@oxy.so/core 4.9.0 → 4.9.1

package/src/i18n/locales/en-US.ts

@@ -1465,14 +1465,6 @@ const dict = {
     },
   },
   preferences: {
-    displayCurrency: {
-      label: 'Display currency',
-      saveFailed: 'Could not save display currency. Please try again.',
-      unavailable: 'Equivalent in {{currency}} unavailable',
-      approximate: 'Approx. {{amount}}',
-      estimate: 'Display estimate. The final payable amount is quoted in FAIR at checkout.',
-    },
-
     title: 'Preferences',
     subtitle: 'Theme, motion, and regional settings',
     sections: {

package/src/i18n/locales/es-ES.ts

@@ -1470,14 +1470,6 @@ const dict = {
     },
   },
   preferences: {
-    displayCurrency: {
-      label: 'Moneda mostrada',
-      saveFailed: 'No se ha podido guardar la moneda. Inténtalo de nuevo.',
-      unavailable: 'Equivalencia en {{currency}} no disponible',
-      approximate: 'Aprox. {{amount}}',
-      estimate: 'Importe orientativo. El importe final se cotiza en FAIR al pagar.',
-    },
-
     title: 'Preferencias',
     subtitle: 'Tema, movimiento y configuración regional',
     sections: {

package/src/index.ts

@@ -616,4 +616,3 @@ export type {
 } from '@oxy.so/contracts';
 
 export type { ProfileAccessInput, ProfileAccessDecision } from '@oxy.so/contracts';
-export type { AccountInvitation, AccountInvitationPreview } from './api/accounts';

package/src/models/interfaces.ts

@@ -264,8 +264,6 @@ export interface NotificationPreferences {
  * Persisted on the User document.
  */
 export interface UserPreferences {
-  /** Preferred display units only; never changes a payment's denomination. */
-  displayCurrency?: 'USD' | 'EUR' | 'FAIR';
   /** BCP-47 language tag, e.g. "en-US", "es-ES". Empty string = follow device. */
   language?: string;
   /** Theme mode preference. */

package/src/server/OxyServer.ts

@@ -162,6 +162,22 @@ interface ServiceTokenCacheEntry {
 }
 
 const WORKLOAD_CACHE_KEY = 'workload-identity';
+
+/**
+ * The resource server a service token is minted for (Oxy's closed set,
+ * `packages/api/src/config/serviceTokenAudiences.ts`). A token is only ever
+ * accepted by its own audience: Oxy's API refuses a `kaana.ai` token and
+ * https://kaana.ai/v1 refuses an `oxy-api` one (Kaana ADR 0002 decision 6).
+ */
+export type ServiceTokenAudience = 'oxy-api' | 'kaana.ai' | 'oxy-api:kaana-control';
+
+/** What `serviceToken()` mints, and what Oxy assumes when no audience is sent. */
+export const DEFAULT_SERVICE_TOKEN_AUDIENCE: ServiceTokenAudience = 'oxy-api';
+
+/** Tokens of different audiences never share a cache entry; the default keeps its old key. */
+function audienceCacheKey(audience: ServiceTokenAudience, key: string): string {
+  return audience === DEFAULT_SERVICE_TOKEN_AUDIENCE ? key : `${audience}\u0000${key}`;
+}
 /** A token is reused until 60s before expiry (clock drift). */
 const TOKEN_REUSE_MARGIN_MS = 60_000;
 
@@ -298,6 +314,20 @@ export class OxyServer extends OxyServices {
    * {@link ServiceCredentialMismatchError} rather than return the cached token.
    */
   async serviceToken(apiKey?: string, apiSecret?: string): Promise<string> {
+    return this.serviceTokenFor(DEFAULT_SERVICE_TOKEN_AUDIENCE, apiKey, apiSecret);
+  }
+
+  /**
+   * A service token for `audience` — e.g. `kaana.ai` for https://kaana.ai/v1.
+   * Minted, cached and refreshed exactly as {@link serviceToken} (which is this
+   * with `oxy-api`), from the same credential or attested workload identity;
+   * each audience has its own cache entry, so one never answers for another.
+   */
+  async serviceTokenFor(
+    audience: ServiceTokenAudience,
+    apiKey?: string,
+    apiSecret?: string,
+  ): Promise<string> {
     const key = apiKey || this.serviceApiKey;
     const secret = apiSecret || this.serviceApiSecret;
 
