@book.dev/sdk 1.60.0 → 1.64.0

package/dist/forwarding/rosterAssertion.js

@@ -0,0 +1,89 @@
+// Per-instance roster assertion (OB-199 — "bind instance ↔ workspace").
+//
+// When a managed instance pulls its bound workspace's roster from the account
+// (`GET /api/workspaces/:id/roster`), it must prove it is the SITE that owns the
+// binding — not an end user. It does so by signing a short-lived assertion with
+// the site's device private key (the same key that double-gates the forwarding
+// tunnel attach). The account verifies the signature against the Site row's
+// registered public key and that the site is bound to the workspace.
+//
+// The signing half runs ONLY where the private key lives — the desktop's OS
+// keychain — so the raw key never enters the (separate) data-server process. The
+// verify half mirrors the relay's `verifyWithSiteKey`; it is provided here so the
+// account can adopt one canonical implementation and so the contract is testable
+// end-to-end (sign → verify) without the account repo.
+//
+// Runtime-agnostic (Web Crypto via {@link signWithSiteKey}/{@link verifyWithSiteKey}).
+import { b64uDecodeString, b64uEncodeString } from './encoding';
+import { signWithSiteKey, verifyWithSiteKey } from './siteKey';
+/** The assertion payload version tag — also the signed-message prefix. */
+export const ROSTER_ASSERTION_VERSION = 'openbook.roster.v1';
+/** Default freshness window for a roster assertion (±5 min — the account's window). */
+export const ROSTER_ASSERTION_SKEW_MS = 5 * 60 * 1000;
+/**
+ * The exact bytes signed/verified: `openbook.roster.v1.<base64url(payloadJson)>`.
+ * Order and separators are fixed so the site and the account never disagree. The
+ * base64url payload carries no `.`, so it never collides with the version prefix's
+ * dots when the account reconstructs the message from the assertion's first half.
+ */
+function rosterAssertionMessage(payloadB64) {
+    return `${ROSTER_ASSERTION_VERSION}.${payloadB64}`;
+}
+/**
+ * Mint a fresh signed roster assertion bearer for `Authorization: Bearer <…>`.
+ * Returns `base64url(payloadJson) + '.' + base64url(ed25519Sig)`. Stamps `ts` at
+ * call time, so mint one PER fetch (the account's freshness window is ±5 min).
+ */
+export async function signRosterAssertion(input) {
+    const ts = input.now ? input.now() : Date.now();
+    const payload = {
+        v: ROSTER_ASSERTION_VERSION,
+        pub: input.publicKey,
+        workspaceId: input.workspaceId,
+        ts,
+    };
+    const payloadB64 = b64uEncodeString(JSON.stringify(payload));
+    const signature = await signWithSiteKey(input.privateKey, rosterAssertionMessage(payloadB64));
+    return `${payloadB64}.${signature}`;
+}
+/**
+ * Verify a roster assertion (the account side, mirrored here for one canonical
+ * impl + end-to-end tests). Returns the parsed payload on success, or `null` on
+ * ANY failure — bad framing, wrong version/workspace/pub, a stale `ts`, or a bad
+ * signature. Never throws (so it can sit directly in an auth gate).
+ */
+export async function verifyRosterAssertion(input) {
+    try {
+        const dot = input.assertion.indexOf('.');
+        if (dot <= 0 || dot === input.assertion.length - 1)
+            return null;
+        const payloadB64 = input.assertion.slice(0, dot);
+        const signature = input.assertion.slice(dot + 1);
+        if (signature.includes('.'))
+            return null; // exactly two base64url parts
+        const parsed = JSON.parse(b64uDecodeString(payloadB64));
+        if (typeof parsed !== 'object' || parsed === null)
+            return null;
+        const payload = parsed;
+        if (payload.v !== ROSTER_ASSERTION_VERSION)
+            return null;
+        if (typeof payload.pub !== 'string' || payload.pub !== input.publicKey)
+            return null;
+        if (typeof payload.workspaceId !== 'string' || payload.workspaceId !== input.workspaceId)
+            return null;
+        if (typeof payload.ts !== 'number' || !Number.isFinite(payload.ts))
+            return null;
+        const now = input.now ?? Date.now();
+        const skewMs = input.skewMs ?? ROSTER_ASSERTION_SKEW_MS;
+        if (Math.abs(now - payload.ts) > skewMs)
+            return null;
+        const ok = await verifyWithSiteKey(input.publicKey, rosterAssertionMessage(payloadB64), signature);
+        if (!ok)
+            return null;
+        return { v: ROSTER_ASSERTION_VERSION, pub: payload.pub, workspaceId: payload.workspaceId, ts: payload.ts };
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=rosterAssertion.js.map

package/dist/forwarding/rosterAssertion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rosterAssertion.js","sourceRoot":"","sources":["../../src/forwarding/rosterAssertion.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,EAAE;AACF,8EAA8E;AAC9E,iFAAiF;AACjF,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,qEAAqE;AACrE,EAAE;AACF,4EAA4E;AAC5E,iFAAiF;AACjF,kFAAkF;AAClF,iFAAiF;AACjF,uDAAuD;AACvD,EAAE;AACF,uFAAuF;AAEvF,OAAO,EAAC,gBAAgB,EAAE,gBAAgB,EAAC,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAC,eAAe,EAAE,iBAAiB,EAAC,MAAM,WAAW,CAAC;AAE7D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AAE7D,uFAAuF;AACvF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAatD;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,UAAkB;IAChD,OAAO,GAAG,wBAAwB,IAAI,UAAU,EAAE,CAAC;AACrD,CAAC;AAaD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAA+B;IACvE,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IAChD,MAAM,OAAO,GAA2B;QACtC,CAAC,EAAE,wBAAwB;QAC3B,GAAG,EAAE,KAAK,CAAC,SAAS;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,EAAE;KACH,CAAC;IACF,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,sBAAsB,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9F,OAAO,GAAG,UAAU,IAAI,SAAS,EAAE,CAAC;AACtC,CAAC;AAeD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAChE,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACjD,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,8BAA8B;QAExE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAY,CAAC;QACnE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/D,MAAM,OAAO,GAAG,MAAiC,CAAC;QAClD,IAAI,OAAO,CAAC,CAAC,KAAK,wBAAwB;YAAE,OAAO,IAAI,CAAC;QACxD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QACpF,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QACtG,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QAEhF,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,wBAAwB,CAAC;QACxD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,GAAG,MAAM;YAAE,OAAO,IAAI,CAAC;QAErD,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,sBAAsB,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,CAAC;QACnG,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACrB,OAAO,EAAC,CAAC,EAAE,wBAAwB,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAC,CAAC;IAC3G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/forwarding/tunnelClient.js

