@oxy.so/core 4.5.0-oxy-one.1 → 4.5.0

package/dist/cjs/server/middleware.js

@@ -53,8 +53,7 @@ class ServiceTokenClaimError extends Error {
     }
 }
 function isOxyServiceEnvironment(value) {
-    return (typeof value === 'string' &&
-        oxyServiceEnvironment_1.OXY_SERVICE_ENVIRONMENTS.includes(value));
+    return (typeof value === 'string' && oxyServiceEnvironment_1.OXY_SERVICE_ENVIRONMENTS.includes(value));
 }
 /** Build the middleware set for one server. See `OxyServer.middleware`. */
 function createOxyMiddleware(host) {
@@ -202,7 +201,7 @@ function createOxyMiddleware(host) {
                         error: 'MISSING_TOKEN',
                         message: 'Access token required',
                         code: 'MISSING_TOKEN',
-                        status: 401
+                        status: 401,
                     };
                     if (onError)
                         return onError(error);
@@ -235,7 +234,7 @@ function createOxyMiddleware(host) {
                         error: 'INVALID_TOKEN_FORMAT',
                         message: 'Invalid token format',
                         code: 'INVALID_TOKEN_FORMAT',
-                        status: 401
+                        status: 401,
                     };
                     if (onError)
                         return onError(error);
@@ -334,7 +333,12 @@ function createOxyMiddleware(host) {
                             req.user = null;
                             return next();
                         }
-                        const error = { error: 'TOKEN_EXPIRED', message: 'Service token expired', code: 'TOKEN_EXPIRED', status: 401 };
+                        const error = {
+                            error: 'TOKEN_EXPIRED',
+                            message: 'Service token expired',
+                            code: 'TOKEN_EXPIRED',
+                            status: 401,
+                        };
                         if (onError)
                             return onError(error);
                         return res.status(401).json(error);
@@ -346,7 +350,12 @@ function createOxyMiddleware(host) {
                             reason: 'Service token is not yet valid (nbf)',
                             status: 401,
                         });
-                        const error = { error: 'INVALID_SERVICE_TOKEN_CLAIMS', message: 'Service token is not yet valid', code: 'INVALID_SERVICE_TOKEN_CLAIMS', status: 401 };
+                        const error = {
+                            error: 'INVALID_SERVICE_TOKEN_CLAIMS',
+                            message: 'Service token is not yet valid',
+                            code: 'INVALID_SERVICE_TOKEN_CLAIMS',
+                            status: 401,
+                        };
                         if (onError)
                             return onError(error);
                         return res.status(401).json(error);
@@ -363,10 +372,10 @@ function createOxyMiddleware(host) {
                         !isExactNonEmptyServiceClaim(decoded.appName) ||
                         !isExactNonEmptyServiceClaim(credentialId) ||
                         !isExactNonEmptyServiceClaim(ownerAccountId) ||
-                        !isOxyServiceEnvironment(environment)
-                        || !Array.isArray(decoded.scopes)
-                        || !decoded.scopes.every((scope) => typeof scope === 'string' && scope.length > 0 && scope === scope.trim())
-                        || new Set(decoded.scopes).size !== decoded.scopes.length) {
+                        !isOxyServiceEnvironment(environment) ||
+                        !Array.isArray(decoded.scopes) ||
+                        !decoded.scopes.every((scope) => typeof scope === 'string' && scope.length > 0 && scope === scope.trim()) ||
+                        new Set(decoded.scopes).size !== decoded.scopes.length) {
                         recordRefusal(req, {
                             code: 'INVALID_SERVICE_TOKEN',
                             stage: 'service-token',
@@ -380,7 +389,9 @@ function createOxyMiddleware(host) {
                                 !isExactNonEmptyServiceClaim(ownerAccountId) ? 'ownerAccountId' : null,
                                 !isOxyServiceEnvironment(environment) ? 'environment' : null,
                                 !Array.isArray(decoded.scopes) ? 'scopes' : null,
-                            ].filter((field) => field !== null).join(', ') || 'scopes'})`,
+                            ]
+                                .filter((field) => field !== null)
+                                .join(', ') || 'scopes'})`,
                             status: 401,
                         });
                         if (optional) {
@@ -388,7 +399,12 @@ function createOxyMiddleware(host) {
                             req.user = null;
                             return next();
                         }
-                        const error = { error: 'INVALID_SERVICE_TOKEN', message: 'Invalid service token: missing required claims', code: 'INVALID_SERVICE_TOKEN', status: 401 };
+                        const error = {
+                            error: 'INVALID_SERVICE_TOKEN',
+                            message: 'Invalid service token: missing required claims',
+                            code: 'INVALID_SERVICE_TOKEN',
+                            status: 401,
+                        };
                         if (onError)
                             return onError(error);
                         return res.status(401).json(error);
@@ -423,8 +439,10 @@ function createOxyMiddleware(host) {
                         // `req.userId = oxyUserId` would let any service impersonate
                         // any user simply by setting the header.
