@book.dev/sdk 1.60.0 → 1.65.0

package/dist/identity.js

@@ -0,0 +1,273 @@
+/**
+ * Verifiable user identity for multi-user OpenBook (OB-165).
+ *
+ * A user proves who they are with a compact **JWS** (JSON Web Signature) signed
+ * by a trusted **issuer** (account.book.pub, or any federated issuer) using
+ * **Ed25519 / `alg: EdDSA`** — the same primitive the forwarding site keys and
+ * plugin provenance already use, so this adds no dependency. The data server
+ * verifies the assertion against the issuer's published JWKS (which it caches,
+ * so verification works offline and on any federated instance), then attributes
+ * every change to the resulting {@link Principal}.
+ *
+ * Design: see `docs/multi-user-and-backups-2026-06.md`. This module is
+ * isomorphic (Web Crypto only) so it runs in the server, the desktop app, the
+ * web shell, and tests alike.
+ */
+import { b64uDecode, b64uEncode, b64uDecodeString, b64uEncodeString, utf8 } from './forwarding/encoding';
+const ED25519 = { name: 'Ed25519' };
+/** A guest principal with an optional display name. */
+export function guestPrincipal(name = '') {
+    const label = name.trim();
+    return {
+        kind: 'guest',
+        subject: label ? `guest:${label}` : 'guest:anonymous',
+        issuer: '',
+        name: label,
+        verifiedVia: 'guest',
+    };
+}
+/** The implicit local owner (in-process / loopback desktop). */
+export function localPrincipal(name = 'Local') {
+    return { kind: 'user', subject: 'local:owner', issuer: 'local', name, verifiedVia: 'local' };
+}
+/** Stable short id for a principal — the value embedded in CRDT edit origins. */
+export function principalId(p) {
+    return p.subject;
+}
+/**
+ * Mint a fresh issuer keypair (Ed25519). Used by the dev issuer and tests; the
+ * real issuer (account.book.pub) holds the equivalent and rotates `kid`s.
+ */
+export async function mintIdentityKeypair(kid = 'dev-1') {
+    const kp = (await crypto.subtle.generateKey(ED25519, true, ['sign', 'verify']));
+    const raw = new Uint8Array(await crypto.subtle.exportKey('raw', kp.publicKey));
+    const priv = new Uint8Array(await crypto.subtle.exportKey('pkcs8', kp.privateKey));
+    return {
+        publicJwk: { kty: 'OKP', crv: 'Ed25519', x: b64uEncode(raw), kid, use: 'sig', alg: 'EdDSA' },
+        privateKey: b64uEncode(priv),
+    };
+}
+/**
+ * Sign an arbitrary JSON payload into a compact EdDSA JWS:
+ * `base64url(header).base64url(payload).base64url(sig)`. Shared by the identity
+ * assertion ({@link signIdentity}) and the revocation document
+ * ({@link signRevocations}) — both are the same JWS shape over a different payload.
+ */
+async function signCompactJws(privateKeyPkcs8, payload, kid) {
+    const header = { alg: 'EdDSA', typ: 'JWT', ...(kid ? { kid } : {}) };
+    const signingInput = `${b64uEncodeString(JSON.stringify(header))}.${b64uEncodeString(JSON.stringify(payload))}`;
+    const key = await crypto.subtle.importKey('pkcs8', b64uDecode(privateKeyPkcs8), ED25519, false, ['sign']);
+    const sig = await crypto.subtle.sign(ED25519, key, utf8(signingInput));
+    return `${signingInput}.${b64uEncode(new Uint8Array(sig))}`;
+}
+/**
+ * Sign an identity assertion (issuer side / dev / tests). Produces a compact
+ * EdDSA JWS: `base64url(header).base64url(claims).base64url(sig)`.
+ */
+export async function signIdentity(privateKeyPkcs8, claims, kid) {
+    return signCompactJws(privateKeyPkcs8, claims, kid);
+}
+/**
+ * Decode an assertion's header + claims **without** verifying the signature.
+ * For client-side display, and for the server's "claimed-but-unverified"
+ * provenance fallback. Never use this to make a trust decision.
+ */
+export function decodeIdentity(jws) {
+    const parts = jws.split('.');
+    if (parts.length !== 3)
+        return null;
+    try {
+        const header = JSON.parse(b64uDecodeString(parts[0]));
+        const claims = JSON.parse(b64uDecodeString(parts[1]));
+        if (!claims || typeof claims.iss !== 'string' || typeof claims.sub !== 'string')
+            return null;
+        return { header, claims };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Verify a compact EdDSA JWS's *signature* against a JWKS. Pure + offline.
