npm - @oxy.so/core - Versions diffs - 4.3.0 → 4.5.0-oxy-one.0 - Mend

@oxy.so/core 4.3.0 → 4.5.0-oxy-one.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (32) hide show

package/dist/cjs/api/assets.js +18 -0
package/dist/cjs/api/billing.js +19 -10
package/dist/cjs/api/users.js +2 -2
package/dist/cjs/server/OxyServer.js +27 -0
package/dist/cjs/server/aliaMachineCredential.js +66 -0
package/dist/cjs/server/index.js +9 -2
package/dist/cjs/server/namespaces.js +25 -1
package/dist/esm/api/assets.js +18 -0
package/dist/esm/api/billing.js +15 -6
package/dist/esm/api/users.js +2 -2
package/dist/esm/server/OxyServer.js +28 -1
package/dist/esm/server/aliaMachineCredential.js +60 -0
package/dist/esm/server/index.js +2 -1
package/dist/esm/server/namespaces.js +23 -0
package/dist/types/api/assets.d.ts +3 -1
package/dist/types/api/billing.d.ts +8 -3
package/dist/types/api/users.d.ts +3 -1
package/dist/types/models/interfaces.d.ts +11 -0
package/dist/types/server/OxyServer.d.ts +9 -1
package/dist/types/server/aliaMachineCredential.d.ts +37 -0
package/dist/types/server/index.d.ts +3 -1
package/dist/types/server/namespaces.d.ts +9 -0
package/dist/types/server/requesterAssertion.d.ts +2 -2
package/package.json +2 -2
package/src/api/assets.ts +16 -0
package/src/api/billing.ts +19 -6
package/src/api/users.ts +2 -2
package/src/models/interfaces.ts +6 -0
package/src/server/OxyServer.ts +33 -1
package/src/server/aliaMachineCredential.ts +94 -0
package/src/server/index.ts +14 -0
package/src/server/namespaces.ts +21 -0

package/dist/cjs/api/assets.js CHANGED Viewed

@@ -51,6 +51,24 @@ class AssetsApi {
     constructor(ctx) {
         this.ctx = ctx;
     }
+    /** Upload already-admitted bytes. Sends required bucket headers, never an Oxy bearer. */
+    async putPresignedUpload(init, body) {
+        if (!init.uploadUrl)
+            return; // bytes already exist for this account
+        const target = new URL(init.uploadUrl);
+        if (target.protocol !== 'https:')
+            throw new Error('Presigned uploads require HTTPS');
+        const headers = new Headers(init.requiredHeaders);
+        headers.forEach((_value, name) => {
+            if (!['if-none-match', 'content-type', 'x-amz-checksum-sha256', 'cache-control'].includes(name.toLowerCase()))
+                throw new Error('Unsupported required upload header');
+        });
+        if (body.type && !headers.has('Content-Type'))
+            headers.set('Content-Type', body.type);
+        const result = await fetch(target.toString(), { method: 'PUT', body, headers, credentials: 'omit', redirect: 'error' });
+        if (!result.ok)
+            throw new Error(`Presigned upload failed (${result.status})`);
+    }
     // ── Upload ───────────────────────────────────────────────────────────────
     /**
      * Upload a file. Accepts a web `File`/`Blob` or a React Native

package/dist/cjs/api/billing.js CHANGED Viewed

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BillingApi = void 0;
+const contracts_1 = require("@oxy.so/contracts");
 /**
  * `oxy.billing` — the signed-in user's subscription, wallet and payment history.
  *
@@ -12,35 +13,43 @@ exports.BillingApi = void 0;
  * `payment.controller`, `wallet.routes` in `packages/api`); `Date` columns
  * arrive as ISO-8601 strings.
  */
-const contracts_1 = require("@oxy.so/contracts");
 const contracts_2 = require("@oxy.so/contracts");
+const contracts_3 = require("@oxy.so/contracts");
+const contracts_4 = require("@oxy.so/contracts");
 const SUBSCRIPTION_TTL = 2 * 60 * 1000;
 const WALLET_TTL = 60 * 1000;
 class BillingApi {
     constructor(ctx) {
         this.ctx = ctx;
     }
+    async startPersonalPlanCheckout(request) {
+        return contracts_1.personalPlanCheckoutResultSchema.parse(await this.ctx.request('POST', '/billing/checkout/personal-plan', contracts_1.personalPlanCheckoutRequestSchema.parse(request), { cache: false }));
+    }
+    /** Public versioned personal plans. Discovery never proves customer access. */
+    async personalPlans() {
+        return contracts_2.personalPlanCatalogueSchema.parse(await this.ctx.request('GET', '/billing/personal-plans', undefined, { cache: false }));
+    }
     /** Product rights only; requires a production application-bound user session. Never cached. */
     async productAccess(query) {
-        const parsed = contracts_1.subjectProductAccessQuerySchema.parse(query);
+        const parsed = contracts_3.subjectProductAccessQuerySchema.parse(query);
         const response = await this.ctx.request('GET', `/v1/products/${encodeURIComponent(parsed.productId)}/access/${encodeURIComponent(parsed.subjectAccountId)}`, undefined, { cache: false });
-        return contracts_1.subjectProductAccessSchema.parse(response);
+        return contracts_3.subjectProductAccessSchema.parse(response);
     }
     /** Named commercial sources for the current subject; no inferred plan collapse. */
-    async productSubscriptions() {
-        return contracts_2.productSubscriptionsResponseSchema.parse(await this.ctx.request("GET", "/billing/product-subscriptions", undefined, { cache: false })).subscriptions;
+    async productSubscriptions(expectedSubjectAccountId) {
+        return contracts_4.productSubscriptionsResponseSchema.parse(await this.ctx.request("GET", expectedSubjectAccountId ? `/billing/product-subscriptions?expectedSubjectAccountId=${encodeURIComponent(expectedSubjectAccountId)}` : "/billing/product-subscriptions", undefined, { cache: false })).subscriptions;
     }
     /** Per-grant credit provenance; no interpretation of the historical mixed balance. */
     async creditGrants() {
-        return contracts_2.subscriptionCreditGrantsResponseSchema.parse(await this.ctx.request("GET", "/billing/credit-grants", undefined, { cache: false })).grants;
+        return contracts_4.subscriptionCreditGrantsResponseSchema.parse(await this.ctx.request("GET", "/billing/credit-grants", undefined, { cache: false })).grants;
     }
     /** Payer-only named-source cancellation. Resolves on provider acceptance, including pending local reconciliation. Use cancelProductSubscriptionWithStatus for detailed completion state. */
-    async cancelProductSubscription(sourceId, expectedSubjectAccountId) {
-        await this.ctx.request("POST", "/billing/product-subscriptions/cancel", contracts_2.cancelProductSubscriptionSchema.parse({ sourceId, ...(expectedSubjectAccountId ? { expectedSubjectAccountId } : {}) }), { cache: false });
+    async cancelProductSubscription(sourceId, expectedSubjectAccountId, actionId) {
+        await this.ctx.request("POST", "/billing/product-subscriptions/cancel", contracts_4.cancelProductSubscriptionSchema.parse({ sourceId, ...(actionId ? { actionId } : {}), ...(expectedSubjectAccountId ? { expectedSubjectAccountId } : {}) }), { cache: false });
     }
     /** Provider acceptance versus completed local cancellation, for user-facing flows. */
-    async cancelProductSubscriptionWithStatus(sourceId, expectedSubjectAccountId) {
-        return contracts_2.productSubscriptionCancellationResultSchema.parse(await this.ctx.request('POST', '/billing/product-subscriptions/cancel', contracts_2.cancelProductSubscriptionSchema.parse({ sourceId, ...(expectedSubjectAccountId ? { expectedSubjectAccountId } : {}) }), { cache: false }));
+    async cancelProductSubscriptionWithStatus(sourceId, expectedSubjectAccountId, actionId) {
+        return contracts_4.productSubscriptionCancellationResultSchema.parse(await this.ctx.request('POST', '/billing/product-subscriptions/cancel', contracts_4.cancelProductSubscriptionSchema.parse({ sourceId, ...(actionId ? { actionId } : {}), ...(expectedSubjectAccountId ? { expectedSubjectAccountId } : {}) }), { cache: false }));
     }
     /** The signed-in user's payment history. Never cached. */
     async payments() {

package/dist/cjs/api/users.js CHANGED Viewed

@@ -109,8 +109,8 @@ class UsersApi {
         return settled.flat();
     }
     /** The signed-in user. Cached 1 minute. */
-    async me() {
-        const user = await this.ctx.request('GET', '/users/me', undefined, { cache: true, cacheTTL: ME_TTL });
+    async me(options) {
+        const user = await this.ctx.request('GET', '/users/me', undefined, { cache: options?.cache ?? true, cacheTTL: ME_TTL });
         return (0, userIdentity_1.normalizeUserIdentity)(user);
     }
     /** A profile by username. Cached 5 minutes; `{ cache: false }` as in `get`. */

package/dist/cjs/server/OxyServer.js CHANGED Viewed

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OxyServer = exports.ServiceCredentialMismatchError = exports.ANONYMOUS_SERVICE_TOKEN_RETRY_MS = void 0;
+const contracts_1 = require("@oxy.so/contracts");
 /**
  * `OxyServer` — the Oxy client for a backend.
  *
@@ -162,6 +163,12 @@ class OxyServer extends OxyServices_1.OxyServices {
             this._serverAgency = new namespaces_1.ServerAgencyApi(this.context);
         return this._serverAgency;
     }
+    /** Application management, plus the receiver-bound Alia machine-key lookup. */
+    get apps() {
+        if (!this._serverApps)
+            this._serverApps = new namespaces_1.ServerAppsApi(this.context);
+        return this._serverApps;
+    }
     /** Reputation reads, plus `award`. */
     get reputation() {
         if (!this._serverReputation)
@@ -273,6 +280,26 @@ class OxyServer extends OxyServices_1.OxyServices {
      * request is on behalf of that user (the API checks the delegation grant).
      * Never cached unless `cache` says so. Rejects with `OxyApiError`.