@@ -10,7 +10,7 @@
 import { globalFetch } from '../client';
 import { buildRelayAttachMessage } from './challenge';
 import { signWithSiteKey } from './siteKey';
-import { decodeBody, decodeControl, encodeBody, encodeControl } from './tunnelProtocol';
+import { decodeBody, decodeControl, encodeBody, encodeControl, FORWARDED_HEADER } from './tunnelProtocol';
 export class TunnelClient {
     constructor(opts) {
         this.opts = opts;
@@ -164,12 +164,22 @@ export class TunnelClient {
         }
         const url = `${this.opts.localOrigin.replace(/\/$/, '')}${frame.path}`;
         const headers = new Headers();
+        const forwardedLk = FORWARDED_HEADER.toLowerCase();
         for (const [k, v] of frame.headers) {
             const lk = k.toLowerCase();
             if (lk === 'host' || lk === 'connection' || lk === 'content-length')
                 continue;
+            // Drop any inbound copy of the forwarded marker — it is OURS to assert, never
+            // client-supplied. The origin's exposure backstop trusts it precisely because
+            // only this client sets it (OB-209).
+            if (lk === forwardedLk)
+                continue;
             headers.append(k, v);
         }
+        // Mark every forwarded request as exposed. Set unconditionally (after the strip
+        // above) so the origin can fail closed on the tunnelled path while the instance
+        // is still unclaimed, even if the UI claim-on-publish guard were bypassed.
+        headers.set(FORWARDED_HEADER, '1');
         const init = { method: frame.method, headers, signal: controller.signal };
         if (hasBody) {
             init.body = body;

