@oxy.so/core 4.1.0 → 4.2.0

package/dist/cjs/inference/OxyInferenceClient.js

@@ -1,4 +1,18 @@
 "use strict";
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _OxyInferenceClient_instances, _OxyInferenceClient_baseURL, _OxyInferenceClient_credential, _OxyInferenceClient_fetch, _OxyInferenceClient_bearer, _OxyInferenceClient_headers, _OxyInferenceClient_request;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OxyInferenceClient = exports.OxyInferenceProtocolError = exports.OxyInferenceError = exports.OXY_INFERENCE_BASE_URL = void 0;
 /**
  * The Oxy inference client — one surface, two credential lanes (issue #972,
  * workstream 15).
@@ -50,20 +64,6 @@
  * schema, so a rename on either side fails a build rather than a customer's
  * request.
  */
-var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
-    if (kind === "m") throw new TypeError("Private method is not writable");
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
-    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
-};
-var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
-    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
-};
-var _OxyInferenceClient_instances, _OxyInferenceClient_baseURL, _OxyInferenceClient_credential, _OxyInferenceClient_fetch, _OxyInferenceClient_bearer, _OxyInferenceClient_headers, _OxyInferenceClient_request;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OxyInferenceClient = exports.OxyInferenceProtocolError = exports.OxyInferenceError = exports.OXY_INFERENCE_BASE_URL = void 0;
 const contracts_1 = require("@oxy.so/contracts");
 const contracts_2 = require("@oxy.so/contracts");
 /** The base URL of the Oxy API, when a caller names none. */
@@ -384,7 +384,15 @@ class OxyInferenceClient {
      * somebody else.
      */
     async getGeneration(id, options = {}) {
-        const body = await __classPrivateFieldGet(this, _OxyInferenceClient_instances, "m", _OxyInferenceClient_request).call(this, 'GET', `/v1/generations/${encodeURIComponent(id)}`, { ...(options.signal === undefined ? {} : { signal: options.signal }) });
+        const record = await this.getGenerationRecord(id, options);
+        if (record.schemaVersion !== 1) {
+            throw new OxyInferenceProtocolError('Internal usage has no financial receipt. Use getGenerationRecord().', record.requestId);
+        }
+        return record;
+    }
+    /** Read a financial receipt (v1) or an internal technical record (v2). */
+    async getGenerationRecord(id, options = {}) {
+        const body = await __classPrivateFieldGet(this, _OxyInferenceClient_instances, "m", _OxyInferenceClient_request).call(this, 'GET', `/v1/generations/${encodeURIComponent(id)}`, options);
         return body.data;
     }
 }

package/dist/cjs/server/OxyServer.js

@@ -29,6 +29,18 @@ exports.OxyServer = exports.ServiceCredentialMismatchError = exports.ANONYMOUS_S
  * Node only.
  */
 const jwt_decode_1 = require("jwt-decode");
+const serviceTokenLifetime_1 = require("./serviceTokenLifetime");
+/** Unverified cache metadata only: an old lifetime forces a new signed mint. */
+function reusableServiceToken(token) {
+    try {
+        const claims = (0, jwt_decode_1.jwtDecode)(token);
+        return (0, serviceTokenLifetime_1.hasBoundedServiceTokenLifetime)(claims) && typeof claims.exp === 'number'
+            && claims.exp > Math.floor(Date.now() / 1000);
+    }
+    catch {
+        return false;
+    }
+}
 const protocol_1 = require("@oxy.so/protocol");
 const OxyServices_1 = require("../OxyServices");
 const logger_1 = require("../logger");
@@ -57,10 +69,10 @@ const WORKLOAD_CACHE_KEY = 'workload-identity';
 const TOKEN_REUSE_MARGIN_MS = 60000;
 /** Bound on remembered `appId:userId` delegation answers. */
 const ACTING_AS_CACHE_MAX = 1000;
-/** A positive grant is reused for 5 minutes — the revocation latency window. */
-const ACTING_AS_GRANT_TTL_MS = 5 * 60 * 1000;
-/** A negative answer (or a failed lookup) is reused for 1 minute. */
-const ACTING_AS_DENIAL_TTL_MS = 60 * 1000;
+/** Explicit read reuse only; effects always perform a fresh lookup. */
+const ACTING_AS_GRANT_TTL_MS = 60000;
+/** Explicit authoritative read denials last ten seconds; failures are never cached. */
+const ACTING_AS_DENIAL_TTL_MS = 10000;
 class OxyServer extends OxyServices_1.OxyServices {
     constructor(config) {
         super(config);
@@ -69,6 +81,7 @@ class OxyServer extends OxyServices_1.OxyServices {
         this.serviceApiSecret = null;
         this.actingAs = new Map();
         this.actingAsPending = new Map();
+        this.actingAsGenerations = new Map();
         /** Public keys only; never private material. */
         this.jwksCache = { keys: new Map(), expiresAt: 0, lastAttemptAt: 0 };
         /**
@@ -122,7 +135,7 @@ class OxyServer extends OxyServices_1.OxyServices {
             },
             jwksCache: this.jwksCache,
             validateSession: (sessionId, options) => this.session.validate(sessionId, options),
-            verifyActingAs: (appId, userId) => this.verifyActingAs(appId, userId),
+            verifyActingAs: (appId, userId, options) => this.verifyActingAs(appId, userId, options),
         });
     }
     /** Files, plus the service-only metadata and linked-URL lookups. */
@@ -208,7 +221,7 @@ class OxyServer extends OxyServices_1.OxyServices {