      */
+    /** Validated request's user session only; never changes the shared client's token. */
+    async productGrantSnapshotForUser(query, accessToken) {
+        const parsed = contracts_1.subjectProductAccessQuerySchema.parse(query);
+        if (!accessToken || /[\r\n]/.test(accessToken))
+            throw new Error('A user session is required');
+        const answer = await this.request('GET', `/v1/products/${encodeURIComponent(parsed.productId)}/access/${encodeURIComponent(parsed.subjectAccountId)}/grants`, undefined, { cache: false, retry: false, headers: { Authorization: `Bearer ${accessToken}` } });
+        const snapshot = contracts_1.subjectProductGrantSnapshotSchema.parse(answer);
+        if (snapshot.access.subjectAccountId !== parsed.subjectAccountId || snapshot.access.productId !== parsed.productId)
+            throw new Error('Product grant response attribution differs');
+        return snapshot;
+    }
+    /** Offline metering read: the API requires this app's live consent for this exact subject. */
+    async productGrantSnapshotForService(query) {
+        const parsed = contracts_1.subjectProductAccessQuerySchema.parse(query);
+        const answer = await this.serviceRequest('GET', `/v1/products/${encodeURIComponent(parsed.productId)}/access/${encodeURIComponent(parsed.subjectAccountId)}/service-grants`, undefined, { cache: false, retry: false });
+        const snapshot = contracts_1.subjectProductGrantSnapshotSchema.parse(answer);
+        if (snapshot.access.subjectAccountId !== parsed.subjectAccountId || snapshot.access.productId !== parsed.productId)
+            throw new Error('Product grant response attribution differs');
+        return snapshot;
+    }
     async serviceRequest(method, url, data, options = {}) {
         const { actAs, headers, ...rest } = options;
         const token = await this.serviceToken();

package/dist/cjs/server/aliaMachineCredential.js ADDED Viewed

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OXY_ALIA_MACHINE_SCOPES = exports.OXY_ALIA_RESOURCE_APPLICATION_ID = void 0;
+exports.isOxyAliaMachinePrincipal = isOxyAliaMachinePrincipal;
+exports.getOxyAliaMachineCredentialBearer = getOxyAliaMachineCredentialBearer;
+exports.createOxyAliaMachineCredentialAuth = createOxyAliaMachineCredentialAuth;
+/** Stable resource identity, shared with the Oxy control plane. Not a display name. */
+exports.OXY_ALIA_RESOURCE_APPLICATION_ID = '6a2f851751b784a86fd0e934';
+exports.OXY_ALIA_MACHINE_SCOPES = ['alia:chat', 'inference:invoke'];
+function id(value) {
+    return typeof value === 'string' && value.length > 0 && value.length <= 128 && value.trim() === value;
+}
+/** Strict response boundary: extra user/tier fields cannot smuggle authority. */
+function isOxyAliaMachinePrincipal(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const p = value;
+    const keys = ['kind', 'audience', 'applicationId', 'credentialId', 'ownerAccountId', 'environment', 'scopes'];
+    return Object.keys(p).length === keys.length && keys.every(key => Object.prototype.hasOwnProperty.call(p, key))
+        && p.kind === 'machine' && p.audience === exports.OXY_ALIA_RESOURCE_APPLICATION_ID
+        && id(p.applicationId) && id(p.credentialId) && id(p.ownerAccountId)
+        && typeof p.environment === 'string' && ['production', 'staging', 'development'].includes(p.environment)
+        && Array.isArray(p.scopes) && p.scopes.length === 2
+        && exports.OXY_ALIA_MACHINE_SCOPES.every(scope => p.scopes.includes(scope));
+}
+// Keep the forwarding credential out of enumerable request/principal objects,
+// logs, response serialization and persistent SDK/session state. No cache.
+const forwardingCredentials = new WeakMap();
+/** Only for the request-scoped Oxy inference client; never for a user API. */
+function getOxyAliaMachineCredentialBearer(req) {
+    const bound = forwardingCredentials.get(req);
+    return bound && req.machineCredential === bound.principal ? bound.bearer : null;
+}
+/** Opt into Alia's app-only chat lane on its two chat routes, never globally. */
+function createOxyAliaMachineCredentialAuth(server, options) {
+    return async (req, res, next) => {
+        const auth = req.headers.authorization;
+        const token = typeof auth === 'string' && auth.startsWith('Bearer ') ? auth.slice(7) : '';
+        if (!token.startsWith('oxy_sk_') || token.length > 2048) {
+            res.status(401).json({ error: 'MACHINE_CREDENTIAL_INVALID' });
+            return;
+        }
+        const existing = req;
+        if (existing.user || existing.userId || existing.serviceApp || existing.oxyRequester
+            || req.machineCredential
+            || req.headers['x-oxy-user-id'] !== undefined || req.headers['x-oxy-requester-assertion'] !== undefined) {
+            res.status(403).json({ error: 'MACHINE_USER_DELEGATION_UNSUPPORTED' });
+            return;
+        }
+        try {
+            const answer = await server.apps.introspectAliaMachineCredential(token);
+            if (!answer.active || !isOxyAliaMachinePrincipal(answer.principal) || answer.principal.environment !== options.environment) {
+                res.status(401).json({ error: 'MACHINE_CREDENTIAL_INVALID' });
+                return;
+            }
+            const principal = Object.freeze({ ...answer.principal, scopes: Object.freeze(['alia:chat', 'inference:invoke']) });
+            req.machineCredential = principal;
+            forwardingCredentials.set(req, { principal, bearer: token });
+            next();
+        }
+        catch {
+            // Transport errors may contain request data; never expose or log them.
+            res.status(503).json({ error: 'MACHINE_CREDENTIAL_VERIFIER_UNAVAILABLE' });
+        }
+    };
+}

package/dist/cjs/server/index.js CHANGED Viewed

@@ -16,8 +16,8 @@
  * ```
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.readCapabilityAuthorization = exports.issueCapabilityTicket = exports.inputSatisfiesCapabilityLimits = exports.createCapabilityTicketMiddleware = exports.CapabilityTicketError = exports.OXY_CSP_BASELINE = exports.inlineScriptCspHash = exports.formatOxyCspPolicy = exports.extractInlineScripts = exports.cspSourcesFor = exports.createOxySecurityHeaders = exports.buildOxyPagesHeaders = exports.buildOxyCspDirectives = exports.createOxyCors = exports.UPSTREAM_HEADERS_TIMEOUT_MS = exports.MAX_URL_LENGTH = exports.MAX_REDIRECTS = exports.DEFAULT_USER_AGENT = exports.BLOCKED_HOSTNAMES = exports.ALLOWED_PROTOCOLS = exports.ALLOWED_PORTS = exports.UpstreamError = exports.SsrfRejection = exports.safeFetch = exports.isBlockedIp = exports.assertSafePublicUrl = exports.createOxyRateLimit = exports.OXY_SERVICE_ENVIRONMENTS = exports.requireOxyAuth = exports.isOxyAuthenticated = exports.getRequiredOxyUserId = exports.getRequiredOxyBillingPrincipal = exports.getOxyUserId = exports.getOxyRequestAttribution = exports.getOxyDelegatedUserId = exports.getOxyBillingPrincipal = exports.getOxyAuthRefusal = exports.getOxyActor = exports.createOxyAuthMiddleware = exports.createOptionalOxyAuth = exports.OXY_ACCOUNT_DELETED_EVENT_URI = exports.OxyAccountEventError = exports.ServerReputationApi = exports.ServerNotificationsApi = exports.ServerLinkedAccountsApi = exports.ServerAssetsApi = exports.ServerAgencyApi = exports.ANONYMOUS_SERVICE_TOKEN_RETRY_MS = exports.ServiceCredentialMismatchError = exports.OxyServer = void 0;
-exports.signInAgentAccount = exports.hasBoundedServiceTokenLifetime = exports.OXY_SERVICE_TOKEN_MAX_LIFETIME_SECONDS = exports.requestWorkloadServiceToken = exports.canAttestWorkloadIdentity = exports.withoutNodeHttpObservation = exports.observeNodeHttp = exports.createEcosystemTraffic = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isLoopbackOrigin = exports.registrableApex = exports.OXY_IDENTITY_CACHE_PREFIXES = exports.oxyUserByIdCacheKey = exports.evictOxyIdentityCache = exports.publishOxyUserInvalidation = exports.createOxyUserInvalidationHandler = exports.createLiveCapabilityTicketVerifier = exports.verifySecret = exports.verifyOxyRequesterAssertion = exports.signOxyRequesterAssertion = exports.readOxyRequesterAssertionKeyId = exports.oxyRequesterAssertionClaimsSchema = exports.OxyRequesterAssertionError = exports.OXY_REQUESTER_ASSERTION_TYPE = exports.OXY_REQUESTER_ASSERTION_MAX_TTL_SECONDS = exports.OXY_REQUESTER_ASSERTION_HEADER = exports.OXY_REQUESTER_ASSERTION_DEFAULT_ISSUER = exports.createOxyRequesterAssertionAuth = exports.createOxyJwksKeyResolver = exports.verifyCapabilityTicket = void 0;
+exports.inlineScriptCspHash = exports.formatOxyCspPolicy = exports.extractInlineScripts = exports.cspSourcesFor = exports.createOxySecurityHeaders = exports.buildOxyPagesHeaders = exports.buildOxyCspDirectives = exports.createOxyCors = exports.UPSTREAM_HEADERS_TIMEOUT_MS = exports.MAX_URL_LENGTH = exports.MAX_REDIRECTS = exports.DEFAULT_USER_AGENT = exports.BLOCKED_HOSTNAMES = exports.ALLOWED_PROTOCOLS = exports.ALLOWED_PORTS = exports.UpstreamError = exports.SsrfRejection = exports.safeFetch = exports.isBlockedIp = exports.assertSafePublicUrl = exports.createOxyRateLimit = exports.OXY_SERVICE_ENVIRONMENTS = exports.requireOxyAuth = exports.isOxyAuthenticated = exports.getRequiredOxyUserId = exports.getRequiredOxyBillingPrincipal = exports.getOxyUserId = exports.getOxyRequestAttribution = exports.getOxyDelegatedUserId = exports.getOxyBillingPrincipal = exports.getOxyAuthRefusal = exports.getOxyActor = exports.createOxyAuthMiddleware = exports.createOptionalOxyAuth = exports.OXY_ACCOUNT_DELETED_EVENT_URI = exports.OxyAccountEventError = exports.OXY_ALIA_MACHINE_SCOPES = exports.OXY_ALIA_RESOURCE_APPLICATION_ID = exports.isOxyAliaMachinePrincipal = exports.getOxyAliaMachineCredentialBearer = exports.createOxyAliaMachineCredentialAuth = exports.ServerReputationApi = exports.ServerNotificationsApi = exports.ServerLinkedAccountsApi = exports.ServerAssetsApi = exports.ServerAgencyApi = exports.ServerAppsApi = exports.ANONYMOUS_SERVICE_TOKEN_RETRY_MS = exports.ServiceCredentialMismatchError = exports.OxyServer = void 0;
+exports.signInAgentAccount = exports.hasBoundedServiceTokenLifetime = exports.OXY_SERVICE_TOKEN_MAX_LIFETIME_SECONDS = exports.requestWorkloadServiceToken = exports.canAttestWorkloadIdentity = exports.withoutNodeHttpObservation = exports.observeNodeHttp = exports.createEcosystemTraffic = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isLoopbackOrigin = exports.registrableApex = exports.OXY_IDENTITY_CACHE_PREFIXES = exports.oxyUserByIdCacheKey = exports.evictOxyIdentityCache = exports.publishOxyUserInvalidation = exports.createOxyUserInvalidationHandler = exports.createLiveCapabilityTicketVerifier = exports.verifySecret = exports.verifyOxyRequesterAssertion = exports.signOxyRequesterAssertion = exports.readOxyRequesterAssertionKeyId = exports.oxyRequesterAssertionClaimsSchema = exports.OxyRequesterAssertionError = exports.OXY_REQUESTER_ASSERTION_TYPE = exports.OXY_REQUESTER_ASSERTION_MAX_TTL_SECONDS = exports.OXY_REQUESTER_ASSERTION_HEADER = exports.OXY_REQUESTER_ASSERTION_DEFAULT_ISSUER = exports.createOxyRequesterAssertionAuth = exports.createOxyJwksKeyResolver = exports.verifyCapabilityTicket = exports.readCapabilityAuthorization = exports.issueCapabilityTicket = exports.inputSatisfiesCapabilityLimits = exports.createCapabilityTicketMiddleware = exports.CapabilityTicketError = exports.OXY_CSP_BASELINE = void 0;
 // The backend client: OxyServices plus the service-token lane, middleware,
 // account events and the service-only namespace methods.
