@oxy.so/core 1.7.1 → 1.7.4

package/dist/esm/mixins/OxyServices.auth.js

@@ -259,10 +259,13 @@ export function OxyServicesAuthMixin(Base) {
         /**
          * Whether this process can prove what it is (ADR 0026).
          *
-         * The check and the module that performs it are loaded LAZILY and only on a
-         * Node host. `@oxy.so/core`'s root barrel reaches React Native and Expo, and
-         * `server/workloadIdentity` imports `node:crypto` — a static import here
-         * would pull it into every mobile bundle for a path a phone can never take.
+         * `#workload-identity` (package.json `imports`) selects a client
+         * implementation for native and browser bundlers, and the signer only for
+         * Node hosts. The runtime Node guard avoids calling attestation on clients;
+         * the module boundary keeps node:crypto out of their bundle graphs (a guard
+         * alone cannot). It is a package import, not a self-reference to an export
+         * subpath: a self-reference only resolves where `@oxy.so/core` is reachable
+         * through `node_modules`, which bundlers inside this workspace are not.
          *
          * @internal
          */
@@ -270,7 +273,7 @@ export function OxyServicesAuthMixin(Base) {
             if (typeof process === 'undefined' || !process.versions?.node)
                 return false;
             try {
-                const { canAttestWorkloadIdentity } = await import('../server/workloadIdentity.js');
+                const { canAttestWorkloadIdentity } = await import('#workload-identity');
                 return canAttestWorkloadIdentity();
             }
             catch {
@@ -298,7 +301,7 @@ export function OxyServicesAuthMixin(Base) {
                 return entry.token;
             if (entry?.pending)
                 return entry.pending;
-            const { requestWorkloadServiceToken } = await import('../server/workloadIdentity.js');
+            const { requestWorkloadServiceToken } = await import('#workload-identity');
             const seeded = entry ?? {
                 token: '',
                 expiresAt: 0,

package/dist/esm/package.json

@@ -1,3 +1,11 @@
 {
-  "type": "module"
+  "type": "module",
+  "imports": {
+    "#workload-identity": {
+      "react-native": "./server/workloadIdentity.client.js",
+      "browser": "./server/workloadIdentity.client.js",
+      "node": "./server/workloadIdentity.js",
+      "default": "./server/workloadIdentity.client.js"
+    }
+  }
 }

package/dist/esm/server/workloadIdentity.client.js

@@ -0,0 +1,7 @@
+/** Workload attestation belongs to a Node host, never a browser or device. */
+export function canAttestWorkloadIdentity() {
+    return false;
+}
+export async function requestWorkloadServiceToken(_options) {
+    throw new Error('Workload identity is only available on a Node host');
+}