                 });
                 throw new ServiceCredentialMismatchError();
             }
-            if (entry.token && entry.expiresAt > now + TOKEN_REUSE_MARGIN_MS) {
+            if (entry.token && reusableServiceToken(entry.token) && entry.expiresAt > now + TOKEN_REUSE_MARGIN_MS) {
                 return entry.token;
             }
             if (entry.pending) {
@@ -270,32 +283,49 @@ class OxyServer extends OxyServices_1.OxyServices {
     }
     // ── Delegation and account events ────────────────────────────────────────
     /**
-     * Whether service app `appId` holds an active delegation grant to act for
-     * `userId`; the grant's scopes, or `null`. Used by `middleware.auth()` for
-     * `X-Oxy-User-Id`.
-     *
-     * Answers are cached per `appId:userId` (a grant for 5 minutes — the
-     * revocation window; a denial or failed lookup for 1 minute), bounded to the
-     * 1000 most recent pairs, and concurrent lookups of one pair share a single
-     * request.
+     * Resolve authority live by default. Explicit read-only reuse lasts at most
+     * 60s positive / 10s negative, anchored to request start; errors never cache.
+     * Effects do not share an older in-flight read. Durable epoch plus local
+     * completion ordering prevents ABA and late positive replies overwriting a
+     * newer refusal even when app/credential revocation leaves epoch unchanged.
      */
-    async verifyActingAs(appId, userId) {
-        const cacheKey = `${appId}:${userId}`;
-        const cached = this.actingAs.get(cacheKey);
-        if (cached && cached.expiresAt > Date.now()) {
-            // Refresh recency for the LRU bound.
-            this.actingAs.delete(cacheKey);
-            this.actingAs.set(cacheKey, cached);
-            return cached.result;
-        }
-        const inflight = this.actingAsPending.get(cacheKey);
-        if (inflight)
-            return inflight;
-        const lookup = this.lookupActingAs(appId, userId).finally(() => {
-            this.actingAsPending.delete(cacheKey);
-        });
+    async verifyActingAs(appId, userId, options = {}) {
+        const pair = JSON.stringify([appId, userId]);
+        const cacheKey = JSON.stringify([appId, userId, options.credentialId, options.ownerAccountId, options.environment]);
+        if (options.cache === true) {
+            const cached = this.actingAs.get(cacheKey);
+            if (cached && cached.expiresAt > Date.now()) {
+                this.actingAs.delete(cacheKey);
+                this.actingAs.set(cacheKey, cached);
+                return cached.result;
+            }
+            const pending = this.actingAsPending.get(cacheKey);
+            if (pending)
+                return pending;
+        }
+        let generation = this.actingAsGenerations.get(pair);
+        if (!generation) {
+            generation = { epoch: 0n, issued: 0, completed: 0 };
+            this.actingAsGenerations.set(pair, generation);
+            if (this.actingAsGenerations.size > ACTING_AS_CACHE_MAX) {
+                const oldest = this.actingAsGenerations.keys().next().value;
+                if (oldest !== undefined)
+                    this.actingAsGenerations.delete(oldest);
+            }
+        }
+        const serial = ++generation.issued;
+        const startedAt = Date.now();
+        const lookup = this.lookupActingAs(appId, userId, options, pair, cacheKey, generation, serial, startedAt);
+        if (options.cache !== true)
+            return lookup;
         this.actingAsPending.set(cacheKey, lookup);
-        return lookup;
+        try {
+            return await lookup;
+        }
+        finally {
+            if (this.actingAsPending.get(cacheKey) === lookup)
+                this.actingAsPending.delete(cacheKey);
+        }
     }
     // ── Internals ────────────────────────────────────────────────────────────
     /**
@@ -351,7 +381,7 @@ class OxyServer extends OxyServices_1.OxyServices {
     /** A token obtained by attestation, cached like a credential's (one identity per process). */
     async workloadServiceToken() {
         const entry = this.serviceTokens.get(WORKLOAD_CACHE_KEY);
-        if (entry?.token && entry.expiresAt > Date.now() + TOKEN_REUSE_MARGIN_MS)
+        if (entry?.token && reusableServiceToken(entry.token) && entry.expiresAt > Date.now() + TOKEN_REUSE_MARGIN_MS)
             return entry.token;
         if (entry?.pending)
             return entry.pending;
@@ -382,36 +412,62 @@ class OxyServer extends OxyServices_1.OxyServices {
                 settled.pending = null;
         }
     }
-    async lookupActingAs(appId, userId) {
+    async lookupActingAs(appId, userId, options, pair, cacheKey, generation, serial, startedAt) {
         try {
-            // The verify endpoint admits only a platform-trusted caller, so this
-            // carries the VERIFIER's own service token. No retry and a short timeout:
-            // it runs inside request-handling middleware, and a retry loop would
-            // multiply the latency of every delegated request. A verifier with no
-            // credential throws here and is refused below — a host that cannot prove
-            // who it is has no business learning who delegated to whom.
