@oxy.so/core 4.5.0-oxy-one.1 → 4.5.0

package/dist/cjs/inference/OxyInferenceClient.js

@@ -205,9 +205,7 @@ class OxyInferenceClient {
         return __classPrivateFieldGet(this, _OxyInferenceClient_instances, "m", _OxyInferenceClient_request).call(this, 'POST', '/v1/responses', {
             body: request,
             ...(options.signal === undefined ? {} : { signal: options.signal }),
-            ...(options.idempotencyKey === undefined
-                ? {}
-                : { idempotencyKey: options.idempotencyKey }),
+            ...(options.idempotencyKey === undefined ? {} : { idempotencyKey: options.idempotencyKey }),
             ...(options.delegatedUserId === undefined
                 ? {}
                 : { delegatedUserId: options.delegatedUserId }),
@@ -224,7 +222,8 @@ class OxyInferenceClient {
             delegatedUserId: options.delegatedUserId,
         });
         const parsed = contracts_1.decisionSuccessSchema.safeParse(payload);
-        if (!parsed.success || parsed.data.model !== input.model ||
+        if (!parsed.success ||
+            parsed.data.model !== input.model ||
             !(0, contracts_1.decisionAnswersMatch)(input, parsed.data.data)) {
             throw new OxyInferenceProtocolError('Invalid or mismatched decisions response.');
         }
@@ -236,9 +235,7 @@ class OxyInferenceClient {
             method: 'POST',
             headers: await __classPrivateFieldGet(this, _OxyInferenceClient_instances, "m", _OxyInferenceClient_headers).call(this, 'audio/*', {
                 hasBody: true,
-                ...(options.idempotencyKey === undefined
-                    ? {}
-                    : { idempotencyKey: options.idempotencyKey }),
+                ...(options.idempotencyKey === undefined ? {} : { idempotencyKey: options.idempotencyKey }),
                 ...(options.delegatedUserId === undefined
                     ? {}
                     : { delegatedUserId: options.delegatedUserId }),
@@ -310,9 +307,7 @@ class OxyInferenceClient {
             method: 'POST',
             headers: await __classPrivateFieldGet(this, _OxyInferenceClient_instances, "m", _OxyInferenceClient_headers).call(this, 'text/event-stream', {
                 hasBody: true,
-                ...(options.idempotencyKey === undefined
-                    ? {}
-                    : { idempotencyKey: options.idempotencyKey }),
+                ...(options.idempotencyKey === undefined ? {} : { idempotencyKey: options.idempotencyKey }),
                 ...(options.delegatedUserId === undefined
                     ? {}
                     : { delegatedUserId: options.delegatedUserId }),
@@ -411,9 +406,7 @@ exports.OxyInferenceClient = OxyInferenceClient;
 _OxyInferenceClient_baseURL = new WeakMap(), _OxyInferenceClient_credential = new WeakMap(), _OxyInferenceClient_fetch = new WeakMap(), _OxyInferenceClient_instances = new WeakSet(), _OxyInferenceClient_bearer = 
 /** The bearer for this request, from whichever lane was configured. */
 async function _OxyInferenceClient_bearer() {
-    const value = typeof __classPrivateFieldGet(this, _OxyInferenceClient_credential, "f") === 'string'
-        ? __classPrivateFieldGet(this, _OxyInferenceClient_credential, "f")
-        : await __classPrivateFieldGet(this, _OxyInferenceClient_credential, "f").call(this);
+    const value = typeof __classPrivateFieldGet(this, _OxyInferenceClient_credential, "f") === 'string' ? __classPrivateFieldGet(this, _OxyInferenceClient_credential, "f") : await __classPrivateFieldGet(this, _OxyInferenceClient_credential, "f").call(this);
     if (value === null || value === undefined || value.length === 0) {
         throw new Error('OxyInferenceClient has no bearer: the configured credential resolved to nothing. On the Oxy auth lane this usually means the session is not restored yet.');
     }
@@ -451,9 +444,7 @@ async function _OxyInferenceClient_request(method, path, options) {
         method,
         headers: await __classPrivateFieldGet(this, _OxyInferenceClient_instances, "m", _OxyInferenceClient_headers).call(this, 'application/json', {
             hasBody: options.body !== undefined,
-            ...(options.idempotencyKey === undefined
-                ? {}
-                : { idempotencyKey: options.idempotencyKey }),
+            ...(options.idempotencyKey === undefined ? {} : { idempotencyKey: options.idempotencyKey }),
             ...(options.delegatedUserId === undefined
                 ? {}
                 : { delegatedUserId: options.delegatedUserId }),
@@ -467,8 +458,11 @@ async function _OxyInferenceClient_request(method, path, options) {
     }
     if (options.bindRequestId) {
         const requestId = response.headers.get('X-Oxy-Request-Id');
-        if (!requestId || typeof payload !== 'object' || payload === null ||
-            !('requestId' in payload) || payload.requestId !== requestId) {
+        if (!requestId ||
+            typeof payload !== 'object' ||
+            payload === null ||
+            !('requestId' in payload) ||
+            payload.requestId !== requestId) {
             throw new OxyInferenceProtocolError('Decisions response request ID does not match its header.', requestId ?? undefined);
         }
     }