                         const grant = await host.verifyActingAs(appId, oxyUserId, {
-                            cache: false, credentialId: decoded.credentialId,
-                            ownerAccountId: decoded.ownerAccountId, environment: decoded.environment,
+                            cache: false,
+                            credentialId: decoded.credentialId,
+                            ownerAccountId: decoded.ownerAccountId,
+                            environment: decoded.environment,
                         });
                         if (!grant || !grant.authorized) {
                             logger_1.logger.warn('[oxy.auth] Service token rejected — no delegation grant', {
@@ -504,7 +522,7 @@ function createOxyMiddleware(host) {
                         error: 'INVALID_TOKEN_PAYLOAD',
                         message: 'Token missing user ID',
                         code: 'INVALID_TOKEN_PAYLOAD',
-                        status: 401
+                        status: 401,
                     };
                     if (onError)
                         return onError(error);
@@ -528,7 +546,7 @@ function createOxyMiddleware(host) {
                         error: 'TOKEN_EXPIRED',
                         message: 'Token expired',
                         code: 'TOKEN_EXPIRED',
-                        status: 401
+                        status: 401,
                     };
                     if (onError)
                         return onError(error);
@@ -556,7 +574,7 @@ function createOxyMiddleware(host) {
                         error: 'SESSION_REQUIRED',
                         message: 'Access token is not bound to a session',
                         code: 'SESSION_REQUIRED',
-                        status: 401
+                        status: 401,
                     };
                     if (onError)
                         return onError(error);
@@ -584,7 +602,7 @@ function createOxyMiddleware(host) {
                             error: 'INVALID_SESSION',
                             message: 'Session invalid or expired',
                             code: 'INVALID_SESSION',
-                            status: 401
+                            status: 401,
                         };
                         if (onError)
                             return onError(error);
@@ -608,7 +626,7 @@ function createOxyMiddleware(host) {
                             error: 'INVALID_SESSION',
                             message: 'Session did not resolve to a usable identity',
                             code: 'INVALID_SESSION',
-                            status: 401
+                            status: 401,
                         };
                         if (onError)
                             return onError(error);
@@ -639,7 +657,7 @@ function createOxyMiddleware(host) {
                             error: 'SESSION_USER_MISMATCH',
                             message: 'Token user does not match the session',
                             code: 'SESSION_USER_MISMATCH',
-                            status: 401
+                            status: 401,
                         };
                         if (onError)
                             return onError(error);
@@ -674,7 +692,7 @@ function createOxyMiddleware(host) {
                             error: 'SESSION_ACTOR_MISMATCH',
                             message: 'Session actor does not match the session',
                             code: 'SESSION_ACTOR_MISMATCH',
-                            status: 401
+                            status: 401,
                         };
                         if (onError)
                             return onError(error);
@@ -687,7 +705,9 @@ function createOxyMiddleware(host) {
                     // Session validation already returned the full user, so `loadUser`
                     // costs no extra round-trip.
                     // One id source: the one `getUserIdentityId` validated (`id`, else `_id`).