+ * Returns `'unknown-key'` when no key matches the header `kid`, `'bad-signature'`
+ * when candidate keys exist but none validated, and `'ok'` on success. Shared by
+ * the identity-token ({@link verifyIdentity}) and revocation-document
+ * ({@link verifyRevocations}) verifiers — both prove the same EdDSA signature.
+ */
+async function verifyCompactSignature(jws, header, jwks) {
+    // Pick candidate keys: the kid-matched one, else every key (kid is a hint).
+    const candidates = header.kid ? jwks.keys.filter((k) => k.kid === header.kid) : jwks.keys;
+    if (candidates.length === 0)
+        return 'unknown-key';
+    const parts = jws.split('.');
+    const signingInput = utf8(`${parts[0]}.${parts[1]}`);
+    const sig = b64uDecode(parts[2]);
+    for (const jwk of candidates) {
+        try {
+            const key = await crypto.subtle.importKey('raw', b64uDecode(jwk.x), ED25519, false, ['verify']);
+            if (await crypto.subtle.verify(ED25519, key, sig, signingInput))
+                return 'ok';
+        }
+        catch {
+            // Malformed key — try the next candidate.
+        }
+    }
+    return 'bad-signature';
+}
+/**
+ * Verify an identity assertion against an issuer's JWKS. Pure + offline: the
+ * caller supplies the (cached) key set, so no network call happens here.
+ *
+ * Returns `{ok:true, claims}` only on a fresh, signature-valid, in-window,
+ * trusted-issuer, non-revoked assertion. On failure returns a reason (and the
+ * decoded claims when they parsed, so the server can record a claimed-but-
+ * unverified identity).
+ */
+export async function verifyIdentity(jws, jwks, opts = {}) {
+    const decoded = decodeIdentity(jws);
+    if (!decoded)
+        return { ok: false, reason: 'malformed' };
+    const { header, claims } = decoded;
+    if (header.alg !== 'EdDSA')
+        return { ok: false, reason: 'unsupported-alg', claims };
+    if (opts.allowedIssuers && !opts.allowedIssuers.includes(claims.iss)) {
+        return { ok: false, reason: 'untrusted-issuer', claims };
+    }
+    const sigCheck = await verifyCompactSignature(jws, header, jwks);
+    if (sigCheck !== 'ok')
+        return { ok: false, reason: sigCheck, claims };
+    // Time window (after the signature is proven, so we can distinguish expired
+    // from forged). Tolerance covers clock skew and short offline spells.
+    const tol = opts.clockToleranceSec ?? 60;
+    const now = Math.floor((opts.nowMs ?? Date.now()) / 1000);
+    if (typeof claims.nbf === 'number' && now + tol < claims.nbf) {
+        return { ok: false, reason: 'not-yet-valid', claims };
+    }
+    if (typeof claims.exp === 'number' && now - tol > claims.exp) {
+        return { ok: false, reason: 'expired', claims };
+    }
+    // Audience binding (OB-177). A scoped token must name THIS server; an unscoped
+    // token is accepted only when the server doesn't demand scoping. Checked after
+    // the signature so a forged `aud` can't pass — `aud` is inside the signed payload.
+    if (typeof claims.aud === 'string' && claims.aud.length > 0) {
+        if (!opts.audience || claims.aud !== opts.audience) {
+            return { ok: false, reason: 'wrong-audience', claims };
+        }
+    }
+    else if (opts.requireAudience) {
+        return { ok: false, reason: 'wrong-audience', claims };
+    }
+    // Revocation (OB-106). Checked LAST — after the signature and the time/aud
+    // window — so only a genuine, in-window token can ever be marked revoked (a
+    // forged token has already failed). The set was signature-verified by the
+    // caller (see {@link verifyRevocations}). A token is revoked when its issuer
+    // published a revocation for this `sub` whose `since` is newer than the token's
+    // `iat`, so a fresh re-login (a newer `iat`) is unaffected.
+    const rev = opts.revocations;
+    if (rev && rev.iss === claims.iss && typeof claims.iat === 'number') {
+        const entry = rev.revocations.find((r) => r.sub === claims.sub);
+        if (entry && claims.iat < entry.since)
+            return { ok: false, reason: 'revoked', claims };
+    }
+    return { ok: true, claims, header };
+}
+/**
+ * Validate + normalise a decoded revocations payload into a {@link RevocationSet}.
+ * Returns `null` when the top-level shape is wrong (so a malformed document is
+ * ignored rather than trusted), and drops any entry missing a `sub` or a numeric
+ * `since`.
