@oxy.so/core 1.7.1 → 1.7.4

package/dist/cjs/mixins/OxyServices.auth.js

@@ -299,10 +299,13 @@ function OxyServicesAuthMixin(Base) {
         /**
          * Whether this process can prove what it is (ADR 0026).
          *
-         * The check and the module that performs it are loaded LAZILY and only on a
-         * Node host. `@oxy.so/core`'s root barrel reaches React Native and Expo, and
-         * `server/workloadIdentity` imports `node:crypto` — a static import here
-         * would pull it into every mobile bundle for a path a phone can never take.
+         * `#workload-identity` (package.json `imports`) selects a client
+         * implementation for native and browser bundlers, and the signer only for
+         * Node hosts. The runtime Node guard avoids calling attestation on clients;
+         * the module boundary keeps node:crypto out of their bundle graphs (a guard
+         * alone cannot). It is a package import, not a self-reference to an export
+         * subpath: a self-reference only resolves where `@oxy.so/core` is reachable
+         * through `node_modules`, which bundlers inside this workspace are not.
          *
          * @internal
          */
@@ -310,7 +313,7 @@ function OxyServicesAuthMixin(Base) {
             if (typeof process === 'undefined' || !process.versions?.node)
                 return false;
             try {
-                const { canAttestWorkloadIdentity } = await Promise.resolve().then(() => __importStar(require('../server/workloadIdentity')));
+                const { canAttestWorkloadIdentity } = await Promise.resolve().then(() => __importStar(require('#workload-identity')));
                 return canAttestWorkloadIdentity();
             }
             catch {
@@ -338,7 +341,7 @@ function OxyServicesAuthMixin(Base) {
                 return entry.token;
             if (entry?.pending)
                 return entry.pending;
-            const { requestWorkloadServiceToken } = await Promise.resolve().then(() => __importStar(require('../server/workloadIdentity')));
+            const { requestWorkloadServiceToken } = await Promise.resolve().then(() => __importStar(require('#workload-identity')));
             const seeded = entry ?? {
                 token: '',
                 expiresAt: 0,

package/dist/cjs/package.json

@@ -1,3 +1,11 @@
 {
-  "type": "commonjs"
+  "type": "commonjs",
+  "imports": {
+    "#workload-identity": {
+      "react-native": "./server/workloadIdentity.client.js",
+      "browser": "./server/workloadIdentity.client.js",
+      "node": "./server/workloadIdentity.js",
+      "default": "./server/workloadIdentity.client.js"
+    }
+  }
 }

package/dist/cjs/server/workloadIdentity.client.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canAttestWorkloadIdentity = canAttestWorkloadIdentity;
+exports.requestWorkloadServiceToken = requestWorkloadServiceToken;
+/** Workload attestation belongs to a Node host, never a browser or device. */
+function canAttestWorkloadIdentity() {
+    return false;
+}
+async function requestWorkloadServiceToken(_options) {
+    throw new Error('Workload identity is only available on a Node host');
+}