             const serviceToken = await this.serviceToken();
-            const result = await this.request('GET', '/internal/service-acting-as/verify', { appId, userId }, { cache: false, retry: false, timeout: 5000, headers: { Authorization: `Bearer ${serviceToken}` } });
-            const verified = result?.authorized
-                ? { authorized: true, scopes: Array.isArray(result.scopes) ? result.scopes : [] }
-                : null;
-            this.rememberActingAs(`${appId}:${userId}`, verified, ACTING_AS_GRANT_TTL_MS);
+            const result = await this.request('GET', '/internal/service-acting-as/verify', { appId, userId, ...(options.credentialId ? { credentialId: options.credentialId,
+                    ownerAccountId: options.ownerAccountId, environment: options.environment } : {}) }, { cache: false, retry: false, timeout: 5000, headers: { Authorization: `Bearer ${serviceToken}` } });
+            // A deadline bounds how long an already old response can authorize. It
+            // is not by itself a measurement of end-to-end revocation latency.
+            if (this.actingAsGenerations.get(pair) !== generation || serial < generation.completed)
+                return null;
+            generation.completed = serial;
+            this.clearActingAsPair(appId, userId);
+            if (Date.now() - startedAt >= 5000)
+                return null;
+            const rawEpoch = result?.epoch;
+            if (typeof rawEpoch !== 'string' || !/^(?:0|[1-9][0-9]{0,18})$/.test(rawEpoch))
+                return null;
+            const epoch = BigInt(rawEpoch);
+            if (epoch > 9223372036854775807n)
+                return null;
+            if (typeof result.authorized !== 'boolean' || !Array.isArray(result.scopes)
+                || !result.scopes.every((scope) => typeof scope === 'string' && scope.length > 0 && scope.trim() === scope)
+                || new Set(result.scopes).size !== result.scopes.length
+                || (!result.authorized && result.scopes.length !== 0))
+                return null;
+            const older = epoch < generation.epoch;
+            if (epoch > generation.epoch)
+                generation.epoch = epoch;
+            if (result.authorized && older)
+                return null;
+            const verified = result.authorized === true
+                ? { authorized: true, scopes: result.scopes, epoch: rawEpoch } : null;
+            if (options.cache === true)
+                this.rememberActingAs(cacheKey, verified, startedAt + (verified ? ACTING_AS_GRANT_TTL_MS : ACTING_AS_DENIAL_TTL_MS));
             return verified;
         }
         catch (error) {
-            logger_1.logger.warn('[oxy.auth] verifyActingAs lookup failed — caching negative result', {
-                component: 'auth',
-                method: 'verifyActingAs',
-                appId,
-                userId,
+            if (this.actingAsGenerations.get(pair) === generation && serial >= generation.completed) {
+                generation.completed = serial;
+                this.clearActingAsPair(appId, userId);
+            }
+            logger_1.logger.warn('[oxy.auth] verifyActingAs lookup failed — not cached', {
+                component: 'auth', method: 'verifyActingAs', appId, userId,
             }, error);
-            this.rememberActingAs(`${appId}:${userId}`, null, ACTING_AS_DENIAL_TTL_MS);
             return null;
         }
     }
-    rememberActingAs(cacheKey, result, ttlMs) {
+    clearActingAsPair(appId, userId) {
+        for (const key of this.actingAs.keys()) {
+            const [cachedApp, cachedUser] = JSON.parse(key);
+            if (cachedApp === appId && cachedUser === userId)
+                this.actingAs.delete(key);
+        }
+    }
+    rememberActingAs(cacheKey, result, expiresAt) {
         this.actingAs.delete(cacheKey);
-        this.actingAs.set(cacheKey, { result, expiresAt: Date.now() + ttlMs });
+        this.actingAs.set(cacheKey, { result, expiresAt });
         if (this.actingAs.size > ACTING_AS_CACHE_MAX) {
             const oldest = this.actingAs.keys().next().value;
             if (oldest !== undefined)