package/dist/forwarding/tunnelClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"tunnelClient.js","sourceRoot":"","sources":["../../src/forwarding/tunnelClient.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,6EAA6E;AAC7E,iFAAiF;AACjF,+EAA+E;AAC/E,kFAAkF;AAClF,EAAE;AACF,kFAAkF;AAClF,8EAA8E;AAC9E,2CAA2C;AAE3C,OAAO,EAAC,WAAW,EAAiB,MAAM,WAAW,CAAC;AACtD,OAAO,EAAC,uBAAuB,EAAC,MAAM,aAAa,CAAC;AACpD,OAAO,EAAC,eAAe,EAAC,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAC,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAoB,MAAM,kBAAkB,CAAC;AAiCzG,MAAM,OAAO,YAAY;IAWvB,YAA6B,IAAyB;QAAzB,SAAI,GAAJ,IAAI,CAAqB;QAT9C,WAAM,GAAiB,SAAS,CAAC;QACjC,YAAO,GAAG,GAAG,CAAC;QACd,YAAO,GAAG,KAAK,CAAC;QACP,aAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;QAOtD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,WAAW,CAAC;QAC/C,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,aAAa,IAAI,SAAS,CAAC;IAC5C,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC1B,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,SAAS,CAAC,IAAkB;QAClC,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACnE,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;IACnB,CAAC;IAED;oFACgF;IACxE,KAAK,CAAC,IAAI;QAChB,IAAI,IAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;YAC5E,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,EAAE,CAAC,UAAU,GAAG,aAAa,CAAC;QAC9B,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,SAAS,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACpD,EAAE,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,EAAE,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;IAEO,OAAO;QACb,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAAE,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAC7D,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC3B,CAAC;IAEO,iBAAiB;QACvB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,KAAM,CAAC,CAAC;QAC5E,UAAU,CAAC,GAAG,EAAE;YACd,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QACpC,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;IAEO,WAAW,CAAC,KAAmB;QACrC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACtC,CAAC;IAED;qEACiE;IACzD,KAAK,CAAC,KAAK;QACjB,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC,EAAE;YAAE,OAAO;QAChB,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;QAC3C,OAAO,EAAE,CAAC,UAAU,KAAK,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,cAAc,GAAG,UAAU,EAAE,CAAC;YACnE,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAA0B;QAChD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,KAAK;gBAAE,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QACD,MAAM,EAAC,EAAE,EAAE,KAAK,EAAC,GAAG,UAAU,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,KAAmB;QACzC,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;YAClB,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACjB,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC;oBACjB,MAAM;gBACR,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBACpG,IAAI,CAAC,WAAW,CAAC,EAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAC,CAAC,CAAC;gBAChE,MAAM;YACR,CAAC;YACD,KAAK,OAAO;gBACV,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC;gBACnB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;gBACzB,MAAM;YACR,KAAK,OAAO;gBACV,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC;gBACjB,MAAM;YACR,KAAK,MAAM;gBACT,IAAI,CAAC,WAAW,CAAC,EAAC,CAAC,EAAE,MAAM,EAAC,CAAC,CAAC;gBAC9B,MAAM;YACR,KAAK,KAAK;gBACR,KAAK,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBAC/B,MAAM;YACR,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACtC,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBAAE,CAAC,CAAC,cAAc,GAAG,SAAS,CAAC;gBACpC,MAAM;YACR,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;gBAChD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC/B,MAAM;YACR,CAAC;YACD;gBACE,MAAM;QACR,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,KAAe;QACzC,MAAM,EAAC,EAAE,EAAC,GAAG,KAAK,CAAC;QACnB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAa,EAAC,UAAU,EAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAEhC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC;QAClE,IAAI,IAA4C,CAAC;QACjD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,GAAG,IAAI,cAAc,CAAa;gBACpC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE;oBACX,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC;gBAC9B,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QACvE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACnC,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YAC3B,IAAI,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,YAAY,IAAI,EAAE,KAAK,gBAAgB;gBAAE,SAAS;YAC9E,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvB,CAAC;QAED,MAAM,IAAI,GAAoC,EAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAC,CAAC;QACzG,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,IAAI,GAAG,IAA2B,CAAC;YACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACvB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC5C,MAAM,UAAU,GAAuB,EAAE,CAAC;YAC1C,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YACnE,IAAI,CAAC,WAAW,CAAC,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAC,CAAC,CAAC;YAC1E,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;gBACb,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpC,SAAS,CAAC;oBACR,MAAM,EAAC,IAAI,EAAE,KAAK,EAAC,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBAC1C,IAAI,IAAI;wBAAE,MAAM;oBAChB,IAAI,KAAK,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;wBAC9B,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;wBACrC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,6CAA6C;oBACnE,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAC,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,IAAI,CAAC,WAAW,CAAC,EAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAC,CAAC,CAAC;QACnG,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"tunnelClient.js","sourceRoot":"","sources":["../../src/forwarding/tunnelClient.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,6EAA6E;AAC7E,iFAAiF;AACjF,+EAA+E;AAC/E,kFAAkF;AAClF,EAAE;AACF,kFAAkF;AAClF,8EAA8E;AAC9E,2CAA2C;AAE3C,OAAO,EAAC,WAAW,EAAiB,MAAM,WAAW,CAAC;AACtD,OAAO,EAAC,uBAAuB,EAAC,MAAM,aAAa,CAAC;AACpD,OAAO,EAAC,eAAe,EAAC,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAC,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,gBAAgB,EAAoB,MAAM,kBAAkB,CAAC;AAiC3H,MAAM,OAAO,YAAY;IAWvB,YAA6B,IAAyB;QAAzB,SAAI,GAAJ,IAAI,CAAqB;QAT9C,WAAM,GAAiB,SAAS,CAAC;QACjC,YAAO,GAAG,GAAG,CAAC;QACd,YAAO,GAAG,KAAK,CAAC;QACP,aAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;QAOtD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,WAAW,CAAC;QAC/C,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,aAAa,IAAI,SAAS,CAAC;IAC5C,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED,IAAI;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC1B,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,SAAS,CAAC,IAAkB;QAClC,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACnE,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;IACnB,CAAC;IAED;oFACgF;IACxE,KAAK,CAAC,IAAI;QAChB,IAAI,IAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;YAC5E,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,EAAE,CAAC,UAAU,GAAG,aAAa,CAAC;QAC9B,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,SAAS,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACpD,EAAE,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClC,EAAE,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;IAEO,OAAO;QACb,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAAE,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAC7D,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC3B,CAAC;IAEO,iBAAiB;QACvB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,KAAM,CAAC,CAAC;QAC5E,UAAU,CAAC,GAAG,EAAE;YACd,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QACpC,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;IAEO,WAAW,CAAC,KAAmB;QACrC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACtC,CAAC;IAED;qEACiE;IACzD,KAAK,CAAC,KAAK;QACjB,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC,EAAE;YAAE,OAAO;QAChB,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;QAC3C,OAAO,EAAE,CAAC,UAAU,KAAK,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,cAAc,GAAG,UAAU,EAAE,CAAC;YACnE,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAA0B;QAChD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,KAAK;gBAAE,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QACD,MAAM,EAAC,EAAE,EAAE,KAAK,EAAC,GAAG,UAAU,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,KAAmB;QACzC,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;YAClB,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACjB,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC;oBACjB,MAAM;gBACR,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBACpG,IAAI,CAAC,WAAW,CAAC,EAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAC,CAAC,CAAC;gBAChE,MAAM;YACR,CAAC;YACD,KAAK,OAAO;gBACV,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC;gBACnB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;gBACzB,MAAM;YACR,KAAK,OAAO;gBACV,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC;gBACjB,MAAM;YACR,KAAK,MAAM;gBACT,IAAI,CAAC,WAAW,CAAC,EAAC,CAAC,EAAE,MAAM,EAAC,CAAC,CAAC;gBAC9B,MAAM;YACR,KAAK,KAAK;gBACR,KAAK,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBAC/B,MAAM;YACR,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACtC,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBAAE,CAAC,CAAC,cAAc,GAAG,SAAS,CAAC;gBACpC,MAAM;YACR,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;gBAChD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC/B,MAAM;YACR,CAAC;YACD;gBACE,MAAM;QACR,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,KAAe;QACzC,MAAM,EAAC,EAAE,EAAC,GAAG,KAAK,CAAC;QACnB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAa,EAAC,UAAU,EAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAEhC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC;QAClE,IAAI,IAA4C,CAAC;QACjD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,GAAG,IAAI,cAAc,CAAa;gBACpC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE;oBACX,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC;gBAC9B,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QACvE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,WAAW,GAAG,gBAAgB,CAAC,WAAW,EAAE,CAAC;QACnD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACnC,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YAC3B,IAAI,EAAE,KAAK,MAAM,IAAI,EAAE,KAAK,YAAY,IAAI,EAAE,KAAK,gBAAgB;gBAAE,SAAS;YAC9E,8EAA8E;YAC9E,8EAA8E;YAC9E,qCAAqC;YACrC,IAAI,EAAE,KAAK,WAAW;gBAAE,SAAS;YACjC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,gFAAgF;QAChF,gFAAgF;QAChF,2EAA2E;QAC3E,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;QAEnC,MAAM,IAAI,GAAoC,EAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAC,CAAC;QACzG,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,IAAI,GAAG,IAA2B,CAAC;YACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACvB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC5C,MAAM,UAAU,GAAuB,EAAE,CAAC;YAC1C,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YACnE,IAAI,CAAC,WAAW,CAAC,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAC,CAAC,CAAC;YAC1E,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;gBACb,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpC,SAAS,CAAC;oBACR,MAAM,EAAC,IAAI,EAAE,KAAK,EAAC,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBAC1C,IAAI,IAAI;wBAAE,MAAM;oBAChB,IAAI,KAAK,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;wBAC9B,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;wBACrC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,6CAA6C;oBACnE,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAC,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,IAAI,CAAC,WAAW,CAAC,EAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAC,CAAC,CAAC;QACnG,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF"}

