@oxy.so/core 4.5.0-oxy-one.0 → 4.5.0

package/dist/esm/server/middleware.js

@@ -4,7 +4,7 @@ import { jwtDecode } from 'jwt-decode';
 import { loadNodeCrypto } from '@oxy.so/protocol';
 import { logger } from '../logger/index.js';
 import { toOxyApiError } from '../OxyServices.errors.js';
-import { OXY_SERVICE_ENVIRONMENTS } from '../utils/oxyServiceEnvironment.js';
+import { OXY_SERVICE_ENVIRONMENTS, } from '../utils/oxyServiceEnvironment.js';
 /** The SET `events` member Oxy uses for an account deletion. */
 export const OXY_ACCOUNT_DELETED_EVENT_URI = 'https://oxy.so/events/account.deleted';
 /** Why an account event token was refused. `message` never contains the token. */
@@ -46,8 +46,7 @@ class ServiceTokenClaimError extends Error {
     }
 }
 function isOxyServiceEnvironment(value) {
-    return (typeof value === 'string' &&
-        OXY_SERVICE_ENVIRONMENTS.includes(value));
+    return (typeof value === 'string' && OXY_SERVICE_ENVIRONMENTS.includes(value));
 }
 /** Build the middleware set for one server. See `OxyServer.middleware`. */
 export function createOxyMiddleware(host) {
@@ -195,7 +194,7 @@ export function createOxyMiddleware(host) {
                         error: 'MISSING_TOKEN',
                         message: 'Access token required',
                         code: 'MISSING_TOKEN',
-                        status: 401
+                        status: 401,
                     };
                     if (onError)
                         return onError(error);
@@ -228,7 +227,7 @@ export function createOxyMiddleware(host) {
                         error: 'INVALID_TOKEN_FORMAT',
                         message: 'Invalid token format',
                         code: 'INVALID_TOKEN_FORMAT',
-                        status: 401
+                        status: 401,
                     };
                     if (onError)
                         return onError(error);
@@ -327,7 +326,12 @@ export function createOxyMiddleware(host) {
                             req.user = null;
                             return next();
                         }
-                        const error = { error: 'TOKEN_EXPIRED', message: 'Service token expired', code: 'TOKEN_EXPIRED', status: 401 };
+                        const error = {
+                            error: 'TOKEN_EXPIRED',
+                            message: 'Service token expired',
+                            code: 'TOKEN_EXPIRED',
+                            status: 401,
+                        };
                         if (onError)
                             return onError(error);
                         return res.status(401).json(error);
@@ -339,7 +343,12 @@ export function createOxyMiddleware(host) {
                             reason: 'Service token is not yet valid (nbf)',
                             status: 401,
                         });
-                        const error = { error: 'INVALID_SERVICE_TOKEN_CLAIMS', message: 'Service token is not yet valid', code: 'INVALID_SERVICE_TOKEN_CLAIMS', status: 401 };
+                        const error = {
+                            error: 'INVALID_SERVICE_TOKEN_CLAIMS',
+                            message: 'Service token is not yet valid',
+                            code: 'INVALID_SERVICE_TOKEN_CLAIMS',
+                            status: 401,
+                        };
                         if (onError)
                             return onError(error);
                         return res.status(401).json(error);
@@ -356,10 +365,10 @@ export function createOxyMiddleware(host) {
                         !isExactNonEmptyServiceClaim(decoded.appName) ||
                         !isExactNonEmptyServiceClaim(credentialId) ||
                         !isExactNonEmptyServiceClaim(ownerAccountId) ||
-                        !isOxyServiceEnvironment(environment)
-                        || !Array.isArray(decoded.scopes)
-                        || !decoded.scopes.every((scope) => typeof scope === 'string' && scope.length > 0 && scope === scope.trim())
-                        || new Set(decoded.scopes).size !== decoded.scopes.length) {
+                        !isOxyServiceEnvironment(environment) ||
+                        !Array.isArray(decoded.scopes) ||
+                        !decoded.scopes.every((scope) => typeof scope === 'string' && scope.length > 0 && scope === scope.trim()) ||
+                        new Set(decoded.scopes).size !== decoded.scopes.length) {
                         recordRefusal(req, {
                             code: 'INVALID_SERVICE_TOKEN',
                             stage: 'service-token',
@@ -373,7 +382,9 @@ export function createOxyMiddleware(host) {
                                 !isExactNonEmptyServiceClaim(ownerAccountId) ? 'ownerAccountId' : null,
                                 !isOxyServiceEnvironment(environment) ? 'environment' : null,
                                 !Array.isArray(decoded.scopes) ? 'scopes' : null,
-                            ].filter((field) => field !== null).join(', ') || 'scopes'})`,
+                            ]
+                                .filter((field) => field !== null)