package/dist/cjs/server/agentAccount.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signInAgentAccount = signInAgentAccount;
+/** Autonomous entry helper. The signer owns its private key (for example in a KMS). */
+const contracts_1 = require("@oxy.so/contracts");
+const secp256k1_1 = require("@oxy.so/protocol/secp256k1");
+/** Explicit sign-in; no timer, automatic escalation or service credential lane. */
+async function signInAgentAccount(options) {
+    const { client, accountId, signer } = options;
+    const publicKey = (0, secp256k1_1.normalizeSecp256k1PublicKey)(signer.publicKey.trim());
+    const claims = await client.auth.agent.requestChallenge(publicKey);
+    const timestamp = Date.now();
+    if (claims.action !== 'agent_signin' || claims.accountId !== accountId || claims.actorId !== accountId
+        || (0, secp256k1_1.normalizeSecp256k1PublicKey)(claims.publicKey) !== publicKey || !claims.authMethodId || claims.expiresAt <= timestamp) {
+        throw new Error('Agent challenge does not match this account and signer');
+    }
+    const signature = await signer.signMessage((0, contracts_1.buildAgentProofMessage)(claims, timestamp));
+    return client.auth.agent.verify(publicKey, { challenge: claims.challenge, timestamp, signature });
+}

package/dist/cjs/server/auth.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OXY_SERVICE_ENVIRONMENTS = void 0;
 exports.getOxyUserId = getOxyUserId;
+exports.getOxyActor = getOxyActor;
 exports.isOxyAuthenticated = isOxyAuthenticated;
 exports.getOxyBillingPrincipal = getOxyBillingPrincipal;
 exports.getRequiredOxyBillingPrincipal = getRequiredOxyBillingPrincipal;
@@ -39,6 +40,24 @@ function getOxyUserId(req) {
         normalizeId(authReq.user?.id) ??
         normalizeId(authReq.user?._id));
 }
+/**
+ * Who acted, and as whom, on this user session (issue #1520), or `null` when
+ * the session authority did not report it.
+ *
+ * An audit records `actorAccountId` as the actor and `effectiveAccountId`
+ * (equal to {@link getOxyUserId}) as the account spoken as. A bot acting with
+ * nobody operating it is its own actor; a person acting as an organization or
+ * a bot is the actor of a `delegated` chain. Never substitute the effective
+ * account's owner for either: when this is `null`, record the actor as unknown.
+ */
+function getOxyActor(req) {
+    const actor = req.oxyActor;
+    if (!actor)
+        return null;
+    // Defence in depth: a chain that does not describe the authenticated
+    // subject is not this request's chain.
+    return actor.effectiveAccountId === getOxyUserId(req) ? actor : null;
+}
 function isOxyAuthenticated(req) {
     return getOxyUserId(req) !== null;
 }

package/dist/cjs/server/capabilityTicket.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CapabilityTicketError = void 0;
-exports.inputSatisfiesCapabilityLimits = inputSatisfiesCapabilityLimits;
+exports.inputSatisfiesCapabilityLimits = exports.CapabilityTicketError = void 0;
 exports.issueCapabilityTicket = issueCapabilityTicket;
 exports.verifyCapabilityTicket = verifyCapabilityTicket;
 exports.readCapabilityAuthorization = readCapabilityAuthorization;
@@ -30,45 +29,6 @@ function decodeJsonSegment(segment) {
         throw new CapabilityTicketError('malformed', 'Capability ticket is not valid base64url JSON');
     }
 }
-function valuesAtPath(input, path) {
-    let current = [input];
-    for (const segment of path.split('.')) {
-        const next = [];
-        for (const value of current) {
-            const records = Array.isArray(value) ? value : [value];
-            for (const record of records) {
-                if (typeof record !== 'object' || record === null || Array.isArray(record))
-                    continue;
-                if (Object.prototype.hasOwnProperty.call(record, segment)) {
-                    next.push(record[segment]);
-                }
-            }
-        }
-        if (next.length === 0)
-            return [];
-        current = next;
-    }
-    return current.flatMap((value) => Array.isArray(value) ? value : [value]);
-}
-/** Enforces the signed per-action bounds before a domain handler runs. */
