@oxy.so/core 4.5.0-oxy-one.1 → 4.5.0

package/src/server/requesterAssertion.ts

@@ -37,21 +37,23 @@ const MAX_ASSERTION_BYTES = 4096;
 
 const identifier = z.string().min(1).max(128);
 
-export const oxyRequesterAssertionClaimsSchema = z.object({
-  iss: z.string().min(1).max(256),
-  aud: identifier,
-  /** The requester account. */
-  sub: identifier,
-  jti: z.string().uuid(),
-  iat: z.number().int().nonnegative(),
-  exp: z.number().int().positive(),
-  /** The application the assertion was minted for, and the only valid presenter. */
-  azp: identifier,
-  /** The exact credential of that application. */
-  cid: identifier,
-  /** The one native agent this requester may reach with it. */
-  agentId: identifier,
-}).strict();
+export const oxyRequesterAssertionClaimsSchema = z
+  .object({
+    iss: z.string().min(1).max(256),
+    aud: identifier,
+    /** The requester account. */
+    sub: identifier,
+    jti: z.string().uuid(),
+    iat: z.number().int().nonnegative(),
+    exp: z.number().int().positive(),
+    /** The application the assertion was minted for, and the only valid presenter. */
+    azp: identifier,
+    /** The exact credential of that application. */
+    cid: identifier,
+    /** The one native agent this requester may reach with it. */
+    agentId: identifier,
+  })
+  .strict();
 
 export type OxyRequesterAssertionClaims = z.infer<typeof oxyRequesterAssertionClaimsSchema>;
 
@@ -99,7 +101,10 @@ export function signOxyRequesterAssertion(
   signing: { readonly keyId: string; readonly privateKey: KeyObject },
 ): string {
   const parsed = oxyRequesterAssertionClaimsSchema.parse(claims);
-  if (parsed.exp <= parsed.iat || parsed.exp - parsed.iat > OXY_REQUESTER_ASSERTION_MAX_TTL_SECONDS) {
+  if (
+    parsed.exp <= parsed.iat ||
+    parsed.exp - parsed.iat > OXY_REQUESTER_ASSERTION_MAX_TTL_SECONDS
+  ) {
     throw new OxyRequesterAssertionError('ttl_exceeded');
   }
   if (!KEY_ID_PATTERN.test(signing.keyId)) throw new OxyRequesterAssertionError('malformed');
@@ -120,11 +125,11 @@ export function readOxyRequesterAssertionKeyId(token: string): string {
   }
   const header = decodeObject(segments[0] as string);
   if (
-    Object.keys(header).length !== 3
-    || header.alg !== ALGORITHM
-    || header.typ !== OXY_REQUESTER_ASSERTION_TYPE
-    || typeof header.kid !== 'string'
-    || !KEY_ID_PATTERN.test(header.kid)
+    Object.keys(header).length !== 3 ||
+    header.alg !== ALGORITHM ||
+    header.typ !== OXY_REQUESTER_ASSERTION_TYPE ||
+    typeof header.kid !== 'string' ||
+    !KEY_ID_PATTERN.test(header.kid)
   ) {
     throw new OxyRequesterAssertionError('malformed');
   }
@@ -148,7 +153,11 @@ export function verifyOxyRequesterAssertion(
   options: OxyRequesterAssertionVerificationOptions,
 ): OxyRequesterAssertionClaims {
   readOxyRequesterAssertionKeyId(token);
-  const [encodedHeader, encodedPayload, encodedSignature] = token.split('.') as [string, string, string];
+  const [encodedHeader, encodedPayload, encodedSignature] = token.split('.') as [
+    string,
+    string,
+    string,
+  ];
   const publicKey = options.publicKey;
   if (!publicKey || publicKey.asymmetricKeyType !== 'ed25519') {
     throw new OxyRequesterAssertionError('unknown_key');
@@ -170,7 +179,10 @@ export function verifyOxyRequesterAssertion(
   if (claims.aud !== options.audience) throw new OxyRequesterAssertionError('wrong_audience');
   if (claims.iat > now + CLOCK_SKEW_SECONDS) throw new OxyRequesterAssertionError('not_yet_valid');
   if (claims.exp <= now) throw new OxyRequesterAssertionError('expired');
-  if (claims.exp <= claims.iat || claims.exp - claims.iat > OXY_REQUESTER_ASSERTION_MAX_TTL_SECONDS) {
+  if (
+    claims.exp <= claims.iat ||
+    claims.exp - claims.iat > OXY_REQUESTER_ASSERTION_MAX_TTL_SECONDS
+  ) {
     throw new OxyRequesterAssertionError('ttl_exceeded');
   }
   return claims;
@@ -187,27 +199,35 @@ const JWKS_MAX_BYTES = 64 * 1024;
 const JWKS_MAX_KEYS = 20;
 