+ */
+function normalizeRevocationSet(payload) {
+    if (!payload || typeof payload !== 'object')
+        return null;
+    const p = payload;
+    if (typeof p.iss !== 'string' || !Array.isArray(p.revocations))
+        return null;
+    const revocations = [];
+    for (const raw of p.revocations) {
+        if (!raw || typeof raw !== 'object')
+            continue;
+        const e = raw;
+        if (typeof e.sub !== 'string' || typeof e.since !== 'number')
+            continue;
+        revocations.push({ sub: e.sub, since: e.since, ...(typeof e.reason === 'string' ? { reason: e.reason } : {}) });
+    }
+    return {
+        iss: p.iss,
+        ...(typeof p.iat === 'number' ? { iat: p.iat } : {}),
+        ...(typeof p.ttl === 'number' ? { ttl: p.ttl } : {}),
+        revocations,
+    };
+}
+/**
+ * Verify an issuer's revocation document — a compact EdDSA JWS, the same format
+ * as an identity token — against the issuer's JWKS, returning the parsed
+ * {@link RevocationSet}. Pure + offline (the caller supplies the cached JWKS).
+ * Returns `null` on a malformed document, unsupported alg, or bad signature, so a
+ * forged or unsigned document can never revoke anything.
+ */
+export async function verifyRevocations(jws, jwks) {
+    const parts = jws.split('.');
+    if (parts.length !== 3)
+        return null;
+    let header;
+    let payload;
+    try {
+        header = JSON.parse(b64uDecodeString(parts[0]));
+        payload = JSON.parse(b64uDecodeString(parts[1]));
+    }
+    catch {
+        return null;
+    }
+    if (header.alg !== 'EdDSA')
+        return null;
+    if ((await verifyCompactSignature(jws, header, jwks)) !== 'ok')
+        return null;
+    return normalizeRevocationSet(payload);
+}
+/**
+ * Sign a revocation document (issuer side / dev / tests) — the counterpart to
+ * {@link verifyRevocations}. Produces the same compact EdDSA JWS the account
+ * service publishes at its revocations endpoint.
+ */
+export async function signRevocations(privateKeyPkcs8, set, kid) {
+    return signCompactJws(privateKeyPkcs8, set, kid);
+}
+/** The active-persona email (lowercased) carried by an assertion, if any. */
+function personaEmail(claims) {
+    const email = claims.email?.trim().toLowerCase();
+    return email ? email : undefined;
+}
+/** Build a verified user principal from validated claims. */
+export function principalFromClaims(claims, header) {
+    const email = personaEmail(claims);
+    return {
+        kind: 'user',
+        subject: `${claims.iss}#${claims.sub}`,
+        issuer: claims.iss,
+        name: claims.name ?? '',
+        ...(email ? { email } : {}),
+        verifiedVia: 'jws',
+        assertion: { kid: header?.kid, jti: claims.jti },
+    };
+}
+/**
+ * Build a claimed-but-unverified principal from an assertion that parsed but
+ * didn't verify fresh (e.g. expired while offline). Provenance still names the
+ * claimed subject, flagged `unverified`.
+ */
+export function unverifiedPrincipalFromClaims(claims) {
+    const email = personaEmail(claims);
+    return {
+        kind: 'user',
+        subject: `${claims.iss}#${claims.sub}`,
+        issuer: claims.iss,
+        name: claims.name ?? '',
+        // Carried for attribution only — an unverified principal is never `jws`, so
+        // `emailIsAuthoritative` is false and this email never drives a grant (B1/N8).