package/dist/forwarding/tunnelProtocol.d.ts

@@ -1,3 +1,14 @@
+/**
+ * Marks a request as having arrived through the tunnel — i.e. an EXPOSED inbound
+ * request, not a loopback/IPC one (OB-209). Forwarding is an outbound tunnel: the
+ * instance stays on loopback, so a forwarded request bypasses the boot exposure
+ * backstop (`assertExposureSafe`, which only guards a listener bind). The tunnel
+ * client SETS this on every request it forwards (overriding any inbound value — it
+ * is never client-supplied), so the origin can recognise the exposed path and fail
+ * closed while the instance is still unclaimed (where `authorize()` rule-0 would
+ * otherwise serve anonymous world-write). Loopback requests never carry it.
+ */
+export declare const FORWARDED_HEADER = "X-OpenBook-Forwarded";
 export type ControlFrame = {
     t: 'challenge';
     nonce: string;

package/dist/forwarding/tunnelProtocol.js

@@ -3,6 +3,17 @@
 // request id. Control frames are JSON (WS text); body chunks are binary (WS
 // binary) prefixed with the id, so large payloads and SSE stream without base64
 // overhead. Shared by the relay (open.book.pub) and the tunnel client below.
+/**
+ * Marks a request as having arrived through the tunnel — i.e. an EXPOSED inbound
+ * request, not a loopback/IPC one (OB-209). Forwarding is an outbound tunnel: the
+ * instance stays on loopback, so a forwarded request bypasses the boot exposure
+ * backstop (`assertExposureSafe`, which only guards a listener bind). The tunnel
+ * client SETS this on every request it forwards (overriding any inbound value — it
+ * is never client-supplied), so the origin can recognise the exposed path and fail
+ * closed while the instance is still unclaimed (where `authorize()` rule-0 would
+ * otherwise serve anonymous world-write). Loopback requests never carry it.
+ */
+export const FORWARDED_HEADER = 'X-OpenBook-Forwarded';
 export function encodeControl(frame) {
     return JSON.stringify(frame);
 }

package/dist/forwarding/tunnelProtocol.js.map

@@ -1 +1 @@
-{"version":3,"file":"tunnelProtocol.js","sourceRoot":"","sources":["../../src/forwarding/tunnelProtocol.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,6EAA6E;AAC7E,4EAA4E;AAC5E,gFAAgF;AAChF,6EAA6E;AAiB7E,MAAM,UAAU,aAAa,CAAC,KAAmB;IAC/C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiB,CAAC;QAC3C,OAAO,CAAC,IAAI,OAAQ,CAAmB,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,UAAU,CAAC,EAAU,EAAE,KAAiB;IACtD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACvD,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAClB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAe;IACxC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IACtE,OAAO,EAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"tunnelProtocol.js","sourceRoot":"","sources":["../../src/forwarding/tunnelProtocol.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,6EAA6E;AAC7E,4EAA4E;AAC5E,gFAAgF;AAChF,6EAA6E;AAE7E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAiBvD,MAAM,UAAU,aAAa,CAAC,KAAmB;IAC/C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiB,CAAC;QAC3C,OAAO,CAAC,IAAI,OAAQ,CAAmB,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,UAAU,CAAC,EAAU,EAAE,KAAiB;IACtD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACvD,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAClB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAe;IACxC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IACtE,OAAO,EAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAC,CAAC;AAChE,CAAC"}