 function parseJwks(value: unknown): Map<string, KeyObject> {
-  if (typeof value !== 'object' || value === null || Array.isArray(value)) throw new Error('JWKS is malformed');
+  if (typeof value !== 'object' || value === null || Array.isArray(value))
+    throw new Error('JWKS is malformed');
   const keys = (value as { keys?: unknown }).keys;
-  if (!Array.isArray(keys) || keys.length === 0 || keys.length > JWKS_MAX_KEYS) throw new Error('JWKS has an invalid key set');
+  if (!Array.isArray(keys) || keys.length === 0 || keys.length > JWKS_MAX_KEYS)
+    throw new Error('JWKS has an invalid key set');
   const result = new Map<string, KeyObject>();
   for (const entry of keys) {
-    if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) throw new Error('JWKS key is malformed');
+    if (typeof entry !== 'object' || entry === null || Array.isArray(entry))
+      throw new Error('JWKS key is malformed');
     const key = entry as Record<string, unknown>;
     if (
-      key.kty !== 'OKP'
-      || key.crv !== 'Ed25519'
-      || key.alg !== 'EdDSA'
-      || key.use !== 'sig'
-      || typeof key.x !== 'string'
-      || typeof key.kid !== 'string'
-      || !KEY_ID_PATTERN.test(key.kid)
-      || Object.prototype.hasOwnProperty.call(key, 'd')
-      || result.has(key.kid)
-    ) throw new Error('JWKS key is unsupported');
+      key.kty !== 'OKP' ||
+      key.crv !== 'Ed25519' ||
+      key.alg !== 'EdDSA' ||
+      key.use !== 'sig' ||
+      typeof key.x !== 'string' ||
+      typeof key.kid !== 'string' ||
+      !KEY_ID_PATTERN.test(key.kid) ||
+      Object.prototype.hasOwnProperty.call(key, 'd') ||
+      result.has(key.kid)
+    )
+      throw new Error('JWKS key is unsupported');
     const x = Buffer.from(key.x, 'base64url');
-    if (x.length !== 32 || x.toString('base64url') !== key.x) throw new Error('JWKS key is not Ed25519');
-    result.set(key.kid, createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: key.x }, format: 'jwk' }));
+    if (x.length !== 32 || x.toString('base64url') !== key.x)
+      throw new Error('JWKS key is not Ed25519');
+    result.set(
+      key.kid,
+      createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: key.x }, format: 'jwk' }),
+    );
   }
   return result;
 }
@@ -248,7 +268,8 @@ export function createOxyJwksKeyResolver(
         });
         if (!response.ok) throw new Error(`JWKS returned HTTP ${response.status}`);
         const body = await response.text();
-        if (Buffer.byteLength(body, 'utf8') > JWKS_MAX_BYTES) throw new Error('JWKS exceeds the size limit');
+        if (Buffer.byteLength(body, 'utf8') > JWKS_MAX_BYTES)
+          throw new Error('JWKS exceeds the size limit');
         keys = parseJwks(JSON.parse(body) as unknown);
         expiresAt = clock() + JWKS_CACHE_MS;
       } finally {
@@ -346,13 +367,16 @@ function reject(
     status,
     applicationId: (req as OxyAuthRequest).serviceApp?.appId ?? null,
   });
-  res.status(status).json({ error, code, message: 'The requester assertion was not accepted', status });
+  res
+    .status(status)
+    .json({ error, code, message: 'The requester assertion was not accepted', status });
 }
 
 function singleHeader(req: Request, name: string): string | null | 'invalid' {
   const value = req.headers[name];
   if (value === undefined) return null;
-  if (typeof value !== 'string' || value.length === 0 || value.length > MAX_ASSERTION_BYTES) return 'invalid';
+  if (typeof value !== 'string' || value.length === 0 || value.length > MAX_ASSERTION_BYTES)
+    return 'invalid';
   return value;
 }
 