+                                .join(', ') || 'scopes'})`,
                             status: 401,
                         });
                         if (optional) {
@@ -381,7 +392,12 @@ export function createOxyMiddleware(host) {
                             req.user = null;
                             return next();
                         }
-                        const error = { error: 'INVALID_SERVICE_TOKEN', message: 'Invalid service token: missing required claims', code: 'INVALID_SERVICE_TOKEN', status: 401 };
+                        const error = {
+                            error: 'INVALID_SERVICE_TOKEN',
+                            message: 'Invalid service token: missing required claims',
+                            code: 'INVALID_SERVICE_TOKEN',
+                            status: 401,
+                        };
                         if (onError)
                             return onError(error);
                         return res.status(401).json(error);
@@ -416,8 +432,10 @@ export function createOxyMiddleware(host) {
                         // `req.userId = oxyUserId` would let any service impersonate
                         // any user simply by setting the header.
                         const grant = await host.verifyActingAs(appId, oxyUserId, {
-                            cache: false, credentialId: decoded.credentialId,
-                            ownerAccountId: decoded.ownerAccountId, environment: decoded.environment,
+                            cache: false,
+                            credentialId: decoded.credentialId,
+                            ownerAccountId: decoded.ownerAccountId,
+                            environment: decoded.environment,
                         });
                         if (!grant || !grant.authorized) {
                             logger.warn('[oxy.auth] Service token rejected — no delegation grant', {
@@ -497,7 +515,7 @@ export function createOxyMiddleware(host) {
                         error: 'INVALID_TOKEN_PAYLOAD',
                         message: 'Token missing user ID',
                         code: 'INVALID_TOKEN_PAYLOAD',
-                        status: 401
+                        status: 401,
                     };
                     if (onError)
                         return onError(error);
@@ -521,7 +539,7 @@ export function createOxyMiddleware(host) {
                         error: 'TOKEN_EXPIRED',
                         message: 'Token expired',
                         code: 'TOKEN_EXPIRED',
-                        status: 401
+                        status: 401,
                     };
                     if (onError)
                         return onError(error);
@@ -549,7 +567,7 @@ export function createOxyMiddleware(host) {
                         error: 'SESSION_REQUIRED',
                         message: 'Access token is not bound to a session',
                         code: 'SESSION_REQUIRED',
-                        status: 401
+                        status: 401,
                     };
                     if (onError)
                         return onError(error);
@@ -577,7 +595,7 @@ export function createOxyMiddleware(host) {
                             error: 'INVALID_SESSION',
                             message: 'Session invalid or expired',
                             code: 'INVALID_SESSION',
-                            status: 401
+                            status: 401,
                         };
                         if (onError)
                             return onError(error);
@@ -601,7 +619,7 @@ export function createOxyMiddleware(host) {
                             error: 'INVALID_SESSION',
                             message: 'Session did not resolve to a usable identity',
                             code: 'INVALID_SESSION',
-                            status: 401
+                            status: 401,
                         };
                         if (onError)
                             return onError(error);
@@ -632,7 +650,7 @@ export function createOxyMiddleware(host) {
                             error: 'SESSION_USER_MISMATCH',
                             message: 'Token user does not match the session',
                             code: 'SESSION_USER_MISMATCH',
-                            status: 401
+                            status: 401,
                         };
                         if (onError)
                             return onError(error);
@@ -667,7 +685,7 @@ export function createOxyMiddleware(host) {
                             error: 'SESSION_ACTOR_MISMATCH',
                             message: 'Session actor does not match the session',
                             code: 'SESSION_ACTOR_MISMATCH',
-                            status: 401
+                            status: 401,
                         };
                         if (onError)
                             return onError(error);
@@ -680,7 +698,9 @@ export function createOxyMiddleware(host) {
                     // Session validation already returned the full user, so `loadUser`
                     // costs no extra round-trip.