package/dist/identity.d.ts

@@ -0,0 +1,185 @@
+/**
+ * Verifiable user identity for multi-user OpenBook (OB-165).
+ *
+ * A user proves who they are with a compact **JWS** (JSON Web Signature) signed
+ * by a trusted **issuer** (account.book.pub, or any federated issuer) using
+ * **Ed25519 / `alg: EdDSA`** — the same primitive the forwarding site keys and
+ * plugin provenance already use, so this adds no dependency. The data server
+ * verifies the assertion against the issuer's published JWKS (which it caches,
+ * so verification works offline and on any federated instance), then attributes
+ * every change to the resulting {@link Principal}.
+ *
+ * Design: see `docs/multi-user-and-backups-2026-06.md`. This module is
+ * isomorphic (Web Crypto only) so it runs in the server, the desktop app, the
+ * web shell, and tests alike.
+ */
+/** How an actor's identity was established for a given request/change. */
+export type VerifiedVia = 
+/** A fresh, signature-verified identity JWS from a trusted issuer. */
+'jws'
+/** Unauthenticated (or self-named) guest. */
+ | 'guest'
+/** A well-formed JWS that no longer verifies fresh (e.g. expired while
+ *  offline). The claimed identity is recorded but flagged as not vouched-for. */
+ | 'unverified'
+/** Attribution carried in from another instance via the sync/merge path
+ *  (OB-170) — vouched for by the originating instance, not re-verified here. */
+ | 'synced'
+/** In-process caller (the embedded `LocalDataClient`) — implicitly the local
+ *  owner; there is no request to carry a credential. */
+ | 'local';
+export type PrincipalKind = 'user' | 'guest';
+/** The actor behind a request, resolved by the server and stamped onto changes. */
+export interface Principal {
+    kind: PrincipalKind;
+    /** Stable, globally-meaningful id. Users: `iss#sub`. Guests: `guest:<name|anon>`. */
+    subject: string;
+    /** The issuer URL that vouched for a user (empty for guests/local). */
+    issuer: string;
+    /** Human-readable display name, when known. */
+    name: string;
+    /**
+     * The single **active-persona email** (lowercased), when the issuer asserts one
+     * (OB-182 §1.1/§3). Net-new threading from the verified `email` claim — there is
+     * never an `emails[]` array (Fork 4/5): one token carries exactly one persona
+     * facet. Only ever *trusted* for persona / email-ACL matching when the principal
+     * is `verifiedVia==='jws'` AND `issuer === config.emailAuthority` (the
+     * `emailIsAuthoritative` gate, B1); on any other principal it is at most an
+     * attribution hint. Absent when the issuer asserts no email. */
+    email?: string;
+    verifiedVia: VerifiedVia;
+    /** Which signed credential authorized this (users only): issuer key id + assertion id. */
+    assertion?: {
+        kid?: string;
+        jti?: string;
+    };
+}
+/** A guest principal with an optional display name. */
+export declare function guestPrincipal(name?: string): Principal;
+/** The implicit local owner (in-process / loopback desktop). */
+export declare function localPrincipal(name?: string): Principal;
+/** Stable short id for a principal — the value embedded in CRDT edit origins. */
+export declare function principalId(p: Principal): string;
+/** JOSE header of an identity assertion. */
+export interface IdentityHeader {
+    alg: 'EdDSA';
+    typ?: string;
+    /** Issuer key id — selects the verifying key from the issuer's JWKS. */
+    kid?: string;
+}
+/** Claims carried by an identity assertion (a JWT-shaped payload). */
+export interface IdentityClaims {
+    /** Issuer URL (the authenticating source). */
+    iss: string;
+    /** Stable user id within the issuer. */
+    sub: string;
+    /** Display name. */
+    name?: string;
+    /** Email, when the issuer chooses to assert it. */
+    email?: string;
+    /** Issued-at (epoch seconds). */
+    iat?: number;
+    /** Expiry (epoch seconds). */
+    exp?: number;
+    /** Not-before (epoch seconds). */
+    nbf?: number;
+    /** Unique assertion id — recorded with each change for traceability. */
+    jti?: string;
+    /**
+     * Audience — the data server this assertion is scoped to (OB-177). When
+     * present, a verifier MUST reject the token unless `aud` names *itself*, so a
+     * server the user connected to can't replay their identity to a different
+     * server (confused-deputy / token redirection). Absent on unscoped tokens
+     * (the single-server model, where exactly one server trusts the issuer).
+     */
+    aud?: string;
+}
+/** An Ed25519 public key in JWK form (`kty:'OKP'`, raw 32-byte `x`, base64url). */
+export interface Jwk {
+    kty: 'OKP';
+    crv: 'Ed25519';
+    /** Raw 32-byte public key, base64url. */
+    x: string;
+    kid?: string;
+    use?: 'sig';
+    alg?: 'EdDSA';
+}
+/** A set of public keys an issuer publishes (the cached, offline-verifiable set). */
+export interface Jwks {
+    keys: Jwk[];
+}
+/** An issuer signing keypair (dev/test issuer, or the account service). */
+export interface IdentityKeypair {
+    /** The public key as a JWK (publish in the JWKS). */
+    publicJwk: Jwk;
+    /** PKCS#8 private key, base64url — kept secret by the issuer. */
+    privateKey: string;
+}
+/**
+ * Mint a fresh issuer keypair (Ed25519). Used by the dev issuer and tests; the
+ * real issuer (account.book.pub) holds the equivalent and rotates `kid`s.
+ */
+export declare function mintIdentityKeypair(kid?: string): Promise<IdentityKeypair>;
+/**
+ * Sign an identity assertion (issuer side / dev / tests). Produces a compact
+ * EdDSA JWS: `base64url(header).base64url(claims).base64url(sig)`.
+ */
+export declare function signIdentity(privateKeyPkcs8: string, claims: IdentityClaims, kid?: string): Promise<string>;
+/**
+ * Decode an assertion's header + claims **without** verifying the signature.
+ * For client-side display, and for the server's "claimed-but-unverified"
+ * provenance fallback. Never use this to make a trust decision.
+ */
+export declare function decodeIdentity(jws: string): {
+    header: IdentityHeader;
+    claims: IdentityClaims;
+} | null;
+/** Reason an assertion failed to verify (for logging / the unverified fallback). */
+export type VerifyFailure = 'malformed' | 'unsupported-alg' | 'unknown-key' | 'bad-signature' | 'expired' | 'not-yet-valid' | 'untrusted-issuer' | 'wrong-audience';
+export type VerifyResult = {
+    ok: true;
+    claims: IdentityClaims;
+    header: IdentityHeader;
+} | {
+    ok: false;
+    reason: VerifyFailure;
+    claims?: IdentityClaims;
+};
+export interface VerifyOptions {
+    /** Allowed clock skew, in seconds (covers minor offsets + short offline). Default 60. */
+    clockToleranceSec?: number;
+    /** Current time in epoch ms (injectable for tests). Default `Date.now()`. */
+    nowMs?: number;
+    /** If set, the `iss` claim must be one of these (issuer-rooted federation). */
+    allowedIssuers?: string[];
+    /**
+     * This data server's own audience identifier (OB-177). When a token carries an
+     * `aud`, it must equal this — otherwise the token was scoped to a *different*
+     * server and is rejected (`wrong-audience`). Leave unset only for the
+     * single-server model, where the issuer never sets `aud`.
+     */
+    audience?: string;
+    /**
+     * Require every token to be audience-bound to {@link audience}: an unscoped
+     * (no-`aud`) token is rejected. Set on a multi-server deployment so a server
+     * can't be handed an unscoped, freely-replayable assertion.
+     */
+    requireAudience?: boolean;
+}
+/**
+ * Verify an identity assertion against an issuer's JWKS. Pure + offline: the
+ * caller supplies the (cached) key set, so no network call happens here.
+ *
+ * Returns `{ok:true, claims}` only on a fresh, signature-valid, in-window,
+ * trusted-issuer assertion. On failure returns a reason (and the decoded claims
+ * when they parsed, so the server can record a claimed-but-unverified identity).
+ */
+export declare function verifyIdentity(jws: string, jwks: Jwks, opts?: VerifyOptions): Promise<VerifyResult>;
+/** Build a verified user principal from validated claims. */
+export declare function principalFromClaims(claims: IdentityClaims, header?: IdentityHeader): Principal;
+/**
+ * Build a claimed-but-unverified principal from an assertion that parsed but
+ * didn't verify fresh (e.g. expired while offline). Provenance still names the
+ * claimed subject, flagged `unverified`.
+ */
+export declare function unverifiedPrincipalFromClaims(claims: IdentityClaims): Principal;

