@oxy.so/core 1.7.3 → 1.8.0

package/dist/types/inference/OxyInferenceClient.d.ts

@@ -49,7 +49,7 @@
  * schema, so a rename on either side fails a build rather than a customer's
  * request.
  */
-import type { CurrencyCode, ExactDecimal, InferenceEnvironment, InferenceErrorCode, InferenceFinishReason, InferenceMessage, InferenceRequestOutcome, InferenceAudioMediaType, InferenceStreamEvent, InferenceSpeechParameters, ModelCatalogueEntry, ResponseFormat, RoutingPolicyReference, RoutingProfile, ToolChoice, ToolDefinition, UnitPrice, UsageQuantity, UsageSource } from '@oxy.so/contracts';
+import type { CurrencyCode, ExactDecimal, InferenceEnvironment, InferenceErrorCode, InferenceFinishReason, InferenceMessage, InferenceReasoning, InferenceRequestOutcome, InferenceAudioMediaType, InferenceStreamEvent, InferenceSpeechParameters, ModelCatalogueEntry, ResponseFormat, RoutingPolicyReference, RoutingProfile, ToolChoice, ToolDefinition, UnitPrice, UsageQuantity, UsageSource } from '@oxy.so/contracts';
 /** The base URL of the Oxy API, when a caller names none. */
 export declare const OXY_INFERENCE_BASE_URL = "https://api.oxy.so";
 /**
@@ -105,6 +105,12 @@ export interface OxyResponsesRequest {
     readonly tools?: readonly ToolDefinition[];
     readonly toolChoice?: ToolChoice;
     readonly responseFormat?: ResponseFormat;
+    /**
+     * `{ effort: 'low' | 'medium' | 'high' }`. Name only an effort the model
+     * lists in its catalogue entry's `capabilities.reasoningEfforts`; any other
+     * is refused with `invalid_request` (HTTP 400) before anything is charged.
+     */
+    readonly reasoning?: InferenceReasoning;
     /** Cost-attribution tags, echoed back on the receipt. At most 16. */
     readonly labels?: Readonly<Record<string, string>>;
     /** Your own correlation id, echoed on the response. */
@@ -282,9 +288,14 @@ export declare class OxyInferenceClient {
      * both see the PUBLIC catalogue; only an internal/system application's
      * service token sees internal-only routes.
      *
-     * **`[]` is a normal answer**, and is the only answer today: the catalogue
-     * is populated by operators, and a route is not publicly exposed until
-     * somebody has reviewed the right to resell it.
+     * **`[]` is a normal answer**: a route is not publicly exposed until
+     * somebody has reviewed the right to resell it. An official application's
+     * credential also sees the internal catalogue Oxy keeps in step with
+     * Kaana automatically.
+     *
+     * Each entry's `capabilities.reasoningEfforts` lists the efforts a request
+     * may name in `reasoning.effort` (empty: none), and `releasedAt`, when
+     * present, is the date the upstream provider published the model.
      */
     listModels(options?: {
         signal?: AbortSignal;

package/dist/types/mixins/OxyServices.auth.d.ts

@@ -391,10 +391,13 @@ export declare function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(B
         /**
          * Whether this process can prove what it is (ADR 0026).
          *
-         * The internal package subpath selects a client implementation for native
-         * and browser bundlers, and the signer only for Node hosts. The runtime
-         * Node guard avoids calling attestation on clients; the module boundary
-         * keeps node:crypto out of their bundle graphs (a guard alone cannot).
+         * `#workload-identity` (package.json `imports`) selects a client
+         * implementation for native and browser bundlers, and the signer only for
+         * Node hosts. The runtime Node guard avoids calling attestation on clients;
+         * the module boundary keeps node:crypto out of their bundle graphs (a guard
+         * alone cannot). It is a package import, not a self-reference to an export
+         * subpath: a self-reference only resolves where `@oxy.so/core` is reachable
+         * through `node_modules`, which bundlers inside this workspace are not.
          *
          * @internal
          */

package/dist/types/mixins/OxyServices.utility.d.ts

@@ -47,6 +47,14 @@ export interface ServiceApp {
     appId: string;
     appName: string;
     scopes: string[];
+    /**
+     * `internal` when the caller is one of Oxy's own applications: app to app it
+     * is trusted outright — {@link requireScope} passes and it may act for a user
+     * without a delegation grant. `external` keeps every scope and grant rule.
+     * What the USER may do (their accounts, plan, limits) is still for the
+     * receiving service to decide. A token without the claim reads as `external`.
+     */
+    tier: 'internal' | 'external';
     /** The credentialId of the specific service credential that minted this token. */
     credentialId: string;
     /**