 var OxyServer_1 = require("./OxyServer");
@@ -25,11 +25,18 @@ Object.defineProperty(exports, "OxyServer", { enumerable: true, get: function ()
 Object.defineProperty(exports, "ServiceCredentialMismatchError", { enumerable: true, get: function () { return OxyServer_1.ServiceCredentialMismatchError; } });
 Object.defineProperty(exports, "ANONYMOUS_SERVICE_TOKEN_RETRY_MS", { enumerable: true, get: function () { return OxyServer_1.ANONYMOUS_SERVICE_TOKEN_RETRY_MS; } });
 var namespaces_1 = require("./namespaces");
+Object.defineProperty(exports, "ServerAppsApi", { enumerable: true, get: function () { return namespaces_1.ServerAppsApi; } });
 Object.defineProperty(exports, "ServerAgencyApi", { enumerable: true, get: function () { return namespaces_1.ServerAgencyApi; } });
 Object.defineProperty(exports, "ServerAssetsApi", { enumerable: true, get: function () { return namespaces_1.ServerAssetsApi; } });
 Object.defineProperty(exports, "ServerLinkedAccountsApi", { enumerable: true, get: function () { return namespaces_1.ServerLinkedAccountsApi; } });
 Object.defineProperty(exports, "ServerNotificationsApi", { enumerable: true, get: function () { return namespaces_1.ServerNotificationsApi; } });
 Object.defineProperty(exports, "ServerReputationApi", { enumerable: true, get: function () { return namespaces_1.ServerReputationApi; } });
+var aliaMachineCredential_1 = require("./aliaMachineCredential");
+Object.defineProperty(exports, "createOxyAliaMachineCredentialAuth", { enumerable: true, get: function () { return aliaMachineCredential_1.createOxyAliaMachineCredentialAuth; } });
+Object.defineProperty(exports, "getOxyAliaMachineCredentialBearer", { enumerable: true, get: function () { return aliaMachineCredential_1.getOxyAliaMachineCredentialBearer; } });
+Object.defineProperty(exports, "isOxyAliaMachinePrincipal", { enumerable: true, get: function () { return aliaMachineCredential_1.isOxyAliaMachinePrincipal; } });
+Object.defineProperty(exports, "OXY_ALIA_RESOURCE_APPLICATION_ID", { enumerable: true, get: function () { return aliaMachineCredential_1.OXY_ALIA_RESOURCE_APPLICATION_ID; } });
+Object.defineProperty(exports, "OXY_ALIA_MACHINE_SCOPES", { enumerable: true, get: function () { return aliaMachineCredential_1.OXY_ALIA_MACHINE_SCOPES; } });
 var middleware_1 = require("./middleware");
 Object.defineProperty(exports, "OxyAccountEventError", { enumerable: true, get: function () { return middleware_1.OxyAccountEventError; } });
 Object.defineProperty(exports, "OXY_ACCOUNT_DELETED_EVENT_URI", { enumerable: true, get: function () { return middleware_1.OXY_ACCOUNT_DELETED_EVENT_URI; } });

package/dist/cjs/server/namespaces.js CHANGED Viewed

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ServerReputationApi = exports.ServerAgencyApi = exports.ServerLinkedAccountsApi = exports.ServerNotificationsApi = exports.ServerAssetsApi = void 0;
+exports.ServerReputationApi = exports.ServerAgencyApi = exports.ServerLinkedAccountsApi = exports.ServerNotificationsApi = exports.ServerAssetsApi = exports.ServerAppsApi = void 0;
 /**
  * The server-side halves of the namespaces: what exists only with a service
  * credential. `OxyServer` returns these from its namespace getters, so
@@ -13,6 +13,8 @@ const notifications_1 = require("../api/notifications");
 const linkedAccounts_1 = require("../api/linkedAccounts");
 const agency_1 = require("../api/agency");
 const reputation_1 = require("../api/reputation");
+const apps_1 = require("../api/apps");
+const aliaMachineCredential_1 = require("./aliaMachineCredential");
 const OxyServices_errors_1 = require("../OxyServices.errors");
 const errorUtils_1 = require("../utils/errorUtils");
 const logger_1 = require("../logger");
@@ -30,6 +32,28 @@ function lane(ctx) {
     }
     return ctx.service;
 }
+class ServerAppsApi extends apps_1.AppsApi {
+    constructor(serverCtx) {
+        super(serverCtx);
+        this.serverCtx = serverCtx;
+    }
+    /** Live receiver-bound lookup using THIS resource server's own service token. */
+    async introspectAliaMachineCredential(token) {
+        if (!token.startsWith('oxy_sk_') || token.length > 2048)
+            return { active: false };
+        const answer = await lane(this.serverCtx).request('POST', '/internal/alia/machine-credentials/introspect', { token }, { cache: false, retry: false });
+        if (!answer || typeof answer !== 'object' || Array.isArray(answer))
+            throw new Error('Invalid machine credential verdict');
+        const record = answer;
+        if (record.active === false && Object.keys(record).length === 1)
+            return { active: false };
+        if (record.active !== true || Object.keys(record).length !== 2 || !(0, aliaMachineCredential_1.isOxyAliaMachinePrincipal)(record.principal)) {
+            throw new Error('Invalid machine credential verdict');
+        }
+        return { active: true, principal: record.principal };
+    }
+}
+exports.ServerAppsApi = ServerAppsApi;
 function chunk(items, size) {
     const chunks = [];
     for (let i = 0; i < items.length; i += size)

package/dist/esm/api/assets.js CHANGED Viewed

@@ -47,6 +47,24 @@ export class AssetsApi {
     constructor(ctx) {
         this.ctx = ctx;
     }
+    /** Upload already-admitted bytes. Sends required bucket headers, never an Oxy bearer. */
+    async putPresignedUpload(init, body) {
+        if (!init.uploadUrl)
+            return; // bytes already exist for this account
+        const target = new URL(init.uploadUrl);
+        if (target.protocol !== 'https:')
+            throw new Error('Presigned uploads require HTTPS');
+        const headers = new Headers(init.requiredHeaders);
+        headers.forEach((_value, name) => {
+            if (!['if-none-match', 'content-type', 'x-amz-checksum-sha256', 'cache-control'].includes(name.toLowerCase()))
+                throw new Error('Unsupported required upload header');
+        });
+        if (body.type && !headers.has('Content-Type'))
+            headers.set('Content-Type', body.type);
+        const result = await fetch(target.toString(), { method: 'PUT', body, headers, credentials: 'omit', redirect: 'error' });
+        if (!result.ok)
+            throw new Error(`Presigned upload failed (${result.status})`);
+    }
     // ── Upload ───────────────────────────────────────────────────────────────
     /**
      * Upload a file. Accepts a web `File`/`Blob` or a React Native

package/dist/esm/api/billing.js CHANGED Viewed

@@ -1,3 +1,4 @@
+import { personalPlanCheckoutRequestSchema, personalPlanCheckoutResultSchema } from '@oxy.so/contracts';
 /**
  * `oxy.billing` — the signed-in user's subscription, wallet and payment history.
  *
@@ -9,6 +10,7 @@
  * `payment.controller`, `wallet.routes` in `packages/api`); `Date` columns
  * arrive as ISO-8601 strings.