@@ -373,8 +397,9 @@ export function createOxyRequesterAssertionAuth(
   let resolvePublicKey = options.resolvePublicKey;
   const resolver = (): ((keyId: string) => Promise<KeyObject | undefined>) => {
     resolvePublicKey ??= createOxyJwksKeyResolver({
-      jwksUrl: options.jwksUrl
-        ?? new URL('/capabilities/.well-known/jwks.json', introspector.baseURL).toString(),
+      jwksUrl:
+        options.jwksUrl ??
+        new URL('/capabilities/.well-known/jwks.json', introspector.baseURL).toString(),
     });
     return resolvePublicKey;
   };
@@ -393,16 +418,23 @@ export function createOxyRequesterAssertionAuth(
     const request = req as OxyRequesterAssertionRequest;
     const serviceApp: OxyServiceAppContext | undefined = request.serviceApp;
     if (!serviceApp) {
-      reject(req, res, options, 401, 'REQUESTER_ASSERTION_REQUIRES_SERVICE_TOKEN', 'service_token_required');
+      reject(
+        req,
+        res,
+        options,
+        401,
+        'REQUESTER_ASSERTION_REQUIRES_SERVICE_TOKEN',
+        'service_token_required',
+      );
       return;
     }
     // One identity channel per request. An offline delegation header or an
     // identity some earlier middleware attached must never be combined with, or
     // silently replaced by, a present-requester assertion.
     if (
-      req.headers['x-oxy-user-id'] !== undefined
-      || request.serviceActingAs !== undefined
-      || (request.userId !== undefined && request.userId !== null)
+      req.headers['x-oxy-user-id'] !== undefined ||
+      request.serviceActingAs !== undefined ||
+      (request.userId !== undefined && request.userId !== null)
     ) {
       reject(req, res, options, 400, 'REQUESTER_ASSERTION_CONFLICT', 'identity_conflict');
       return;
@@ -437,17 +469,24 @@ export function createOxyRequesterAssertionAuth(
         presenter: { applicationId: serviceApp.appId, credentialId: serviceApp.credentialId },
       });
     } catch {
-      reject(req, res, options, 503, 'REQUESTER_ASSERTION_UNAVAILABLE', 'introspection_unavailable');
+      reject(
+        req,
+        res,
+        options,
+        503,
+        'REQUESTER_ASSERTION_UNAVAILABLE',
+        'introspection_unavailable',
+      );
       return;
     }
 
     if (
-      introspection.active !== true
-      || introspection.requesterAccountId !== claims.sub
-      || introspection.agentId !== claims.agentId
-      || introspection.applicationId !== claims.azp
-      || introspection.credentialId !== claims.cid
-      || introspection.jti !== claims.jti
+      introspection.active !== true ||
+      introspection.requesterAccountId !== claims.sub ||
+      introspection.agentId !== claims.agentId ||
+      introspection.applicationId !== claims.azp ||
+      introspection.credentialId !== claims.cid ||
+      introspection.jti !== claims.jti
     ) {
       reject(req, res, options, 401, 'REQUESTER_ASSERTION_INACTIVE', 'inactive');
       return;

package/src/server/serviceTokenLifetime.ts

@@ -6,8 +6,13 @@ export function hasBoundedServiceTokenLifetime(
   claims: { iat?: unknown; exp?: unknown },
   nowSeconds = Math.floor(Date.now() / 1000),
 ): boolean {
-  return typeof claims.iat === 'number' && Number.isSafeInteger(claims.iat)
-    && typeof claims.exp === 'number' && Number.isSafeInteger(claims.exp)
-    && claims.iat <= nowSeconds && claims.exp > claims.iat
-    && claims.exp - claims.iat <= OXY_SERVICE_TOKEN_MAX_LIFETIME_SECONDS;
+  return (
+    typeof claims.iat === 'number' &&
+    Number.isSafeInteger(claims.iat) &&
+    typeof claims.exp === 'number' &&
+    Number.isSafeInteger(claims.exp) &&
+    claims.iat <= nowSeconds &&
+    claims.exp > claims.iat &&
+    claims.exp - claims.iat <= OXY_SERVICE_TOKEN_MAX_LIFETIME_SECONDS
+  );
 }