package/dist/types/server/auth.d.ts

@@ -24,6 +24,8 @@ export interface OxyServiceAppContext {
      */
     ownerAccountId: string;
     environment: OxyServiceEnvironment;
+    /** `internal` for one of Oxy's own applications, else `external` (see `ServiceApp.tier`). */
+    tier: 'internal' | 'external';
 }
 export interface OxyServiceActingAsContext {
     userId: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/core",
-  "version": "1.7.3",
+  "version": "1.8.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -59,17 +59,7 @@
       },
       "default": "./dist/esm/logger/index.js"
     },
-    "./package.json": "./package.json",
-    "./internal/workload-identity": {
-      "types": "./dist/types/server/workloadIdentity.d.ts",
-      "react-native": "./dist/esm/server/workloadIdentity.client.js",
-      "browser": "./dist/esm/server/workloadIdentity.client.js",
-      "node": {
-        "import": "./dist/esm/server/workloadIdentity.js",
-        "require": "./dist/cjs/server/workloadIdentity.js"
-      },
-      "default": "./dist/esm/server/workloadIdentity.client.js"
-    }
+    "./package.json": "./package.json"
   },
   "files": [
     "NOTICE",
@@ -128,7 +118,7 @@
     "@oxy.so/telemetry": "^1.1.1",
     "@noble/ciphers": "^1.3.0",
     "@noble/hashes": "^1.8.0",
-    "@oxy.so/contracts": "^1.3.0",
+    "@oxy.so/contracts": "^1.4.0",
     "@oxy.so/protocol": "^1.1.0",
     "@scure/bip39": "^1.6.0",
     "buffer": "^6.0.3",

package/src/inference/OxyInferenceClient.ts

@@ -57,6 +57,7 @@ import type {
     InferenceErrorCode,
     InferenceFinishReason,
     InferenceMessage,
+    InferenceReasoning,
     InferenceRequestOutcome,
     InferenceAudioMediaType,
     InferenceStreamEvent,
@@ -140,6 +141,12 @@ export interface OxyResponsesRequest {
     readonly tools?: readonly ToolDefinition[];
     readonly toolChoice?: ToolChoice;
     readonly responseFormat?: ResponseFormat;
+    /**
+     * `{ effort: 'low' | 'medium' | 'high' }`. Name only an effort the model
+     * lists in its catalogue entry's `capabilities.reasoningEfforts`; any other
+     * is refused with `invalid_request` (HTTP 400) before anything is charged.
+     */
+    readonly reasoning?: InferenceReasoning;
     /** Cost-attribution tags, echoed back on the receipt. At most 16. */
     readonly labels?: Readonly<Record<string, string>>;
     /** Your own correlation id, echoed on the response. */
@@ -370,9 +377,14 @@ export class OxyInferenceClient {
      * both see the PUBLIC catalogue; only an internal/system application's
      * service token sees internal-only routes.
      *
-     * **`[]` is a normal answer**, and is the only answer today: the catalogue
-     * is populated by operators, and a route is not publicly exposed until
-     * somebody has reviewed the right to resell it.
+     * **`[]` is a normal answer**: a route is not publicly exposed until
+     * somebody has reviewed the right to resell it. An official application's
+     * credential also sees the internal catalogue Oxy keeps in step with
+     * Kaana automatically.
+     *
+     * Each entry's `capabilities.reasoningEfforts` lists the efforts a request
+     * may name in `reasoning.effort` (empty: none), and `releasedAt`, when
+     * present, is the date the upstream provider published the model.
      */
     async listModels(options: { signal?: AbortSignal } = {}): Promise<ModelCatalogueEntry[]> {
         const body = await this.#request<CatalogueCollection<ModelCatalogueEntry>>(

package/src/inference/__tests__/OxyInferenceClient.test.ts

@@ -296,6 +296,23 @@ describe('OxyInferenceClient', () => {
             expect(answer.requestId).toBe('req-1');
         });
 
