@oxy.so/core 4.5.0-oxy-one.0 → 4.5.0

package/dist/types/index.d.ts

@@ -24,13 +24,13 @@ export { OxyServices, OXY_API_URL, OXY_CLOUD_URL } from './OxyServices';
 export type { OxyConfig, LinkedHttpClient } from './OxyServices';
 export { OxyApiError, OxyAuthenticationError, OxyAuthenticationTimeoutError, AssetUrlResolutionError, ServiceAssetMetadataError, } from './OxyServices.errors';
 export type { HttpMethod } from './client/context';
-export type { RequestOptions, ResponseRequest, ResponseTransport, AuthenticatedResponseRequest, AuthRefreshReason, AuthRefreshHandler } from './HttpService';
+export type { RequestOptions, ResponseRequest, ResponseTransport, AuthenticatedResponseRequest, AuthRefreshReason, AuthRefreshHandler, } from './HttpService';
 export type { SessionApi, DeviceCredentialProvider, SessionValidation } from './api/session';
 export type { AuthApi, ChallengeResponse, RegistrationRequest, ChallengeVerifyRequest, PublicKeyCheckResponse, OAuthUserInfoResponse, OAuthTokenExchangeResult, CommonsSignInHandle, CommonsSignInStatus, CommonsSignInPurpose, CommonsOAuthContext, CommonsApprovalInfo, CommonsApprovalSubjectAccount, CommonsSignInActionResult, CommonsOAuthFinalizeResult, CommonsDeliveryResult, SignInDeviceOptions, ClaimedSession, } from './api/auth';
 export type { UsersApi, ResolveExternalUserInput, DeleteAccountProof } from './api/users';
 export type { FollowsApi, FollowMutationResult, BulkFollowEntry, BulkFollowResult, BulkUnfollowEntry, BulkUnfollowResult, ViewerGraph, EnsureFollowTargetInput, RegisterFollowKindInput, } from './api/follows';
 export type { PrivacyApi } from './api/privacy';
-export type { NotificationsApi, PushTokenPlatform, RegisterPushTokenInput } from './api/notifications';
+export type { NotificationsApi, PushTokenPlatform, RegisterPushTokenInput, } from './api/notifications';
 export { assetUrlCacheTTL } from './api/assets';
 export type { AssetsApi, AssetRecord, UploadedAsset, AssetLinkState, AssetUploadOptions, AssetLinkTarget, AssetDeleteResult, } from './api/assets';
 export { buildUserDid } from './api/identity';
@@ -45,7 +45,7 @@ export type { BillingApi, SubscriptionPlan, SubscriptionStatus, SubscriptionFeat
 export { REPUTATION_CACHE_PREFIX } from './api/reputation';
 export type { ReputationApi, ReputationPage } from './api/reputation';
 export type { CivicApi, CivicCardResult, SubmitRealLifeAttestationInput, DenyValidationResult, VouchForPersonInput, WithdrawVouchResult, IssueCredentialInput, RevokeCredentialResult, } from './api/civic';
-export type { NodesApi, UserNodeStatus, UserNodeMode, UserNodeController, UserNodeLivenessStatus, RegisterNodeInput, RemoveNodeResult } from './api/nodes';
+export type { NodesApi, UserNodeStatus, UserNodeMode, UserNodeController, UserNodeLivenessStatus, RegisterNodeInput, RemoveNodeResult, } from './api/nodes';
 export { AccountNotOnDeviceError } from './api/devices';
 export type { DevicesApi, UserDevice, SecurityInfo } from './api/devices';
 export type { TopicsApi, TopicListOptions } from './api/topics';