package/dist/cjs/models/interfaces.js

@@ -6,15 +6,15 @@ exports.SECURITY_EVENT_SEVERITY_MAP = void 0;
  * Maps each event type to its default severity level
  */
 exports.SECURITY_EVENT_SEVERITY_MAP = {
-    'sign_in': 'low',
-    'sign_out': 'low',
-    'profile_updated': 'low',
-    'email_changed': 'medium',
-    'device_added': 'medium',
-    'device_removed': 'medium',
-    'security_settings_changed': 'medium',
-    'account_recovery': 'high',
-    'private_key_exported': 'high',
-    'backup_created': 'high',
-    'suspicious_activity': 'critical',
+    sign_in: 'low',
+    sign_out: 'low',
+    profile_updated: 'low',
+    email_changed: 'medium',
+    device_added: 'medium',
+    device_removed: 'medium',
+    security_settings_changed: 'medium',
+    account_recovery: 'high',
+    private_key_exported: 'high',
+    backup_created: 'high',
+    suspicious_activity: 'critical',
 };

package/dist/cjs/server/OxyServer.js

@@ -35,8 +35,9 @@ const serviceTokenLifetime_1 = require("./serviceTokenLifetime");
 function reusableServiceToken(token) {
     try {
         const claims = (0, jwt_decode_1.jwtDecode)(token);
-        return (0, serviceTokenLifetime_1.hasBoundedServiceTokenLifetime)(claims) && typeof claims.exp === 'number'
-            && claims.exp > Math.floor(Date.now() / 1000);
+        return ((0, serviceTokenLifetime_1.hasBoundedServiceTokenLifetime)(claims) &&
+            typeof claims.exp === 'number' &&
+            claims.exp > Math.floor(Date.now() / 1000));
     }
     catch {
         return false;
@@ -84,7 +85,11 @@ class OxyServer extends OxyServices_1.OxyServices {
         this.actingAsPending = new Map();
         this.actingAsGenerations = new Map();
         /** Public keys only; never private material. */
-        this.jwksCache = { keys: new Map(), expiresAt: 0, lastAttemptAt: 0 };
+        this.jwksCache = {
+            keys: new Map(),
+            expiresAt: 0,
+            lastAttemptAt: 0,
+        };
         /**
          * Before this instant a request without a user session does not try to mint
          * a service token and goes out anonymous. Set after a failed mint.
@@ -228,7 +233,9 @@ class OxyServer extends OxyServices_1.OxyServices {
                 });
                 throw new ServiceCredentialMismatchError();
             }
-            if (entry.token && reusableServiceToken(entry.token) && entry.expiresAt > now + TOKEN_REUSE_MARGIN_MS) {
+            if (entry.token &&
+                reusableServiceToken(entry.token) &&
+                entry.expiresAt > now + TOKEN_REUSE_MARGIN_MS) {
                 return entry.token;
             }
             if (entry.pending) {
@@ -287,7 +294,8 @@ class OxyServer extends OxyServices_1.OxyServices {
             throw new Error('A user session is required');
         const answer = await this.request('GET', `/v1/products/${encodeURIComponent(parsed.productId)}/access/${encodeURIComponent(parsed.subjectAccountId)}/grants`, undefined, { cache: false, retry: false, headers: { Authorization: `Bearer ${accessToken}` } });
         const snapshot = contracts_1.subjectProductGrantSnapshotSchema.parse(answer);
-        if (snapshot.access.subjectAccountId !== parsed.subjectAccountId || snapshot.access.productId !== parsed.productId)
+        if (snapshot.access.subjectAccountId !== parsed.subjectAccountId ||
+            snapshot.access.productId !== parsed.productId)
             throw new Error('Product grant response attribution differs');
         return snapshot;
     }
@@ -296,7 +304,8 @@ class OxyServer extends OxyServices_1.OxyServices {
         const parsed = contracts_1.subjectProductAccessQuerySchema.parse(query);
         const answer = await this.serviceRequest('GET', `/v1/products/${encodeURIComponent(parsed.productId)}/access/${encodeURIComponent(parsed.subjectAccountId)}/service-grants`, undefined, { cache: false, retry: false });
         const snapshot = contracts_1.subjectProductGrantSnapshotSchema.parse(answer);
-        if (snapshot.access.subjectAccountId !== parsed.subjectAccountId || snapshot.access.productId !== parsed.productId)
+        if (snapshot.access.subjectAccountId !== parsed.subjectAccountId ||
+            snapshot.access.productId !== parsed.productId)
             throw new Error('Product grant response attribution differs');
         return snapshot;
     }
@@ -318,7 +327,13 @@ class OxyServer extends OxyServices_1.OxyServices {
      */
     async verifyActingAs(appId, userId, options = {}) {
         const pair = JSON.stringify([appId, userId]);
-        const cacheKey = JSON.stringify([appId, userId, options.credentialId, options.ownerAccountId, options.environment]);
+        const cacheKey = JSON.stringify([
+            appId,
+            userId,
+            options.credentialId,
+            options.ownerAccountId,
