@oxy.so/core 1.7.1 → 1.7.3

package/dist/esm/mixins/OxyServices.auth.js

@@ -259,10 +259,10 @@ export function OxyServicesAuthMixin(Base) {
         /**
          * Whether this process can prove what it is (ADR 0026).
          *
-         * The check and the module that performs it are loaded LAZILY and only on a
-         * Node host. `@oxy.so/core`'s root barrel reaches React Native and Expo, and
-         * `server/workloadIdentity` imports `node:crypto` — a static import here
-         * would pull it into every mobile bundle for a path a phone can never take.
+         * The internal package subpath selects a client implementation for native
+         * and browser bundlers, and the signer only for Node hosts. The runtime
+         * Node guard avoids calling attestation on clients; the module boundary
+         * keeps node:crypto out of their bundle graphs (a guard alone cannot).
          *
          * @internal
          */
@@ -270,7 +270,7 @@ export function OxyServicesAuthMixin(Base) {
             if (typeof process === 'undefined' || !process.versions?.node)
                 return false;
             try {
-                const { canAttestWorkloadIdentity } = await import('../server/workloadIdentity.js');
+                const { canAttestWorkloadIdentity } = await import('@oxy.so/core/internal/workload-identity');
                 return canAttestWorkloadIdentity();
             }
             catch {
@@ -298,7 +298,7 @@ export function OxyServicesAuthMixin(Base) {
                 return entry.token;
             if (entry?.pending)
                 return entry.pending;
-            const { requestWorkloadServiceToken } = await import('../server/workloadIdentity.js');
+            const { requestWorkloadServiceToken } = await import('@oxy.so/core/internal/workload-identity');
             const seeded = entry ?? {
                 token: '',
                 expiresAt: 0,

package/dist/esm/server/workloadIdentity.client.js

@@ -0,0 +1,7 @@
+/** Workload attestation belongs to a Node host, never a browser or device. */
+export function canAttestWorkloadIdentity() {
+    return false;
+}
+export async function requestWorkloadServiceToken(_options) {
+    throw new Error('Workload identity is only available on a Node host');
+}