                     // One id source: the one `getUserIdentityId` validated (`id`, else `_id`).
-                    req.user = loadUser ? { ...validationResult.user, id: validatedUserId } : { id: validatedUserId };
+                    req.user = loadUser
+                        ? { ...validationResult.user, id: validatedUserId }
+                        : { id: validatedUserId };
                     if (debug) {
                         logger.debug(`[oxy.auth] OK user=${validatedUserId} session=${sessionId}`, {
                             component: 'auth',
@@ -714,7 +734,7 @@ export function createOxyMiddleware(host) {
                         error: 'SESSION_VALIDATION_ERROR',
                         message: 'Session validation failed',
                         code: 'SESSION_VALIDATION_ERROR',
-                        status: 401
+                        status: 401,
                     };
                     if (onError)
                         return onError(error);
@@ -996,16 +1016,16 @@ function parseServiceTokenJwks(value) {
         if (typeof value !== 'object' || value === null || Array.isArray(value))
             throw new ServiceTokenSignatureError('Oxy JWKS contains a malformed key');
         const key = value;
-        if (key.kty !== 'OKP'
-            || key.crv !== 'Ed25519'
-            || typeof key.x !== 'string'
-            || key.x.length === 0
-            || key.use !== 'sig'
-            || key.alg !== 'EdDSA'
-            || typeof key.kid !== 'string'
-            || !/^[A-Za-z0-9._-]{1,128}$/.test(key.kid)
-            || Object.prototype.hasOwnProperty.call(key, 'd')
-            || result.has(key.kid))
+        if (key.kty !== 'OKP' ||
+            key.crv !== 'Ed25519' ||
+            typeof key.x !== 'string' ||
+            key.x.length === 0 ||
+            key.use !== 'sig' ||
+            key.alg !== 'EdDSA' ||
+            typeof key.kid !== 'string' ||
+            !/^[A-Za-z0-9._-]{1,128}$/.test(key.kid) ||
+            Object.prototype.hasOwnProperty.call(key, 'd') ||
+            result.has(key.kid))
             throw new ServiceTokenSignatureError('Oxy JWKS contains an unsupported or duplicate key');
         const x = Buffer.from(key.x, 'base64url');
         if (x.length !== 32 || x.toString('base64url') !== key.x) {
@@ -1086,11 +1106,11 @@ async function verifyServiceTokenSignature(token, options) {
         throw new ServiceTokenStructureError('Service token has empty segment');
     }
     const header = parseJsonSegment(headerB64);
-    if (Object.keys(header).length !== 3
-        || header.alg !== 'EdDSA'
-        || header.typ !== 'JWT'
-        || typeof header.kid !== 'string'
-        || !/^[A-Za-z0-9._-]{1,128}$/.test(header.kid))
+    if (Object.keys(header).length !== 3 ||
+        header.alg !== 'EdDSA' ||
+        header.typ !== 'JWT' ||
+        typeof header.kid !== 'string' ||
+        !/^[A-Za-z0-9._-]{1,128}$/.test(header.kid))
         throw new ServiceTokenStructureError('Service token JOSE header is not supported');
     const jwk = await resolveServiceTokenPublicKey(header.kid, options.jwksUrl, options.cache);
     let publicKey;
@@ -1134,13 +1154,12 @@ function readStringClaim(value) {
 /**
  * Resolve the canonical user id from a validated session's user object.
  *
- * The API serializer emits `id`, but some upstream shapes carry the raw Mongo
- * `_id` instead. We accept either, but only a non-empty string — anything else
+ * The API serializer emits `id`, but some upstream shapes carry a raw `_id`
+ * instead. We accept either, but only a non-empty string — anything else
  * means the validated identity is unusable and the caller must reject.