+            options.environment,
+        ]);
         if (options.cache === true) {
             const cached = this.actingAs.get(cacheKey);
             if (cached && cached.expiresAt > Date.now()) {
@@ -401,18 +416,32 @@ class OxyServer extends OxyServices_1.OxyServices {
             entry.secretBuf = secretBuf;
         }
         else {
-            this.serviceTokens.set(cacheKey, { token: response.token, expiresAt, secretBuf, pending: null, apiKey: key });
+            this.serviceTokens.set(cacheKey, {
+                token: response.token,
+                expiresAt,
+                secretBuf,
+                pending: null,
+                apiKey: key,
+            });
         }
         return response.token;
     }
     /** A token obtained by attestation, cached like a credential's (one identity per process). */
     async workloadServiceToken() {
         const entry = this.serviceTokens.get(WORKLOAD_CACHE_KEY);
-        if (entry?.token && reusableServiceToken(entry.token) && entry.expiresAt > Date.now() + TOKEN_REUSE_MARGIN_MS)
+        if (entry?.token &&
+            reusableServiceToken(entry.token) &&
+            entry.expiresAt > Date.now() + TOKEN_REUSE_MARGIN_MS)
             return entry.token;
         if (entry?.pending)
             return entry.pending;
-        const seeded = entry ?? { token: '', expiresAt: 0, secretBuf: Buffer.alloc(0), pending: null, apiKey: WORKLOAD_CACHE_KEY };
+        const seeded = entry ?? {
+            token: '',
+            expiresAt: 0,
+            secretBuf: Buffer.alloc(0),
+            pending: null,
+            apiKey: WORKLOAD_CACHE_KEY,
+        };
         this.serviceTokens.set(WORKLOAD_CACHE_KEY, seeded);
         const pending = (async () => {
             const granted = await (0, workloadIdentity_1.requestWorkloadServiceToken)({ baseUrl: this.baseURL });
@@ -442,8 +471,22 @@ class OxyServer extends OxyServices_1.OxyServices {
     async lookupActingAs(appId, userId, options, pair, cacheKey, generation, serial, startedAt) {
         try {
             const serviceToken = await this.serviceToken();
-            const result = await this.request('GET', '/internal/service-acting-as/verify', { appId, userId, ...(options.credentialId ? { credentialId: options.credentialId,
-                    ownerAccountId: options.ownerAccountId, environment: options.environment } : {}) }, { cache: false, retry: false, timeout: 5000, headers: { Authorization: `Bearer ${serviceToken}` } });
+            const result = await this.request('GET', '/internal/service-acting-as/verify', {
+                appId,
+                userId,
+                ...(options.credentialId
+                    ? {
+                        credentialId: options.credentialId,
+                        ownerAccountId: options.ownerAccountId,
+                        environment: options.environment,
+                    }
+                    : {}),
+            }, {
+                cache: false,
+                retry: false,
+                timeout: 5000,
+                headers: { Authorization: `Bearer ${serviceToken}` },
+            });
             // A deadline bounds how long an already old response can authorize. It
             // is not by itself a measurement of end-to-end revocation latency.
             if (this.actingAsGenerations.get(pair) !== generation || serial < generation.completed)
@@ -458,10 +501,11 @@ class OxyServer extends OxyServices_1.OxyServices {
             const epoch = BigInt(rawEpoch);
             if (epoch > 9223372036854775807n)
                 return null;
-            if (typeof result.authorized !== 'boolean' || !Array.isArray(result.scopes)
-                || !result.scopes.every((scope) => typeof scope === 'string' && scope.length > 0 && scope.trim() === scope)
-                || new Set(result.scopes).size !== result.scopes.length
-                || (!result.authorized && result.scopes.length !== 0))
+            if (typeof result.authorized !== 'boolean' ||
+                !Array.isArray(result.scopes) ||
+                !result.scopes.every((scope) => typeof scope === 'string' && scope.length > 0 && scope.trim() === scope) ||
+                new Set(result.scopes).size !== result.scopes.length ||
+                (!result.authorized && result.scopes.length !== 0))
                 return null;
             const older = epoch < generation.epoch;
             if (epoch > generation.epoch)
@@ -469,7 +513,8 @@ class OxyServer extends OxyServices_1.OxyServices {
             if (result.authorized && older)
                 return null;
             const verified = result.authorized === true
-                ? { authorized: true, scopes: result.scopes, epoch: rawEpoch } : null;
+                ? { authorized: true, scopes: result.scopes, epoch: rawEpoch }