-                    req.user = loadUser ? { ...validationResult.user, id: validatedUserId } : { id: validatedUserId };
+                    req.user = loadUser
+                        ? { ...validationResult.user, id: validatedUserId }
+                        : { id: validatedUserId };
                     if (debug) {
                         logger_1.logger.debug(`[oxy.auth] OK user=${validatedUserId} session=${sessionId}`, {
                             component: 'auth',
@@ -721,7 +741,7 @@ function createOxyMiddleware(host) {
                         error: 'SESSION_VALIDATION_ERROR',
                         message: 'Session validation failed',
                         code: 'SESSION_VALIDATION_ERROR',
-                        status: 401
+                        status: 401,
                     };
                     if (onError)
                         return onError(error);
@@ -1003,16 +1023,16 @@ function parseServiceTokenJwks(value) {
         if (typeof value !== 'object' || value === null || Array.isArray(value))
             throw new ServiceTokenSignatureError('Oxy JWKS contains a malformed key');
         const key = value;
-        if (key.kty !== 'OKP'
-            || key.crv !== 'Ed25519'
-            || typeof key.x !== 'string'
-            || key.x.length === 0
-            || key.use !== 'sig'
-            || key.alg !== 'EdDSA'
-            || typeof key.kid !== 'string'
-            || !/^[A-Za-z0-9._-]{1,128}$/.test(key.kid)
-            || Object.prototype.hasOwnProperty.call(key, 'd')
-            || result.has(key.kid))
+        if (key.kty !== 'OKP' ||
+            key.crv !== 'Ed25519' ||
+            typeof key.x !== 'string' ||
+            key.x.length === 0 ||
+            key.use !== 'sig' ||
+            key.alg !== 'EdDSA' ||
+            typeof key.kid !== 'string' ||
+            !/^[A-Za-z0-9._-]{1,128}$/.test(key.kid) ||
+            Object.prototype.hasOwnProperty.call(key, 'd') ||
+            result.has(key.kid))
             throw new ServiceTokenSignatureError('Oxy JWKS contains an unsupported or duplicate key');
         const x = Buffer.from(key.x, 'base64url');
         if (x.length !== 32 || x.toString('base64url') !== key.x) {
@@ -1093,11 +1113,11 @@ async function verifyServiceTokenSignature(token, options) {
         throw new ServiceTokenStructureError('Service token has empty segment');
     }
     const header = parseJsonSegment(headerB64);
-    if (Object.keys(header).length !== 3
-        || header.alg !== 'EdDSA'
-        || header.typ !== 'JWT'
-        || typeof header.kid !== 'string'
-        || !/^[A-Za-z0-9._-]{1,128}$/.test(header.kid))
+    if (Object.keys(header).length !== 3 ||
+        header.alg !== 'EdDSA' ||
+        header.typ !== 'JWT' ||
+        typeof header.kid !== 'string' ||
+        !/^[A-Za-z0-9._-]{1,128}$/.test(header.kid))
         throw new ServiceTokenStructureError('Service token JOSE header is not supported');
     const jwk = await resolveServiceTokenPublicKey(header.kid, options.jwksUrl, options.cache);
     let publicKey;
@@ -1141,13 +1161,12 @@ function readStringClaim(value) {
 /**
  * Resolve the canonical user id from a validated session's user object.
  *
- * The API serializer emits `id`, but some upstream shapes carry the raw Mongo
- * `_id` instead. We accept either, but only a non-empty string — anything else
+ * The API serializer emits `id`, but some upstream shapes carry a raw `_id`
+ * instead. We accept either, but only a non-empty string — anything else
  * means the validated identity is unusable and the caller must reject.
