@oxyhq/core 3.9.1 → 3.10.1

package/dist/cjs/i18n/locales/en-US.json

@@ -129,6 +129,15 @@
             "title": "Reputation = Trust & Growth",
             "body": "Oxy Trust is a reputation system that reacts to what you do. Helpful, respectful, constructive actions earn it. Harmful or low‑effort stuff chips it away. More reputation can unlock benefits; low reputation can limit features. It keeps things fair and rewards real contribution."
         },
+        "name": {
+            "title": "What's your name?",
+            "body": "Add your name so people know who you are.",
+            "firstLabel": "First name",
+            "firstPlaceholder": "Your first name",
+            "lastLabel": "Last name",
+            "lastPlaceholder": "Your last name",
+            "saveFailed": "Could not save your name"
+        },
         "avatar": {
             "title": "Make It Yours",
             "body": "Add an avatar so people recognize you. It will show anywhere you show up here. Skip if you want — you can add it later.",

package/dist/cjs/i18n/locales/es-ES.json

@@ -849,6 +849,15 @@
             "title": "Reputación = Confianza y crecimiento",
             "body": "Oxy Trust es un sistema de reputación que reacciona a lo que haces. Las acciones útiles, respetuosas y constructivas la aumentan. Las acciones dañinas o de poco esfuerzo la reducen. Más reputación puede desbloquear beneficios; poca reputación puede limitar funciones. Mantiene la justicia y recompensa la contribución real."
         },
+        "name": {
+            "title": "¿Cuál es tu nombre?",
+            "body": "Añade tu nombre para que la gente sepa quién eres.",
+            "firstLabel": "Nombre",
+            "firstPlaceholder": "Tu nombre",
+            "lastLabel": "Apellidos",
+            "lastPlaceholder": "Tus apellidos",
+            "saveFailed": "No se pudo guardar tu nombre"
+        },
         "avatar": {
             "title": "Hazlo tuyo",
             "body": "Añade un avatar para que te reconozcan. Se mostrará donde aparezcas aquí. Puedes omitirlo — puedes añadirlo más tarde.",

package/dist/cjs/i18n/locales/locales/en-US.json

@@ -129,6 +129,15 @@
       "title": "Reputation = Trust & Growth",
       "body": "Oxy Trust is a reputation system that reacts to what you do. Helpful, respectful, constructive actions earn it. Harmful or low‑effort stuff chips it away. More reputation can unlock benefits; low reputation can limit features. It keeps things fair and rewards real contribution."
     },
+    "name": {
+      "title": "What's your name?",
+      "body": "Add your name so people know who you are.",
+      "firstLabel": "First name",
+      "firstPlaceholder": "Your first name",
+      "lastLabel": "Last name",
+      "lastPlaceholder": "Your last name",
+      "saveFailed": "Could not save your name"
+    },
     "avatar": {
       "title": "Make It Yours",
       "body": "Add an avatar so people recognize you. It will show anywhere you show up here. Skip if you want — you can add it later.",

package/dist/cjs/i18n/locales/locales/es-ES.json

@@ -849,6 +849,15 @@
       "title": "Reputación = Confianza y crecimiento",
       "body": "Oxy Trust es un sistema de reputación que reacciona a lo que haces. Las acciones útiles, respetuosas y constructivas la aumentan. Las acciones dañinas o de poco esfuerzo la reducen. Más reputación puede desbloquear beneficios; poca reputación puede limitar funciones. Mantiene la justicia y recompensa la contribución real."
     },
+    "name": {
+      "title": "¿Cuál es tu nombre?",
+      "body": "Añade tu nombre para que la gente sepa quién eres.",
+      "firstLabel": "Nombre",
+      "firstPlaceholder": "Tu nombre",
+      "lastLabel": "Apellidos",
+      "lastPlaceholder": "Tus apellidos",
+      "saveFailed": "No se pudo guardar tu nombre"
+    },
     "avatar": {
       "title": "Hazlo tuyo",
       "body": "Añade un avatar para que te reconozcan. Se mostrará donde aparezcas aquí. Puedes omitirlo — puedes añadirlo más tarde.",