+                : null;
             if (options.cache === true)
                 this.rememberActingAs(cacheKey, verified, startedAt + (verified ? ACTING_AS_GRANT_TTL_MS : ACTING_AS_DENIAL_TTL_MS));
             return verified;
@@ -480,7 +525,10 @@ class OxyServer extends OxyServices_1.OxyServices {
                 this.clearActingAsPair(appId, userId);
             }
             logger_1.logger.warn('[oxy.auth] verifyActingAs lookup failed — not cached', {
-                component: 'auth', method: 'verifyActingAs', appId, userId,
+                component: 'auth',
+                method: 'verifyActingAs',
+                appId,
+                userId,
             }, error);
             return null;
         }
@@ -519,11 +567,11 @@ class OxyServer extends OxyServices_1.OxyServices {
         catch {
             throw new middleware_1.OxyAccountEventError('Account event token is malformed');
         }
-        if (Object.keys(header).length !== 3
-            || header.alg !== 'EdDSA'
-            || header.typ !== 'secevent+jwt'
-            || typeof header.kid !== 'string'
-            || !/^[A-Za-z0-9._-]{1,128}$/.test(header.kid)) {
+        if (Object.keys(header).length !== 3 ||
+            header.alg !== 'EdDSA' ||
+            header.typ !== 'secevent+jwt' ||
+            typeof header.kid !== 'string' ||
+            !/^[A-Za-z0-9._-]{1,128}$/.test(header.kid)) {
             throw new middleware_1.OxyAccountEventError('Account event token header is not supported');
         }
         const nodeCrypto = await (0, protocol_1.loadNodeCrypto)();
@@ -532,7 +580,9 @@ class OxyServer extends OxyServices_1.OxyServices {
             jwk = await (0, middleware_1.resolveServiceTokenPublicKey)(header.kid, options.jwksUrl ?? new URL('/.well-known/jwks.json', this.baseURL).toString(), this.jwksCache);
         }
         catch (error) {
-            throw new middleware_1.OxyAccountEventError(error instanceof Error ? error.message.replace('Service token', 'Account event') : 'Signing key is unavailable');
+            throw new middleware_1.OxyAccountEventError(error instanceof Error
+                ? error.message.replace('Service token', 'Account event')
+                : 'Signing key is unavailable');
         }
         const signature = Buffer.from(signatureB64, 'base64url');
         if (signature.toString('base64url') !== signatureB64 || signature.length !== 64) {
@@ -540,7 +590,10 @@ class OxyServer extends OxyServices_1.OxyServices {
         }
         let verified = false;
         try {
-            const publicKey = nodeCrypto.createPublicKey({ key: jwk, format: 'jwk' });
+            const publicKey = nodeCrypto.createPublicKey({
+                key: jwk,
+                format: 'jwk',
+            });
             verified = nodeCrypto.verify(null, Buffer.from(`${headerB64}.${payloadB64}`), publicKey, signature);
         }
         catch {
@@ -551,7 +604,7 @@ class OxyServer extends OxyServices_1.OxyServices {
         if (payload.iss !== middleware_1.OXY_JWT_ISSUER) {
             throw new middleware_1.OxyAccountEventError('Account event token issuer is not Oxy');
         }
-        const audience = options.audience ?? await this.configuredServiceAppId();
+        const audience = options.audience ?? (await this.configuredServiceAppId());
         if (typeof payload.aud !== 'string' || payload.aud !== audience) {
             throw new middleware_1.OxyAccountEventError('Account event token is addressed to another application');
         }
@@ -567,7 +620,10 @@ class OxyServer extends OxyServices_1.OxyServices {
         }
         const entries = Object.entries(events);
         const deleted = events[middleware_1.OXY_ACCOUNT_DELETED_EVENT_URI];
-        if (entries.length !== 1 || typeof deleted !== 'object' || deleted === null || Array.isArray(deleted)) {
+        if (entries.length !== 1 ||
+            typeof deleted !== 'object' ||
+            deleted === null ||
+            Array.isArray(deleted)) {
             throw new middleware_1.OxyAccountEventError('Account event token carries an unknown event');
         }
         const body = deleted;
@@ -577,7 +633,9 @@ class OxyServer extends OxyServices_1.OxyServices {
         if (typeof body.occurredAt !== 'string' || Number.isNaN(Date.parse(body.occurredAt))) {
             throw new middleware_1.OxyAccountEventError('Account event has no occurrence time');
         }
-        if (body.username !== undefined && body.username !== null && typeof body.username !== 'string') {
+        if (body.username !== undefined &&
+            body.username !== null &&
+            typeof body.username !== 'string') {
             throw new middleware_1.OxyAccountEventError('Account event username is malformed');
         }
         return {