+        ...(email ? { email } : {}),
+        verifiedVia: 'unverified',
+        assertion: { jti: claims.jti },
+    };
+}
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAC,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,IAAI,EAAC,MAAM,uBAAuB,CAAC;AAEvG,MAAM,OAAO,GAAG,EAAC,IAAI,EAAE,SAAS,EAAU,CAAC;AA2C3C,uDAAuD;AACvD,MAAM,UAAU,cAAc,CAAC,IAAI,GAAG,EAAE;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC1B,OAAO;QACL,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,iBAAiB;QACrD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,KAAK;QACX,WAAW,EAAE,OAAO;KACrB,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,cAAc,CAAC,IAAI,GAAG,OAAO;IAC3C,OAAO,EAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAC,CAAC;AAC7F,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,WAAW,CAAC,CAAY;IACtC,OAAO,CAAC,CAAC,OAAO,CAAC;AACnB,CAAC;AAgGD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAG,GAAG,OAAO;IACrD,MAAM,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAkB,CAAC;IACjG,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IACnF,OAAO;QACL,SAAS,EAAE,EAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAC;QAC1F,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAAC,eAAuB,EAAE,OAAgB,EAAE,GAAY;IACnF,MAAM,MAAM,GAAmB,EAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAC,GAAG,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAC,CAAC;IACjF,MAAM,YAAY,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;IAChH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1G,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IACvE,OAAO,GAAG,YAAY,IAAI,UAAU,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,eAAuB,EACvB,MAAsB,EACtB,GAAY;IAEZ,OAAO,cAAc,CAAC,eAAe,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAmB,CAAC;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAmB,CAAC;QACxE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC7F,OAAO,EAAC,MAAM,EAAE,MAAM,EAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAiDD;;;;;;GAMG;AACH,KAAK,UAAU,sBAAsB,CACnC,GAAW,EACX,MAAsB,EACtB,IAAU;IAEV,4EAA4E;IAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC1F,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC;IAClD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YAChG,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW,EAAE,IAAU,EAAE,OAAsB,EAAE;IACpF,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAC,CAAC;IACtD,MAAM,EAAC,MAAM,EAAE,MAAM,EAAC,GAAG,OAAO,CAAC;IACjC,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAC,CAAC;IAClF,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACrE,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAC,CAAC;IACzD,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACjE,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAC,CAAC;IAEpE,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1D,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QAC7D,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,GAAG,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QAC7D,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAC,CAAC;IAChD,CAAC;IAED,+EAA+E;IAC/E,+EAA+E;IAC/E,mFAAmF;IACnF,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnD,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAC,CAAC;QACvD,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAC,CAAC;IACvD,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,gFAAgF;IAChF,4DAA4D;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC;IAC7B,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,KAAK,IAAI,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,KAAK;YAAE,OAAO,EAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAC,CAAC;IACvF,CAAC;IAED,OAAO,EAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,OAAgB;IAC9C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,CAAC,GAAG,OAA+E,CAAC;IAC1F,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QAC9C,MAAM,CAAC,GAAG,GAAyD,CAAC;QACpE,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;YAAE,SAAS;QACvE,WAAW,CAAC,IAAI,CAAC,EAAC,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAC,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO;QACL,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAC,GAAG,EAAE,CAAC,CAAC,GAAG,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAC,GAAG,EAAE,CAAC,CAAC,GAAG,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,IAAU;IAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,MAAsB,CAAC;IAC3B,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAmB,CAAC;QAClE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,MAAM,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,eAAuB,EACvB,GAAkB,EAClB,GAAY;IAEZ,OAAO,cAAc,CAAC,eAAe,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AACnD,