the module that performs it are loaded LAZILY and only on a
-         * Node host. `@oxy.so/core`'s root barrel reaches React Native and Expo, and
-         * `server/workloadIdentity` imports `node:crypto` — a static import here
-         * would pull it into every mobile bundle for a path a phone can never take.
+         * The internal package subpath selects a client implementation for native
+         * and browser bundlers, and the signer only for Node hosts. The runtime
+         * Node guard avoids calling attestation on clients; the module boundary
+         * keeps node:crypto out of their bundle graphs (a guard alone cannot).
          *
          * @internal
          */
@@ -310,7 +310,7 @@ function OxyServicesAuthMixin(Base) {
             if (typeof process === 'undefined' || !process.versions?.node)
                 return false;
             try {
-                const { canAttestWorkloadIdentity } = await Promise.resolve().then(() => __importStar(require('../server/workloadIdentity')));
+                const { canAttestWorkloadIdentity } = await Promise.resolve().then(() => __importStar(require('@oxy.so/core/internal/workload-identity')));
                 return canAttestWorkloadIdentity();
             }
             catch {
@@ -338,7 +338,7 @@ function OxyServicesAuthMixin(Base) {
                 return entry.token;
             if (entry?.pending)
                 return entry.pending;
-            const { requestWorkloadServiceToken } = await Promise.resolve().then(() => __importStar(require('../server/workloadIdentity')));
+            const { requestWorkloadServiceToken } = await Promise.resolve().then(() => __importStar(require('@oxy.so/core/internal/workload-identity')));
             const seeded = entry ?? {
                 token: '',
                 expiresAt: 0,

package/dist/cjs/server/workloadIdentity.client.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canAttestWorkloadIdentity = canAttestWorkloadIdentity;
+exports.requestWorkloadServiceToken = requestWorkloadServiceToken;
+/** Workload attestation belongs to a Node host, never a browser or device. */
+function canAttestWorkloadIdentity() {
+    return false;
+}
+async function requestWorkloadServiceToken(_options) {
+    throw new Error('Workload identity is only available on a Node host');
+}