package/dist/cjs/server/agentAccount.js

@@ -10,8 +10,12 @@ async function signInAgentAccount(options) {
     const publicKey = (0, secp256k1_1.normalizeSecp256k1PublicKey)(signer.publicKey.trim());
     const claims = await client.auth.agent.requestChallenge(publicKey);
     const timestamp = Date.now();
-    if (claims.action !== 'agent_signin' || claims.accountId !== accountId || claims.actorId !== accountId
-        || (0, secp256k1_1.normalizeSecp256k1PublicKey)(claims.publicKey) !== publicKey || !claims.authMethodId || claims.expiresAt <= timestamp) {
+    if (claims.action !== 'agent_signin' ||
+        claims.accountId !== accountId ||
+        claims.actorId !== accountId ||
+        (0, secp256k1_1.normalizeSecp256k1PublicKey)(claims.publicKey) !== publicKey ||
+        !claims.authMethodId ||
+        claims.expiresAt <= timestamp) {
         throw new Error('Agent challenge does not match this account and signer');
     }
     const signature = await signer.signMessage((0, contracts_1.buildAgentProofMessage)(claims, timestamp));

package/dist/cjs/server/aliaMachineCredential.js

@@ -8,20 +8,34 @@ exports.createOxyAliaMachineCredentialAuth = createOxyAliaMachineCredentialAuth;
 exports.OXY_ALIA_RESOURCE_APPLICATION_ID = '6a2f851751b784a86fd0e934';
 exports.OXY_ALIA_MACHINE_SCOPES = ['alia:chat', 'inference:invoke'];
 function id(value) {
-    return typeof value === 'string' && value.length > 0 && value.length <= 128 && value.trim() === value;
+    return (typeof value === 'string' && value.length > 0 && value.length <= 128 && value.trim() === value);
 }
 /** Strict response boundary: extra user/tier fields cannot smuggle authority. */
 function isOxyAliaMachinePrincipal(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return false;
     const p = value;
-    const keys = ['kind', 'audience', 'applicationId', 'credentialId', 'ownerAccountId', 'environment', 'scopes'];
-    return Object.keys(p).length === keys.length && keys.every(key => Object.prototype.hasOwnProperty.call(p, key))
-        && p.kind === 'machine' && p.audience === exports.OXY_ALIA_RESOURCE_APPLICATION_ID
-        && id(p.applicationId) && id(p.credentialId) && id(p.ownerAccountId)
-        && typeof p.environment === 'string' && ['production', 'staging', 'development'].includes(p.environment)
-        && Array.isArray(p.scopes) && p.scopes.length === 2
-        && exports.OXY_ALIA_MACHINE_SCOPES.every(scope => p.scopes.includes(scope));
+    const keys = [
+        'kind',
+        'audience',
+        'applicationId',
+        'credentialId',
+        'ownerAccountId',
+        'environment',
+        'scopes',
+    ];
+    return (Object.keys(p).length === keys.length &&
+        keys.every((key) => Object.prototype.hasOwnProperty.call(p, key)) &&
+        p.kind === 'machine' &&
+        p.audience === exports.OXY_ALIA_RESOURCE_APPLICATION_ID &&
+        id(p.applicationId) &&
+        id(p.credentialId) &&
+        id(p.ownerAccountId) &&
+        typeof p.environment === 'string' &&
+        ['production', 'staging', 'development'].includes(p.environment) &&
+        Array.isArray(p.scopes) &&
+        p.scopes.length === 2 &&
+        exports.OXY_ALIA_MACHINE_SCOPES.every((scope) => p.scopes.includes(scope)));
 }
 // Keep the forwarding credential out of enumerable request/principal objects,
 // logs, response serialization and persistent SDK/session state. No cache.
@@ -29,7 +43,9 @@ const forwardingCredentials = new WeakMap();
 /** Only for the request-scoped Oxy inference client; never for a user API. */
 function getOxyAliaMachineCredentialBearer(req) {
     const bound = forwardingCredentials.get(req);
-    return bound && req.machineCredential === bound.principal ? bound.bearer : null;
+    return bound && req.machineCredential === bound.principal
+        ? bound.bearer
+        : null;
 }
 /** Opt into Alia's app-only chat lane on its two chat routes, never globally. */
 function createOxyAliaMachineCredentialAuth(server, options) {
@@ -41,19 +57,28 @@ function createOxyAliaMachineCredentialAuth(server, options) {
             return;
         }
         const existing = req;
-        if (existing.user || existing.userId || existing.serviceApp || existing.oxyRequester
-            || req.machineCredential
-            || req.headers['x-oxy-user-id'] !== undefined || req.headers['x-oxy-requester-assertion'] !== undefined) {
+        if (existing.user ||
+            existing.userId ||
+            existing.serviceApp ||
+            existing.oxyRequester ||
+            req.machineCredential ||
+            req.headers['x-oxy-user-id'] !== undefined ||
+            req.headers['x-oxy-requester-assertion'] !== undefined) {
             res.status(403).json({ error: 'MACHINE_USER_DELEGATION_UNSUPPORTED' });
             return;
         }
         try {
             const answer = await server.apps.introspectAliaMachineCredential(token);
-            if (!answer.active || !isOxyAliaMachinePrincipal(answer.principal) || answer.principal.environment !== options.environment) {
+            if (!answer.active ||
+                !isOxyAliaMachinePrincipal(answer.principal) ||
+                answer.principal.environment !== options.environment) {
                 res.status(401).json({ error: 'MACHINE_CREDENTIAL_INVALID' });
                 return;
             }
-            const principal = Object.freeze({ ...answer.principal, scopes: Object.freeze(['alia:chat', 'inference:invoke']) });
+            const principal = Object.freeze({
+                ...answer.principal,
+                scopes: Object.freeze(['alia:chat', 'inference:invoke']),
+            });
             req.machineCredential = principal;
             forwardingCredentials.set(req, { principal, bearer: token });
             next();