package/src/server/traffic.ts

@@ -1,5 +1,10 @@
 import { observeNodeHttp, withoutNodeHttpObservation } from './trafficNodeHttp';
-import { observeTrafficSocket, observeTrafficWebSocket, type TrafficWebSocket, type TrafficSocket } from '@oxy.so/telemetry/socket';
+import {
+  observeTrafficSocket,
+  observeTrafficWebSocket,
+  type TrafficWebSocket,
+  type TrafficSocket,
+} from '@oxy.so/telemetry/socket';
 import { randomUUID } from 'node:crypto';
 import type { RequestHandler } from 'express';
 import { OxyServer } from './OxyServer';
@@ -9,7 +14,15 @@ import { OxyServer } from './OxyServer';
 // server-only and the server barrel already exports `./workloadIdentity`, so
 // there is nothing here for a phone to load.
 import { canAttestWorkloadIdentity } from './workloadIdentity';
-import { createTrafficCollector, instrumentTrafficFetch, trafficMiddleware, type TrafficFlow, type ServiceEndpoint, resolveOxyServiceEndpoint, infrastructureLocation } from '@oxy.so/telemetry/collector';
+import {
+  createTrafficCollector,
+  instrumentTrafficFetch,
+  trafficMiddleware,
+  type TrafficFlow,
+  type ServiceEndpoint,
+  resolveOxyServiceEndpoint,
+  infrastructureLocation,
+} from '@oxy.so/telemetry/collector';
 