package/dist/identity.js

@@ -0,0 +1,181 @@
+/**
+ * Verifiable user identity for multi-user OpenBook (OB-165).
+ *
+ * A user proves who they are with a compact **JWS** (JSON Web Signature) signed
+ * by a trusted **issuer** (account.book.pub, or any federated issuer) using
+ * **Ed25519 / `alg: EdDSA`** — the same primitive the forwarding site keys and
+ * plugin provenance already use, so this adds no dependency. The data server
+ * verifies the assertion against the issuer's published JWKS (which it caches,
+ * so verification works offline and on any federated instance), then attributes
+ * every change to the resulting {@link Principal}.
+ *
+ * Design: see `docs/multi-user-and-backups-2026-06.md`. This module is
+ * isomorphic (Web Crypto only) so it runs in the server, the desktop app, the
+ * web shell, and tests alike.
+ */
+import { b64uDecode, b64uEncode, b64uDecodeString, b64uEncodeString, utf8 } from './forwarding/encoding';
+const ED25519 = { name: 'Ed25519' };
+/** A guest principal with an optional display name. */
+export function guestPrincipal(name = '') {
+    const label = name.trim();
+    return {
+        kind: 'guest',
+        subject: label ? `guest:${label}` : 'guest:anonymous',
+        issuer: '',
+        name: label,
+        verifiedVia: 'guest',
+    };
+}
+/** The implicit local owner (in-process / loopback desktop). */
+export function localPrincipal(name = 'Local') {
+    return { kind: 'user', subject: 'local:owner', issuer: 'local', name, verifiedVia: 'local' };
+}
+/** Stable short id for a principal — the value embedded in CRDT edit origins. */
+export function principalId(p) {
+    return p.subject;
+}
+/**
+ * Mint a fresh issuer keypair (Ed25519). Used by the dev issuer and tests; the
+ * real issuer (account.book.pub) holds the equivalent and rotates `kid`s.
+ */
+export async function mintIdentityKeypair(kid = 'dev-1') {
+    const kp = (await crypto.subtle.generateKey(ED25519, true, ['sign', 'verify']));
+    const raw = new Uint8Array(await crypto.subtle.exportKey('raw', kp.publicKey));
+    const priv = new Uint8Array(await crypto.subtle.exportKey('pkcs8', kp.privateKey));
+    return {
+        publicJwk: { kty: 'OKP', crv: 'Ed25519', x: b64uEncode(raw), kid, use: 'sig', alg: 'EdDSA' },
+        privateKey: b64uEncode(priv),
+    };
+}
+/**
+ * Sign an identity assertion (issuer side / dev / tests). Produces a compact
+ * EdDSA JWS: `base64url(header).base64url(claims).base64url(sig)`.
+ */
+export async function signIdentity(privateKeyPkcs8, claims, kid) {
+    const header = { alg: 'EdDSA', typ: 'JWT', ...(kid ? { kid } : {}) };
+    const signingInput = `${b64uEncodeString(JSON.stringify(header))}.${b64uEncodeString(JSON.stringify(claims))}`;
+    const key = await crypto.subtle.importKey('pkcs8', b64uDecode(privateKeyPkcs8), ED25519, false, ['sign']);
+    const sig = await crypto.subtle.sign(ED25519, key, utf8(signingInput));
+    return `${signingInput}.${b64uEncode(new Uint8Array(sig))}`;
+}
+/**
+ * Decode an assertion's header + claims **without** verifying the signature.
+ * For client-side display, and for the server's "claimed-but-unverified"
+ * provenance fallback. Never use this to make a trust decision.
+ */
+export function decodeIdentity(jws) {
+    const parts = jws.split('.');
+    if (parts.length !== 3)
+        return null;
+    try {
+        const header = JSON.parse(b64uDecodeString(parts[0]));
+        const claims = JSON.parse(b64uDecodeString(parts[1]));
+        if (!claims || typeof claims.iss !== 'string' || typeof claims.sub !== 'string')
+            return null;
+        return { header, claims };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Verify an identity assertion against an issuer's JWKS. Pure + offline: the
+ * caller supplies the (cached) key set, so no network call happens here.
+ *
+ * Returns `{ok:true, claims}` only on a fresh, signature-valid, in-window,
+ * trusted-issuer assertion. On failure returns a reason (and the decoded claims
+ * when they parsed, so the server can record a claimed-but-unverified identity).
+ */
+export async function verifyIdentity(jws, jwks, opts = {}) {
+    const decoded = decodeIdentity(jws);
+    if (!decoded)
+        return { ok: false, reason: 'malformed' };
+    const { header, claims } = decoded;
+    if (header.alg !== 'EdDSA')
+        return { ok: false, reason: 'unsupported-alg', claims };
+    if (opts.allowedIssuers && !opts.allowedIssuers.includes(claims.iss)) {
+        return { ok: false, reason: 'untrusted-issuer', claims };
+    }
+    // Pick candidate keys: the kid-matched one, else every key (kid is a hint).
+    const candidates = header.kid ? jwks.keys.filter((k) => k.kid === header.kid) : jwks.keys;
+    if (candidates.length === 0)
+        return { ok: false, reason: 'unknown-key', claims };
+    const parts = jws.split('.');
+    const signingInput = utf8(`${parts[0]}.${parts[1]}`);
+    const sig = b64uDecode(parts[2]);
+    let verified = false;
+    for (const jwk of candidates) {
+        try {
+            const key = await crypto.subtle.importKey('raw', b64uDecode(jwk.x), ED25519, false, ['verify']);
+            if (await crypto.subtle.verify(ED25519, key, sig, signingInput)) {
+                verified = true;
+                break;
+            }
+        }
+        catch {
+            // Malformed key — try the next candidate.
+        }
+    }
+    if (!verified)
+        return { ok: false, reason: 'bad-signature', claims };
+    // Time window (after the signature is proven, so we can distinguish expired
+    // from forged). Tolerance covers clock skew and short offline spells.
+    const tol = opts.clockToleranceSec ?? 60;
+    const now = Math.floor((opts.nowMs ?? Date.now()) / 1000);
+    if (typeof claims.nbf === 'number' && now + tol < claims.nbf) {
+        return { ok: false, reason: 'not-yet-valid', claims };
+    }
+    if (typeof claims.exp === 'number' && now - tol > claims.exp) {
+        return { ok: false, reason: 'expired', claims };
+    }
+    // Audience binding (OB-177). A scoped token must name THIS server; an unscoped
+    // token is accepted only when the server doesn't demand scoping. Checked after
+    // the signature so a forged `aud` can't pass — `aud` is inside the signed payload.
+    if (typeof claims.aud === 'string' && claims.aud.length > 0) {
+        if (!opts.audience || claims.aud !== opts.audience) {