package/dist/cjs/server/auth.js

@@ -36,9 +36,7 @@ function ensureUser(req, userId) {
 }
 function getOxyUserId(req) {
     const authReq = req;
-    return (normalizeId(authReq.userId) ??
-        normalizeId(authReq.user?.id) ??
-        normalizeId(authReq.user?._id));
+    return (normalizeId(authReq.userId) ?? normalizeId(authReq.user?.id) ?? normalizeId(authReq.user?._id));
 }
 /**
  * Who acted, and as whom, on this user session (issue #1520), or `null` when
@@ -182,7 +180,10 @@ function requireOxyAuth(req, res, next) {
     next();
 }
 function createOptionalOxyAuth(oxy, options = {}) {
-    const resolveSession = oxy.middleware.auth({ ...options.auth, optional: true });
+    const resolveSession = oxy.middleware.auth({
+        ...options.auth,
+        optional: true,
+    });
     return (req, res, next) => {
         if (getOxyUserId(req)) {
             next();

package/dist/cjs/server/capabilityTicket.js

@@ -63,11 +63,11 @@ function verifyCapabilityTicket(token, options) {
         throw new CapabilityTicketError('malformed', 'Capability ticket header is not supported');
     }
     const headerRecord = header;
-    if (Object.keys(headerRecord).length !== 3
-        || headerRecord.alg !== ALGORITHM
-        || headerRecord.typ !== TOKEN_TYPE
-        || typeof headerRecord.kid !== 'string'
-        || headerRecord.kid.length === 0) {
+    if (Object.keys(headerRecord).length !== 3 ||
+        headerRecord.alg !== ALGORITHM ||
+        headerRecord.typ !== TOKEN_TYPE ||
+        typeof headerRecord.kid !== 'string' ||
+        headerRecord.kid.length === 0) {
         throw new CapabilityTicketError('malformed', 'Capability ticket header is not supported');
     }
     const publicKey = options.resolvePublicKey(headerRecord.kid);