  */
 function getUserIdentityId(user) {
-    const candidate = user.id
-        ?? user._id;
+    const candidate = user.id ?? user._id;
     return typeof candidate === 'string' && candidate.length > 0 ? candidate : null;
 }
 /**

package/dist/cjs/server/namespaces.js

@@ -47,7 +47,9 @@ class ServerAppsApi extends apps_1.AppsApi {
         const record = answer;
         if (record.active === false && Object.keys(record).length === 1)
             return { active: false };
-        if (record.active !== true || Object.keys(record).length !== 2 || !(0, aliaMachineCredential_1.isOxyAliaMachinePrincipal)(record.principal)) {
+        if (record.active !== true ||
+            Object.keys(record).length !== 2 ||
+            !(0, aliaMachineCredential_1.isOxyAliaMachinePrincipal)(record.principal)) {
             throw new Error('Invalid machine credential verdict');
         }
         return { active: true, principal: record.principal };
@@ -175,7 +177,9 @@ class ServerAssetsApi extends assets_1.AssetsApi {
             return [];
         const settled = await Promise.all(chunk(unique, SERVICE_ASSET_METADATA_BY_SHA_CHUNK_SIZE).map(async (part) => {
             try {
-                const body = options.ownerUserId ? { sha256s: part, ownerUserId: options.ownerUserId } : { sha256s: part };
+                const body = options.ownerUserId
+                    ? { sha256s: part, ownerUserId: options.ownerUserId }
+                    : { sha256s: part };
                 const entries = await lane(this.ctx).request('POST', '/assets/service/by-sha256', body);
                 return Array.isArray(entries) ? entries : [];
             }
@@ -218,7 +222,14 @@ class ServerLinkedAccountsApi extends linkedAccounts_1.LinkedAccountsApi {
 exports.ServerLinkedAccountsApi = ServerLinkedAccountsApi;
 function agencyAuthorityOptions(signal) {
     signal?.throwIfAborted();
-    return { cache: false, deduplicate: false, retry: false, skipAuth: true, timeout: 5000, ...(signal ? { signal } : {}) };
+    return {
+        cache: false,
+        deduplicate: false,
+        retry: false,
+        skipAuth: true,
+        timeout: 5000,
+        ...(signal ? { signal } : {}),
+    };
 }
 class ServerAgencyApi extends agency_1.AgencyApi {
     /** Live registry discovery with this service's existing capability scopes. */
@@ -256,15 +267,25 @@ class ServerAgencyApi extends agency_1.AgencyApi {
         options.signal?.throwIfAborted();
         if (!authorizationId || authorizationId.length > 255 || /\s/.test(authorizationId))
             throw new Error('An execution authorization id is required');
-        if (!options.requesterToken || options.requesterToken.length > 16384 || /\s/.test(options.requesterToken))
+        if (!options.requesterToken ||
+            options.requesterToken.length > 16384 ||
+            /\s/.test(options.requesterToken))
             throw new Error('A requester bearer is required');
-        await this.ctx.request('DELETE', `/capabilities/execution-authorizations/${encodeURIComponent(authorizationId)}`, undefined, { ...agencyAuthorityOptions(options.signal), headers: { Authorization: `Bearer ${options.requesterToken}` } });
+        await this.ctx.request('DELETE', `/capabilities/execution-authorizations/${encodeURIComponent(authorizationId)}`, undefined, {
+            ...agencyAuthorityOptions(options.signal),
+            headers: { Authorization: `Bearer ${options.requesterToken}` },
+        });
     }
     /** Independent service proof plus present requester bearer, sent only to Oxy. */
     async createForegroundExecutionAuthorization(input, options) {
-        if (options.requesterToken === '' || options.requesterToken.length > 16384 || /\s/.test(options.requesterToken))
+        if (options.requesterToken === '' ||
+            options.requesterToken.length > 16384 ||
+            /\s/.test(options.requesterToken))
             throw new Error('A requester bearer is required');
-        const result = await lane(this.ctx).request('POST', '/capabilities/foreground-execution-authorizations', { ...contracts_1.foregroundExecutionAuthorizationInputSchema.parse(input), subjectToken: options.requesterToken }, agencyAuthorityOptions(options.signal));
+        const result = await lane(this.ctx).request('POST', '/capabilities/foreground-execution-authorizations', {
+            ...contracts_1.foregroundExecutionAuthorizationInputSchema.parse(input),
+            subjectToken: options.requesterToken,
+        }, agencyAuthorityOptions(options.signal));
         return result.authorization;
     }
     /**

package/dist/cjs/server/requesterAssertion.js