-function inputSatisfiesCapabilityLimits(tool, input, limits) {
-    for (const limit of limits) {
-        if (limit.tool !== tool)
-            return false;
-        const actualValues = valuesAtPath(input, limit.key);
-        if (actualValues.length === 0)
-            return false;
-        if (typeof limit.value === 'number') {
-            const maximum = limit.value;
-            if (!actualValues.every((actual) => (typeof actual === 'number' && Number.isFinite(actual) && actual <= maximum)))
-                return false;
-            continue;
-        }
-        if (!actualValues.every((actual) => actual === limit.value))
-            return false;
-    }
-    return true;
-}
 function issueCapabilityTicket(claims, options) {
     const ttlSeconds = options.ttlSeconds ?? 60;
     if (!Number.isInteger(ttlSeconds) || ttlSeconds < 1 || ttlSeconds > DEFAULT_MAX_TTL_SECONDS) {
@@ -190,3 +150,5 @@ function createCapabilityTicketMiddleware(options) {
         }
     };
 }
+var contracts_2 = require("@oxy.so/contracts");
+Object.defineProperty(exports, "inputSatisfiesCapabilityLimits", { enumerable: true, get: function () { return contracts_2.inputSatisfiesCapabilityLimits; } });

package/dist/cjs/server/index.js

@@ -16,8 +16,8 @@
  * ```
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.verifyCapabilityTicket = exports.readCapabilityAuthorization = exports.issueCapabilityTicket = exports.inputSatisfiesCapabilityLimits = exports.createCapabilityTicketMiddleware = exports.CapabilityTicketError = exports.OXY_CSP_BASELINE = exports.inlineScriptCspHash = exports.formatOxyCspPolicy = exports.extractInlineScripts = exports.cspSourcesFor = exports.createOxySecurityHeaders = exports.buildOxyPagesHeaders = exports.buildOxyCspDirectives = exports.createOxyCors = exports.UPSTREAM_HEADERS_TIMEOUT_MS = exports.MAX_URL_LENGTH = exports.MAX_REDIRECTS = exports.DEFAULT_USER_AGENT = exports.BLOCKED_HOSTNAMES = exports.ALLOWED_PROTOCOLS = exports.ALLOWED_PORTS = exports.UpstreamError = exports.SsrfRejection = exports.safeFetch = exports.isBlockedIp = exports.assertSafePublicUrl = exports.createOxyRateLimit = exports.OXY_SERVICE_ENVIRONMENTS = exports.requireOxyAuth = exports.isOxyAuthenticated = exports.getRequiredOxyUserId = exports.getRequiredOxyBillingPrincipal = exports.getOxyUserId = exports.getOxyRequestAttribution = exports.getOxyDelegatedUserId = exports.getOxyBillingPrincipal = exports.getOxyAuthRefusal = exports.createOxyAuthMiddleware = exports.createOptionalOxyAuth = exports.OXY_ACCOUNT_DELETED_EVENT_URI = exports.OxyAccountEventError = exports.ServerReputationApi = exports.ServerNotificationsApi = exports.ServerLinkedAccountsApi = exports.ServerAssetsApi = exports.ServerAgencyApi = exports.ANONYMOUS_SERVICE_TOKEN_RETRY_MS = exports.ServiceCredentialMismatchError = exports.OxyServer = void 0;
-exports.requestWorkloadServiceToken = exports.canAttestWorkloadIdentity = exports.withoutNodeHttpObservation = exports.observeNodeHttp = exports.createEcosystemTraffic = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isLoopbackOrigin = exports.registrableApex = exports.OXY_IDENTITY_CACHE_PREFIXES = exports.oxyUserByIdCacheKey = exports.evictOxyIdentityCache = exports.publishOxyUserInvalidation = exports.createOxyUserInvalidationHandler = exports.verifySecret = exports.verifyOxyRequesterAssertion = exports.signOxyRequesterAssertion = exports.readOxyRequesterAssertionKeyId = exports.oxyRequesterAssertionClaimsSchema = exports.OxyRequesterAssertionError = exports.OXY_REQUESTER_ASSERTION_TYPE = exports.OXY_REQUESTER_ASSERTION_MAX_TTL_SECONDS = exports.OXY_REQUESTER_ASSERTION_HEADER = exports.OXY_REQUESTER_ASSERTION_DEFAULT_ISSUER = exports.createOxyRequesterAssertionAuth = exports.createOxyJwksKeyResolver = void 0;