  */
+import { personalPlanCatalogueSchema } from '@oxy.so/contracts';
 import { subjectProductAccessQuerySchema, subjectProductAccessSchema, } from '@oxy.so/contracts';
 import { productSubscriptionCancellationResultSchema, cancelProductSubscriptionSchema, productSubscriptionsResponseSchema, subscriptionCreditGrantsResponseSchema, } from '@oxy.so/contracts';
 const SUBSCRIPTION_TTL = 2 * 60 * 1000;
@@ -17,6 +19,13 @@ export class BillingApi {
     constructor(ctx) {
         this.ctx = ctx;
     }
+    async startPersonalPlanCheckout(request) {
+        return personalPlanCheckoutResultSchema.parse(await this.ctx.request('POST', '/billing/checkout/personal-plan', personalPlanCheckoutRequestSchema.parse(request), { cache: false }));
+    }
+    /** Public versioned personal plans. Discovery never proves customer access. */
+    async personalPlans() {
+        return personalPlanCatalogueSchema.parse(await this.ctx.request('GET', '/billing/personal-plans', undefined, { cache: false }));
+    }
     /** Product rights only; requires a production application-bound user session. Never cached. */
     async productAccess(query) {
         const parsed = subjectProductAccessQuerySchema.parse(query);
@@ -24,20 +33,20 @@ export class BillingApi {
         return subjectProductAccessSchema.parse(response);
     }
     /** Named commercial sources for the current subject; no inferred plan collapse. */
-    async productSubscriptions() {
-        return productSubscriptionsResponseSchema.parse(await this.ctx.request("GET", "/billing/product-subscriptions", undefined, { cache: false })).subscriptions;
+    async productSubscriptions(expectedSubjectAccountId) {
+        return productSubscriptionsResponseSchema.parse(await this.ctx.request("GET", expectedSubjectAccountId ? `/billing/product-subscriptions?expectedSubjectAccountId=${encodeURIComponent(expectedSubjectAccountId)}` : "/billing/product-subscriptions", undefined, { cache: false })).subscriptions;
     }
     /** Per-grant credit provenance; no interpretation of the historical mixed balance. */
     async creditGrants() {
         return subscriptionCreditGrantsResponseSchema.parse(await this.ctx.request("GET", "/billing/credit-grants", undefined, { cache: false })).grants;
     }
     /** Payer-only named-source cancellation. Resolves on provider acceptance, including pending local reconciliation. Use cancelProductSubscriptionWithStatus for detailed completion state. */
-    async cancelProductSubscription(sourceId, expectedSubjectAccountId) {
-        await this.ctx.request("POST", "/billing/product-subscriptions/cancel", cancelProductSubscriptionSchema.parse({ sourceId, ...(expectedSubjectAccountId ? { expectedSubjectAccountId } : {}) }), { cache: false });
+    async cancelProductSubscription(sourceId, expectedSubjectAccountId, actionId) {
+        await this.ctx.request("POST", "/billing/product-subscriptions/cancel", cancelProductSubscriptionSchema.parse({ sourceId, ...(actionId ? { actionId } : {}), ...(expectedSubjectAccountId ? { expectedSubjectAccountId } : {}) }), { cache: false });
     }
     /** Provider acceptance versus completed local cancellation, for user-facing flows. */
-    async cancelProductSubscriptionWithStatus(sourceId, expectedSubjectAccountId) {
-        return productSubscriptionCancellationResultSchema.parse(await this.ctx.request('POST', '/billing/product-subscriptions/cancel', cancelProductSubscriptionSchema.parse({ sourceId, ...(expectedSubjectAccountId ? { expectedSubjectAccountId } : {}) }), { cache: false }));
+    async cancelProductSubscriptionWithStatus(sourceId, expectedSubjectAccountId, actionId) {
+        return productSubscriptionCancellationResultSchema.parse(await this.ctx.request('POST', '/billing/product-subscriptions/cancel', cancelProductSubscriptionSchema.parse({ sourceId, ...(actionId ? { actionId } : {}), ...(expectedSubjectAccountId ? { expectedSubjectAccountId } : {}) }), { cache: false }));
     }
     /** The signed-in user's payment history. Never cached. */
     async payments() {

package/dist/esm/api/users.js CHANGED Viewed

@@ -73,8 +73,8 @@ export class UsersApi {
         return settled.flat();
     }
     /** The signed-in user. Cached 1 minute. */
-    async me() {
-        const user = await this.ctx.request('GET', '/users/me', undefined, { cache: true, cacheTTL: ME_TTL });
+    async me(options) {
+        const user = await this.ctx.request('GET', '/users/me', undefined, { cache: options?.cache ?? true, cacheTTL: ME_TTL });
         return normalizeUserIdentity(user);
     }
     /** A profile by username. Cached 5 minutes; `{ cache: false }` as in `get`. */

package/dist/esm/server/OxyServer.js CHANGED Viewed

@@ -1,3 +1,4 @@
+import { subjectProductAccessQuerySchema, subjectProductGrantSnapshotSchema } from '@oxy.so/contracts';
 /**
  * `OxyServer` — the Oxy client for a backend.
  *
@@ -43,7 +44,7 @@ import { OxyServices } from '../OxyServices.js';
 import { logger } from '../logger/index.js';
 import { canAttestWorkloadIdentity, requestWorkloadServiceToken } from './workloadIdentity.js';
 import { createOxyMiddleware, OXY_ACCOUNT_DELETED_EVENT_URI, OXY_JWT_ISSUER, OxyAccountEventError, parseJsonSegment, resolveServiceTokenPublicKey, } from './middleware.js';
-import { ServerAgencyApi, ServerAssetsApi, ServerLinkedAccountsApi, ServerNotificationsApi, ServerReputationApi, } from './namespaces.js';
+import { ServerAppsApi, ServerAgencyApi, ServerAssetsApi, ServerLinkedAccountsApi, ServerNotificationsApi, ServerReputationApi, } from './namespaces.js';
 /**
  * How long a failed service-token mint sends session-less requests anonymous
  * before the next attempt, under `serviceIdentity: 'when-anonymous'`.
@@ -158,6 +159,12 @@ export class OxyServer extends OxyServices {
             this._serverAgency = new ServerAgencyApi(this.context);
         return this._serverAgency;
     }
+    /** Application management, plus the receiver-bound Alia machine-key lookup. */
+    get apps() {
+        if (!this._serverApps)
+            this._serverApps = new ServerAppsApi(this.context);
+        return this._serverApps;
+    }
     /** Reputation reads, plus `award`. */
     get reputation() {
         if (!this._serverReputation)
@@ -269,6 +276,26 @@ export class OxyServer extends OxyServices {
      * request is on behalf of that user (the API checks the delegation grant).
      * Never cached unless `cache` says so. Rejects with `OxyApiError`.
      */
+    /** Validated request's user session only; never changes the shared client's token. */
+    async productGrantSnapshotForUser(query, accessToken) {
+        const parsed = subjectProductAccessQuerySchema.parse(query);
+        if (!accessToken || /[\r\n]/.test(accessToken))
+            throw new Error('A user session is required');
+        const answer = await this.request('GET', `/v1/products/${encodeURIComponent(parsed.productId)}/access/${encodeURIComponent(parsed.subjectAccountId)}/grants`, undefined, { cache: false, retry: false, headers: { Authorization: `Bearer ${accessToken}` } });
+        const snapshot = subjectProductGrantSnapshotSchema.parse(answer);
+        if (snapshot.access.subjectAccountId !== parsed.subjectAccountId || snapshot.access.productId !== parsed.productId)
+            throw new Error('Product grant response attribution differs');
+        return snapshot;
+    }
+    /** Offline metering read: the API requires this app's live consent for this exact subject. */
+    async productGrantSnapshotForService(query) {
+        const parsed = subjectProductAccessQuerySchema.parse(query);
+        const answer = await this.serviceRequest('GET', `/v1/products/${encodeURIComponent(parsed.productId)}/access/${encodeURIComponent(parsed.subjectAccountId)}/service-grants`, undefined, { cache: false, retry: false });
+        const snapshot = subjectProductGrantSnapshotSchema.parse(answer);
+        if (snapshot.access.subjectAccountId !== parsed.subjectAccountId || snapshot.access.productId !== parsed.productId)
+            throw new Error('Product grant response attribution differs');
+        return snapshot;
+    }
     async serviceRequest(method, url, data, options = {}) {
         const { actAs, headers, ...rest } = options;
         const token = await this.serviceToken();

package/dist/esm/server/aliaMachineCredential.js ADDED Viewed

@@ -0,0 +1,60 @@
+/** Stable resource identity, shared with the Oxy control plane. Not a display name. */
+export const OXY_ALIA_RESOURCE_APPLICATION_ID = '6a2f851751b784a86fd0e934';
+export const OXY_ALIA_MACHINE_SCOPES = ['alia:chat', 'inference:invoke'];
+function id(value) {
+    return typeof value === 'string' && value.length > 0 && value.length <= 128 && value.trim() === value;
+}
+/** Strict response boundary: extra user/tier fields cannot smuggle authority. */
+export function isOxyAliaMachinePrincipal(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const p = value;
+    const keys = ['kind', 'audience', 'applicationId', 'credentialId', 'ownerAccountId', 'environment', 'scopes'];
+    return Object.keys(p).length === keys.length && keys.every(key => Object.prototype.hasOwnProperty.call(p, key))
+        && p.kind === 'machine' && p.audience === OXY_ALIA_RESOURCE_APPLICATION_ID
+        && id(p.applicationId) && id(p.credentialId) && id(p.ownerAccountId)
+        && typeof p.environment === 'string' && ['production', 'staging', 'development'].includes(p.environment)
+        && Array.isArray(p.scopes) && p.scopes.length === 2
+        && OXY_ALIA_MACHINE_SCOPES.every(scope => p.scopes.includes(scope));
+}
+// Keep the forwarding credential out of enumerable request/principal objects,
+// logs, response serialization and persistent SDK/session state. No cache.