@@ -33,7 +33,8 @@ const KEY_ID_PATTERN = /^[A-Za-z0-9._-]{1,128}$/;
 const BASE64URL_PATTERN = /^[A-Za-z0-9_-]+$/;
 const MAX_ASSERTION_BYTES = 4096;
 const identifier = zod_1.z.string().min(1).max(128);
-exports.oxyRequesterAssertionClaimsSchema = zod_1.z.object({
+exports.oxyRequesterAssertionClaimsSchema = zod_1.z
+    .object({
     iss: zod_1.z.string().min(1).max(256),
     aud: identifier,
     /** The requester account. */
@@ -47,7 +48,8 @@ exports.oxyRequesterAssertionClaimsSchema = zod_1.z.object({
     cid: identifier,
     /** The one native agent this requester may reach with it. */
     agentId: identifier,
-}).strict();
+})
+    .strict();
 class OxyRequesterAssertionError extends Error {
     constructor(code) {
         super(`Requester assertion rejected: ${code}`);
@@ -80,7 +82,8 @@ function decodeObject(segment) {
 /** Signs an assertion. Oxy is the only intended caller. */
 function signOxyRequesterAssertion(claims, signing) {
     const parsed = exports.oxyRequesterAssertionClaimsSchema.parse(claims);
-    if (parsed.exp <= parsed.iat || parsed.exp - parsed.iat > exports.OXY_REQUESTER_ASSERTION_MAX_TTL_SECONDS) {
+    if (parsed.exp <= parsed.iat ||
+        parsed.exp - parsed.iat > exports.OXY_REQUESTER_ASSERTION_MAX_TTL_SECONDS) {
         throw new OxyRequesterAssertionError('ttl_exceeded');
     }
     if (!KEY_ID_PATTERN.test(signing.keyId))
@@ -101,11 +104,11 @@ function readOxyRequesterAssertionKeyId(token) {
         throw new OxyRequesterAssertionError('malformed');
     }
     const header = decodeObject(segments[0]);
-    if (Object.keys(header).length !== 3
-        || header.alg !== ALGORITHM
-        || header.typ !== exports.OXY_REQUESTER_ASSERTION_TYPE
-        || typeof header.kid !== 'string'
-        || !KEY_ID_PATTERN.test(header.kid)) {
+    if (Object.keys(header).length !== 3 ||
+        header.alg !== ALGORITHM ||
+        header.typ !== exports.OXY_REQUESTER_ASSERTION_TYPE ||
+        typeof header.kid !== 'string' ||
+        !KEY_ID_PATTERN.test(header.kid)) {
         throw new OxyRequesterAssertionError('malformed');
     }
     return header.kid;
@@ -144,7 +147,8 @@ function verifyOxyRequesterAssertion(token, options) {
         throw new OxyRequesterAssertionError('not_yet_valid');
     if (claims.exp <= now)
         throw new OxyRequesterAssertionError('expired');
-    if (claims.exp <= claims.iat || claims.exp - claims.iat > exports.OXY_REQUESTER_ASSERTION_MAX_TTL_SECONDS) {
+    if (claims.exp <= claims.iat ||
+        claims.exp - claims.iat > exports.OXY_REQUESTER_ASSERTION_MAX_TTL_SECONDS) {
         throw new OxyRequesterAssertionError('ttl_exceeded');
     }
     return claims;
@@ -168,15 +172,15 @@ function parseJwks(value) {
         if (typeof entry !== 'object' || entry === null || Array.isArray(entry))
             throw new Error('JWKS key is malformed');
         const key = entry;
-        if (key.kty !== 'OKP'
-            || key.crv !== 'Ed25519'
-            || key.alg !== 'EdDSA'
-            || key.use !== 'sig'
-            || typeof key.x !== 'string'
-            || typeof key.kid !== 'string'
-            || !KEY_ID_PATTERN.test(key.kid)
-            || Object.prototype.hasOwnProperty.call(key, 'd')
-            || result.has(key.kid))
+        if (key.kty !== 'OKP' ||
+            key.crv !== 'Ed25519' ||
+            key.alg !== 'EdDSA' ||
+            key.use !== 'sig' ||
+            typeof key.x !== 'string' ||
+            typeof key.kid !== 'string' ||
+            !KEY_ID_PATTERN.test(key.kid) ||
+            Object.prototype.hasOwnProperty.call(key, 'd') ||
+            result.has(key.kid))
             throw new Error('JWKS key is unsupported');
         const x = Buffer.from(key.x, 'base64url');
         if (x.length !== 32 || x.toString('base64url') !== key.x)
@@ -252,7 +256,9 @@ function reject(req, res, options, status, error, code) {
         status,
         applicationId: req.serviceApp?.appId ?? null,
     });
-    res.status(status).json({ error, code, message: 'The requester assertion was not accepted', status });
+    res
+        .status(status)
+        .json({ error, code, message: 'The requester assertion was not accepted', status });
 }
 function singleHeader(req, name) {
     const value = req.headers[name];
@@ -276,8 +282,8 @@ function createOxyRequesterAssertionAuth(introspector, options) {
     let resolvePublicKey = options.resolvePublicKey;
     const resolver = () => {
         resolvePublicKey ?? (resolvePublicKey = createOxyJwksKeyResolver({
-            jwksUrl: options.jwksUrl
-                ?? new URL('/capabilities/.well-known/jwks.json', introspector.baseURL).toString(),
+            jwksUrl: options.jwksUrl ??