+exports.readCapabilityAuthorization = exports.issueCapabilityTicket = exports.inputSatisfiesCapabilityLimits = exports.createCapabilityTicketMiddleware = exports.CapabilityTicketError = exports.OXY_CSP_BASELINE = exports.inlineScriptCspHash = exports.formatOxyCspPolicy = exports.extractInlineScripts = exports.cspSourcesFor = exports.createOxySecurityHeaders = exports.buildOxyPagesHeaders = exports.buildOxyCspDirectives = exports.createOxyCors = exports.UPSTREAM_HEADERS_TIMEOUT_MS = exports.MAX_URL_LENGTH = exports.MAX_REDIRECTS = exports.DEFAULT_USER_AGENT = exports.BLOCKED_HOSTNAMES = exports.ALLOWED_PROTOCOLS = exports.ALLOWED_PORTS = exports.UpstreamError = exports.SsrfRejection = exports.safeFetch = exports.isBlockedIp = exports.assertSafePublicUrl = exports.createOxyRateLimit = exports.OXY_SERVICE_ENVIRONMENTS = exports.requireOxyAuth = exports.isOxyAuthenticated = exports.getRequiredOxyUserId = exports.getRequiredOxyBillingPrincipal = exports.getOxyUserId = exports.getOxyRequestAttribution = exports.getOxyDelegatedUserId = exports.getOxyBillingPrincipal = exports.getOxyAuthRefusal = exports.getOxyActor = exports.createOxyAuthMiddleware = exports.createOptionalOxyAuth = exports.OXY_ACCOUNT_DELETED_EVENT_URI = exports.OxyAccountEventError = exports.ServerReputationApi = exports.ServerNotificationsApi = exports.ServerLinkedAccountsApi = exports.ServerAssetsApi = exports.ServerAgencyApi = exports.ANONYMOUS_SERVICE_TOKEN_RETRY_MS = exports.ServiceCredentialMismatchError = exports.OxyServer = void 0;
+exports.signInAgentAccount = exports.hasBoundedServiceTokenLifetime = exports.OXY_SERVICE_TOKEN_MAX_LIFETIME_SECONDS = exports.requestWorkloadServiceToken = exports.canAttestWorkloadIdentity = exports.withoutNodeHttpObservation = exports.observeNodeHttp = exports.createEcosystemTraffic = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isLoopbackOrigin = exports.registrableApex = exports.OXY_IDENTITY_CACHE_PREFIXES = exports.oxyUserByIdCacheKey = exports.evictOxyIdentityCache = exports.publishOxyUserInvalidation = exports.createOxyUserInvalidationHandler = exports.createLiveCapabilityTicketVerifier = exports.verifySecret = exports.verifyOxyRequesterAssertion = exports.signOxyRequesterAssertion = exports.readOxyRequesterAssertionKeyId = exports.oxyRequesterAssertionClaimsSchema = exports.OxyRequesterAssertionError = exports.OXY_REQUESTER_ASSERTION_TYPE = exports.OXY_REQUESTER_ASSERTION_MAX_TTL_SECONDS = exports.OXY_REQUESTER_ASSERTION_HEADER = exports.OXY_REQUESTER_ASSERTION_DEFAULT_ISSUER = exports.createOxyRequesterAssertionAuth = exports.createOxyJwksKeyResolver = exports.verifyCapabilityTicket = void 0;
 // The backend client: OxyServices plus the service-token lane, middleware,
 // account events and the service-only namespace methods.
 var OxyServer_1 = require("./OxyServer");
@@ -36,6 +36,7 @@ Object.defineProperty(exports, "OXY_ACCOUNT_DELETED_EVENT_URI", { enumerable: tr
 var auth_1 = require("./auth");
 Object.defineProperty(exports, "createOptionalOxyAuth", { enumerable: true, get: function () { return auth_1.createOptionalOxyAuth; } });
 Object.defineProperty(exports, "createOxyAuthMiddleware", { enumerable: true, get: function () { return auth_1.createOxyAuthMiddleware; } });
+Object.defineProperty(exports, "getOxyActor", { enumerable: true, get: function () { return auth_1.getOxyActor; } });
 Object.defineProperty(exports, "getOxyAuthRefusal", { enumerable: true, get: function () { return auth_1.getOxyAuthRefusal; } });
 Object.defineProperty(exports, "getOxyBillingPrincipal", { enumerable: true, get: function () { return auth_1.getOxyBillingPrincipal; } });
 Object.defineProperty(exports, "getOxyDelegatedUserId", { enumerable: true, get: function () { return auth_1.getOxyDelegatedUserId; } });
@@ -106,6 +107,8 @@ Object.defineProperty(exports, "verifyOxyRequesterAssertion", { enumerable: true
 // Constant-time secret comparison.
 var verifySecret_1 = require("./verifySecret");
 Object.defineProperty(exports, "verifySecret", { enumerable: true, get: function () { return verifySecret_1.verifySecret; } });
+var liveCapabilityTicket_1 = require("./liveCapabilityTicket");
+Object.defineProperty(exports, "createLiveCapabilityTicketVerifier", { enumerable: true, get: function () { return liveCapabilityTicket_1.createLiveCapabilityTicketVerifier; } });
 // Cross-service user-invalidation signal: oxy-api publishes when identity
 // changes, every consuming backend sweeps its caches instead of waiting out a TTL.