package/dist/cjs/index.js

@@ -20,8 +20,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.rgbToHex = exports.hexToRgb = exports.lightenColor = exports.darkenColor = exports.isAndroid = exports.isIOS = exports.isNative = exports.isWeb = exports.setPlatformOS = exports.getPlatformOS = exports.isRTLLocale = exports.normalizeLanguageCode = exports.getNativeLanguageName = exports.getLanguageName = exports.getLanguageMetadata = exports.SUPPORTED_LANGUAGES = exports.TopicSource = exports.TopicType = exports.SECURITY_EVENT_SEVERITY_MAP = exports.DeviceManager = exports.RecoveryPhraseService = exports.SignatureService = exports.IdentityPersistError = exports.IdentityAlreadyExistsError = exports.KeyManager = exports.sessionsArraysEqual = exports.normalizeAndSortSessions = exports.mergeSessions = exports.authenticatedApiCall = exports.withAuthErrorHandling = exports.isAuthenticationError = exports.ensureValidToken = exports.AuthenticationFailedError = exports.SessionSyncRequiredError = exports.getNormalizedUserHandle = exports.getCanonicalUserHandle = exports.normalizeUserIdentityOrNull = exports.normalizeUserIdentity = exports.getNormalizedUserId = exports.OxyAppDataIdentifierError = exports.ServiceCredentialMismatchError = exports.createCrossDomainAuth = exports.CrossDomainAuth = exports.createAuthManager = exports.AuthManager = exports.oxyClient = exports.OXY_CLOUD_URL = exports.OxyAuthenticationTimeoutError = exports.OxyAuthenticationError = exports.OxyServices = void 0;
 exports.isRequiredNumber = exports.isRequiredString = exports.isValidPassword = exports.isValidUsername = exports.isValidEmail = exports.PASSWORD_REGEX = exports.USERNAME_REGEX = exports.EMAIL_REGEX = exports.retryAsync = exports.validateRequiredFields = exports.handleHttpError = exports.createApiError = exports.ErrorCodes = exports.safeJsonParse = exports.buildPaginationParams = exports.buildUrl = exports.buildSearchParams = exports.translate = exports.createDebugLogger = exports.debugError = exports.debugWarn = exports.debugLog = exports.isDev = exports.withRetry = exports.delay = exports.shouldAllowRequest = exports.recordSuccess = exports.recordFailure = exports.calculateBackoffInterval = exports.createCircuitBreakerState = exports.DEFAULT_CIRCUIT_BREAKER_CONFIG = exports.isRetryableError = exports.isNetworkError = exports.isServerError = exports.isRateLimitError = exports.isNotFoundError = exports.isForbiddenError = exports.isUnauthorizedError = exports.isAlreadyRegisteredError = exports.getErrorMessage = exports.getErrorStatus = exports.HttpStatus = exports.getSystemColorScheme = exports.systemPrefersDarkMode = exports.getOppositeTheme = exports.normalizeColorScheme = exports.normalizeTheme = exports.getContrastTextColor = exports.isLightColor = exports.withOpacity = void 0;
-exports.isCentralIdPOrigin = exports.buildSsoBounceUrl = exports.getSsoCallbackBootstrapScript = exports.ssoNavigate = exports.ssoCallbackBootstrapKey = exports.ssoAttemptedKey = exports.ssoNoSessionKey = exports.ssoDestKey = exports.ssoGuardKey = exports.ssoStateKey = exports.SSO_GUARD_TTL_MS = exports.SSO_CALLBACK_PATH = exports.generateSsoState = exports.consumeSsoReturn = exports.parseSsoReturnFragment = exports.resolveCentralAuthUrl = exports.CENTRAL_IDP_APEX = exports.CENTRAL_AUTH_URL = exports.MULTIPART_TLDS = exports.registrableApex = exports.autoDetectAuthWebUrl = exports.getAccountColor = exports.mergeAccountsFromRefreshAll = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.logPerformance = exports.logPayment = exports.logDevice = exports.logUser = exports.logSession = exports.logApi = exports.logAuth = exports.LogLevel = exports.logger = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = void 0;
-exports.packageInfo = exports.runColdBoot = exports.guardActive = void 0;
+exports.guardActive = exports.isCentralIdPOrigin = exports.buildSsoBounceUrl = exports.getSsoCallbackBootstrapScript = exports.ssoNavigate = exports.ssoCallbackBootstrapKey = exports.ssoAttemptedKey = exports.ssoNoSessionKey = exports.ssoDestKey = exports.ssoGuardKey = exports.ssoStateKey = exports.SSO_GUARD_TTL_MS = exports.SSO_CALLBACK_PATH = exports.generateSsoState = exports.consumeSsoReturn = exports.parseSsoReturnFragment = exports.resolveCentralAuthUrl = exports.CENTRAL_IDP_APEX = exports.CENTRAL_AUTH_URL = exports.registrableApex = exports.autoDetectAuthWebUrl = exports.getAccountColor = exports.mergeAccountsFromRefreshAll = exports.formatPublicKeyHandle = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.createQuickAccount = exports.buildAccountsArray = exports.updateAvatarVisibility = exports.logPerformance = exports.logPayment = exports.logDevice = exports.logUser = exports.logSession = exports.logApi = exports.logAuth = exports.LogLevel = exports.logger = exports.validateAndSanitizeUserInput = exports.isValidObjectId = exports.sanitizeHTML = exports.sanitizeString = exports.isValidFileType = exports.isValidFileSize = exports.isValidDate = exports.isValidURL = exports.isValidUUID = exports.isValidObject = exports.isValidArray = exports.isRequiredBoolean = void 0;
+exports.packageInfo = exports.runColdBoot = void 0;
 // Ensure crypto polyfills are loaded before anything else
 require("./crypto/polyfill");
 // ---------------------------------------------------------------------------
@@ -242,7 +242,6 @@ Object.defineProperty(exports, "getAccountColor", { enumerable: true, get: funct
 var fapiAutoDetect_1 = require("./utils/fapiAutoDetect");
 Object.defineProperty(exports, "autoDetectAuthWebUrl", { enumerable: true, get: function () { return fapiAutoDetect_1.autoDetectAuthWebUrl; } });
 Object.defineProperty(exports, "registrableApex", { enumerable: true, get: function () { return fapiAutoDetect_1.registrableApex; } });
-Object.defineProperty(exports, "MULTIPART_TLDS", { enumerable: true, get: function () { return fapiAutoDetect_1.MULTIPART_TLDS; } });
 // Central cross-domain SSO (opaque single-use code bounce via auth.oxy.so)
 var authWebUrl_1 = require("./utils/authWebUrl");
 Object.defineProperty(exports, "CENTRAL_AUTH_URL", { enumerable: true, get: function () { return authWebUrl_1.CENTRAL_AUTH_URL; } });