 export interface EcosystemTrafficOptions {
   service: string;
@@ -29,8 +42,14 @@ export function createEcosystemTraffic(options: EcosystemTrafficOptions): {
   wrapFetch(fetcher: typeof fetch): typeof fetch;
   installFetch(): void;
   observeHttp: ReturnType<typeof trafficMiddleware>;
-  observeSocket(socket: TrafficSocket, options?: Parameters<typeof observeTrafficSocket>[4]): () => void;
-  observeWebSocket(socket: TrafficWebSocket, options?: Parameters<typeof observeTrafficWebSocket>[4]): () => void;
+  observeSocket(
+    socket: TrafficSocket,
+    options?: Parameters<typeof observeTrafficSocket>[4],
+  ): () => void;
+  observeWebSocket(
+    socket: TrafficWebSocket,
+    options?: Parameters<typeof observeTrafficWebSocket>[4],
+  ): () => void;
   stop(): Promise<void>;
 } {
   const region = options.region ?? process.env.AWS_REGION ?? 'unknown';
@@ -38,7 +57,9 @@ export function createEcosystemTraffic(options: EcosystemTrafficOptions): {
   const activityKey = process.env.OXY_ACTIVITY_API_KEY;
   const activitySecret = process.env.OXY_ACTIVITY_API_SECRET;
   if (!options.credential && Boolean(activityKey) !== Boolean(activitySecret)) {
-    throw new Error('Ecosystem activity requires a complete OXY_ACTIVITY_API_KEY and OXY_ACTIVITY_API_SECRET pair');
+    throw new Error(
+      'Ecosystem activity requires a complete OXY_ACTIVITY_API_KEY and OXY_ACTIVITY_API_SECRET pair',
+    );
   }
   const apiKey = activityKey || process.env.OXY_SERVICE_API_KEY;
   const apiSecret = activitySecret || process.env.OXY_SERVICE_API_SECRET;
@@ -73,24 +94,44 @@ export function createEcosystemTraffic(options: EcosystemTrafficOptions): {
   const fetcher = globalThis.fetch.bind(globalThis);
   const instanceId = randomUUID();
   const location = options.location ?? infrastructureLocation(region);
-  if (!location) throw new Error('Ecosystem activity requires a known infrastructure region or explicit location');
+  if (!location)
+    throw new Error(
+      'Ecosystem activity requires a known infrastructure region or explicit location',
+    );
   const post = async (path: string, data: unknown) => {
     const token = await credential();
     const response = await fetcher(new URL(path, baseURL), {
-      method: 'POST', headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
-      body: JSON.stringify(data), signal: AbortSignal.timeout(4_000),
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
+      body: JSON.stringify(data),
+      signal: AbortSignal.timeout(4_000),
     });
     if (!response.ok) throw new Error('Activity collection failed');
   };
-  const collector = createTrafficCollector(events => post('/internal/activity', events));
+  const collector = createTrafficCollector((events) => post('/internal/activity', events));
   let stopped = false;
   let heartbeatWork = Promise.resolve();
   let heartbeatPending = false;
-  const reportError = options.onError ?? (() => console.warn('Ecosystem activity publisher unavailable'));
+  const reportError =
+    options.onError ?? (() => console.warn('Ecosystem activity publisher unavailable'));
   const heartbeat = (removed = false) => {
     if (!removed && (stopped || heartbeatPending)) return heartbeatWork;
     heartbeatPending = true;
-    heartbeatWork = heartbeatWork.then(() => post('/internal/activity/infrastructure', { instanceId, service: options.service, region, ...location, status: options.ready?.() ? 'online' : 'unknown', removed })).catch(reportError).finally(() => { heartbeatPending = false; });
+    heartbeatWork = heartbeatWork
+      .then(() =>
+        post('/internal/activity/infrastructure', {
+          instanceId,
+          service: options.service,
+          region,
+          ...location,
+          status: options.ready?.() ? 'online' : 'unknown',
+          removed,
+        }),
+      )
+      .catch(reportError)
+      .finally(() => {
+        heartbeatPending = false;
+      });
     return heartbeatWork;
   };
   const flush = () => collector.flush().catch(reportError);
@@ -98,17 +139,30 @@ export function createEcosystemTraffic(options: EcosystemTrafficOptions): {
   const sockets = new WeakMap<object, () => void>();
   let fetchInstalled = false;
   const wrapFetch = (fetcher: typeof fetch): typeof fetch => {