 var userInvalidation_1 = require("./userInvalidation");
@@ -142,3 +145,8 @@ Object.defineProperty(exports, "withoutNodeHttpObservation", { enumerable: true,
 var workloadIdentity_1 = require("./workloadIdentity");
 Object.defineProperty(exports, "canAttestWorkloadIdentity", { enumerable: true, get: function () { return workloadIdentity_1.canAttestWorkloadIdentity; } });
 Object.defineProperty(exports, "requestWorkloadServiceToken", { enumerable: true, get: function () { return workloadIdentity_1.requestWorkloadServiceToken; } });
+var serviceTokenLifetime_1 = require("./serviceTokenLifetime");
+Object.defineProperty(exports, "OXY_SERVICE_TOKEN_MAX_LIFETIME_SECONDS", { enumerable: true, get: function () { return serviceTokenLifetime_1.OXY_SERVICE_TOKEN_MAX_LIFETIME_SECONDS; } });
+Object.defineProperty(exports, "hasBoundedServiceTokenLifetime", { enumerable: true, get: function () { return serviceTokenLifetime_1.hasBoundedServiceTokenLifetime; } });
+var agentAccount_1 = require("./agentAccount");
+Object.defineProperty(exports, "signInAgentAccount", { enumerable: true, get: function () { return agentAccount_1.signInAgentAccount; } });

package/dist/cjs/server/liveCapabilityTicket.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createLiveCapabilityTicketVerifier = createLiveCapabilityTicketVerifier;
+const contracts_1 = require("@oxy.so/contracts");
+const capabilityTicket_1 = require("./capabilityTicket");
+/** Local signature + live receiving-service introspection; no cache or retry. */
+function createLiveCapabilityTicketVerifier(options) {
+    if (typeof options.issuer !== 'string' || options.issuer.trim() === '')
+        throw new Error('A trusted Capability issuer is required');
+    const timeoutMs = options.timeoutMs ?? 5000;
+    if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 60000) {
+        throw new Error('Capability introspection timeout must be between 1 and 60000ms');
+    }
+    return async (ticket, input = {}) => {
+        input.signal?.throwIfAborted();
+        const signed = (0, capabilityTicket_1.verifyCapabilityTicket)(ticket, options);
+        if (!signed.catalog)
+            throw new Error('Internal MCP requires a signed catalogue binding');
+        const controller = new AbortController();
+        const abort = () => controller.abort(input.signal?.reason);
+        input.signal?.addEventListener('abort', abort, { once: true });
+        const timer = setTimeout(() => controller.abort(new Error('Capability introspection timed out')), timeoutMs);
+        let rejectAbort;
+        try {
+            const interrupted = new Promise((_resolve, reject) => {
+                rejectAbort = () => reject(controller.signal.reason ?? new Error('Capability introspection aborted'));
+                controller.signal.addEventListener('abort', rejectAbort, { once: true });
+                if (controller.signal.aborted)
+                    rejectAbort();
+            });
+            const result = await Promise.race([options.introspect(ticket, { signal: controller.signal }), interrupted]);
+            controller.signal.throwIfAborted();
+            if (result.active !== true)
+                throw new Error('Capability ticket is inactive');
+            const live = contracts_1.capabilityTicketClaimsSchema.parse(result.claims);
+            if ((0, contracts_1.canonicalCapabilityJson)(live) !== (0, contracts_1.canonicalCapabilityJson)(signed))
+                throw new Error('Capability introspection claims mismatch');
+            // An authority response delayed past expiry cannot extend the signed grant.
+            return (0, capabilityTicket_1.verifyCapabilityTicket)(ticket, options);
+        }
+        finally {
+            clearTimeout(timer);
+            input.signal?.removeEventListener('abort', abort);
+            if (rejectAbort)
+                controller.signal.removeEventListener('abort', rejectAbort);
+        }
+    };
+}

package/dist/cjs/server/middleware.js

@@ -4,6 +4,8 @@ exports.OXY_JWT_ISSUER = exports.OxyAccountEventError = exports.OXY_ACCOUNT_DELE
 exports.createOxyMiddleware = createOxyMiddleware;
 exports.parseJsonSegment = parseJsonSegment;
 exports.resolveServiceTokenPublicKey = resolveServiceTokenPublicKey;
+const serviceTokenLifetime_1 = require("./serviceTokenLifetime");
+const contracts_1 = require("@oxy.so/contracts");
 const jwt_decode_1 = require("jwt-decode");
 const protocol_1 = require("@oxy.so/protocol");
 const logger_1 = require("../logger");
@@ -412,22 +414,18 @@ function createOxyMiddleware(host) {
                             return onError(error);
                         return res.status(401).json(error);
                     }
-                    // One of Oxy's own applications acts for a user without a grant:
-                    // inside the ecosystem that is trust, not consent. It still acts
-                    // with the USER's authority only — what that user may do is for the
-                    // receiving service to check.