+        it('sends a reasoning effort as the edge expects it', async () => {
+            const { impl, calls } = stubFetch([{ status: 200, body: {} }]);
+            const client = new OxyInferenceClient({
+                credential: 'k',
+                baseURL: 'http://test.invalid',
+                fetch: impl,
+            });
+
+            await client.respond({ model: 'acme/thinker', input: 'hello', reasoning: { effort: 'high' } });
+
+            expect(JSON.parse(String(calls[0].init.body))).toEqual({
+                model: 'acme/thinker',
+                input: 'hello',
+                reasoning: { effort: 'high' },
+            });
+        });
+
         it('serializes an exact routing-profile ID byte-for-byte', async () => {
             const { impl, calls } = stubFetch([{ status: 200, body: {} }]);
             const client = new OxyInferenceClient({

package/src/mixins/OxyServices.auth.ts

@@ -647,17 +647,20 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
     /**
      * Whether this process can prove what it is (ADR 0026).
      *
-     * The internal package subpath selects a client implementation for native
-     * and browser bundlers, and the signer only for Node hosts. The runtime
-     * Node guard avoids calling attestation on clients; the module boundary
-     * keeps node:crypto out of their bundle graphs (a guard alone cannot).
+     * `#workload-identity` (package.json `imports`) selects a client
+     * implementation for native and browser bundlers, and the signer only for
+     * Node hosts. The runtime Node guard avoids calling attestation on clients;
+     * the module boundary keeps node:crypto out of their bundle graphs (a guard
+     * alone cannot). It is a package import, not a self-reference to an export
+     * subpath: a self-reference only resolves where `@oxy.so/core` is reachable
+     * through `node_modules`, which bundlers inside this workspace are not.
      *
      * @internal
      */
     async _canUseWorkloadIdentity(): Promise<boolean> {
       if (typeof process === 'undefined' || !process.versions?.node) return false;
       try {
-        const { canAttestWorkloadIdentity } = await import('@oxy.so/core/internal/workload-identity');
+        const { canAttestWorkloadIdentity } = await import('#workload-identity');
         return canAttestWorkloadIdentity();
       } catch {
         // A bundler that dropped the server subpath, or a runtime without it.
@@ -684,7 +687,7 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
       if (entry?.token && entry.expiresAt > now + 60_000) return entry.token;
       if (entry?.pending) return entry.pending;
 
-      const { requestWorkloadServiceToken } = await import('@oxy.so/core/internal/workload-identity');
+      const { requestWorkloadServiceToken } = await import('#workload-identity');
       const seeded = entry ?? {
         token: '',
         expiresAt: 0,

package/src/mixins/OxyServices.utility.ts

@@ -24,6 +24,7 @@ interface JwtPayload {
   ownerAccountId?: string;
   appName?: string;
   scopes?: string[];
+  tier?: string;
   aud?: string | string[];
   iss?: string;
   environment?: string;
@@ -78,6 +79,14 @@ export interface ServiceApp {
   appId: string;
   appName: string;
   scopes: string[];
+  /**
+   * `internal` when the caller is one of Oxy's own applications: app to app it
+   * is trusted outright — {@link requireScope} passes and it may act for a user
+   * without a delegation grant. `external` keeps every scope and grant rule.
+   * What the USER may do (their accounts, plan, limits) is still for the
+   * receiving service to decide. A token without the claim reads as `external`.
+   */
+  tier: 'internal' | 'external';
   /** The credentialId of the specific service credential that minted this token. */
   credentialId: string;
   /**
@@ -705,6 +714,8 @@ export function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base:
               return res.status(401).json(error);
             }
 
+            const tier: ServiceApp['tier'] = decoded.tier === 'internal' ? 'internal' : 'external';
+
             // Read delegated user ID from header
             const oxyUserIdRaw = req.headers['x-oxy-user-id'];
             const oxyUserId = isExactNonEmptyServiceClaim(oxyUserIdRaw) ? oxyUserIdRaw : null;
@@ -725,12 +736,20 @@ export function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base:
               return res.status(401).json(error);
             }
 
-            // C3: a service may only act as a user when an explicit
-            // ServiceActingAs grant exists for that (appId, userId) pair.
-            // Without the grant we MUST refuse — silently attaching
-            // `req.userId = oxyUserId` would let any service impersonate
-            // any user simply by setting the header.
-            if (oxyUserId) {
+            // One of Oxy's own applications acts for a user without a grant:
+            // inside the ecosystem that is trust, not consent. It still acts
+            // with the USER's authority only — what that user may do is for the
+            // receiving service to check.
+            if (oxyUserId && tier === 'internal') {
+              req.userId = oxyUserId;
+              req.user = { id: oxyUserId } as User;
+              req.serviceActingAs = { userId: oxyUserId, scopes: [] };
+            } else if (oxyUserId) {
+              // C3: an EXTERNAL service may only act as a user when an explicit
+              // ServiceActingAs grant exists for that (appId, userId) pair.
+              // Without the grant we MUST refuse — silently attaching
+              // `req.userId = oxyUserId` would let any service impersonate
+              // any user simply by setting the header.
               const grant = await oxyInstance.verifyServiceActingAs(appId, oxyUserId);
               if (!grant || !grant.authorized) {
                 logger.warn('[oxy.auth] Service token rejected — no delegation grant', {
@@ -781,6 +800,7 @@ export function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base:
               ownerAccountId,
               scopes: Array.isArray(decoded.scopes) ? decoded.scopes : [],
               environment,
+              tier,
             };
 
             if (debug) {
@@ -1255,6 +1275,13 @@ export function OxyServicesUtilityMixin<T extends typeof OxyServicesBase>(Base:
           return;
         }
 