-    const wrapped = instrumentTrafficFetch(fetcher, collector, options.service, region, options.resolveEndpoint ?? resolveOxyServiceEndpoint);
-    return Object.assign((...args: Parameters<typeof fetch>) => withoutNodeHttpObservation(() => wrapped(...args)), fetcher) as typeof fetch;
+    const wrapped = instrumentTrafficFetch(
+      fetcher,
+      collector,
+      options.service,
+      region,
+      options.resolveEndpoint ?? resolveOxyServiceEndpoint,
+    );
+    return Object.assign(
+      (...args: Parameters<typeof fetch>) => withoutNodeHttpObservation(() => wrapped(...args)),
+      fetcher,
+    ) as typeof fetch;
   };
   const observeHttp = trafficMiddleware(collector, options.service, region);
-  const timer = setInterval(() => { void flush(); }, 2_000);
+  const timer = setInterval(() => {
+    void flush();
+  }, 2_000);
   timer.unref?.();
   void heartbeat();
-  const heartbeatTimer = setInterval(() => { void heartbeat(); }, 10_000);
+  const heartbeatTimer = setInterval(() => {
+    void heartbeat();
+  }, 10_000);
   heartbeatTimer.unref?.();
   return {
-    record: flow => collector.record({ ...flow, service: options.service, region }),
+    record: (flow) => collector.record({ ...flow, service: options.service, region }),
     middleware: observeHttp as RequestHandler,
     observeHttp,
     wrapFetch,
@@ -118,14 +172,34 @@ export function createEcosystemTraffic(options: EcosystemTrafficOptions): {
       const original = globalThis.fetch;
       const wrapped = wrapFetch(original);
       globalThis.fetch = wrapped;
-      cleanups.add(() => { if (globalThis.fetch === wrapped) globalThis.fetch = original; });
-      cleanups.add(observeNodeHttp(collector, options.service, region, options.resolveEndpoint ?? resolveOxyServiceEndpoint));
+      cleanups.add(() => {
+        if (globalThis.fetch === wrapped) globalThis.fetch = original;
+      });
+      cleanups.add(
+        observeNodeHttp(
+          collector,
+          options.service,
+          region,
+          options.resolveEndpoint ?? resolveOxyServiceEndpoint,
+        ),
+      );
     },
     observeWebSocket(socket, socketOptions) {
       const existing = sockets.get(socket);
       if (existing) return existing;
-      const unobserve = observeTrafficWebSocket(socket, collector, options.service, region, socketOptions);
-      const cleanup = () => { unobserve(); socket.off('close', cleanup); cleanups.delete(cleanup); sockets.delete(socket); };
+      const unobserve = observeTrafficWebSocket(
+        socket,
+        collector,
+        options.service,
+        region,
+        socketOptions,
+      );
+      const cleanup = () => {
+        unobserve();
+        socket.off('close', cleanup);
+        cleanups.delete(cleanup);
+        sockets.delete(socket);
+      };
       sockets.set(socket, cleanup);
       socket.once('close', cleanup);
       cleanups.add(cleanup);
@@ -134,13 +208,33 @@ export function createEcosystemTraffic(options: EcosystemTrafficOptions): {
     observeSocket(socket, socketOptions) {
       const existing = sockets.get(socket);
       if (existing) return existing;
-      const unobserve = observeTrafficSocket(socket, collector, options.service, region, socketOptions);
-      const cleanup = () => { unobserve(); socket.off('disconnect', cleanup); cleanups.delete(cleanup); sockets.delete(socket); };
+      const unobserve = observeTrafficSocket(
+        socket,
+        collector,
+        options.service,
+        region,
+        socketOptions,
+      );
+      const cleanup = () => {
+        unobserve();
+        socket.off('disconnect', cleanup);
+        cleanups.delete(cleanup);
+        sockets.delete(socket);
+      };
       sockets.set(socket, cleanup);
       socket.once('disconnect', cleanup);
       cleanups.add(cleanup);
       return cleanup;
     },
-    async stop() { if (stopped) return; stopped = true; for (const cleanup of cleanups) cleanup(); cleanups.clear(); clearInterval(timer); clearInterval(heartbeatTimer); await flush(); await heartbeat(true); },
+    async stop() {
+      if (stopped) return;
+      stopped = true;
+      for (const cleanup of cleanups) cleanup();
+      cleanups.clear();
+      clearInterval(timer);
+      clearInterval(heartbeatTimer);
+      await flush();
+      await heartbeat(true);
+    },
   };
 }