package/dist/cjs/mixins/OxyServices.assets.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OxyServicesAssetsMixin = OxyServicesAssetsMixin;
+const platform_1 = require("../utils/platform");
 function OxyServicesAssetsMixin(Base) {
     return class extends Base {
         constructor(...args) {
@@ -43,8 +44,8 @@ function OxyServicesAssetsMixin(Base) {
          *
          * For a CDN-signed URL fetched from the API, use {@link getFileDownloadUrlAsync}.
          */
-        getFileDownloadUrl(fileId, variant, expiresIn) {
-            const token = this.getClient().getAccessToken();
+        getFileDownloadUrl(fileId, variant, expiresIn, options = {}) {
+            const token = options.omitToken ? undefined : this.getClient().getAccessToken();
             // Public case: no auth token and no expiry requested → clean CDN URL.
             // CloudFront serves the public media origin under `${cloudURL}/<id>`.
             if (!token && !expiresIn) {
@@ -192,10 +193,32 @@ function OxyServicesAssetsMixin(Base) {
                     formData.append('file', file, fileName);
                 }
                 else if ('uri' in file && typeof file.uri === 'string') {
-                    // React Native file descriptor — RN's FormData handles {uri, type, name} natively.
-                    // It reads the file from disk during the multipart request — no in-JS Blob
-                    // conversion (which would fail on Hermes for ArrayBuffer-backed Blobs).
-                    formData.append('file', file, fileName);
+                    const descriptor = file;
+                    if ((0, platform_1.isReactNative)()) {
+                        // React Native file descriptor — RN's FormData handles {uri, type, name} natively.
+                        // It reads the file from disk during the multipart request — no in-JS Blob
+                        // conversion (which would fail on Hermes for ArrayBuffer-backed Blobs).
+                        formData.append('file', descriptor, fileName);
+                    }
+                    else {
+                        // Web (browser/Node): the browser's FormData cannot read bytes from a plain
+                        // { uri } object — it would serialize "[object Object]" and the server would
+                        // store a 0-byte asset. Materialize the uri into a real Blob first. `fetch`
+                        // resolves blob:, data:, and http(s): uris on web, so all picker outputs work.
+                        const res = await fetch(descriptor.uri);
+                        if (!res.ok) {
+                            throw new Error(`Failed to read file from uri (status ${res.status})`);
+                        }
+                        const fetched = await res.blob();
+                        // Preserve the descriptor's declared MIME type when the fetched blob has none.
+                        const blob = fetched.type === '' && descriptor.type
+                            ? new Blob([fetched], { type: descriptor.type })
+                            : fetched;
+                        if (blob.size === 0) {
+                            throw new Error('Cannot upload an empty file');
+                        }
+                        formData.append('file', blob, fileName);
+                    }
                 }
                 else {
                     throw new Error('Unsupported file input: expected File, Blob, or { uri, type?, name?, size? } descriptor');