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,MAAsB;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACnC,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,mBAAmB,CAAC,MAAsB,EAAE,MAAuB;IACjF,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,GAAG,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,EAAE;QACtC,MAAM,EAAE,MAAM,CAAC,GAAG;QAClB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;QACvB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAC,KAAK,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,WAAW,EAAE,KAAK;QAClB,SAAS,EAAE,EAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAC;KAC/C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAsB;IAClE,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,GAAG,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,EAAE;QACtC,MAAM,EAAE,MAAM,CAAC,GAAG;QAClB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;QACvB,4EAA4E;QAC5E,+EAA+E;QAC/E,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAC,KAAK,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,WAAW,EAAE,YAAY;QACzB,SAAS,EAAE,EAAC,GAAG,EAAE,MAAM,CAAC,GAAG,EAAC;KAC7B,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,23 +1,27 @@
-export type { PageSnapshot, PageMeta, StoredPage, PageInput, ServerInfo, ServerControls } from './types';
-export { emptyPageSnapshot } from './types';
-export { API, type ApiError } from './routes';
-export type { DataClient, PageSubscription, FetchLike, LiveSourceLike, HttpDataClientOptions } from './client';
+export type { PageSnapshot, PageMeta, StoredPage, PageInput, ServerInfo, ServerControls, PageVisibility, Visibility, MemberRole, MemberStatus, MemberSource, AclLevel, Member, PageAcl, } from './types';
+export { emptyPageSnapshot, PAGE_VISIBILITIES } from './types';
+export { API, type ApiError, type CompactResult } from './routes';
+export type { DataClient, PageSubscription, FetchLike, LiveSourceLike, HttpDataClientOptions, IdentityCredential } from './client';
 export { HttpDataClient } from './client';
-export { ForwardingClient, TunnelClient, MemoryKeyStore, mintSiteKeypair, signWithSiteKey, type KeyStore, type SiteIdentity, type ForwardingClientOptions, type TunnelStatus, } from './forwarding';
+export { ForwardingClient, TunnelClient, MemoryKeyStore, mintSiteKeypair, signWithSiteKey, verifyWithSiteKey, FORWARDED_HEADER, signRosterAssertion, verifyRosterAssertion, ROSTER_ASSERTION_VERSION, ROSTER_ASSERTION_SKEW_MS, type KeyStore, type SiteIdentity, type ForwardingClientOptions, type TunnelStatus, type RosterAssertionPayload, type SignRosterAssertionInput, type VerifyRosterAssertionInput, } from './forwarding';
 export type { DatabasePropertyType, NumberFormat, NumberDisplay, StatusGroup, RollupFunction, RollupConfig, RelationCardinality, DatabaseSelectOption, DatabaseProperty, DateRange, LocationValue, PropertyGroup, RowTemplate, DatabaseViewType, ChartAggregate, SummaryType, FilterOperator, FilterConjunction, DatabaseFilter, DatabaseFilterGroup, FilterNode, SortDirection, DatabaseSort, DatabaseView, DatabaseMetric, ColorRule, DatabaseSchema, StoredDatabase, DatabaseInput, DatabaseUpdate, DatabaseRow, RowInput, RowUpdate, RowGroup, ChartDatum, ChartSeries, ChartSegment, ChartGroup, ChartMatrix, DateSpan, GraphNode, GraphEdge, DependencyGraph, InverseUpdate, RowTreeNode, } from './database';
 export { TITLE_PROPERTY_ID, SELECT_COLORS, NO_VALUE_GROUP, STATUS_GROUPS, RELATIVE_DATE_OPS, projectExports, rowValue, matchesFilter, rowMatchesCondition, applyView, viewFilterRoot, isFilterGroup, shortId, defaultDatabaseSchema, defaultView, defaultStatusOptions, removeProperty, formatNumber, formatUniqueId, numberProgress, groupRows, groupRowsBy, groupRowsByParent, PARENT_GROUP_ID, NO_PARENT_GROUP, aggregateRows, aggregateMatrix, CHART_TOTAL_SERIES, summarizeColumn, dateStart, dateEnd, parseDay, rowDateSpan, rowLocation, asLocation, dependencyGraph, syncInverseUpdates, relationSides, buildRowTree, flattenRowTree, isImageUrl, firstImageUrl, coverImageUrl, } from './database';
 export { evaluateFormula, formulaReferences, FormulaError, type FormulaValue, type FormulaResolver, } from './formula';
 export { OWNER_PROPERTY_ID, VERIFICATION_PROPERTY_ID, BACKLINKS_PROPERTY_ID, THEME_PROPERTY_ID, COVER_PROPERTY_ID, FONTS_PROPERTY_ID, ICON_PROPERTY_ID, FULLWIDTH_PROPERTY_ID, SYSTEM_PAGE_PROPERTIES, isVerified, verificationExpired, isVerificationActive, makeVerification, extractMentionIds, propertiesReferencePage, type VerificationValue, } from './pageProperties';
-export { getServerUrlOverride, setServerUrlOverride, getServerTokenOverride, setServerTokenOverride, isMixedContentBlocked } from './connection';