+        // Oxy's own applications are trusted app to app; scopes are the
+        // external lane.
+        if (req.serviceApp.tier === 'internal') {
+          next();
+          return;
+        }
+
         const appHasScope = appScopes.includes(scope);
         const delegationHasScope = delegatedScopes.includes(scope);
         const hasRequiredScope = req.serviceActingAs

package/src/mixins/__tests__/serviceAuth.test.ts

@@ -189,9 +189,42 @@ describe('C3: service-token acting-as enforcement', () => {
       ownerAccountId: 'owner-account-1',
       scopes: ['user:read'],
       environment: 'production',
+      // No `tier` claim: a token minted before it existed is external.
+      tier: 'external',
     });
   });
 
+  it("lets one of Oxy's own applications act for a user without a grant", async () => {
+    const verifySpy = jest.spyOn(oxy, 'verifyServiceActingAs');
+    const token = signServiceToken(
+      { appId: 'alia', appName: 'Alia', scopes: [], tier: 'internal' },
+      SERVICE_SECRET,
+    );
+    const req = makeReq({ headers: { authorization: `Bearer ${token}`, 'x-oxy-user-id': 'user-1' } });
+    const res = makeRes();
+    const next = jest.fn();
+
+    await oxy.auth({ jwtSecret: SERVICE_SECRET })(req as unknown as never, res as unknown as never, next as unknown as never);
+
+    expect(verifySpy).not.toHaveBeenCalled();
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(req.userId).toBe('user-1');
+    expect(req.serviceApp?.tier).toBe('internal');
+  });
+
+  it('still refuses an EXTERNAL application acting for a user without a grant', async () => {
+    jest.spyOn(oxy, 'verifyServiceActingAs').mockResolvedValue(null);
+    const token = signServiceToken({ appId: 'app-1', appName: 'third-party', tier: 'external' }, SERVICE_SECRET);
+    const req = makeReq({ headers: { authorization: `Bearer ${token}`, 'x-oxy-user-id': 'user-1' } });
+    const res = makeRes();
+    const next = jest.fn();
+
+    await oxy.auth({ jwtSecret: SERVICE_SECRET })(req as unknown as never, res as unknown as never, next as unknown as never);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(res.statusCode).toBe(403);
+  });
+
   it('does NOT call verifyServiceActingAs when X-Oxy-User-Id is absent (service acts as itself)', async () => {
     const verifySpy = jest
       .spyOn(oxy, 'verifyServiceActingAs')
@@ -682,6 +715,30 @@ describe('requireScope() middleware', () => {
     oxy = new OxyServices({ baseURL: 'http://test.invalid' });
   });
 
+  it("passes one of Oxy's own applications whatever scope is asked for", () => {
+    const req = makeReq();
+    req.serviceApp = { appId: 'a', appName: 'svc', credentialId: 'cred-1', scopes: [], tier: 'internal' };
+    req.serviceActingAs = { userId: 'u-1', scopes: [] };
+    const res = makeRes();
+    const next = jest.fn();
+
+    oxy.requireScope('files:write')(req as unknown as never, res as unknown as never, next as unknown as never);
+
+    expect(next).toHaveBeenCalledTimes(1);
+  });
+
+  it('holds an external application to its scopes', () => {
+    const req = makeReq();
+    req.serviceApp = { appId: 'a', appName: 'svc', credentialId: 'cred-1', scopes: ['user:read'], tier: 'external' };
+    const res = makeRes();
+    const next = jest.fn();
+
+    oxy.requireScope('files:write')(req as unknown as never, res as unknown as never, next as unknown as never);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(res.statusCode).toBe(403);
+  });
+
   it('allows requests where the app holds the required scope', () => {
     const req = makeReq({
       // Simulate a fully-authenticated service request — auth() has already

package/src/server/auth.ts

@@ -28,6 +28,8 @@ export interface OxyServiceAppContext {
    */
   ownerAccountId: string;
   environment: OxyServiceEnvironment;
+  /** `internal` for one of Oxy's own applications, else `external` (see `ServiceApp.tier`). */
+  tier: 'internal' | 'external';
 }
 
 export interface OxyServiceActingAsContext {