+                new URL('/capabilities/.well-known/jwks.json', introspector.baseURL).toString(),
         }));
         return resolvePublicKey;
     };
@@ -300,9 +306,9 @@ function createOxyRequesterAssertionAuth(introspector, options) {
         // One identity channel per request. An offline delegation header or an
         // identity some earlier middleware attached must never be combined with, or
         // silently replaced by, a present-requester assertion.
-        if (req.headers['x-oxy-user-id'] !== undefined
-            || request.serviceActingAs !== undefined
-            || (request.userId !== undefined && request.userId !== null)) {
+        if (req.headers['x-oxy-user-id'] !== undefined ||
+            request.serviceActingAs !== undefined ||
+            (request.userId !== undefined && request.userId !== null)) {
             reject(req, res, options, 400, 'REQUESTER_ASSERTION_CONFLICT', 'identity_conflict');
             return;
         }
@@ -338,12 +344,12 @@ function createOxyRequesterAssertionAuth(introspector, options) {
             reject(req, res, options, 503, 'REQUESTER_ASSERTION_UNAVAILABLE', 'introspection_unavailable');
             return;
         }
-        if (introspection.active !== true
-            || introspection.requesterAccountId !== claims.sub
-            || introspection.agentId !== claims.agentId
-            || introspection.applicationId !== claims.azp
-            || introspection.credentialId !== claims.cid
-            || introspection.jti !== claims.jti) {
+        if (introspection.active !== true ||
+            introspection.requesterAccountId !== claims.sub ||
+            introspection.agentId !== claims.agentId ||
+            introspection.applicationId !== claims.azp ||
+            introspection.credentialId !== claims.cid ||
+            introspection.jti !== claims.jti) {
             reject(req, res, options, 401, 'REQUESTER_ASSERTION_INACTIVE', 'inactive');
             return;
         }

package/dist/cjs/server/serviceTokenLifetime.js

@@ -6,8 +6,11 @@ exports.hasBoundedServiceTokenLifetime = hasBoundedServiceTokenLifetime;
 exports.OXY_SERVICE_TOKEN_MAX_LIFETIME_SECONDS = 300;
 /** Call only after signature verification; cache checks alone confer no authority. */
 function hasBoundedServiceTokenLifetime(claims, nowSeconds = Math.floor(Date.now() / 1000)) {
-    return typeof claims.iat === 'number' && Number.isSafeInteger(claims.iat)
-        && typeof claims.exp === 'number' && Number.isSafeInteger(claims.exp)
-        && claims.iat <= nowSeconds && claims.exp > claims.iat
-        && claims.exp - claims.iat <= exports.OXY_SERVICE_TOKEN_MAX_LIFETIME_SECONDS;
+    return (typeof claims.iat === 'number' &&
+        Number.isSafeInteger(claims.iat) &&
+        typeof claims.exp === 'number' &&
+        Number.isSafeInteger(claims.exp) &&
+        claims.iat <= nowSeconds &&
+        claims.exp > claims.iat &&
+        claims.exp - claims.iat <= exports.OXY_SERVICE_TOKEN_MAX_LIFETIME_SECONDS);
 }

package/dist/cjs/server/traffic.js

@@ -58,13 +58,15 @@ function createEcosystemTraffic(options) {
     const post = async (path, data) => {
         const token = await credential();
         const response = await fetcher(new URL(path, baseURL), {
-            method: 'POST', headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
-            body: JSON.stringify(data), signal: AbortSignal.timeout(4000),
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
+            body: JSON.stringify(data),
+            signal: AbortSignal.timeout(4000),
         });
         if (!response.ok)
             throw new Error('Activity collection failed');
     };
-    const collector = (0, collector_1.createTrafficCollector)(events => post('/internal/activity', events));
+    const collector = (0, collector_1.createTrafficCollector)((events) => post('/internal/activity', events));
     let stopped = false;
     let heartbeatWork = Promise.resolve();
     let heartbeatPending = false;
@@ -73,7 +75,19 @@ function createEcosystemTraffic(options) {
         if (!removed && (stopped || heartbeatPending))
             return heartbeatWork;
         heartbeatPending = true;
-        heartbeatWork = heartbeatWork.then(() => post('/internal/activity/infrastructure', { instanceId, service: options.service, region, ...location, status: options.ready?.() ? 'online' : 'unknown', removed })).catch(reportError).finally(() => { heartbeatPending = false; });