+export { getServerUrlOverride, setServerUrlOverride, getServerTokenOverride, setServerTokenOverride, getIdentityCredential, setIdentityToken, setGuestName, getForwardingAudience, setForwardingAudience, isMixedContentBlocked } from './connection';
 export { AccountClient, AccountError, DEFAULT_ACCOUNT_URL, getAccountUrlOverride, setAccountUrlOverride, resolveAccountUrl, type AccountSettings, } from './account';
+export { guestPrincipal, localPrincipal, principalId, mintIdentityKeypair, signIdentity, decodeIdentity, verifyIdentity, verifyRevocations, signRevocations, principalFromClaims, unverifiedPrincipalFromClaims, type Principal, type PrincipalKind, type VerifiedVia, type IdentityHeader, type IdentityClaims, type Jwk, type Jwks, type RevocationEntry, type RevocationSet, type IdentityKeypair, type VerifyOptions, type VerifyResult, type VerifyFailure, } from './identity';
+export { DEFAULT_INSTANCE_CONFIG, type GuestAccess, type TrustedIssuerConfig, type InstanceConfig, type InstanceInfo, type StoredEdit, type WorkspaceBinding, type WorkspaceRoster, type WorkspaceRosterEntry, } from './provenance';
+export { authorize, isEmailAuthoritative, type Role, type EffectiveVisibility, type AclEntry, type AccessPage, type AccessCtx, type Decision, } from './authorize';
 export { snapshotText, paragraphBlocks, textSnapshot, appendTextToSnapshot, appendBlocksToSnapshot, type AppendBlock } from './content';
 export { snapshotBlocks, contentHash, computeBlockMtimes, stampSnapshotMtimes, latestBlockMtime, type BlockDigest, } from './mtime';
+export { computeBlockAuthors, stampSnapshotAuthors, latestSnapshotAuthor } from './authors';
 export { pageToBookHtml, bookHtmlToPage, readBookHtmlMeta, slugify, type BookPageRecord, } from './bookfile';
 export { spaceToBookFiles, parseBookFolder, SPACE_BUNDLE_FILE, type BookFolderFile, type SpaceSnapshot, } from './bookFolder';
 export { canonicalDigest, generateRegistryKeys, signPlugin, verifyPlugin, validateManifest, OPENBOOK_REGISTRY, type PluginManifest, type PluginAgentTool, type PluginPackage, type PluginSignature, type StoredPlugin, } from './plugins';
 export { buildSampleDocument, seedSampleDocument, SAMPLE_DOCUMENT_NAME } from './sampleDocument';
-export type { CommentRun, SuggestionAuthorKind, SuggestionKind, SuggestionStatus, SuggestionTarget, StoredSuggestion, SuggestionInput, SuggestionUpdate, StoredComment, CommentInput, } from './suggestions';
+export type { CommentRun, AuthoredIdentity, SuggestionAuthorKind, SuggestionKind, SuggestionStatus, SuggestionTarget, StoredSuggestion, SuggestionInput, SuggestionUpdate, StoredComment, CommentInput, } from './suggestions';
 export { PAGE_TEMPLATES, instantiateTemplate, type PageTemplate } from './templates';
-export { BACKUP_VERSION, remapBundle, type SpaceBackup, type ImportMode, type ImportRequest, type ImportResult, } from './backup';
+export { BACKUP_VERSION, BACKUP_CADENCES, BACKUP_CADENCE_MS, DEFAULT_BACKUP_CONFIG, remapBundle, type SpaceBackup, type ImportMode, type ImportRequest, type ImportResult, type BackupCadence, type BackupConfig, type BackupCadenceStatus, type BackupStatus, } from './backup';
 export type { AgentChatEvent, AgentChatMessage, AgentChatOptions, AgentProposal, InterviewStep, AiProvider, AiConfig, AiProviderSettings, AiEffort, AiSkill, AiStatus, AiSearchResult, AiSearchResponse, AiTasksResponse, AiStreamEvent, } from './ai';
-export { providerSettings } from './ai';
+export { providerSettings, isPaidProvider } from './ai';

package/dist/index.js

@@ -1,19 +1,23 @@
-export { emptyPageSnapshot } from './types';
+export { emptyPageSnapshot, PAGE_VISIBILITIES } from './types';
 export { API } from './routes';
 export { HttpDataClient } from './client';
-export { ForwardingClient, TunnelClient, MemoryKeyStore, mintSiteKeypair, signWithSiteKey, } from './forwarding';
+export { ForwardingClient, TunnelClient, MemoryKeyStore, mintSiteKeypair, signWithSiteKey, verifyWithSiteKey, FORWARDED_HEADER, signRosterAssertion, verifyRosterAssertion, ROSTER_ASSERTION_VERSION, ROSTER_ASSERTION_SKEW_MS, } from './forwarding';
 export { TITLE_PROPERTY_ID, SELECT_COLORS, NO_VALUE_GROUP, STATUS_GROUPS, RELATIVE_DATE_OPS, projectExports, rowValue, matchesFilter, rowMatchesCondition, applyView, viewFilterRoot, isFilterGroup, shortId, defaultDatabaseSchema, defaultView, defaultStatusOptions, removeProperty, formatNumber, formatUniqueId, numberProgress, groupRows, groupRowsBy, groupRowsByParent, PARENT_GROUP_ID, NO_PARENT_GROUP, aggregateRows, aggregateMatrix, CHART_TOTAL_SERIES, summarizeColumn, dateStart, dateEnd, parseDay, rowDateSpan, rowLocation, asLocation, dependencyGraph, syncInverseUpdates, relationSides, buildRowTree, flattenRowTree, isImageUrl, firstImageUrl, coverImageUrl, } from './database';