package/dist/cjs/mixins/OxyServices.utility.js

@@ -691,33 +691,45 @@ function OxyServicesUtilityMixin(Base) {
                         }
                         return next(new Error('Invalid token'));
                     }
-                    const userId = decoded.userId || decoded.id;
-                    if (!userId) {
+                    const claimedUserId = decoded.userId || decoded.id;
+                    if (!claimedUserId) {
                         return next(new Error('Invalid token payload'));
                     }
                     // Check expiration — reject tokens at exact expiry second (use <=)
                     if (decoded.exp && decoded.exp <= Math.floor(Date.now() / 1000)) {
                         return next(new Error('Token expired'));
                     }
-                    // Validate session if available
-                    if (decoded.sessionId) {
-                        try {
-                            const result = await oxyInstance.validateSession(decoded.sessionId, {
-                                useHeaderValidation: true,
-                            });
-                            if (!result || !result.valid) {
-                                return next(new Error('Session invalid'));
-                            }
+                    // A server-validated session is mandatory. A bare decoded JWT proves
+                    // nothing — the signature is not verified here, so without a session
+                    // round-trip a forged token could claim any user id.
+                    if (!decoded.sessionId) {
+                        return next(new Error('Session required'));
+                    }
+                    let userId = claimedUserId;
+                    try {
+                        const result = await oxyInstance.validateSession(decoded.sessionId, {
+                            useHeaderValidation: true,
+                        });
+                        if (!result || !result.valid || !result.user) {
+                            return next(new Error('Session invalid'));
                         }
-                        catch (validateErr) {
-                            if (debug) {
-                                loggerUtils_1.logger.debug('[oxy.authSocket] Session validation failed', {
-                                    component: 'auth',
-                                    method: 'authSocket',
-                                }, validateErr);
-                            }
-                            return next(new Error('Session validation failed'));
+                        // The session is the source of truth. The client-claimed user id
+                        // must match the server-validated identity, otherwise a valid
+                        // session could be paired with a forged user id.
+                        const validatedUserId = getUserIdentityId(result.user);
+                        if (!validatedUserId || validatedUserId !== claimedUserId) {
+                            return next(new Error('Session user mismatch'));
                         }
+                        userId = validatedUserId;
+                    }
+                    catch (validateErr) {
+                        if (debug) {
+                            loggerUtils_1.logger.debug('[oxy.authSocket] Session validation failed', {
+                                component: 'auth',
+                                method: 'authSocket',
+                            }, validateErr);
+                        }
+                        return next(new Error('Session validation failed'));
                     }
                     // Attach user data to socket. We expose BOTH `socket.data.userId`
                     // (the official Socket.IO data slot) and `socket.user` because
@@ -782,9 +794,9 @@ function OxyServicesUtilityMixin(Base) {
          * Express.js middleware that enforces a specific service-token scope.
          *
          * Mount AFTER `auth()` / `serviceAuth()` — relies on `req.serviceApp` and
-         * (when delegation is in effect) `req.serviceActingAs.scopes`. The scope
-         * is granted if EITHER list contains it, mirroring the OAuth2 model where
-         * the app's app-level scopes and the per-user delegated scopes both count.
+         * (when delegation is in effect) `req.serviceActingAs.scopes`. App-only
+         * service requests require the app scope. Delegated user requests require
+         * BOTH the app scope and the per-user delegation scope.
          *
          * Requests authenticated as a regular user (no service token) are rejected
          * with 403 — scope-protected endpoints are service-to-service by design.
@@ -814,7 +826,12 @@ function OxyServicesUtilityMixin(Base) {
                     });
                     return;
                 }
-                if (appScopes.includes(scope) || delegatedScopes.includes(scope)) {
+                const appHasScope = appScopes.includes(scope);
+                const delegationHasScope = delegatedScopes.includes(scope);
+                const hasRequiredScope = req.serviceActingAs
+                    ? appHasScope && delegationHasScope
+                    : appHasScope;
+                if (hasRequiredScope) {
                     next();
                     return;
                 }
@@ -872,6 +889,18 @@ async function verifyServiceTokenSignature(token, secret) {
  * access token signed by the same shared secret could be replayed as a
  * service token because no claim binding existed.
  */
+/**
+ * Resolve the canonical user id from a validated session's user object.
+ *
+ * The API serializer emits `id`, but some upstream shapes carry the raw Mongo
+ * `_id` instead. We accept either, but only a non-empty string — anything else
+ * means the validated identity is unusable and the caller must reject.
+ */
+function getUserIdentityId(user) {
+    const candidate = user.id
+        ?? user._id;
+    return typeof candidate === 'string' && candidate.length > 0 ? candidate : null;
+}
 function verifyServiceTokenClaims(decoded, expected) {
     if (decoded.type !== 'service') {
         throw new ServiceTokenClaimError(`Service token has unexpected type '${String(decoded.type)}'`);