@@ -53,7 +53,7 @@ export { OxyAppDataIdentifierError } from './api/appData';
 export type { AppDataApi } from './api/appData';
 export type { ContactsApi, ContactDiscoveryMatch, ContactDiscoveryResponse } from './api/contacts';
 export { getCommonsApprovalBlockingReason, parseCommonsApprovalExpiresAt, } from './utils/commonsApproval';
-export { selectCommonsDelivery, pushTargetsFromDelivery, commonsDeliveryPlatform } from './utils/commonsDelivery';
+export { selectCommonsDelivery, pushTargetsFromDelivery, commonsDeliveryPlatform, } from './utils/commonsDelivery';
 export type { CommonsDeliveryFacts, CommonsDeliveryPlatform, CommonsDeliveryRoute, } from './utils/commonsDelivery';
 export { getNormalizedUserId, normalizeUserIdentity, normalizeUserIdentityOrNull, } from './utils/userIdentity';
 export { getCanonicalUserHandle, getNormalizedUserHandle, } from './utils/userHandle';

package/dist/types/server/index.d.ts

@@ -14,7 +14,7 @@
  * app.use('/api', createOxyAuthMiddleware(oxy));
  * ```
  */
-export { OxyServer, ServiceCredentialMismatchError, ANONYMOUS_SERVICE_TOKEN_RETRY_MS } from './OxyServer';
+export { OxyServer, ServiceCredentialMismatchError, ANONYMOUS_SERVICE_TOKEN_RETRY_MS, } from './OxyServer';
 export type { OxyServerConfig, ServiceTokenResponse } from './OxyServer';
 export { ServerAppsApi, ServerAgencyApi, ServerAssetsApi, ServerLinkedAccountsApi, ServerNotificationsApi, ServerReputationApi, } from './namespaces';
 export { createOxyAliaMachineCredentialAuth, getOxyAliaMachineCredentialBearer, isOxyAliaMachinePrincipal, OXY_ALIA_RESOURCE_APPLICATION_ID, OXY_ALIA_MACHINE_SCOPES, } from './aliaMachineCredential';
@@ -42,10 +42,10 @@ export { createLiveCapabilityTicketVerifier } from './liveCapabilityTicket';
 export type { LiveCapabilityTicketVerifierOptions } from './liveCapabilityTicket';
 export { createOxyUserInvalidationHandler, publishOxyUserInvalidation, } from './userInvalidation';
 export type { OxyInvalidationPublisher, OxyUserInvalidationHandlerOptions, } from './userInvalidation';
-export { evictOxyIdentityCache, oxyUserByIdCacheKey, OXY_IDENTITY_CACHE_PREFIXES } from '../utils/identityCacheSweep';
+export { evictOxyIdentityCache, oxyUserByIdCacheKey, OXY_IDENTITY_CACHE_PREFIXES, } from '../utils/identityCacheSweep';
 export type { OxyIdentityCacheEvictor } from '../utils/identityCacheSweep';
 export { registrableApex } from '../utils/registrableApex';
-export { isLoopbackOrigin, isOfficialWebOrigin, isAllowedDeviceJoinOrigin } from '../utils/officialOrigins';
+export { isLoopbackOrigin, isOfficialWebOrigin, isAllowedDeviceJoinOrigin, } from '../utils/officialOrigins';
 export { createEcosystemTraffic } from './traffic';
 export type { EcosystemTrafficOptions } from './traffic';
 export { observeNodeHttp, withoutNodeHttpObservation } from './trafficNodeHttp';
@@ -55,8 +55,8 @@ export { observeNodeHttp, withoutNodeHttpObservation } from './trafficNodeHttp';
  * exported from this subpath rather than the root barrel because it reaches the
  * container credentials endpoint.