  */
 function getUserIdentityId(user) {
-    const candidate = user.id
-        ?? user._id;
+    const candidate = user.id ?? user._id;
     return typeof candidate === 'string' && candidate.length > 0 ? candidate : null;
 }
 /**

package/dist/esm/server/namespaces.js

@@ -4,14 +4,14 @@
  * `server.assets.metadataByIds(...)` sits beside every client method of
  * `oxy.assets`.
  */
-import { capabilityTicketRequestSchema, foregroundExecutionAuthorizationInputSchema } from '@oxy.so/contracts';
+import { capabilityTicketRequestSchema, foregroundExecutionAuthorizationInputSchema, } from '@oxy.so/contracts';
 import { AssetsApi } from '../api/assets.js';
 import { NotificationsApi } from '../api/notifications.js';
 import { LinkedAccountsApi } from '../api/linkedAccounts.js';
-import { AgencyApi } from '../api/agency.js';
+import { AgencyApi, } from '../api/agency.js';
 import { ReputationApi } from '../api/reputation.js';
 import { AppsApi } from '../api/apps.js';
-import { isOxyAliaMachinePrincipal } from './aliaMachineCredential.js';
+import { isOxyAliaMachinePrincipal, } from './aliaMachineCredential.js';
 import { ServiceAssetMetadataError, ServiceLinkedDownloadUrlError } from '../OxyServices.errors.js';
 import { extractErrorStatus } from '../utils/errorUtils.js';
 import { logger } from '../logger/index.js';
@@ -44,7 +44,9 @@ export class ServerAppsApi extends AppsApi {
         const record = answer;
         if (record.active === false && Object.keys(record).length === 1)
             return { active: false };
-        if (record.active !== true || Object.keys(record).length !== 2 || !isOxyAliaMachinePrincipal(record.principal)) {
+        if (record.active !== true ||
+            Object.keys(record).length !== 2 ||
+            !isOxyAliaMachinePrincipal(record.principal)) {
             throw new Error('Invalid machine credential verdict');
         }
         return { active: true, principal: record.principal };
@@ -171,7 +173,9 @@ export class ServerAssetsApi extends AssetsApi {
             return [];
         const settled = await Promise.all(chunk(unique, SERVICE_ASSET_METADATA_BY_SHA_CHUNK_SIZE).map(async (part) => {
             try {
-                const body = options.ownerUserId ? { sha256s: part, ownerUserId: options.ownerUserId } : { sha256s: part };
+                const body = options.ownerUserId
+                    ? { sha256s: part, ownerUserId: options.ownerUserId }
+                    : { sha256s: part };
                 const entries = await lane(this.ctx).request('POST', '/assets/service/by-sha256', body);
                 return Array.isArray(entries) ? entries : [];
             }
@@ -211,7 +215,14 @@ export class ServerLinkedAccountsApi extends LinkedAccountsApi {
 }
 function agencyAuthorityOptions(signal) {
     signal?.throwIfAborted();
-    return { cache: false, deduplicate: false, retry: false, skipAuth: true, timeout: 5000, ...(signal ? { signal } : {}) };
+    return {
+        cache: false,
+        deduplicate: false,
+        retry: false,
+        skipAuth: true,
+        timeout: 5000,
+        ...(signal ? { signal } : {}),
+    };
 }
 export class ServerAgencyApi extends AgencyApi {
     /** Live registry discovery with this service's existing capability scopes. */
@@ -249,15 +260,25 @@ export class ServerAgencyApi extends AgencyApi {
         options.signal?.throwIfAborted();
         if (!authorizationId || authorizationId.length > 255 || /\s/.test(authorizationId))
             throw new Error('An execution authorization id is required');