-                    if (oxyUserId && tier === 'internal') {
-                        req.userId = oxyUserId;
-                        req.user = { id: oxyUserId };
-                        req.serviceActingAs = { userId: oxyUserId, scopes: [] };
-                    }
-                    else if (oxyUserId) {
-                        // C3: an EXTERNAL service may only act as a user when an explicit
+                    // A service credential plus a user header is never a present user
+                    // session, even for an internal tier. Offline delegation is explicit.
+                    if (oxyUserId) {
+                        // C3: every service may only act as a user when an explicit
                         // ServiceActingAs grant exists for that (appId, userId) pair.
                         // Without the grant we MUST refuse — silently attaching
                         // `req.userId = oxyUserId` would let any service impersonate
                         // any user simply by setting the header.
-                        const grant = await host.verifyActingAs(appId, oxyUserId);
+                        const grant = await host.verifyActingAs(appId, oxyUserId, {
+                            cache: false, credentialId: decoded.credentialId,
+                            ownerAccountId: decoded.ownerAccountId, environment: decoded.environment,
+                        });
                         if (!grant || !grant.authorized) {
                             logger_1.logger.warn('[oxy.auth] Service token rejected — no delegation grant', {
                                 component: 'auth',
@@ -647,7 +645,43 @@ function createOxyMiddleware(host) {
                             return onError(error);
                         return res.status(401).json(error);
                     }
+                    // Who acted, and as whom — from the session authority's answer
+                    // (#1520), never from a header or this undecoded token. An API that
+                    // predates the field answers without it, and that is `null` here:
+                    // "not reported", never a guess that the subject acted for itself.
+                    // A chain naming a DIFFERENT effective account than the session
+                    // resolved to has no benign cause and is refused like a user
+                    // mismatch.
+                    const actor = readActorChain(validationResult.actor);
+                    if (actor === 'invalid' || (actor && actor.effectiveAccountId !== validatedUserId)) {
+                        logger_1.logger.warn('[oxy.auth] Session rejected — actor chain does not describe the session', {
+                            component: 'auth',
+                            method: 'auth',
+                            validatedUserId,
+                        });
+                        recordRefusal(req, {
+                            code: 'SESSION_ACTOR_MISMATCH',
+                            stage: 'session',
+                            reason: 'Session actor chain does not describe the validated session',
+                            status: 401,
+                        });
+                        if (optional) {
+                            req.userId = null;
+                            req.user = null;
+                            return next();
+                        }
+                        const error = {
+                            error: 'SESSION_ACTOR_MISMATCH',
+                            message: 'Session actor does not match the session',
+                            code: 'SESSION_ACTOR_MISMATCH',
+                            status: 401
+                        };
+                        if (onError)
+                            return onError(error);
+                        return res.status(401).json(error);
+                    }
                     req.userId = validatedUserId;
+                    req.oxyActor = actor;
                     req.accessToken = token;
                     req.sessionId = sessionId;
                     // Session validation already returned the full user, so `loadUser`
@@ -909,12 +943,6 @@ function createOxyMiddleware(host) {
                 });
                 return;
             }
-            // Oxy's own applications are trusted app to app; scopes are the
-            // external lane.
-            if (req.serviceApp.tier === 'internal') {
-                next();
-                return;
-            }
             const appHasScope = appScopes.includes(scope);
             const delegationHasScope = delegatedScopes.includes(scope);
             const hasRequiredScope = req.serviceActingAs
@@ -1130,6 +1158,9 @@ function getUserIdentityId(user) {
  * service token because no claim binding existed.
  */
 function verifyServiceTokenClaims(decoded, expected) {
+    if (!(0, serviceTokenLifetime_1.hasBoundedServiceTokenLifetime)(decoded)) {
+        throw new ServiceTokenClaimError('Service token lifetime must be positive and at most 300 seconds');
+    }
     if (decoded.type !== 'service') {
         throw new ServiceTokenClaimError(`Service token has unexpected type '${String(decoded.type)}'`);
     }
@@ -1146,3 +1177,14 @@ function verifyServiceTokenClaims(decoded, expected) {
         throw new ServiceTokenClaimError(`Service token audience mismatch: expected '${expected.audience}', got '${String(aud)}'`);
     }
 }
+/**
+ * Parse the session authority's actor chain. `null` when the API did not send
+ * one; `'invalid'` when it sent something that is not a chain, which the caller
+ * refuses rather than ignores.
+ */
+function readActorChain(raw) {
+    if (raw === undefined || raw === null)
+        return null;
+    const parsed = contracts_1.accountActorChainSchema.safeParse(raw);
+    return parsed.success ? parsed.data : 'invalid';
+}