 export { evaluateFormula, formulaReferences, FormulaError, } from './formula';
 export { OWNER_PROPERTY_ID, VERIFICATION_PROPERTY_ID, BACKLINKS_PROPERTY_ID, THEME_PROPERTY_ID, COVER_PROPERTY_ID, FONTS_PROPERTY_ID, ICON_PROPERTY_ID, FULLWIDTH_PROPERTY_ID, SYSTEM_PAGE_PROPERTIES, isVerified, verificationExpired, isVerificationActive, makeVerification, extractMentionIds, propertiesReferencePage, } from './pageProperties';
-export { getServerUrlOverride, setServerUrlOverride, getServerTokenOverride, setServerTokenOverride, isMixedContentBlocked } from './connection';
+export { getServerUrlOverride, setServerUrlOverride, getServerTokenOverride, setServerTokenOverride, getIdentityCredential, setIdentityToken, setGuestName, getForwardingAudience, setForwardingAudience, isMixedContentBlocked } from './connection';
 export { AccountClient, AccountError, DEFAULT_ACCOUNT_URL, getAccountUrlOverride, setAccountUrlOverride, resolveAccountUrl, } from './account';
+export { guestPrincipal, localPrincipal, principalId, mintIdentityKeypair, signIdentity, decodeIdentity, verifyIdentity, verifyRevocations, signRevocations, principalFromClaims, unverifiedPrincipalFromClaims, } from './identity';
+export { DEFAULT_INSTANCE_CONFIG, } from './provenance';
+export { authorize, isEmailAuthoritative, } from './authorize';
 export { snapshotText, paragraphBlocks, textSnapshot, appendTextToSnapshot, appendBlocksToSnapshot } from './content';
 export { snapshotBlocks, contentHash, computeBlockMtimes, stampSnapshotMtimes, latestBlockMtime, } from './mtime';
+export { computeBlockAuthors, stampSnapshotAuthors, latestSnapshotAuthor } from './authors';
 export { pageToBookHtml, bookHtmlToPage, readBookHtmlMeta, slugify, } from './bookfile';
 export { spaceToBookFiles, parseBookFolder, SPACE_BUNDLE_FILE, } from './bookFolder';
 export { canonicalDigest, generateRegistryKeys, signPlugin, verifyPlugin, validateManifest, OPENBOOK_REGISTRY, } from './plugins';
 export { buildSampleDocument, seedSampleDocument, SAMPLE_DOCUMENT_NAME } from './sampleDocument';
 export { PAGE_TEMPLATES, instantiateTemplate } from './templates';
-export { BACKUP_VERSION, remapBundle, } from './backup';
-export { providerSettings } from './ai';
+export { BACKUP_VERSION, BACKUP_CADENCES, BACKUP_CADENCE_MS, DEFAULT_BACKUP_CONFIG, remapBundle, } from './backup';
+export { providerSettings, isPaidProvider } from './ai';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,iBAAiB,EAAC,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAC,GAAG,EAAgB,MAAM,UAAU,CAAC;AAE5C,OAAO,EAAC,cAAc,EAAC,MAAM,UAAU,CAAC;AACxC,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,eAAe,GAKhB,MAAM,cAAc,CAAC;AAgDtB,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,QAAQ,EACR,aAAa,EACb,mBAAmB,EACnB,SAAS,EACT,cAAc,EACd,aAAa,EACb,OAAO,EACP,qBAAqB,EACrB,WAAW,EACX,oBAAoB,EACpB,cAAc,EACd,YAAY,EACZ,cAAc,EACd,cAAc,EACd,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,OAAO,EACP,QAAQ,EACR,WAAW,EACX,WAAW,EACX,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,cAAc,EACd,UAAU,EACV,aAAa,EACb,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,YAAY,GAGb,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,EACtB,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,GAExB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAC,oBAAoB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,qBAAqB,EAAC,MAAM,cAAc,CAAC;AAC/I,OAAO,EACL,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,GAElB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAC,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,oBAAoB,EAAE,sBAAsB,EAAmB,MAAM,WAAW,CAAC;AACtI,OAAO,EACL,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GAEjB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,OAAO,GAER,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,iBAAiB,GAGlB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,GAMlB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAC,mBAAmB,EAAE,kBAAkB,EAAE,oBAAoB,EAAC,MAAM,kBAAkB,CAAC;AAa/F,OAAO,EAAC,cAAc,EAAE,mBAAmB,EAAoB,MAAM,aAAa,CAAC;AACnF,OAAO,EACL,cAAc,EACd,WAAW,GAKZ,MAAM,UAAU,CAAC;AAkBlB,OAAO,EAAC,gBAAgB,EAAC,MAAM,MAAM,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAC,iBAAiB,EAAE,iBAAiB,EAAC,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAC,GAAG,EAAoC,MAAM,UAAU,CAAC;AAEhE,OAAO,EAAC,cAAc,EAAC,MAAM,UAAU,CAAC;AACxC,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,GAQzB,MAAM,cAAc,CAAC;AAgDtB,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,QAAQ,EACR,aAAa,EACb,mBAAmB,EACnB,SAAS,EACT,cAAc,EACd,aAAa,EACb,OAAO,EACP,qBAAqB,EACrB,WAAW,EACX,oBAAoB,EACpB,cAAc,EACd,YAAY,EACZ,cAAc,EACd,cAAc,EACd,