+            return { ok: false, reason: 'wrong-audience', claims };
+        }
+    }
+    else if (opts.requireAudience) {
+        return { ok: false, reason: 'wrong-audience', claims };
+    }
+    return { ok: true, claims, header };
+}
+/** The active-persona email (lowercased) carried by an assertion, if any. */
+function personaEmail(claims) {
+    const email = claims.email?.trim().toLowerCase();
+    return email ? email : undefined;
+}
+/** Build a verified user principal from validated claims. */
+export function principalFromClaims(claims, header) {
+    const email = personaEmail(claims);
+    return {
+        kind: 'user',
+        subject: `${claims.iss}#${claims.sub}`,
+        issuer: claims.iss,
+        name: claims.name ?? '',
+        ...(email ? { email } : {}),
+        verifiedVia: 'jws',
+        assertion: { kid: header?.kid, jti: claims.jti },
+    };
+}
+/**
+ * Build a claimed-but-unverified principal from an assertion that parsed but
+ * didn't verify fresh (e.g. expired while offline). Provenance still names the
+ * claimed subject, flagged `unverified`.
+ */
+export function unverifiedPrincipalFromClaims(claims) {
+    const email = personaEmail(claims);
+    return {
+        kind: 'user',
+        subject: `${claims.iss}#${claims.sub}`,
+        issuer: claims.iss,
+        name: claims.name ?? '',
+        // Carried for attribution only — an unverified principal is never `jws`, so
+        // `emailIsAuthoritative` is false and this email never drives a grant (B1/N8).
+        ...(email ? { email } : {}),
+        verifiedVia: 'unverified',
+        assertion: { jti: claims.jti },
+    };
+}
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAC,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,IAAI,EAAC,MAAM,uBAAuB,CAAC;AAEvG,MAAM,OAAO,GAAG,EAAC,IAAI,EAAE,SAAS,EAAU,CAAC;AA2C3C,uDAAuD;AACvD,MAAM,UAAU,cAAc,CAAC,IAAI,GAAG,EAAE;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,OAAO;QACL,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,iBAAiB;QACrD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,KAAK;QACX,WAAW,EAAE,OAAO;KACrB,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,cAAc,CAAC,IAAI,GAAG,OAAO;IAC3C,OAAO,EAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAC,CAAC;AAC7F,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,WAAW,CAAC,CAAY;IACtC,OAAO,CAAC,CAAC,OAAO,CAAC;AACnB,CAAC;AAgED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAG,GAAG,OAAO;IACrD,MAAM,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAkB,CAAC;IACjG,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IACnF,OAAO;QACL,SAAS,EAAE,EAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAC;QAC1F,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,eAAuB,EACvB,MAAsB,EACtB,GAAY;IAEZ,MAAM,MAAM,GAAmB,EAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAC,GAAG,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAC,CAAC;IACjF,MAAM,YAAY,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;IAC/G,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1G,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IACvE,OAAO,GAAG,YAAY,IAAI,UAAU,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAmB,CAAC;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAmB,CAAC;QACxE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC7F,OAAO,EAAC,MAAM,EAAE,MAAM,EAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAuCD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW,EAAE,IAAU,EAAE,OAAsB,EAAE;IACpF,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAC,CAAC;IACtD,MAAM,EAAC,MAAM,EAAE,MAAM,EAAC,GAAG,OAAO,CAAC;IACjC,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAC,CAAC;IAClF,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACrE,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAC,CAAC;IACzD,CAAC;IAED,4EAA4E;IAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC1F,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAC,CAAC;IAE/E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YAChG,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;gBAChE,QAAQ,GAAG,IAAI,CAAC;gBAChB,MAAM;YACR,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAC,CAAC;IAEnE,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1D,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QAC7D,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QAC7D,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAC,CAAC;IAChD,CAAC;IAED,+EAA+E;IAC/E,+EAA+E;IAC/E,mFAAmF;IACnF,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnD,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAC,CAAC;QACvD,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAC,CAAC;IACvD,CAAC;IAED,OAAO,EAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAC,CAAC;AACpC,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,MAAsB;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACnC,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,mBAAmB,CAAC,MAAsB,EAAE,MAAuB;IACjF,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,GAAG,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,EAAE;QACtC,MAAM,EAAE,MAAM,CAAC,GAAG;QAClB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;QACvB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAC,KAAK,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,WAAW,EAAE,KAAK;QAClB,SAAS,EAAE,EAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAC;KAC/C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAsB;IAClE,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,GAAG,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,EAAE;QACtC,MAAM,EAAE,MAAM,CAAC,GAAG;QAClB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;QACvB,4EAA4E;QAC5E,+EAA+E;QAC/E,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAC,KAAK,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,WAAW,EAAE,YAAY;QACzB,SAAS,EAAE,EAAC,GAAG,EAAE,MAAM,CAAC,GAAG,EAAC;KAC7B,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,23 +1,27 @@
-export type { PageSnapshot, PageMeta, StoredPage, PageInput, ServerInfo, ServerControls } from './types';
-export { emptyPageSnapshot } from './types';
-export { API, type ApiError } from './routes';
-export type { DataClient, PageSubscription, FetchLike, LiveSourceLike, HttpDataClientOptions } from './client';
+export type { PageSnapshot, PageMeta, StoredPage, PageInput, ServerInfo, ServerControls, PageVisibility, Visibility, MemberRole, MemberStatus, MemberSource, AclLevel, Member, PageAcl, } from './types';