package/dist/cjs/server/cors.js

@@ -0,0 +1,155 @@
+"use strict";
+/**
+ * Strict CORS allowlist for Oxy backends.
+ *
+ * WHY THIS EXISTS
+ * ---------------
+ * App backends kept hand-rolling CORS, and the unsafe patterns recurred:
+ *   - `Access-Control-Allow-Origin: *` together with credentials (which is
+ *     spec-invalid AND a credential-leak vector), or
+ *   - a "reflect whatever Origin the request carried" fallback (effectively
+ *     `*` for credentialed requests — the Allo wildcard-fallback class).
+ *
+ * `createOxyCors` returns a self-contained Express middleware (no `cors`
+ * package dependency) that:
+ *   - allows the Oxy apex origin family (anything under `*.${CENTRAL_IDP_APEX}`,
+ *     i.e. `oxy.so` — covering `auth.oxy.so`, `api.oxy.so`, `accounts.oxy.so`,
+ *     `console.oxy.so`, `inbox.oxy.so`, the marketing site, …) reusing the
+ *     central-origin constants already in core, NOT a fresh hardcoded list,
+ *   - allows the caller's explicit `appOrigins`,
+ *   - DENIES everything else (no reflection, never a wildcard with credentials),
+ *   - echoes back the EXACT matched origin (so credentialed requests work) and
+ *     sets `Vary: Origin` for correct caching,
+ *   - answers CORS preflight (`OPTIONS`) with `204`.
+ *
+ * Node/Express-only: exported solely from `@oxyhq/core/server`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createOxyCors = createOxyCors;
+const authWebUrl_1 = require("../utils/authWebUrl");
+const fapiAutoDetect_1 = require("../utils/fapiAutoDetect");
+/** Default HTTP methods allowed across origins. */
+const DEFAULT_ALLOWED_METHODS = ['GET', 'HEAD', 'PUT', 'PATCH', 'POST', 'DELETE', 'OPTIONS'];
+/** Default request headers a browser may send on a credentialed cross-origin call. */
+const DEFAULT_ALLOWED_HEADERS = [
+    'Content-Type',
+    'Authorization',
+    'X-Requested-With',
+    'X-Oxy-User-Id',
+    'X-Oxy-Internal',
+    'X-CSRF-Token',
+];
+/** How long (seconds) a browser may cache a successful preflight. */
+const DEFAULT_MAX_AGE_SECONDS = 86400;
+/**
+ * Whether `candidate` belongs to the Oxy apex origin family — i.e. its
+ * registrable apex equals {@link CENTRAL_IDP_APEX} (`oxy.so`). This matches the
+ * apex itself (`https://oxy.so`) and any subdomain (`https://auth.oxy.so`,
+ * `https://api.oxy.so`, …) over http or https, ports allowed. Returns false on
+ * any parse failure (fail closed).
+ */
+function isOxyFamilyOrigin(candidate) {
+    let hostname;
+    let protocol;
+    try {
+        const url = new URL(candidate);
+        hostname = url.hostname.toLowerCase();
+        protocol = url.protocol;
+    }
+    catch {
+        return false;
+    }
+    if (protocol !== 'https:' && protocol !== 'http:')
+        return false;
+    if (hostname === authWebUrl_1.CENTRAL_IDP_APEX)
+        return true;
+    return (0, fapiAutoDetect_1.registrableApex)(hostname) === authWebUrl_1.CENTRAL_IDP_APEX;
+}
+/** Normalize a raw origin string to its canonical `scheme://host[:port]` form. */
+function normalizeOrigin(raw) {
+    try {
+        return new URL(raw).origin;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Build the origin-matching predicate: true iff `origin` is in the Oxy apex
+ * family OR exactly matches one of the configured app origins.