  */
-export { canAttestWorkloadIdentity, requestWorkloadServiceToken } from './workloadIdentity';
-export type { WorkloadServiceToken, WorkloadServiceTokenOptions } from './workloadIdentity';
-export { OXY_SERVICE_TOKEN_MAX_LIFETIME_SECONDS, hasBoundedServiceTokenLifetime } from './serviceTokenLifetime';
+export { attestWorkloadIdentity, canAttestWorkloadIdentity, requestWorkloadServiceToken, } from './workloadIdentity';
+export type { WorkloadAttestation, WorkloadServiceToken, WorkloadServiceTokenOptions, } from './workloadIdentity';
+export { OXY_SERVICE_TOKEN_MAX_LIFETIME_SECONDS, hasBoundedServiceTokenLifetime, } from './serviceTokenLifetime';
 export { signInAgentAccount } from './agentAccount';
 export type { AgentAccountSigner } from './agentAccount';

package/dist/types/server/requesterAssertion.d.ts

@@ -36,8 +36,8 @@ export declare const oxyRequesterAssertionClaimsSchema: z.ZodObject<{
     /** The one native agent this requester may reach with it. */
     agentId: z.ZodString;
 }, "strict", z.ZodTypeAny, {
-    sub: string;
     exp: number;
+    sub: string;
     aud: string;
     iss: string;
     jti: string;
@@ -46,8 +46,8 @@ export declare const oxyRequesterAssertionClaimsSchema: z.ZodObject<{
     cid: string;
     agentId: string;
 }, {
-    sub: string;
     exp: number;
+    sub: string;
     aud: string;
     iss: string;
     jti: string;

package/dist/types/server/workloadIdentity.client.d.ts

@@ -1,4 +1,8 @@
-import type { WorkloadServiceToken, WorkloadServiceTokenOptions } from './workloadIdentity';
+import type { WorkloadAttestation, WorkloadServiceToken, WorkloadServiceTokenOptions } from './workloadIdentity';
 /** Workload attestation belongs to a Node host, never a browser or device. */
 export declare function canAttestWorkloadIdentity(): boolean;
 export declare function requestWorkloadServiceToken(_options: WorkloadServiceTokenOptions): Promise<WorkloadServiceToken>;
+export declare function attestWorkloadIdentity(_options: {
+    nonce: string;
+    fetch?: typeof fetch;
+}): Promise<WorkloadAttestation>;

package/dist/types/server/workloadIdentity.d.ts

@@ -18,6 +18,32 @@ export interface WorkloadServiceToken {
  * checkout has no attestation to offer and must fall back to a credential.
  */
 export declare function canAttestWorkloadIdentity(env?: NodeJS.ProcessEnv): boolean;
+/** A proof of this process's identity, exactly as `POST /auth/service-token/workload` takes it. */
+export interface WorkloadAttestation {
+    provider: 'aws-iam';
+    attestation: {
+        headers: Record<string, string>;
+    };
+}
+/**
+ * Signs this process's identity proof over a nonce the CALLER chose, and sends
+ * it nowhere.
+ *
+ * {@link requestWorkloadServiceToken} is the ordinary consumer: Oxy issues the
+ * nonce and replays the proof. This exists for the one host that is its own
+ * verifier — Oxy's API acting as an application it hosts (Inbox) needs to learn
+ * which role it runs as, and the honest way to learn that is the way it learns
+ * anyone else's: sign `GetCallerIdentity` and let STS say whose signature it is.
+ * Reading a role name out of configuration would be the process's own word for
+ * what it is, which is what ADR 0026 refuses from every other caller.
+ *
+ * The same signer, so the two can never disagree about the shape the verifier
+ * accepts. Throws exactly as the token path does when there is no identity here.
+ */
+export declare function attestWorkloadIdentity(options: {
+    nonce: string;
+    fetch?: typeof fetch;
+}): Promise<WorkloadAttestation>;
 /**
  * Exchanges this process's identity for an Oxy service token.
  *

package/dist/types/session/accountDelegationAccess.d.ts

@@ -13,7 +13,7 @@
  * (or the structural subset below), so the SDK and every agent runtime read the
  * API's already-resolved relationship and effective permissions identically.