+export { emptyPageSnapshot, PAGE_VISIBILITIES } from './types';
+export { API, type ApiError, type CompactResult } from './routes';
+export type { DataClient, PageSubscription, FetchLike, LiveSourceLike, HttpDataClientOptions, IdentityCredential } from './client';
 export { HttpDataClient } from './client';
-export { ForwardingClient, TunnelClient, MemoryKeyStore, mintSiteKeypair, signWithSiteKey, type KeyStore, type SiteIdentity, type ForwardingClientOptions, type TunnelStatus, } from './forwarding';
+export { ForwardingClient, TunnelClient, MemoryKeyStore, mintSiteKeypair, signWithSiteKey, verifyWithSiteKey, FORWARDED_HEADER, signRosterAssertion, verifyRosterAssertion, ROSTER_ASSERTION_VERSION, ROSTER_ASSERTION_SKEW_MS, type KeyStore, type SiteIdentity, type ForwardingClientOptions, type TunnelStatus, type RosterAssertionPayload, type SignRosterAssertionInput, type VerifyRosterAssertionInput, } from './forwarding';
 export type { DatabasePropertyType, NumberFormat, NumberDisplay, StatusGroup, RollupFunction, RollupConfig, RelationCardinality, DatabaseSelectOption, DatabaseProperty, DateRange, LocationValue, PropertyGroup, RowTemplate, DatabaseViewType, ChartAggregate, SummaryType, FilterOperator, FilterConjunction, DatabaseFilter, DatabaseFilterGroup, FilterNode, SortDirection, DatabaseSort, DatabaseView, DatabaseMetric, ColorRule, DatabaseSchema, StoredDatabase, DatabaseInput, DatabaseUpdate, DatabaseRow, RowInput, RowUpdate, RowGroup, ChartDatum, ChartSeries, ChartSegment, ChartGroup, ChartMatrix, DateSpan, GraphNode, GraphEdge, DependencyGraph, InverseUpdate, RowTreeNode, } from './database';
 export { TITLE_PROPERTY_ID, SELECT_COLORS, NO_VALUE_GROUP, STATUS_GROUPS, RELATIVE_DATE_OPS, projectExports, rowValue, matchesFilter, rowMatchesCondition, applyView, viewFilterRoot, isFilterGroup, shortId, defaultDatabaseSchema, defaultView, defaultStatusOptions, removeProperty, formatNumber, formatUniqueId, numberProgress, groupRows, groupRowsBy, groupRowsByParent, PARENT_GROUP_ID, NO_PARENT_GROUP, aggregateRows, aggregateMatrix, CHART_TOTAL_SERIES, summarizeColumn, dateStart, dateEnd, parseDay, rowDateSpan, rowLocation, asLocation, dependencyGraph, syncInverseUpdates, relationSides, buildRowTree, flattenRowTree, isImageUrl, firstImageUrl, coverImageUrl, } from './database';
 export { evaluateFormula, formulaReferences, FormulaError, type FormulaValue, type FormulaResolver, } from './formula';
 export { OWNER_PROPERTY_ID, VERIFICATION_PROPERTY_ID, BACKLINKS_PROPERTY_ID, THEME_PROPERTY_ID, COVER_PROPERTY_ID, FONTS_PROPERTY_ID, ICON_PROPERTY_ID, FULLWIDTH_PROPERTY_ID, SYSTEM_PAGE_PROPERTIES, isVerified, verificationExpired, isVerificationActive, makeVerification, extractMentionIds, propertiesReferencePage, type VerificationValue, } from './pageProperties';
-export { getServerUrlOverride, setServerUrlOverride, getServerTokenOverride, setServerTokenOverride, isMixedContentBlocked } from './connection';
+export { getServerUrlOverride, setServerUrlOverride, getServerTokenOverride, setServerTokenOverride, getIdentityCredential, setIdentityToken, setGuestName, getForwardingAudience, setForwardingAudience, isMixedContentBlocked } from './connection';
 export { AccountClient, AccountError, DEFAULT_ACCOUNT_URL, getAccountUrlOverride, setAccountUrlOverride, resolveAccountUrl, type AccountSettings, } from './account';
+export { guestPrincipal, localPrincipal, principalId, mintIdentityKeypair, signIdentity, decodeIdentity, verifyIdentity, principalFromClaims, unverifiedPrincipalFromClaims, type Principal, type PrincipalKind, type VerifiedVia, type IdentityHeader, type IdentityClaims, type Jwk, type Jwks, type IdentityKeypair, type VerifyOptions, type VerifyResult, type VerifyFailure, } from './identity';
+export { DEFAULT_INSTANCE_CONFIG, type GuestAccess, type TrustedIssuerConfig, type InstanceConfig, type InstanceInfo, type StoredEdit, type WorkspaceBinding, type WorkspaceRoster, type WorkspaceRosterEntry, } from './provenance';
+export { authorize, isEmailAuthoritative, type Role, type EffectiveVisibility, type AclEntry, type AccessPage, type AccessCtx, type Decision, } from './authorize';
 export { snapshotText, paragraphBlocks, textSnapshot, appendTextToSnapshot, appendBlocksToSnapshot, type AppendBlock } from './content';
 export { snapshotBlocks, contentHash, computeBlockMtimes, stampSnapshotMtimes, latestBlockMtime, type BlockDigest, } from './mtime';
+export { computeBlockAuthors, stampSnapshotAuthors, latestSnapshotAuthor } from './authors';
 export { pageToBookHtml, bookHtmlToPage, readBookHtmlMeta, slugify, type BookPageRecord, } from './bookfile';
 export { spaceToBookFiles, parseBookFolder, SPACE_BUNDLE_FILE, type BookFolderFile, type SpaceSnapshot, } from './bookFolder';
 export { canonicalDigest, generateRegistryKeys, signPlugin, verifyPlugin, validateManifest, OPENBOOK_REGISTRY, type PluginManifest, type PluginAgentTool, type PluginPackage, type PluginSignature, type StoredPlugin, } from './plugins';
 export { buildSampleDocument, seedSampleDocument, SAMPLE_DOCUMENT_NAME } from './sampleDocument';
-export type { CommentRun, SuggestionAuthorKind, SuggestionKind, SuggestionStatus, SuggestionTarget, StoredSuggestion, SuggestionInput, SuggestionUpdate, StoredComment, CommentInput, } from './suggestions';
+export type { CommentRun, AuthoredIdentity, SuggestionAuthorKind, SuggestionKind, SuggestionStatus, SuggestionTarget, StoredSuggestion, SuggestionInput, SuggestionUpdate, StoredComment, CommentInput, } from './suggestions';
 export { PAGE_TEMPLATES, instantiateTemplate, type PageTemplate } from './templates';
-export { BACKUP_VERSION, remapBundle, type SpaceBackup, type ImportMode, type ImportRequest, type ImportResult, } from './backup';
+export { BACKUP_VERSION, BACKUP_CADENCES, BACKUP_CADENCE_MS, DEFAULT_BACKUP_CONFIG, remapBundle, type SpaceBackup, type ImportMode, type ImportRequest, type ImportResult, type BackupCadence, type BackupConfig, type BackupCadenceStatus, type BackupStatus, } from './backup';
 export type { AgentChatEvent, AgentChatMessage, AgentChatOptions, AgentProposal, InterviewStep, AiProvider, AiConfig, AiProviderSettings, AiEffort, AiSkill, AiStatus, AiSearchResult, AiSearchResponse, AiTasksResponse, AiStreamEvent, } from './ai';
-export { providerSettings } from './ai';
+export { providerSettings, isPaidProvider } from './ai';