-        if (!options.requesterToken || options.requesterToken.length > 16384 || /\s/.test(options.requesterToken))
+        if (!options.requesterToken ||
+            options.requesterToken.length > 16384 ||
+            /\s/.test(options.requesterToken))
             throw new Error('A requester bearer is required');
-        await this.ctx.request('DELETE', `/capabilities/execution-authorizations/${encodeURIComponent(authorizationId)}`, undefined, { ...agencyAuthorityOptions(options.signal), headers: { Authorization: `Bearer ${options.requesterToken}` } });
+        await this.ctx.request('DELETE', `/capabilities/execution-authorizations/${encodeURIComponent(authorizationId)}`, undefined, {
+            ...agencyAuthorityOptions(options.signal),
+            headers: { Authorization: `Bearer ${options.requesterToken}` },
+        });
     }
     /** Independent service proof plus present requester bearer, sent only to Oxy. */
     async createForegroundExecutionAuthorization(input, options) {
-        if (options.requesterToken === '' || options.requesterToken.length > 16384 || /\s/.test(options.requesterToken))
+        if (options.requesterToken === '' ||
+            options.requesterToken.length > 16384 ||
+            /\s/.test(options.requesterToken))
             throw new Error('A requester bearer is required');
-        const result = await lane(this.ctx).request('POST', '/capabilities/foreground-execution-authorizations', { ...foregroundExecutionAuthorizationInputSchema.parse(input), subjectToken: options.requesterToken }, agencyAuthorityOptions(options.signal));
+        const result = await lane(this.ctx).request('POST', '/capabilities/foreground-execution-authorizations', {
+            ...foregroundExecutionAuthorizationInputSchema.parse(input),
+            subjectToken: options.requesterToken,
+        }, agencyAuthorityOptions(options.signal));
         return result.authorization;
     }
     /**

package/dist/esm/server/requesterAssertion.js

@@ -25,7 +25,8 @@ const KEY_ID_PATTERN = /^[A-Za-z0-9._-]{1,128}$/;
 const BASE64URL_PATTERN = /^[A-Za-z0-9_-]+$/;
 const MAX_ASSERTION_BYTES = 4096;
 const identifier = z.string().min(1).max(128);
-export const oxyRequesterAssertionClaimsSchema = z.object({
+export const oxyRequesterAssertionClaimsSchema = z
+    .object({
     iss: z.string().min(1).max(256),
     aud: identifier,
     /** The requester account. */
@@ -39,7 +40,8 @@ export const oxyRequesterAssertionClaimsSchema = z.object({
     cid: identifier,
     /** The one native agent this requester may reach with it. */
     agentId: identifier,
-}).strict();
+})
+    .strict();
 export class OxyRequesterAssertionError extends Error {
     constructor(code) {
         super(`Requester assertion rejected: ${code}`);
@@ -71,7 +73,8 @@ function decodeObject(segment) {
 /** Signs an assertion. Oxy is the only intended caller. */
 export function signOxyRequesterAssertion(claims, signing) {
     const parsed = oxyRequesterAssertionClaimsSchema.parse(claims);
-    if (parsed.exp <= parsed.iat || parsed.exp - parsed.iat > OXY_REQUESTER_ASSERTION_MAX_TTL_SECONDS) {
+    if (parsed.exp <= parsed.iat ||
+        parsed.exp - parsed.iat > OXY_REQUESTER_ASSERTION_MAX_TTL_SECONDS) {
         throw new OxyRequesterAssertionError('ttl_exceeded');
     }
     if (!KEY_ID_PATTERN.test(signing.keyId))
@@ -92,11 +95,11 @@ export function readOxyRequesterAssertionKeyId(token) {
         throw new OxyRequesterAssertionError('malformed');
     }
     const header = decodeObject(segments[0]);
-    if (Object.keys(header).length !== 3