@@ -305,7 +335,7 @@ export class OxyServer extends OxyServices {
       // No credential — prove what this process IS instead. The fallback, not the
       // preference: a deployment that still has a credential keeps using it.
       if (canAttestWorkloadIdentity()) {
-        return this.workloadServiceToken();
+        return this.workloadServiceToken(audience);
       }
       throw new Error(
         'Service credentials not provided. Pass serviceAuth, call configureServiceAuth(), or pass apiKey and apiSecret.',
@@ -314,7 +344,7 @@ export class OxyServer extends OxyServices {
 
     // The apiKey is the credential's PUBLIC id (`oxy_dk_…`, the OAuth
     // client_id), so it keys the in-memory cache as is; the secret never does.
-    const cacheKey = key;
+    const cacheKey = audienceCacheKey(audience, key);
     const now = Date.now();
     const providedSecretBuf = Buffer.from(secret, 'utf8');
 
@@ -351,7 +381,7 @@ export class OxyServer extends OxyServices {
       this.serviceTokens.set(cacheKey, entry);
     }
 
-    const pending = this.mintServiceToken(key, secret, cacheKey, providedSecretBuf);
+    const pending = this.mintServiceToken(key, secret, cacheKey, providedSecretBuf, audience);
     entry.pending = pending;
     try {
       return await pending;
@@ -382,7 +412,10 @@ export class OxyServer extends OxyServices {
       this.serviceTokens.clear();
       return;
     }
-    this.serviceTokens.delete(targetKey);
+    // Every audience minted from that credential goes with it.
+    for (const [cacheKey, entry] of this.serviceTokens) {
+      if (entry.apiKey === targetKey) this.serviceTokens.delete(cacheKey);
+    }
   }
 
   /**
@@ -580,11 +613,16 @@ export class OxyServer extends OxyServices {
     secret: string,
     cacheKey: string,
     secretBuf: Buffer,
+    audience: ServiceTokenAudience,
   ): Promise<string> {
     const response = await this.request<ServiceTokenResponse>(
       'POST',
       '/auth/service-token',
-      { apiKey: key, apiSecret: secret },
+      {
+        apiKey: key,
+        apiSecret: secret,
+        ...(audience === DEFAULT_SERVICE_TOKEN_AUDIENCE ? {} : { audience }),
+      },
       { cache: false, retry: false, skipAuth: true },
     );
     const expiresAt = Date.now() + response.expiresIn * 1000;
@@ -605,9 +643,10 @@ export class OxyServer extends OxyServices {
     return response.token;
   }
 
-  /** A token obtained by attestation, cached like a credential's (one identity per process). */
-  private async workloadServiceToken(): Promise<string> {
-    const entry = this.serviceTokens.get(WORKLOAD_CACHE_KEY);
+  /** A token obtained by attestation, cached like a credential's (one identity per process, one entry per audience). */
+  private async workloadServiceToken(audience: ServiceTokenAudience): Promise<string> {
+    const cacheKey = audienceCacheKey(audience, WORKLOAD_CACHE_KEY);
+    const entry = this.serviceTokens.get(cacheKey);
     if (
       entry?.token &&
       reusableServiceToken(entry.token) &&
@@ -623,11 +662,14 @@ export class OxyServer extends OxyServices {
       pending: null,
       apiKey: WORKLOAD_CACHE_KEY,
     };
-    this.serviceTokens.set(WORKLOAD_CACHE_KEY, seeded);
+    this.serviceTokens.set(cacheKey, seeded);
 
     const pending = (async () => {
-      const granted = await requestWorkloadServiceToken({ baseUrl: this.baseURL });
-      const current = this.serviceTokens.get(WORKLOAD_CACHE_KEY);
+      const granted = await requestWorkloadServiceToken({
+        baseUrl: this.baseURL,
+        ...(audience === DEFAULT_SERVICE_TOKEN_AUDIENCE ? {} : { audience }),
+      });
+      const current = this.serviceTokens.get(cacheKey);
       if (current) {
         current.token = granted.token;
         current.expiresAt = Date.now() + granted.expiresIn * 1000;
@@ -639,12 +681,11 @@ export class OxyServer extends OxyServices {
     try {
       return await pending;
     } catch (error) {
-      const failed = this.serviceTokens.get(WORKLOAD_CACHE_KEY);
-      if (failed?.pending === pending && !failed.token)
-        this.serviceTokens.delete(WORKLOAD_CACHE_KEY);
+      const failed = this.serviceTokens.get(cacheKey);
+      if (failed?.pending === pending && !failed.token) this.serviceTokens.delete(cacheKey);
       throw error;
     } finally {
-      const settled = this.serviceTokens.get(WORKLOAD_CACHE_KEY);
+      const settled = this.serviceTokens.get(cacheKey);
       if (settled?.pending === pending) settled.pending = null;
     }
   }