+const forwardingCredentials = new WeakMap();
+/** Only for the request-scoped Oxy inference client; never for a user API. */
+export function getOxyAliaMachineCredentialBearer(req) {
+    const bound = forwardingCredentials.get(req);
+    return bound && req.machineCredential === bound.principal ? bound.bearer : null;
+}
+/** Opt into Alia's app-only chat lane on its two chat routes, never globally. */
+export function createOxyAliaMachineCredentialAuth(server, options) {
+    return async (req, res, next) => {
+        const auth = req.headers.authorization;
+        const token = typeof auth === 'string' && auth.startsWith('Bearer ') ? auth.slice(7) : '';
+        if (!token.startsWith('oxy_sk_') || token.length > 2048) {
+            res.status(401).json({ error: 'MACHINE_CREDENTIAL_INVALID' });
+            return;
+        }
+        const existing = req;
+        if (existing.user || existing.userId || existing.serviceApp || existing.oxyRequester
+            || req.machineCredential
+            || req.headers['x-oxy-user-id'] !== undefined || req.headers['x-oxy-requester-assertion'] !== undefined) {
+            res.status(403).json({ error: 'MACHINE_USER_DELEGATION_UNSUPPORTED' });
+            return;
+        }
+        try {
+            const answer = await server.apps.introspectAliaMachineCredential(token);
+            if (!answer.active || !isOxyAliaMachinePrincipal(answer.principal) || answer.principal.environment !== options.environment) {
+                res.status(401).json({ error: 'MACHINE_CREDENTIAL_INVALID' });
+                return;
+            }
+            const principal = Object.freeze({ ...answer.principal, scopes: Object.freeze(['alia:chat', 'inference:invoke']) });
+            req.machineCredential = principal;
+            forwardingCredentials.set(req, { principal, bearer: token });
+            next();
+        }
+        catch {
+            // Transport errors may contain request data; never expose or log them.
+            res.status(503).json({ error: 'MACHINE_CREDENTIAL_VERIFIER_UNAVAILABLE' });
+        }
+    };
+}

package/dist/esm/server/index.js CHANGED Viewed

@@ -17,7 +17,8 @@
 // The backend client: OxyServices plus the service-token lane, middleware,
 // account events and the service-only namespace methods.
 export { OxyServer, ServiceCredentialMismatchError, ANONYMOUS_SERVICE_TOKEN_RETRY_MS } from './OxyServer.js';
-export { ServerAgencyApi, ServerAssetsApi, ServerLinkedAccountsApi, ServerNotificationsApi, ServerReputationApi, } from './namespaces.js';
+export { ServerAppsApi, ServerAgencyApi, ServerAssetsApi, ServerLinkedAccountsApi, ServerNotificationsApi, ServerReputationApi, } from './namespaces.js';
+export { createOxyAliaMachineCredentialAuth, getOxyAliaMachineCredentialBearer, isOxyAliaMachinePrincipal, OXY_ALIA_RESOURCE_APPLICATION_ID, OXY_ALIA_MACHINE_SCOPES, } from './aliaMachineCredential.js';
 export { OxyAccountEventError, OXY_ACCOUNT_DELETED_EVENT_URI } from './middleware.js';
 export { createOptionalOxyAuth, createOxyAuthMiddleware, getOxyActor, getOxyAuthRefusal, getOxyBillingPrincipal, getOxyDelegatedUserId, getOxyRequestAttribution, getOxyUserId, getRequiredOxyBillingPrincipal, getRequiredOxyUserId, isOxyAuthenticated, requireOxyAuth, OXY_SERVICE_ENVIRONMENTS, } from './auth.js';
 export { createOxyRateLimit } from './rateLimit.js';

package/dist/esm/server/namespaces.js CHANGED Viewed

@@ -10,6 +10,8 @@ import { NotificationsApi } from '../api/notifications.js';
 import { LinkedAccountsApi } from '../api/linkedAccounts.js';
 import { AgencyApi } from '../api/agency.js';
 import { ReputationApi } from '../api/reputation.js';
+import { AppsApi } from '../api/apps.js';
+import { isOxyAliaMachinePrincipal } from './aliaMachineCredential.js';
 import { ServiceAssetMetadataError, ServiceLinkedDownloadUrlError } from '../OxyServices.errors.js';
 import { extractErrorStatus } from '../utils/errorUtils.js';
 import { logger } from '../logger/index.js';
@@ -27,6 +29,27 @@ function lane(ctx) {
     }
     return ctx.service;
 }
+export class ServerAppsApi extends AppsApi {
+    constructor(serverCtx) {
+        super(serverCtx);
+        this.serverCtx = serverCtx;
+    }
+    /** Live receiver-bound lookup using THIS resource server's own service token. */
+    async introspectAliaMachineCredential(token) {
+        if (!token.startsWith('oxy_sk_') || token.length > 2048)
+            return { active: false };
+        const answer = await lane(this.serverCtx).request('POST', '/internal/alia/machine-credentials/introspect', { token }, { cache: false, retry: false });
+        if (!answer || typeof answer !== 'object' || Array.isArray(answer))
+            throw new Error('Invalid machine credential verdict');
+        const record = answer;
+        if (record.active === false && Object.keys(record).length === 1)
+            return { active: false };
+        if (record.active !== true || Object.keys(record).length !== 2 || !isOxyAliaMachinePrincipal(record.principal)) {
+            throw new Error('Invalid machine credential verdict');
+        }
+        return { active: true, principal: record.principal };
+    }
+}
 function chunk(items, size) {
     const chunks = [];
     for (let i = 0; i < items.length; i += size)

package/dist/types/api/assets.d.ts CHANGED Viewed

@@ -1,5 +1,5 @@
 import type { OxyContext } from '../client/context';
-import type { AccountStorageUsageResponse, Asset, AssetDeleteSummary, AssetLink, AssetMetadata, AssetUploadInput, BatchFileAccessResponse, FileVisibility } from '../models/interfaces';
+import type { AccountStorageUsageResponse, AssetInitResponse, Asset, AssetDeleteSummary, AssetLink, AssetMetadata, AssetUploadInput, BatchFileAccessResponse, FileVisibility } from '../models/interfaces';
 /**
  * How long a resolved asset URL may stay in the SDK's GET cache, in ms: never
  * longer than the media token's lifetime, and discounted below it.
@@ -41,6 +41,8 @@ export interface AssetDeleteResult {
 export declare class AssetsApi {
     protected readonly ctx: OxyContext;
     constructor(ctx: OxyContext);
+    /** Upload already-admitted bytes. Sends required bucket headers, never an Oxy bearer. */
+    putPresignedUpload(init: AssetInitResponse, body: Blob): Promise<void>;
     /**
      * Upload a file. Accepts a web `File`/`Blob` or a React Native
      * `{ uri, type?, name?, size? }` descriptor.

package/dist/types/api/billing.d.ts CHANGED Viewed

@@ -1,3 +1,4 @@
+import { type PersonalPlanCheckoutRequest, type PersonalPlanCheckoutResult } from '@oxy.so/contracts';
 /**
  * `oxy.billing` — the signed-in user's subscription, wallet and payment history.
  *
@@ -9,6 +10,7 @@
  * `payment.controller`, `wallet.routes` in `packages/api`); `Date` columns
  * arrive as ISO-8601 strings.
  */
+import { type PersonalPlanCatalogue } from '@oxy.so/contracts';
 import { type SubjectProductAccess, type SubjectProductAccessQuery } from '@oxy.so/contracts';
 import { type ProductSubscriptionSummary, type SubscriptionCreditGrant, type ProductSubscriptionCancellationResult } from '@oxy.so/contracts';
 import type { OxyContext } from '../client/context';
@@ -99,16 +101,19 @@ export interface WalletTransactionsPage {
 export declare class BillingApi {
     protected readonly ctx: OxyContext;
     constructor(ctx: OxyContext);
+    startPersonalPlanCheckout(request: PersonalPlanCheckoutRequest): Promise<PersonalPlanCheckoutResult>;
+    /** Public versioned personal plans. Discovery never proves customer access. */
+    personalPlans(): Promise<PersonalPlanCatalogue>;
     /** Product rights only; requires a production application-bound user session. Never cached. */
     productAccess(query: SubjectProductAccessQuery): Promise<SubjectProductAccess>;
     /** Named commercial sources for the current subject; no inferred plan collapse. */
-    productSubscriptions(): Promise<ProductSubscriptionSummary[]>;
+    productSubscriptions(expectedSubjectAccountId?: string): Promise<ProductSubscriptionSummary[]>;
     /** Per-grant credit provenance; no interpretation of the historical mixed balance. */
     creditGrants(): Promise<SubscriptionCreditGrant[]>;
     /** Payer-only named-source cancellation. Resolves on provider acceptance, including pending local reconciliation. Use cancelProductSubscriptionWithStatus for detailed completion state. */
-    cancelProductSubscription(sourceId: string, expectedSubjectAccountId?: string): Promise<void>;
+    cancelProductSubscription(sourceId: string, expectedSubjectAccountId?: string, actionId?: string): Promise<void>;
     /** Provider acceptance versus completed local cancellation, for user-facing flows. */
-    cancelProductSubscriptionWithStatus(sourceId: string, expectedSubjectAccountId?: string): Promise<ProductSubscriptionCancellationResult>;
+    cancelProductSubscriptionWithStatus(sourceId: string, expectedSubjectAccountId?: string, actionId?: string): Promise<ProductSubscriptionCancellationResult>;
     /** The signed-in user's payment history. Never cached. */
     payments(): Promise<Payment[]>;
     /** A user's subscription (default: the signed-in user's). */

package/dist/types/api/users.d.ts CHANGED Viewed

@@ -61,7 +61,9 @@ export declare class UsersApi {
      */
     getMany(ids: string[]): Promise<User[]>;
     /** The signed-in user. Cached 1 minute. */
-    me(): Promise<User>;
+    me(options?: {
+        cache?: boolean;
+    }): Promise<User>;
     /** A profile by username. Cached 5 minutes; `{ cache: false }` as in `get`. */
     byUsername(username: string, options?: {
         cache?: boolean;

package/dist/types/models/interfaces.d.ts CHANGED Viewed

@@ -200,6 +200,13 @@ export interface User {
      * user sets it. Updated via `updateThemePreference` / `updateProfile`.