-        || header.alg !== ALGORITHM
-        || header.typ !== OXY_REQUESTER_ASSERTION_TYPE
-        || typeof header.kid !== 'string'
-        || !KEY_ID_PATTERN.test(header.kid)) {
+    if (Object.keys(header).length !== 3 ||
+        header.alg !== ALGORITHM ||
+        header.typ !== OXY_REQUESTER_ASSERTION_TYPE ||
+        typeof header.kid !== 'string' ||
+        !KEY_ID_PATTERN.test(header.kid)) {
         throw new OxyRequesterAssertionError('malformed');
     }
     return header.kid;
@@ -135,7 +138,8 @@ export function verifyOxyRequesterAssertion(token, options) {
         throw new OxyRequesterAssertionError('not_yet_valid');
     if (claims.exp <= now)
         throw new OxyRequesterAssertionError('expired');
-    if (claims.exp <= claims.iat || claims.exp - claims.iat > OXY_REQUESTER_ASSERTION_MAX_TTL_SECONDS) {
+    if (claims.exp <= claims.iat ||
+        claims.exp - claims.iat > OXY_REQUESTER_ASSERTION_MAX_TTL_SECONDS) {
         throw new OxyRequesterAssertionError('ttl_exceeded');
     }
     return claims;
@@ -159,15 +163,15 @@ function parseJwks(value) {
         if (typeof entry !== 'object' || entry === null || Array.isArray(entry))
             throw new Error('JWKS key is malformed');
         const key = entry;
-        if (key.kty !== 'OKP'
-            || key.crv !== 'Ed25519'
-            || key.alg !== 'EdDSA'
-            || key.use !== 'sig'
-            || typeof key.x !== 'string'
-            || typeof key.kid !== 'string'
-            || !KEY_ID_PATTERN.test(key.kid)
-            || Object.prototype.hasOwnProperty.call(key, 'd')
-            || result.has(key.kid))
+        if (key.kty !== 'OKP' ||
+            key.crv !== 'Ed25519' ||
+            key.alg !== 'EdDSA' ||
+            key.use !== 'sig' ||
+            typeof key.x !== 'string' ||
+            typeof key.kid !== 'string' ||
+            !KEY_ID_PATTERN.test(key.kid) ||
+            Object.prototype.hasOwnProperty.call(key, 'd') ||
+            result.has(key.kid))
             throw new Error('JWKS key is unsupported');
         const x = Buffer.from(key.x, 'base64url');
         if (x.length !== 32 || x.toString('base64url') !== key.x)
@@ -243,7 +247,9 @@ function reject(req, res, options, status, error, code) {
         status,
         applicationId: req.serviceApp?.appId ?? null,
     });
-    res.status(status).json({ error, code, message: 'The requester assertion was not accepted', status });
+    res
+        .status(status)
+        .json({ error, code, message: 'The requester assertion was not accepted', status });
 }
 function singleHeader(req, name) {
     const value = req.headers[name];
@@ -267,8 +273,8 @@ export function createOxyRequesterAssertionAuth(introspector, options) {
     let resolvePublicKey = options.resolvePublicKey;
     const resolver = () => {
         resolvePublicKey ?? (resolvePublicKey = createOxyJwksKeyResolver({
-            jwksUrl: options.jwksUrl
-                ?? new URL('/capabilities/.well-known/jwks.json', introspector.baseURL).toString(),
+            jwksUrl: options.jwksUrl ??
+                new URL('/capabilities/.well-known/jwks.json', introspector.baseURL).toString(),
         }));
         return resolvePublicKey;
     };
@@ -291,9 +297,9 @@ export function createOxyRequesterAssertionAuth(introspector, options) {
         // One identity channel per request. An offline delegation header or an
         // identity some earlier middleware attached must never be combined with, or
         // silently replaced by, a present-requester assertion.