  */
-import type { AccountKind, AccountMember, AccountRelationship } from "../api/accounts";
+import type { AccountKind, AccountMember, AccountRelationship } from '../api/accounts';
 export interface AccountDelegationAccess {
     /** The caller owns the account or has a live membership in it. */
     readonly hasStanding: boolean;

package/dist/types/session/index.d.ts

@@ -10,7 +10,7 @@ import '../crypto/polyfill';
 export { DeviceManager } from '../utils/deviceManager';
 export type { DeviceFingerprint, StoredDeviceInfo } from '../utils/deviceManager';
 export { SessionClient } from './SessionClient';
-export type { TokenTransport, SessionClientHost, SessionClientOptions, DeviceCredential, SessionStateOrigin } from './SessionClient';
+export type { TokenTransport, SessionClientHost, SessionClientOptions, DeviceCredential, SessionStateOrigin, } from './SessionClient';
 export type { SocketIOFactory, MinimalSocket } from './socketLoader';
 export { createSessionClientHost } from './sessionClientHost';
 export { createSessionClient } from './createSessionClient';

package/dist/types/utils/userIdentity.d.ts

@@ -4,7 +4,7 @@ interface UserIdentityInput {
 }
 /**
  * Returns the stable SDK user id from API payloads that may use either `id` or
- * Mongo-style `_id`.
+ * a raw `_id`.
  */
 export declare function getNormalizedUserId(user: UserIdentityInput | null | undefined): string | null;
 /**

package/dist/types/utils/validationUtils.d.ts

@@ -65,10 +65,10 @@ export declare function isValidPassword(password: string): boolean;
  * — script digits (`٠١٢`, `०१२`), 1082 symbols (`֍ ۞ ৳`), 180 punctuation marks
  * (`։ ، ؛ ।`), and 9 INVISIBLE format/control characters, among them U+061C
  * ARABIC LETTER MARK (a bidi control that can visually reorder a name) and
- * U+180E MONGOLIAN VOWEL SEPARATOR. Without it the rejections listed above held
+ * U+180E (the Mong-script vowel separator). Without it the rejections listed above held
  * for ASCII input only. It is the set of scripts Unicode UTS #39 marks
  * "Recommended" for general interchange / identifiers, plus Cherokee and
- * Mongolian (both in real modern name use). "Common" script is deliberately
+ * the Mong script, ISO 15924 (both in real modern name use). "Common" script is deliberately
  * EXCLUDED — that is where ASCII digits and general punctuation live, and this
  * policy excludes those; the space separators, combining marks, and apostrophe a
  * name needs are added back explicitly. Limited-use / excluded / historic
@@ -257,9 +257,8 @@ export declare function sanitizeString(input: string): string;
  */
 export declare function sanitizeHTML(input: string): string;
 /**
- * Validate MongoDB ObjectId format
- * Note: This is a basic format check. For full validation, use mongoose.Types.ObjectId.isValid()
- * This function works in environments where mongoose may not be available (e.g., client-side)
+ * Validate the legacy 24-hex id format (a format check only; it does not
+ * prove the id exists).
  */
 export declare function isValidObjectId(id: string): boolean;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxy.so/core",
-  "version": "4.5.0-oxy-one.0",
+  "version": "4.5.0",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -179,7 +179,7 @@
     "@oxy.so/telemetry": "^1.2.0",
     "@noble/ciphers": "^1.3.0",
     "@noble/hashes": "^1.8.0",
-    "@oxy.so/contracts": "4.11.0-oxy-one.0",
+    "@oxy.so/contracts": "4.12.0",
     "@oxy.so/protocol": "^1.2.2",
     "@scure/bip39": "^1.6.0",
     "buffer": "^6.0.3",
@@ -212,7 +212,6 @@
     }
   },
   "devDependencies": {
-    "@biomejs/biome": "^1.9.4",
     "@react-native-async-storage/async-storage": "^2.2.0",
     "@types/express": "^4.17.25",
     "@types/invariant": "^2.2.34",