      */
     themePreference?: ThemePreference;
+    /** Product-specific personalization; never inferred from generic premium. */
+    personalization?: {
+        mentionMono: {
+            allowed: boolean;
+            expiresAt: string | null;
+        };
+    };
     /**
      * The authenticated viewer's relationship to THIS profile. Populated ONLY on
      * single-profile fetches (`getProfileByUsername` / `getUserById`) when the
@@ -520,6 +527,8 @@ export interface AssetInitRequest {
     mime: string;
 }
 export interface AssetInitResponse {
+    /** Replay these headers on PUT; Content-Length is supplied by the transport. */
+    requiredHeaders?: Record<string, string>;
     uploadUrl: string;
     fileId: string;
     sha256: string;
@@ -694,6 +703,8 @@ export interface AccountStorageCategoryUsage {
     count: number;
 }
 export interface AccountStorageUsageResponse {
+    quotaEnforcement?: 'metadata_admission' | 'unconfigured';
+    reservedBytes?: string | null;
     plan: 'basic' | 'pro' | 'business';
     totalUsedBytes: number;
     totalLimitBytes: number;

package/dist/types/server/OxyServer.d.ts CHANGED Viewed

@@ -1,8 +1,9 @@
+import { type SubjectProductAccessQuery, type SubjectProductGrantSnapshot } from '@oxy.so/contracts';
 import { OxyServices, type OxyConfig } from '../OxyServices';
 import type { HttpMethod } from '../client/context';
 import type { RequestOptions } from '../HttpService';
 import { type OxyAccountEvent, type OxyAccountEventFeedPage, type OxyMiddleware, type ServiceActingAsVerification, type VerifyAccountEventOptions } from './middleware';
-import { ServerAgencyApi, ServerAssetsApi, ServerLinkedAccountsApi, ServerNotificationsApi, ServerReputationApi } from './namespaces';
+import { ServerAppsApi, ServerAgencyApi, ServerAssetsApi, ServerLinkedAccountsApi, ServerNotificationsApi, ServerReputationApi } from './namespaces';
 export interface OxyServerConfig extends OxyConfig {
     /** This service's application credential. Omit to use workload identity (ADR 0026). */
     serviceAuth?: {
@@ -87,6 +88,7 @@ export declare class OxyServer extends OxyServices {
     private _serverNotifications?;
     private _serverLinkedAccounts?;
     private _serverAgency?;
+    private _serverApps?;
     private _serverReputation?;
     /** Files, plus the service-only metadata and linked-URL lookups. */
     get assets(): ServerAssetsApi;
@@ -96,6 +98,8 @@ export declare class OxyServer extends OxyServices {
     get linkedAccounts(): ServerLinkedAccountsApi;
     /** Delegated capabilities, plus `introspectRequesterAssertion`. */
     get agency(): ServerAgencyApi;
+    /** Application management, plus the receiver-bound Alia machine-key lookup. */
+    get apps(): ServerAppsApi;
     /** Reputation reads, plus `award`. */
     get reputation(): ServerReputationApi;
     /**
@@ -129,6 +133,10 @@ export declare class OxyServer extends OxyServices {
      * request is on behalf of that user (the API checks the delegation grant).
      * Never cached unless `cache` says so. Rejects with `OxyApiError`.
      */
+    /** Validated request's user session only; never changes the shared client's token. */
+    productGrantSnapshotForUser(query: SubjectProductAccessQuery, accessToken: string): Promise<SubjectProductGrantSnapshot>;
+    /** Offline metering read: the API requires this app's live consent for this exact subject. */
+    productGrantSnapshotForService(query: SubjectProductAccessQuery): Promise<SubjectProductGrantSnapshot>;
     serviceRequest<T>(method: HttpMethod, url: string, data?: unknown, options?: RequestOptions & {
         actAs?: string;
     }): Promise<T>;

package/dist/types/server/aliaMachineCredential.d.ts ADDED Viewed

@@ -0,0 +1,37 @@
+import type { Request, RequestHandler } from 'express';
+import type { OxyServiceEnvironment } from './auth';
+/** Stable resource identity, shared with the Oxy control plane. Not a display name. */
+export declare const OXY_ALIA_RESOURCE_APPLICATION_ID = "6a2f851751b784a86fd0e934";
+export declare const OXY_ALIA_MACHINE_SCOPES: readonly ["alia:chat", "inference:invoke"];
+/** App-only assistant turn: no human subject, service tier or delegated authority. */
+export interface OxyAliaMachinePrincipal {
+    readonly kind: 'machine';
+    readonly audience: typeof OXY_ALIA_RESOURCE_APPLICATION_ID;
+    readonly applicationId: string;
+    readonly credentialId: string;
+    readonly ownerAccountId: string;
+    readonly environment: OxyServiceEnvironment;
+    readonly scopes: readonly ['alia:chat', 'inference:invoke'];
+}
+export type AliaMachineCredentialIntrospection = {
+    active: false;
+} | {
+    active: true;
+    principal: OxyAliaMachinePrincipal;
+};
+export interface OxyAliaMachineCredentialHost {
+    readonly apps: {
+        introspectAliaMachineCredential(token: string): Promise<AliaMachineCredentialIntrospection>;
+    };
+}
+export interface OxyAliaMachineRequest extends Request {
+    machineCredential?: OxyAliaMachinePrincipal;
+}
+/** Strict response boundary: extra user/tier fields cannot smuggle authority. */
+export declare function isOxyAliaMachinePrincipal(value: unknown): value is OxyAliaMachinePrincipal;
+/** Only for the request-scoped Oxy inference client; never for a user API. */
+export declare function getOxyAliaMachineCredentialBearer(req: Request): string | null;
+/** Opt into Alia's app-only chat lane on its two chat routes, never globally. */
+export declare function createOxyAliaMachineCredentialAuth(server: OxyAliaMachineCredentialHost, options: {
+    environment: OxyServiceEnvironment;
+}): RequestHandler;

package/dist/types/server/index.d.ts CHANGED Viewed

@@ -16,7 +16,9 @@
  */
 export { OxyServer, ServiceCredentialMismatchError, ANONYMOUS_SERVICE_TOKEN_RETRY_MS } from './OxyServer';
 export type { OxyServerConfig, ServiceTokenResponse } from './OxyServer';
-export { ServerAgencyApi, ServerAssetsApi, ServerLinkedAccountsApi, ServerNotificationsApi, ServerReputationApi, } from './namespaces';
+export { ServerAppsApi, ServerAgencyApi, ServerAssetsApi, ServerLinkedAccountsApi, ServerNotificationsApi, ServerReputationApi, } from './namespaces';
+export { createOxyAliaMachineCredentialAuth, getOxyAliaMachineCredentialBearer, isOxyAliaMachinePrincipal, OXY_ALIA_RESOURCE_APPLICATION_ID, OXY_ALIA_MACHINE_SCOPES, } from './aliaMachineCredential';
+export type { AliaMachineCredentialIntrospection, OxyAliaMachinePrincipal, OxyAliaMachineRequest, OxyAliaMachineCredentialHost, } from './aliaMachineCredential';
 export type { CapabilityTicketGrant, CapabilityTicketIntrospection, CreateExecutionAuthorizationInput, ServiceCapabilityCatalog, } from './namespaces';
 export { OxyAccountEventError, OXY_ACCOUNT_DELETED_EVENT_URI } from './middleware';
 export type { AuthMiddlewareOptions, OxyAccountEvent, OxyAccountEventFeedItem, OxyAccountEventFeedPage, OxyMiddleware, ServiceActingAsVerification, ServiceApp, VerifyAccountEventOptions, } from './middleware';

package/dist/types/server/namespaces.d.ts CHANGED Viewed

@@ -5,12 +5,21 @@
  * `oxy.assets`.
  */
 import { type ForegroundExecutionAuthorizationInput, type ActorRef, type AppCapabilityCatalog, type AutonomyLevel, type CapabilityTicketClaims, type CapabilityTicketRequest, type GrantLimit, type PolicyDecision, type ResourceRef, type CreateOxyNotificationRequest, type AwardReputationInput, type ReputationTransaction, type ServiceLinkedAccountListResponse } from '@oxy.so/contracts';
+import type { OxyContext } from '../client/context';
 import type { Notification, ServiceAssetMetadata, ServiceAssetMetadataBySha, ServiceLinkedDownloadUrl } from '../models/interfaces';
 import { AssetsApi } from '../api/assets';
 import { NotificationsApi } from '../api/notifications';
 import { LinkedAccountsApi } from '../api/linkedAccounts';
 import { AgencyApi, type CapabilityExecutionAuthorization, type RequesterAssertionGrant, type RequesterAssertionIntrospection } from '../api/agency';
 import { ReputationApi } from '../api/reputation';
+import { AppsApi } from '../api/apps';
+import { type AliaMachineCredentialIntrospection } from './aliaMachineCredential';
+export declare class ServerAppsApi extends AppsApi {
+    private readonly serverCtx;
+    constructor(serverCtx: OxyContext);
+    /** Live receiver-bound lookup using THIS resource server's own service token. */
+    introspectAliaMachineCredential(token: string): Promise<AliaMachineCredentialIntrospection>;
+}
 export declare class ServerAssetsApi extends AssetsApi {
     /**
      * Resolve many asset ids to their content-addressed metadata (`sha256`,

package/dist/types/server/requesterAssertion.d.ts CHANGED Viewed

@@ -36,8 +36,8 @@ export declare const oxyRequesterAssertionClaimsSchema: z.ZodObject<{
     /** The one native agent this requester may reach with it. */
     agentId: z.ZodString;
 }, "strict", z.ZodTypeAny, {
-    exp: number;
     sub: string;
+    exp: number;
     aud: string;
     iss: string;
     jti: string;
@@ -46,8 +46,8 @@ export declare const oxyRequesterAssertionClaimsSchema: z.ZodObject<{
     cid: string;
     agentId: string;
 }, {
-    exp: number;
     sub: string;
+    exp: number;
     aud: string;
     iss: string;
     jti: string;

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/core",
-  "version": "4.3.0",
+  "version": "4.5.0-oxy-one.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -179,7 +179,7 @@
     "@oxy.so/telemetry": "^1.2.0",
     "@noble/ciphers": "^1.3.0",
     "@noble/hashes": "^1.8.0",
-    "@oxy.so/contracts": "^4.9.1",
+    "@oxy.so/contracts": "4.11.0-oxy-one.0",
     "@oxy.so/protocol": "^1.2.2",
     "@scure/bip39": "^1.6.0",
     "buffer": "^6.0.3",

package/src/api/assets.ts CHANGED Viewed

@@ -18,6 +18,7 @@ import type { OxyContext } from '../client/context';
 import { logger } from '../logger';
 import type {
   AccountStorageUsageResponse,
+  AssetInitResponse,
   Asset,
   AssetDeleteSummary,
   AssetLink,
@@ -101,6 +102,21 @@ export interface AssetDeleteResult {
 export class AssetsApi {
   constructor(protected readonly ctx: OxyContext) {}
+  /** Upload already-admitted bytes. Sends required bucket headers, never an Oxy bearer. */
+  async putPresignedUpload(init: AssetInitResponse, body: Blob): Promise<void> {
+    if (!init.uploadUrl) return; // bytes already exist for this account
+    const target = new URL(init.uploadUrl);
+    if (target.protocol !== 'https:') throw new Error('Presigned uploads require HTTPS');
+    const headers = new Headers(init.requiredHeaders);
+    headers.forEach((_value,name) => {
+      if (!['if-none-match','content-type','x-amz-checksum-sha256','cache-control'].includes(name.toLowerCase()))
+        throw new Error('Unsupported required upload header');
+    });
+    if (body.type && !headers.has('Content-Type')) headers.set('Content-Type',body.type);
+    const result = await fetch(target.toString(),{method:'PUT',body,headers,credentials:'omit',redirect:'error'});
+    if(!result.ok)throw new Error(`Presigned upload failed (${result.status})`);
+  }
   // ── Upload ───────────────────────────────────────────────────────────────
   /**

package/src/api/billing.ts CHANGED Viewed

@@ -1,3 +1,4 @@
+import { personalPlanCheckoutRequestSchema, personalPlanCheckoutResultSchema, type PersonalPlanCheckoutRequest, type PersonalPlanCheckoutResult } from '@oxy.so/contracts';
 /**
  * `oxy.billing` — the signed-in user's subscription, wallet and payment history.