-        if (req.headers['x-oxy-user-id'] !== undefined
-            || request.serviceActingAs !== undefined
-            || (request.userId !== undefined && request.userId !== null)) {
+        if (req.headers['x-oxy-user-id'] !== undefined ||
+            request.serviceActingAs !== undefined ||
+            (request.userId !== undefined && request.userId !== null)) {
             reject(req, res, options, 400, 'REQUESTER_ASSERTION_CONFLICT', 'identity_conflict');
             return;
         }
@@ -329,12 +335,12 @@ export function createOxyRequesterAssertionAuth(introspector, options) {
             reject(req, res, options, 503, 'REQUESTER_ASSERTION_UNAVAILABLE', 'introspection_unavailable');
             return;
         }
-        if (introspection.active !== true
-            || introspection.requesterAccountId !== claims.sub
-            || introspection.agentId !== claims.agentId
-            || introspection.applicationId !== claims.azp
-            || introspection.credentialId !== claims.cid
-            || introspection.jti !== claims.jti) {
+        if (introspection.active !== true ||
+            introspection.requesterAccountId !== claims.sub ||
+            introspection.agentId !== claims.agentId ||
+            introspection.applicationId !== claims.azp ||
+            introspection.credentialId !== claims.cid ||
+            introspection.jti !== claims.jti) {
             reject(req, res, options, 401, 'REQUESTER_ASSERTION_INACTIVE', 'inactive');
             return;
         }

package/dist/esm/server/serviceTokenLifetime.js

@@ -2,8 +2,11 @@
 export const OXY_SERVICE_TOKEN_MAX_LIFETIME_SECONDS = 300;
 /** Call only after signature verification; cache checks alone confer no authority. */
 export function hasBoundedServiceTokenLifetime(claims, nowSeconds = Math.floor(Date.now() / 1000)) {
-    return typeof claims.iat === 'number' && Number.isSafeInteger(claims.iat)
-        && typeof claims.exp === 'number' && Number.isSafeInteger(claims.exp)
-        && claims.iat <= nowSeconds && claims.exp > claims.iat
-        && claims.exp - claims.iat <= OXY_SERVICE_TOKEN_MAX_LIFETIME_SECONDS;
+    return (typeof claims.iat === 'number' &&
+        Number.isSafeInteger(claims.iat) &&
+        typeof claims.exp === 'number' &&
+        Number.isSafeInteger(claims.exp) &&
+        claims.iat <= nowSeconds &&
+        claims.exp > claims.iat &&
+        claims.exp - claims.iat <= OXY_SERVICE_TOKEN_MAX_LIFETIME_SECONDS);
 }

package/dist/esm/server/traffic.js

@@ -1,5 +1,5 @@
 import { observeNodeHttp, withoutNodeHttpObservation } from './trafficNodeHttp.js';
-import { observeTrafficSocket, observeTrafficWebSocket } from '@oxy.so/telemetry/socket';
+import { observeTrafficSocket, observeTrafficWebSocket, } from '@oxy.so/telemetry/socket';
 import { randomUUID } from 'node:crypto';
 import { OxyServer } from './OxyServer.js';
 // Static, like `OxyServer`'s own import: this module is
@@ -8,7 +8,7 @@ import { OxyServer } from './OxyServer.js';
 // server-only and the server barrel already exports `./workloadIdentity`, so
 // there is nothing here for a phone to load.
 import { canAttestWorkloadIdentity } from './workloadIdentity.js';
-import { createTrafficCollector, instrumentTrafficFetch, trafficMiddleware, resolveOxyServiceEndpoint, infrastructureLocation } from '@oxy.so/telemetry/collector';
+import { createTrafficCollector, instrumentTrafficFetch, trafficMiddleware, resolveOxyServiceEndpoint, infrastructureLocation, } from '@oxy.so/telemetry/collector';
 /** Install once per service process, before registering HTTP routes. */
 export function createEcosystemTraffic(options) {
     const region = options.region ?? process.env.AWS_REGION ?? 'unknown';
@@ -55,13 +55,15 @@ export function createEcosystemTraffic(options) {
     const post = async (path, data) => {
         const token = await credential();
         const response = await fetcher(new URL(path, baseURL), {
-            method: 'POST', headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
-            body: JSON.stringify(data), signal: AbortSignal.timeout(4000),
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
+            body: JSON.stringify(data),
+            signal: AbortSignal.timeout(4000),
         });
         if (!response.ok)
             throw new Error('Activity collection failed');
     };
-    const collector = createTrafficCollector(events => post('/internal/activity', events));
+    const collector = createTrafficCollector((events) => post('/internal/activity', events));
     let stopped = false;
     let heartbeatWork = Promise.resolve();
     let heartbeatPending = false;