+ */
+function buildOriginAllowed(appOrigins) {
+    const explicit = new Set();
+    for (const raw of appOrigins) {
+        const normalized = normalizeOrigin(raw);
+        if (normalized)
+            explicit.add(normalized);
+    }
+    return (origin) => {
+        const normalized = normalizeOrigin(origin);
+        if (normalized === null)
+            return false;
+        if (explicit.has(normalized))
+            return true;
+        return isOxyFamilyOrigin(normalized);
+    };
+}
+/**
+ * Create a strict Oxy CORS middleware. See module docs.
+ *
+ * @example
+ * ```ts
+ * app.use(createOxyCors({ appOrigins: ['https://app.example.com'] }));
+ * ```
+ */
+function createOxyCors(options = {}) {
+    const { appOrigins = [], allowCredentials = true, methods = DEFAULT_ALLOWED_METHODS, allowedHeaders = DEFAULT_ALLOWED_HEADERS, exposedHeaders = [], maxAgeSeconds = DEFAULT_MAX_AGE_SECONDS, } = options;
+    const isOriginAllowed = buildOriginAllowed(appOrigins);
+    const methodsHeader = methods.join(', ');
+    const allowedHeadersHeader = allowedHeaders.join(', ');
+    const exposedHeadersHeader = exposedHeaders.join(', ');
+    return (req, res, next) => {
+        const origin = req.headers.origin;
+        // Same-origin or non-browser requests carry no Origin header — pass through
+        // untouched (no ACAO header is emitted, which is correct for them).
+        if (typeof origin !== 'string' || origin.length === 0) {
+            if (req.method === 'OPTIONS') {
+                res.sendStatus(204);
+                return;
+            }
+            next();
+            return;
+        }
+        // Origin is present. Caching correctness: this response varies by Origin.
+        res.setHeader('Vary', 'Origin');
+        if (!isOriginAllowed(origin)) {
+            // DENY: do NOT reflect the origin, do NOT emit a wildcard. The browser
+            // will block the cross-origin read. Preflights for denied origins get a
+            // 204 with no CORS headers (the actual request then fails CORS).
+            if (req.method === 'OPTIONS') {
+                res.sendStatus(204);
+                return;
+            }
+            next();
+            return;
+        }
+        // ALLOW: echo the EXACT matched origin — never `*`, even without credentials.
+        res.setHeader('Access-Control-Allow-Origin', origin);
+        if (allowCredentials) {
+            res.setHeader('Access-Control-Allow-Credentials', 'true');
+        }
+        if (exposedHeadersHeader) {
+            res.setHeader('Access-Control-Expose-Headers', exposedHeadersHeader);
+        }
+        if (req.method === 'OPTIONS') {
+            res.setHeader('Access-Control-Allow-Methods', methodsHeader);
+            // Honour the browser's requested headers when present, else the default set.
+            const requested = req.headers['access-control-request-headers'];
+            res.setHeader('Access-Control-Allow-Headers', typeof requested === 'string' && requested.length > 0 ? requested : allowedHeadersHeader);
+            res.setHeader('Access-Control-Max-Age', String(maxAgeSeconds));
+            res.sendStatus(204);
+            return;
+        }
+        next();
+    };
+}