  *
@@ -9,6 +10,7 @@
  * `payment.controller`, `wallet.routes` in `packages/api`); `Date` columns
  * arrive as ISO-8601 strings.
  */
+import { personalPlanCatalogueSchema, type PersonalPlanCatalogue } from '@oxy.so/contracts';
 import { type SubjectProductAccess,
 	type SubjectProductAccessQuery,
 	subjectProductAccessQuerySchema, subjectProductAccessSchema, } from '@oxy.so/contracts';
@@ -115,6 +117,17 @@ export interface WalletTransactionsPage {
 export class BillingApi {
   constructor(protected readonly ctx: OxyContext) {}
+  async startPersonalPlanCheckout(request: PersonalPlanCheckoutRequest): Promise<PersonalPlanCheckoutResult> {
+    return personalPlanCheckoutResultSchema.parse(await this.ctx.request<unknown>('POST', '/billing/checkout/personal-plan',
+      personalPlanCheckoutRequestSchema.parse(request), { cache: false }));
+  }
+  /** Public versioned personal plans. Discovery never proves customer access. */
+  async personalPlans(): Promise<PersonalPlanCatalogue> {
+    return personalPlanCatalogueSchema.parse(await this.ctx.request<unknown>(
+      'GET', '/billing/personal-plans', undefined, { cache: false }));
+  }
   /** Product rights only; requires a production application-bound user session. Never cached. */
   async productAccess(query: SubjectProductAccessQuery): Promise<SubjectProductAccess> {
     const parsed = subjectProductAccessQuerySchema.parse(query);
@@ -125,11 +138,11 @@ export class BillingApi {
   }
 	/** Named commercial sources for the current subject; no inferred plan collapse. */
-	async productSubscriptions(): Promise<ProductSubscriptionSummary[]> {
+	async productSubscriptions(expectedSubjectAccountId?: string): Promise<ProductSubscriptionSummary[]> {
 		return productSubscriptionsResponseSchema.parse(
 			await this.ctx.request<unknown>(
 				"GET",
-				"/billing/product-subscriptions",
+				expectedSubjectAccountId ? `/billing/product-subscriptions?expectedSubjectAccountId=${encodeURIComponent(expectedSubjectAccountId)}` : "/billing/product-subscriptions",
 				undefined,
 				{ cache: false },
 			),
@@ -149,20 +162,20 @@ export class BillingApi {
 	}
 	/** Payer-only named-source cancellation. Resolves on provider acceptance, including pending local reconciliation. Use cancelProductSubscriptionWithStatus for detailed completion state. */
-	async cancelProductSubscription(sourceId: string, expectedSubjectAccountId?: string): Promise<void> {
+	async cancelProductSubscription(sourceId: string, expectedSubjectAccountId?: string, actionId?:string): Promise<void> {
 		await this.ctx.request(
 			"POST",
 			"/billing/product-subscriptions/cancel",
-			cancelProductSubscriptionSchema.parse({ sourceId, ...(expectedSubjectAccountId ? { expectedSubjectAccountId } : {}) }),
+			cancelProductSubscriptionSchema.parse({ sourceId, ...(actionId?{actionId}:{}), ...(expectedSubjectAccountId ? { expectedSubjectAccountId } : {}) }),
 			{ cache: false },
 		);
 	}
   /** Provider acceptance versus completed local cancellation, for user-facing flows. */
-  async cancelProductSubscriptionWithStatus(sourceId: string, expectedSubjectAccountId?: string): Promise<ProductSubscriptionCancellationResult> {
+  async cancelProductSubscriptionWithStatus(sourceId: string, expectedSubjectAccountId?: string, actionId?:string): Promise<ProductSubscriptionCancellationResult> {
     return productSubscriptionCancellationResultSchema.parse(await this.ctx.request<unknown>(
       'POST', '/billing/product-subscriptions/cancel',
-      cancelProductSubscriptionSchema.parse({ sourceId, ...(expectedSubjectAccountId ? { expectedSubjectAccountId } : {}) }),
+      cancelProductSubscriptionSchema.parse({ sourceId, ...(actionId?{actionId}:{}), ...(expectedSubjectAccountId ? { expectedSubjectAccountId } : {}) }),
       { cache: false },
     ));
   }

package/src/api/users.ts CHANGED Viewed

@@ -121,8 +121,8 @@ export class UsersApi {
   }
   /** The signed-in user. Cached 1 minute. */
-  async me(): Promise<User> {
-    const user = await this.ctx.request<User>('GET', '/users/me', undefined, { cache: true, cacheTTL: ME_TTL });
+  async me(options?: {cache?: boolean}): Promise<User> {
+    const user = await this.ctx.request<User>('GET', '/users/me', undefined, { cache: options?.cache ?? true, cacheTTL: ME_TTL });
     return normalizeUserIdentity(user);
   }

package/src/models/interfaces.ts CHANGED Viewed

@@ -224,6 +224,8 @@ export interface User {
    * user sets it. Updated via `updateThemePreference` / `updateProfile`.
    */
   themePreference?: ThemePreference;
+  /** Product-specific personalization; never inferred from generic premium. */
+  personalization?: {mentionMono:{allowed:boolean;expiresAt:string|null}};
   /**
    * The authenticated viewer's relationship to THIS profile. Populated ONLY on
    * single-profile fetches (`getProfileByUsername` / `getUserById`) when the
@@ -581,6 +583,8 @@ export interface AssetInitRequest {
 }
 export interface AssetInitResponse {
+  /** Replay these headers on PUT; Content-Length is supplied by the transport. */
+  requiredHeaders?: Record<string, string>;
   uploadUrl: string;
   fileId: string;
   sha256: string;
@@ -769,6 +773,8 @@ export interface AccountStorageCategoryUsage {
 }
 export interface AccountStorageUsageResponse {
+  quotaEnforcement?: 'metadata_admission' | 'unconfigured';
+  reservedBytes?: string | null;
   plan: 'basic' | 'pro' | 'business';
   totalUsedBytes: number;
   totalLimitBytes: number;

package/src/server/OxyServer.ts CHANGED Viewed

@@ -1,3 +1,4 @@
+import { subjectProductAccessQuerySchema, subjectProductGrantSnapshotSchema, type SubjectProductAccessQuery, type SubjectProductGrantSnapshot } from '@oxy.so/contracts';
 /**
  * `OxyServer` — the Oxy client for a backend.
  *
@@ -59,6 +60,7 @@ import {
   type VerifyAccountEventOptions,
 } from './middleware';
 import {
+  ServerAppsApi,
   ServerAgencyApi,
   ServerAssetsApi,
   ServerLinkedAccountsApi,
@@ -217,6 +219,7 @@ export class OxyServer extends OxyServices {
   private _serverNotifications?: ServerNotificationsApi;
   private _serverLinkedAccounts?: ServerLinkedAccountsApi;
   private _serverAgency?: ServerAgencyApi;
+  private _serverApps?: ServerAppsApi;
   private _serverReputation?: ServerReputationApi;
   /** Files, plus the service-only metadata and linked-URL lookups. */
@@ -239,6 +242,11 @@ export class OxyServer extends OxyServices {
     if (!this._serverAgency) this._serverAgency = new ServerAgencyApi(this.context);
     return this._serverAgency;
   }
+  /** Application management, plus the receiver-bound Alia machine-key lookup. */
+  override get apps(): ServerAppsApi {
+    if (!this._serverApps) this._serverApps = new ServerAppsApi(this.context);
+    return this._serverApps;
+  }
   /** Reputation reads, plus `award`. */
   override get reputation(): ServerReputationApi {
     if (!this._serverReputation) this._serverReputation = new ServerReputationApi(this.context);
@@ -355,6 +363,31 @@ export class OxyServer extends OxyServices {
    * request is on behalf of that user (the API checks the delegation grant).
    * Never cached unless `cache` says so. Rejects with `OxyApiError`.