package/src/server/index.ts

@@ -21,8 +21,9 @@ export {
   OxyServer,
   ServiceCredentialMismatchError,
   ANONYMOUS_SERVICE_TOKEN_RETRY_MS,
+  DEFAULT_SERVICE_TOKEN_AUDIENCE,
 } from './OxyServer';
-export type { OxyServerConfig, ServiceTokenResponse } from './OxyServer';
+export type { OxyServerConfig, ServiceTokenAudience, ServiceTokenResponse } from './OxyServer';
 export {
   ServerAppsApi,
   ServerAgencyApi,

package/src/server/workloadIdentity.ts

@@ -41,6 +41,11 @@ const STS_BODY = 'Action=GetCallerIdentity&Version=2011-06-15';
 export interface WorkloadServiceTokenOptions {
   /** Oxy's base URL, e.g. `https://api.oxy.so`. */
   baseUrl: string;
+  /**
+   * The resource server the token is for (e.g. `kaana.ai`). Omitted, Oxy mints
+   * for `oxy-api`, as it always has.
+   */
+  audience?: string;
   /** Injected in tests; defaults to the global. */
   fetch?: typeof fetch;
 }
@@ -233,7 +238,12 @@ export async function requestWorkloadServiceToken(
   const tokenResponse = await fetchImpl(`${base}/auth/service-token/workload`, {
     method: 'POST',
     headers: { 'content-type': 'application/json' },
-    body: JSON.stringify({ provider: 'aws-iam', nonce: challenge.nonce, attestation }),
+    body: JSON.stringify({
+      provider: 'aws-iam',
+      nonce: challenge.nonce,
+      attestation,
+      ...(options.audience === undefined ? {} : { audience: options.audience }),
+    }),
   });
   if (!tokenResponse.ok) {
     // The body carries a bounded `reason`; the token never travels on a failure,

package/src/utils/corsPreflight.ts

@@ -0,0 +1,49 @@
+/**
+ * Whether a browser has to send a CORS preflight (`OPTIONS`) before this
+ * cross-origin request goes out, per the Fetch standard's CORS-safelisted
+ * methods and request headers.
+ *
+ * The SDK uses it for one invariant: its anonymous telemetry headers
+ * (`X-Oxy-Activity-Id`, `X-Oxy-Edge-Region`) ride only on requests that are
+ * preflighted anyway, so they never turn a request that would go straight out
+ * into one that first waits a round trip for an `OPTIONS`. A browser caches a
+ * preflight per URL, so without this every distinct anonymous read (a post's
+ * replies, a profile, a public app record) paid a round trip of its own.
+ *
+ * Deliberately conservative: a header it does not recognise as safelisted
+ * counts as needing a preflight, which only means the telemetry headers ride
+ * along exactly as they always did. Value-level rules (for example `Accept`'s
+ * 128-byte limit) are not modelled; a misjudgement in that direction drops two
+ * advisory headers from one request and nothing else.
+ */
+
+const SAFELISTED_METHODS: ReadonlySet<string> = new Set(['GET', 'HEAD', 'POST']);
+
+const SAFELISTED_HEADERS: ReadonlySet<string> = new Set([
+  'accept',
+  'accept-language',
+  'content-language',
+  'content-type',
+]);
+
+const SAFELISTED_CONTENT_TYPES: ReadonlySet<string> = new Set([
+  'application/x-www-form-urlencoded',
+  'multipart/form-data',
+  'text/plain',
+]);
+
+export function requiresCorsPreflight(
+  method: string,
+  headers: Iterable<readonly [string, string]>,
+): boolean {
+  if (!SAFELISTED_METHODS.has(method.toUpperCase())) return true;
+  for (const [rawName, value] of headers) {
+    const name = rawName.toLowerCase();
+    if (!SAFELISTED_HEADERS.has(name)) return true;
+    if (name === 'content-type') {
+      const essence = value.split(';')[0]?.trim().toLowerCase() ?? '';
+      if (!SAFELISTED_CONTENT_TYPES.has(essence)) return true;
+    }
+  }
+  return false;
+}