package/dist/cjs/server/index.js

@@ -16,7 +16,7 @@
  * ```
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createOxyRateLimit = exports.requireOxyAuth = exports.isOxyAuthenticated = exports.getRequiredOxyUserId = exports.getOxyUserId = exports.createOxyAuthMiddleware = exports.createOptionalOxyAuth = void 0;
+exports.verifySecret = exports.createOxyCors = exports.UPSTREAM_HEADERS_TIMEOUT_MS = exports.MAX_URL_LENGTH = exports.MAX_REDIRECTS = exports.DEFAULT_USER_AGENT = exports.BLOCKED_HOSTNAMES = exports.ALLOWED_PROTOCOLS = exports.ALLOWED_PORTS = exports.UpstreamError = exports.SsrfRejection = exports.safeFetch = exports.isBlockedIp = exports.assertSafePublicUrl = exports.createOxyRateLimit = exports.requireOxyAuth = exports.isOxyAuthenticated = exports.getRequiredOxyUserId = exports.getOxyUserId = exports.createOxyAuthMiddleware = exports.createOptionalOxyAuth = void 0;
 var auth_1 = require("./auth");
 Object.defineProperty(exports, "createOptionalOxyAuth", { enumerable: true, get: function () { return auth_1.createOptionalOxyAuth; } });
 Object.defineProperty(exports, "createOxyAuthMiddleware", { enumerable: true, get: function () { return auth_1.createOxyAuthMiddleware; } });
@@ -26,3 +26,23 @@ Object.defineProperty(exports, "isOxyAuthenticated", { enumerable: true, get: fu
 Object.defineProperty(exports, "requireOxyAuth", { enumerable: true, get: function () { return auth_1.requireOxyAuth; } });
 var rateLimit_1 = require("./rateLimit");
 Object.defineProperty(exports, "createOxyRateLimit", { enumerable: true, get: function () { return rateLimit_1.createOxyRateLimit; } });
+// SSRF-safe upstream fetch + URL validation (Node-only).
+var safeFetch_1 = require("./safeFetch");
+Object.defineProperty(exports, "assertSafePublicUrl", { enumerable: true, get: function () { return safeFetch_1.assertSafePublicUrl; } });
+Object.defineProperty(exports, "isBlockedIp", { enumerable: true, get: function () { return safeFetch_1.isBlockedIp; } });
+Object.defineProperty(exports, "safeFetch", { enumerable: true, get: function () { return safeFetch_1.safeFetch; } });
+Object.defineProperty(exports, "SsrfRejection", { enumerable: true, get: function () { return safeFetch_1.SsrfRejection; } });
+Object.defineProperty(exports, "UpstreamError", { enumerable: true, get: function () { return safeFetch_1.UpstreamError; } });
+Object.defineProperty(exports, "ALLOWED_PORTS", { enumerable: true, get: function () { return safeFetch_1.ALLOWED_PORTS; } });
+Object.defineProperty(exports, "ALLOWED_PROTOCOLS", { enumerable: true, get: function () { return safeFetch_1.ALLOWED_PROTOCOLS; } });
+Object.defineProperty(exports, "BLOCKED_HOSTNAMES", { enumerable: true, get: function () { return safeFetch_1.BLOCKED_HOSTNAMES; } });
+Object.defineProperty(exports, "DEFAULT_USER_AGENT", { enumerable: true, get: function () { return safeFetch_1.DEFAULT_USER_AGENT; } });
+Object.defineProperty(exports, "MAX_REDIRECTS", { enumerable: true, get: function () { return safeFetch_1.MAX_REDIRECTS; } });
+Object.defineProperty(exports, "MAX_URL_LENGTH", { enumerable: true, get: function () { return safeFetch_1.MAX_URL_LENGTH; } });
+Object.defineProperty(exports, "UPSTREAM_HEADERS_TIMEOUT_MS", { enumerable: true, get: function () { return safeFetch_1.UPSTREAM_HEADERS_TIMEOUT_MS; } });
+// Strict CORS allowlist (Oxy apex family + explicit app origins).
+var cors_1 = require("./cors");
+Object.defineProperty(exports, "createOxyCors", { enumerable: true, get: function () { return cors_1.createOxyCors; } });
+// Constant-time secret comparison.
+var verifySecret_1 = require("./verifySecret");
+Object.defineProperty(exports, "verifySecret", { enumerable: true, get: function () { return verifySecret_1.verifySecret; } });