@@ -70,7 +72,19 @@ export function createEcosystemTraffic(options) {
         if (!removed && (stopped || heartbeatPending))
             return heartbeatWork;
         heartbeatPending = true;
-        heartbeatWork = heartbeatWork.then(() => post('/internal/activity/infrastructure', { instanceId, service: options.service, region, ...location, status: options.ready?.() ? 'online' : 'unknown', removed })).catch(reportError).finally(() => { heartbeatPending = false; });
+        heartbeatWork = heartbeatWork
+            .then(() => post('/internal/activity/infrastructure', {
+            instanceId,
+            service: options.service,
+            region,
+            ...location,
+            status: options.ready?.() ? 'online' : 'unknown',
+            removed,
+        }))
+            .catch(reportError)
+            .finally(() => {
+            heartbeatPending = false;
+        });
         return heartbeatWork;
     };
     const flush = () => collector.flush().catch(reportError);
@@ -82,13 +96,17 @@ export function createEcosystemTraffic(options) {
         return Object.assign((...args) => withoutNodeHttpObservation(() => wrapped(...args)), fetcher);
     };
     const observeHttp = trafficMiddleware(collector, options.service, region);
-    const timer = setInterval(() => { void flush(); }, 2000);
+    const timer = setInterval(() => {
+        void flush();
+    }, 2000);
     timer.unref?.();
     void heartbeat();
-    const heartbeatTimer = setInterval(() => { void heartbeat(); }, 10000);
+    const heartbeatTimer = setInterval(() => {
+        void heartbeat();
+    }, 10000);
     heartbeatTimer.unref?.();
     return {
-        record: flow => collector.record({ ...flow, service: options.service, region }),
+        record: (flow) => collector.record({ ...flow, service: options.service, region }),
         middleware: observeHttp,
         observeHttp,
         wrapFetch,
@@ -99,8 +117,10 @@ export function createEcosystemTraffic(options) {
             const original = globalThis.fetch;
             const wrapped = wrapFetch(original);
             globalThis.fetch = wrapped;
-            cleanups.add(() => { if (globalThis.fetch === wrapped)
-                globalThis.fetch = original; });
+            cleanups.add(() => {
+                if (globalThis.fetch === wrapped)
+                    globalThis.fetch = original;
+            });
             cleanups.add(observeNodeHttp(collector, options.service, region, options.resolveEndpoint ?? resolveOxyServiceEndpoint));
         },
         observeWebSocket(socket, socketOptions) {
@@ -108,7 +128,12 @@ export function createEcosystemTraffic(options) {
             if (existing)
                 return existing;
             const unobserve = observeTrafficWebSocket(socket, collector, options.service, region, socketOptions);
-            const cleanup = () => { unobserve(); socket.off('close', cleanup); cleanups.delete(cleanup); sockets.delete(socket); };
+            const cleanup = () => {
+                unobserve();
+                socket.off('close', cleanup);
+                cleanups.delete(cleanup);
+                sockets.delete(socket);
+            };
             sockets.set(socket, cleanup);
             socket.once('close', cleanup);
             cleanups.add(cleanup);
@@ -119,14 +144,28 @@ export function createEcosystemTraffic(options) {
             if (existing)
                 return existing;
             const unobserve = observeTrafficSocket(socket, collector, options.service, region, socketOptions);
-            const cleanup = () => { unobserve(); socket.off('disconnect', cleanup); cleanups.delete(cleanup); sockets.delete(socket); };
+            const cleanup = () => {
+                unobserve();
+                socket.off('disconnect', cleanup);
+                cleanups.delete(cleanup);
+                sockets.delete(socket);
+            };
             sockets.set(socket, cleanup);
             socket.once('disconnect', cleanup);
             cleanups.add(cleanup);
             return cleanup;
         },
-        async stop() { if (stopped)
-            return; stopped = true; for (const cleanup of cleanups)
-            cleanup(); cleanups.clear(); clearInterval(timer); clearInterval(heartbeatTimer); await flush(); await heartbeat(true); },
+        async stop() {
+            if (stopped)
+                return;
+            stopped = true;
+            for (const cleanup of cleanups)
+                cleanup();
+            cleanups.clear();
+            clearInterval(timer);
+            clearInterval(heartbeatTimer);
+            await flush();
+            await heartbeat(true);
+        },
     };
 }