package/dist/cjs/server/index.js

@@ -17,7 +17,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.inlineScriptCspHash = exports.formatOxyCspPolicy = exports.extractInlineScripts = exports.cspSourcesFor = exports.createOxySecurityHeaders = exports.buildOxyPagesHeaders = exports.buildOxyCspDirectives = exports.createOxyCors = exports.UPSTREAM_HEADERS_TIMEOUT_MS = exports.MAX_URL_LENGTH = exports.MAX_REDIRECTS = exports.DEFAULT_USER_AGENT = exports.BLOCKED_HOSTNAMES = exports.ALLOWED_PROTOCOLS = exports.ALLOWED_PORTS = exports.UpstreamError = exports.SsrfRejection = exports.safeFetch = exports.isBlockedIp = exports.assertSafePublicUrl = exports.createOxyRateLimit = exports.OXY_SERVICE_ENVIRONMENTS = exports.requireOxyAuth = exports.isOxyAuthenticated = exports.getRequiredOxyUserId = exports.getRequiredOxyBillingPrincipal = exports.getOxyUserId = exports.getOxyRequestAttribution = exports.getOxyDelegatedUserId = exports.getOxyBillingPrincipal = exports.getOxyAuthRefusal = exports.getOxyActor = exports.createOxyAuthMiddleware = exports.createOptionalOxyAuth = exports.OXY_ACCOUNT_DELETED_EVENT_URI = exports.OxyAccountEventError = exports.OXY_ALIA_MACHINE_SCOPES = exports.OXY_ALIA_RESOURCE_APPLICATION_ID = exports.isOxyAliaMachinePrincipal = exports.getOxyAliaMachineCredentialBearer = exports.createOxyAliaMachineCredentialAuth = exports.ServerReputationApi = exports.ServerNotificationsApi = exports.ServerLinkedAccountsApi = exports.ServerAssetsApi = exports.ServerAgencyApi = exports.ServerAppsApi = exports.ANONYMOUS_SERVICE_TOKEN_RETRY_MS = exports.ServiceCredentialMismatchError = exports.OxyServer = void 0;
-exports.signInAgentAccount = exports.hasBoundedServiceTokenLifetime = exports.OXY_SERVICE_TOKEN_MAX_LIFETIME_SECONDS = exports.requestWorkloadServiceToken = exports.canAttestWorkloadIdentity = exports.withoutNodeHttpObservation = exports.observeNodeHttp = exports.createEcosystemTraffic = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isLoopbackOrigin = exports.registrableApex = exports.OXY_IDENTITY_CACHE_PREFIXES = exports.oxyUserByIdCacheKey = exports.evictOxyIdentityCache = exports.publishOxyUserInvalidation = exports.createOxyUserInvalidationHandler = exports.createLiveCapabilityTicketVerifier = exports.verifySecret = exports.verifyOxyRequesterAssertion = exports.signOxyRequesterAssertion = exports.readOxyRequesterAssertionKeyId = exports.oxyRequesterAssertionClaimsSchema = exports.OxyRequesterAssertionError = exports.OXY_REQUESTER_ASSERTION_TYPE = exports.OXY_REQUESTER_ASSERTION_MAX_TTL_SECONDS = exports.OXY_REQUESTER_ASSERTION_HEADER = exports.OXY_REQUESTER_ASSERTION_DEFAULT_ISSUER = exports.createOxyRequesterAssertionAuth = exports.createOxyJwksKeyResolver = exports.verifyCapabilityTicket = exports.readCapabilityAuthorization = exports.issueCapabilityTicket = exports.inputSatisfiesCapabilityLimits = exports.createCapabilityTicketMiddleware = exports.CapabilityTicketError = exports.OXY_CSP_BASELINE = void 0;