    */
+  /** Validated request's user session only; never changes the shared client's token. */
+  async productGrantSnapshotForUser(query: SubjectProductAccessQuery, accessToken: string): Promise<SubjectProductGrantSnapshot> {
+    const parsed = subjectProductAccessQuerySchema.parse(query);
+    if (!accessToken || /[\r\n]/.test(accessToken)) throw new Error('A user session is required');
+    const answer = await this.request<unknown>('GET',
+      `/v1/products/${encodeURIComponent(parsed.productId)}/access/${encodeURIComponent(parsed.subjectAccountId)}/grants`,
+      undefined, { cache: false, retry: false, headers: { Authorization: `Bearer ${accessToken}` } });
+    const snapshot = subjectProductGrantSnapshotSchema.parse(answer);
+    if(snapshot.access.subjectAccountId !== parsed.subjectAccountId || snapshot.access.productId !== parsed.productId)
+      throw new Error('Product grant response attribution differs');
+    return snapshot;
+  }
+  /** Offline metering read: the API requires this app's live consent for this exact subject. */
+  async productGrantSnapshotForService(query: SubjectProductAccessQuery): Promise<SubjectProductGrantSnapshot> {
+    const parsed = subjectProductAccessQuerySchema.parse(query);
+    const answer = await this.serviceRequest<unknown>('GET',
+      `/v1/products/${encodeURIComponent(parsed.productId)}/access/${encodeURIComponent(parsed.subjectAccountId)}/service-grants`,
+      undefined, { cache: false, retry: false });
+    const snapshot = subjectProductGrantSnapshotSchema.parse(answer);
+    if (snapshot.access.subjectAccountId !== parsed.subjectAccountId || snapshot.access.productId !== parsed.productId)
+      throw new Error('Product grant response attribution differs');
+    return snapshot;
+  }
   async serviceRequest<T>(
     method: HttpMethod,
     url: string,
@@ -695,4 +728,3 @@ export class OxyServer extends OxyServices {
     return appId;
   }
 }

package/src/server/aliaMachineCredential.ts ADDED Viewed

@@ -0,0 +1,94 @@
+import type { Request, RequestHandler } from 'express';
+import type { OxyServiceEnvironment } from './auth';
+/** Stable resource identity, shared with the Oxy control plane. Not a display name. */
+export const OXY_ALIA_RESOURCE_APPLICATION_ID = '6a2f851751b784a86fd0e934';
+export const OXY_ALIA_MACHINE_SCOPES = ['alia:chat', 'inference:invoke'] as const;
+/** App-only assistant turn: no human subject, service tier or delegated authority. */
+export interface OxyAliaMachinePrincipal {
+  readonly kind: 'machine';
+  readonly audience: typeof OXY_ALIA_RESOURCE_APPLICATION_ID;
+  readonly applicationId: string;
+  readonly credentialId: string;
+  readonly ownerAccountId: string;
+  readonly environment: OxyServiceEnvironment;
+  readonly scopes: readonly ['alia:chat', 'inference:invoke'];
+}
+export type AliaMachineCredentialIntrospection =
+  | { active: false }
+  | { active: true; principal: OxyAliaMachinePrincipal };
+export interface OxyAliaMachineCredentialHost {
+  readonly apps: {
+    introspectAliaMachineCredential(token: string): Promise<AliaMachineCredentialIntrospection>;
+  };
+}
+export interface OxyAliaMachineRequest extends Request {
+  machineCredential?: OxyAliaMachinePrincipal;
+}
+function id(value: unknown): value is string {
+  return typeof value === 'string' && value.length > 0 && value.length <= 128 && value.trim() === value;
+}
+/** Strict response boundary: extra user/tier fields cannot smuggle authority. */
+export function isOxyAliaMachinePrincipal(value: unknown): value is OxyAliaMachinePrincipal {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  const p = value as Record<string, unknown>;
+  const keys = ['kind', 'audience', 'applicationId', 'credentialId', 'ownerAccountId', 'environment', 'scopes'];
+  return Object.keys(p).length === keys.length && keys.every(key => Object.prototype.hasOwnProperty.call(p, key))
+    && p.kind === 'machine' && p.audience === OXY_ALIA_RESOURCE_APPLICATION_ID
+    && id(p.applicationId) && id(p.credentialId) && id(p.ownerAccountId)
+    && typeof p.environment === 'string' && ['production', 'staging', 'development'].includes(p.environment)
+    && Array.isArray(p.scopes) && p.scopes.length === 2
+    && OXY_ALIA_MACHINE_SCOPES.every(scope => (p.scopes as unknown[]).includes(scope));
+}
+// Keep the forwarding credential out of enumerable request/principal objects,
+// logs, response serialization and persistent SDK/session state. No cache.
+const forwardingCredentials = new WeakMap<Request, { principal: OxyAliaMachinePrincipal; bearer: string }>();
+/** Only for the request-scoped Oxy inference client; never for a user API. */
+export function getOxyAliaMachineCredentialBearer(req: Request): string | null {
+  const bound = forwardingCredentials.get(req);
+  return bound && (req as OxyAliaMachineRequest).machineCredential === bound.principal ? bound.bearer : null;
+}
+/** Opt into Alia's app-only chat lane on its two chat routes, never globally. */
+export function createOxyAliaMachineCredentialAuth(
+  server: OxyAliaMachineCredentialHost,
+  options: { environment: OxyServiceEnvironment },
+): RequestHandler {
+  return async (req, res, next) => {
+    const auth = req.headers.authorization;
+    const token = typeof auth === 'string' && auth.startsWith('Bearer ') ? auth.slice(7) : '';
+    if (!token.startsWith('oxy_sk_') || token.length > 2048) {
+      res.status(401).json({ error: 'MACHINE_CREDENTIAL_INVALID' });
+      return;
+    }
+    const existing = req as Request & { user?: unknown; userId?: unknown; serviceApp?: unknown; oxyRequester?: unknown };
+    if (existing.user || existing.userId || existing.serviceApp || existing.oxyRequester
+      || (req as OxyAliaMachineRequest).machineCredential
+      || req.headers['x-oxy-user-id'] !== undefined || req.headers['x-oxy-requester-assertion'] !== undefined) {
+      res.status(403).json({ error: 'MACHINE_USER_DELEGATION_UNSUPPORTED' });
+      return;
+    }
+    try {
+      const answer = await server.apps.introspectAliaMachineCredential(token);
+      if (!answer.active || !isOxyAliaMachinePrincipal(answer.principal) || answer.principal.environment !== options.environment) {
+        res.status(401).json({ error: 'MACHINE_CREDENTIAL_INVALID' });
+        return;
+      }
+      const principal = Object.freeze({ ...answer.principal, scopes: Object.freeze(['alia:chat', 'inference:invoke'] as const) });
+      (req as OxyAliaMachineRequest).machineCredential = principal;
+      forwardingCredentials.set(req, { principal, bearer: token });
+      next();
+    } catch {
+      // Transport errors may contain request data; never expose or log them.
+      res.status(503).json({ error: 'MACHINE_CREDENTIAL_VERIFIER_UNAVAILABLE' });
+    }
+  };
+}

package/src/server/index.ts CHANGED Viewed

@@ -20,12 +20,26 @@
 export { OxyServer, ServiceCredentialMismatchError, ANONYMOUS_SERVICE_TOKEN_RETRY_MS } from './OxyServer';
 export type { OxyServerConfig, ServiceTokenResponse } from './OxyServer';
 export {
+  ServerAppsApi,
   ServerAgencyApi,
   ServerAssetsApi,
   ServerLinkedAccountsApi,
   ServerNotificationsApi,
   ServerReputationApi,
 } from './namespaces';
+export {
+  createOxyAliaMachineCredentialAuth,
+  getOxyAliaMachineCredentialBearer,
+  isOxyAliaMachinePrincipal,
+  OXY_ALIA_RESOURCE_APPLICATION_ID,
+  OXY_ALIA_MACHINE_SCOPES,
+} from './aliaMachineCredential';
+export type {
+  AliaMachineCredentialIntrospection,
+  OxyAliaMachinePrincipal,
+  OxyAliaMachineRequest,
+  OxyAliaMachineCredentialHost,
+} from './aliaMachineCredential';
 export type {
   CapabilityTicketGrant,
   CapabilityTicketIntrospection,

package/src/server/namespaces.ts CHANGED Viewed

@@ -18,6 +18,8 @@ import { NotificationsApi } from '../api/notifications';
 import { LinkedAccountsApi } from '../api/linkedAccounts';
 import { AgencyApi, type CapabilityExecutionAuthorization, type RequesterAssertionGrant, type RequesterAssertionIntrospection } from '../api/agency';
 import { ReputationApi } from '../api/reputation';
+import { AppsApi } from '../api/apps';
+import { isOxyAliaMachinePrincipal, type AliaMachineCredentialIntrospection } from './aliaMachineCredential';
 import { ServiceAssetMetadataError, ServiceLinkedDownloadUrlError } from '../OxyServices.errors';
 import { extractErrorStatus } from '../utils/errorUtils';
 import { logger } from '../logger';
@@ -39,6 +41,25 @@ function lane(ctx: OxyContext): ServiceLane {
   return ctx.service;
 }
+export class ServerAppsApi extends AppsApi {
+  constructor(private readonly serverCtx: OxyContext) { super(serverCtx); }
+  /** Live receiver-bound lookup using THIS resource server's own service token. */
+  async introspectAliaMachineCredential(token: string): Promise<AliaMachineCredentialIntrospection> {
+    if (!token.startsWith('oxy_sk_') || token.length > 2048) return { active: false };
+    const answer = await lane(this.serverCtx).request<unknown>(
+      'POST', '/internal/alia/machine-credentials/introspect', { token },
+      { cache: false, retry: false },
+    );
+    if (!answer || typeof answer !== 'object' || Array.isArray(answer)) throw new Error('Invalid machine credential verdict');
+    const record = answer as Record<string, unknown>;
+    if (record.active === false && Object.keys(record).length === 1) return { active: false };
+    if (record.active !== true || Object.keys(record).length !== 2 || !isOxyAliaMachinePrincipal(record.principal)) {
+      throw new Error('Invalid machine credential verdict');
+    }
+    return { active: true, principal: record.principal };
+  }
+}
 function chunk<T>(items: T[], size: number): T[][] {
   const chunks: T[][] = [];
   for (let i = 0; i < items.length; i += size) chunks.push(items.slice(i, i + size));