package/src/server/trafficNodeHttp.ts

@@ -2,14 +2,23 @@ import http from 'node:http';
 import https from 'node:https';
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { syncBuiltinESMExports } from 'node:module';
-import { normalizeInfrastructureRegion, trafficType, type TrafficFlow, type ServiceEndpoint } from '@oxy.so/telemetry/collector';
+import {
+  normalizeInfrastructureRegion,
+  trafficType,
+  type TrafficFlow,
+  type ServiceEndpoint,
+} from '@oxy.so/telemetry/collector';
 
 const suppressed = new AsyncLocalStorage<boolean>();
-export function withoutNodeHttpObservation<T>(callback: () => T): T { return suppressed.run(true, callback); }
+export function withoutNodeHttpObservation<T>(callback: () => T): T {
+  return suppressed.run(true, callback);
+}
 
 /** Node and Bun share the HTTP facade; Bun does not emit Node's HTTP diagnostic channels. */
 export function observeNodeHttp(
-  collector: { record(flow: TrafficFlow): void }, service: string, region: string,
+  collector: { record(flow: TrafficFlow): void },
+  service: string,
+  region: string,
   resolveEndpoint: (url: URL) => ServiceEndpoint | undefined,
 ): () => void {
   const seen = new WeakSet<http.ClientRequest>();
@@ -20,28 +29,60 @@ export function observeNodeHttp(
     const host = request.getHeader('host') ?? request.host;
     if (typeof host !== 'string') return request;
     const url = new URL(request.path || '/', `${request.protocol || 'http:'}//${host}`);
-    if (/^\/(?:internal\/activity|auth\/service-token|platform-infrastructure)(?:\/|$)/.test(url.pathname)) return request;
+    if (
+      /^\/(?:internal\/activity|auth\/service-token|platform-infrastructure)(?:\/|$)/.test(
+        url.pathname,
+      )
+    )
+      return request;
     const peer = resolveEndpoint(url);
     if (peer && !request.headersSent) request.setHeader('X-Oxy-Source-Region', region);
-    const flow: TrafficFlow = { service, region, activityType: trafficType(url.pathname), scope: peer ? 'internal' : 'external', direction: 'outbound', sourceRegion: region, sourceService: service, targetService: peer?.service };
+    const flow: TrafficFlow = {
+      service,
+      region,
+      activityType: trafficType(url.pathname),
+      scope: peer ? 'internal' : 'external',
+      direction: 'outbound',
+      sourceRegion: region,
+      sourceService: service,
+      targetService: peer?.service,
+    };
     const emit = request.emit;
     let recorded = false;
-    const restore = () => { if (request.emit === observedEmit) request.emit = emit; restoreRequests.delete(restore); };
+    const restore = () => {
+      if (request.emit === observedEmit) request.emit = emit;
+      restoreRequests.delete(restore);
+    };
     // Intercept notifications without adding an 'error' listener: observation
     // must not turn an unhandled application error into a swallowed error.
-    const observedEmit: typeof request.emit = function (this: http.ClientRequest, event: string | symbol, ...args: unknown[]) {
+    const observedEmit: typeof request.emit = function (
+      this: http.ClientRequest,
+      event: string | symbol,
+      ...args: unknown[]
+    ) {
       try {
         if (!recorded && event === 'response') {
           recorded = true;
           const response = args[0] as http.IncomingMessage;
-          const targetRegion = peer ? normalizeInfrastructureRegion(response.headers['x-oxy-region']) : undefined;
+          const targetRegion = peer
+            ? normalizeInfrastructureRegion(response.headers['x-oxy-region'])
+            : undefined;
           collector.record({ ...flow, targetRegion });
-          collector.record({ ...flow, direction: 'inbound', sourceRegion: targetRegion, targetRegion: region, sourceService: peer?.service, targetService: service });
+          collector.record({
+            ...flow,
+            direction: 'inbound',
+            sourceRegion: targetRegion,
+            targetRegion: region,
+            sourceService: peer?.service,
+            targetService: service,
+          });
         } else if (!recorded && (event === 'error' || event === 'close')) {
           recorded = true;
           collector.record(flow);
         }
-      } catch { /* A metrics failure cannot change a request's behavior. */ }
+      } catch {
+        /* A metrics failure cannot change a request's behavior. */
+      }
       if (event === 'close') restore();
       return emit.call(this, event, ...args);
     };
@@ -50,13 +91,19 @@ export function observeNodeHttp(
     return request;
   };
   const safelyObserve = (request: http.ClientRequest) => {
-    try { return observe(request); } catch { return request; }
+    try {
+      return observe(request);
+    } catch {
+      return request;
+    }
   };
-  const patches = [http, https].map(module => {
+  const patches = [http, https].map((module) => {
     const request = module.request;
     const get = module.get;
-    const wrappedRequest = ((...args: Parameters<typeof request>) => safelyObserve(request.apply(module, args))) as typeof request;
-    const wrappedGet = ((...args: Parameters<typeof get>) => safelyObserve(get.apply(module, args))) as typeof get;
+    const wrappedRequest = ((...args: Parameters<typeof request>) =>
+      safelyObserve(request.apply(module, args))) as typeof request;
+    const wrappedGet = ((...args: Parameters<typeof get>) =>
+      safelyObserve(get.apply(module, args))) as typeof get;
     module.request = wrappedRequest;
     module.get = wrappedGet;
     return () => {

package/src/server/userInvalidation.ts

@@ -58,10 +58,7 @@ import {
   type OxyUserChangeReason,
   type OxyUserInvalidationEvent,
 } from '@oxy.so/contracts';
-import {
-  evictOxyIdentityCache,
-  type OxyIdentityCacheEvictor,
-} from '../utils/identityCacheSweep';
+import { evictOxyIdentityCache, type OxyIdentityCacheEvictor } from '../utils/identityCacheSweep';
 
 /**
  * The publish surface of a Redis client. Both `ioredis` and `node-redis`

package/src/server/workloadIdentity.client.ts

@@ -1,4 +1,8 @@
-import type { WorkloadServiceToken, WorkloadServiceTokenOptions } from './workloadIdentity';
+import type {
+  WorkloadAttestation,
+  WorkloadServiceToken,
+  WorkloadServiceTokenOptions,
+} from './workloadIdentity';
 
 /** Workload attestation belongs to a Node host, never a browser or device. */
 export function canAttestWorkloadIdentity(): boolean {
@@ -10,3 +14,10 @@ export async function requestWorkloadServiceToken(
 ): Promise<WorkloadServiceToken> {
   throw new Error('Workload identity is only available on a Node host');
 }
+
+export async function attestWorkloadIdentity(_options: {
+  nonce: string;
+  fetch?: typeof fetch;
+}): Promise<WorkloadAttestation> {
+  throw new Error('Workload identity is only available on a Node host');
+}