+exports.signInAgentAccount = exports.hasBoundedServiceTokenLifetime = exports.OXY_SERVICE_TOKEN_MAX_LIFETIME_SECONDS = exports.requestWorkloadServiceToken = exports.canAttestWorkloadIdentity = exports.attestWorkloadIdentity = exports.withoutNodeHttpObservation = exports.observeNodeHttp = exports.createEcosystemTraffic = exports.isAllowedDeviceJoinOrigin = exports.isOfficialWebOrigin = exports.isLoopbackOrigin = exports.registrableApex = exports.OXY_IDENTITY_CACHE_PREFIXES = exports.oxyUserByIdCacheKey = exports.evictOxyIdentityCache = exports.publishOxyUserInvalidation = exports.createOxyUserInvalidationHandler = exports.createLiveCapabilityTicketVerifier = exports.verifySecret = exports.verifyOxyRequesterAssertion = exports.signOxyRequesterAssertion = exports.readOxyRequesterAssertionKeyId = exports.oxyRequesterAssertionClaimsSchema = exports.OxyRequesterAssertionError = exports.OXY_REQUESTER_ASSERTION_TYPE = exports.OXY_REQUESTER_ASSERTION_MAX_TTL_SECONDS = exports.OXY_REQUESTER_ASSERTION_HEADER = exports.OXY_REQUESTER_ASSERTION_DEFAULT_ISSUER = exports.createOxyRequesterAssertionAuth = exports.createOxyJwksKeyResolver = exports.verifyCapabilityTicket = exports.readCapabilityAuthorization = exports.issueCapabilityTicket = exports.inputSatisfiesCapabilityLimits = exports.createCapabilityTicketMiddleware = exports.CapabilityTicketError = exports.OXY_CSP_BASELINE = void 0;
 // The backend client: OxyServices plus the service-token lane, middleware,
 // account events and the service-only namespace methods.
 var OxyServer_1 = require("./OxyServer");
@@ -150,6 +150,7 @@ Object.defineProperty(exports, "withoutNodeHttpObservation", { enumerable: true,
  * container credentials endpoint.
  */
 var workloadIdentity_1 = require("./workloadIdentity");
+Object.defineProperty(exports, "attestWorkloadIdentity", { enumerable: true, get: function () { return workloadIdentity_1.attestWorkloadIdentity; } });
 Object.defineProperty(exports, "canAttestWorkloadIdentity", { enumerable: true, get: function () { return workloadIdentity_1.canAttestWorkloadIdentity; } });
 Object.defineProperty(exports, "requestWorkloadServiceToken", { enumerable: true, get: function () { return workloadIdentity_1.requestWorkloadServiceToken; } });
 var serviceTokenLifetime_1 = require("./serviceTokenLifetime");

package/dist/cjs/server/liveCapabilityTicket.js

@@ -28,7 +28,10 @@ function createLiveCapabilityTicketVerifier(options) {
                 if (controller.signal.aborted)
                     rejectAbort();
             });
-            const result = await Promise.race([options.introspect(ticket, { signal: controller.signal }), interrupted]);
+            const result = await Promise.race([
+                options.introspect(ticket, { signal: controller.signal }),
+                interrupted,
+            ]);
             controller.signal.throwIfAborted();
             if (result.active !== true)
                 throw new Error('Capability ticket is inactive');