+        heartbeatWork = heartbeatWork
+            .then(() => post('/internal/activity/infrastructure', {
+            instanceId,
+            service: options.service,
+            region,
+            ...location,
+            status: options.ready?.() ? 'online' : 'unknown',
+            removed,
+        }))
+            .catch(reportError)
+            .finally(() => {
+            heartbeatPending = false;
+        });
         return heartbeatWork;
     };
     const flush = () => collector.flush().catch(reportError);
@@ -85,13 +99,17 @@ function createEcosystemTraffic(options) {
         return Object.assign((...args) => (0, trafficNodeHttp_1.withoutNodeHttpObservation)(() => wrapped(...args)), fetcher);
     };
     const observeHttp = (0, collector_1.trafficMiddleware)(collector, options.service, region);
-    const timer = setInterval(() => { void flush(); }, 2000);
+    const timer = setInterval(() => {
+        void flush();
+    }, 2000);
     timer.unref?.();
     void heartbeat();
-    const heartbeatTimer = setInterval(() => { void heartbeat(); }, 10000);
+    const heartbeatTimer = setInterval(() => {
+        void heartbeat();
+    }, 10000);
     heartbeatTimer.unref?.();
     return {
-        record: flow => collector.record({ ...flow, service: options.service, region }),
+        record: (flow) => collector.record({ ...flow, service: options.service, region }),
         middleware: observeHttp,
         observeHttp,
         wrapFetch,
@@ -102,8 +120,10 @@ function createEcosystemTraffic(options) {
             const original = globalThis.fetch;
             const wrapped = wrapFetch(original);
             globalThis.fetch = wrapped;
-            cleanups.add(() => { if (globalThis.fetch === wrapped)
-                globalThis.fetch = original; });
+            cleanups.add(() => {
+                if (globalThis.fetch === wrapped)
+                    globalThis.fetch = original;
+            });
             cleanups.add((0, trafficNodeHttp_1.observeNodeHttp)(collector, options.service, region, options.resolveEndpoint ?? collector_1.resolveOxyServiceEndpoint));
         },
         observeWebSocket(socket, socketOptions) {
@@ -111,7 +131,12 @@ function createEcosystemTraffic(options) {
             if (existing)
                 return existing;
             const unobserve = (0, socket_1.observeTrafficWebSocket)(socket, collector, options.service, region, socketOptions);
-            const cleanup = () => { unobserve(); socket.off('close', cleanup); cleanups.delete(cleanup); sockets.delete(socket); };
+            const cleanup = () => {
+                unobserve();
+                socket.off('close', cleanup);
+                cleanups.delete(cleanup);
+                sockets.delete(socket);
+            };
             sockets.set(socket, cleanup);
             socket.once('close', cleanup);
             cleanups.add(cleanup);
@@ -122,14 +147,28 @@ function createEcosystemTraffic(options) {
             if (existing)
                 return existing;
             const unobserve = (0, socket_1.observeTrafficSocket)(socket, collector, options.service, region, socketOptions);
-            const cleanup = () => { unobserve(); socket.off('disconnect', cleanup); cleanups.delete(cleanup); sockets.delete(socket); };
+            const cleanup = () => {
+                unobserve();
+                socket.off('disconnect', cleanup);
+                cleanups.delete(cleanup);
+                sockets.delete(socket);
+            };
             sockets.set(socket, cleanup);
             socket.once('disconnect', cleanup);
             cleanups.add(cleanup);
             return cleanup;
         },
-        async stop() { if (stopped)
-            return; stopped = true; for (const cleanup of cleanups)
-            cleanup(); cleanups.clear(); clearInterval(timer); clearInterval(heartbeatTimer); await flush(); await heartbeat(true); },
+        async stop() {
+            if (stopped)
+                return;
+            stopped = true;
+            for (const cleanup of cleanups)
+                cleanup();
+            cleanups.clear();
+            clearInterval(timer);
+            clearInterval(heartbeatTimer);
+            await flush();
+            await heartbeat(true);
+        },
     };
 }