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,OAAO,EACP,QAAQ,EACR,WAAW,EACX,WAAW,EACX,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,cAAc,EACd,UAAU,EACV,aAAa,EACb,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,YAAY,GAGb,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,EACtB,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,uBAAuB,GAExB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAC,oBAAoB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,YAAY,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,qBAAqB,EAAC,MAAM,cAAc,CAAC;AACpP,OAAO,EACL,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,EACrB,iBAAiB,GAElB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,cAAc,EACd,cAAc,EACd,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,6BAA6B,GAc9B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uBAAuB,GASxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,SAAS,EACT,oBAAoB,GAOrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAC,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,oBAAoB,EAAE,sBAAsB,EAAmB,MAAM,WAAW,CAAC;AACtI,OAAO,EACL,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,GAEjB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAC,mBAAmB,EAAE,oBAAoB,EAAE,oBAAoB,EAAC,MAAM,WAAW,CAAC;AAC1F,OAAO,EACL,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,OAAO,GAER,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,iBAAiB,GAGlB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,GAMlB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAC,mBAAmB,EAAE,kBAAkB,EAAE,oBAAoB,EAAC,MAAM,kBAAkB,CAAC;AAc/F,OAAO,EAAC,cAAc,EAAE,mBAAmB,EAAoB,MAAM,aAAa,CAAC;AACnF,OAAO,EACL,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,WAAW,GASZ,MAAM,UAAU,CAAC;AAkBlB,OAAO,EAAC,gBAAgB,EAAE,cAAc,EAAC,MAAM,MAAM,CAAC"}

package/dist/provenance.d.ts

@@ -0,0 +1,168 @@
+/**
+ * Multi-user instance policy + change provenance (OB-165). The contract the
+ * server and clients share for: the guest-access gate, the set of trusted
+ * identity issuers, and the durable per-change edit log.
+ *
+ * Design: `docs/multi-user-and-backups-2026-06.md`.
+ */
+import type { Jwks, Principal, RevocationSet, VerifiedVia } from './identity';
+import type { MemberRole, PageVisibility } from './types';
+/** What an unauthenticated (guest) caller may do on this instance. */
+export type GuestAccess = 
+/** Guests are rejected entirely (sign-in required). */
+'off'
+/** Guests may read, but not write. */
+ | 'read'
+/** Guests may read and write (the default — same as a no-login workspace today). */
+ | 'write';
+/** An identity issuer this instance trusts (issuer-rooted federation). */
+export interface TrustedIssuerConfig {
+    /** The `iss` claim this config authorizes. */
+    issuer: string;
+    /** Where to (re)fetch the issuer's JWKS for online refresh. */
+    jwksUrl?: string;
+    /** Inline / cached JWKS — makes verification offline-capable (and is how the
+     *  dev issuer ships its key). */
+    jwks?: Jwks;
+    /**
+     * Where to (re)fetch the issuer's revocation document (OB-106) — an EdDSA-signed
+     * JWS verified against the issuer's JWKS. Polled + cached like {@link jwksUrl},
+     * with a last-good offline fallback. Absent ⇒ this issuer publishes no
+     * revocations and every signature-valid, in-window token is honoured.
+     */
+    revocationsUrl?: string;
+    /**
+     * Inline / cached revocation set — config-trusted (like an inline {@link jwks}),
+     * so it needs no signature check. Mainly for the dev issuer and tests; the real
+     * account issuer ships a signed document via {@link revocationsUrl}.
+     */
+    revocations?: RevocationSet;
+}
+/** The instance's multi-user policy, persisted in the `settings` table. */
+export interface InstanceConfig {
+    guestAccess: GuestAccess;
+    /** The principal subject that administers this instance, once claimed. */
+    ownerSubject?: string;
+    trustedIssuers: TrustedIssuerConfig[];
+    /**
+     * This server's own audience identifier (OB-177). When set, an identity token
+     * scoped to a *different* audience is rejected, and clients should request a
+     * token bound to this value. Leave unset for the single-server model.
+     */
+    audience?: string;
+    /** Require every identity token to be audience-bound to {@link audience}
+     *  (reject unscoped tokens). Multi-server hardening. */
+    requireAudience?: boolean;
+    /**
+     * Default audience scope a page's `visibility='inherit'` resolves to at the root
+     * (OB-182 §2.4, Fork 1). Set to `'members'` (private) when the instance is
+     * claimed; an unclaimed instance never reaches the access path. Never `'inherit'`.
+     */
+    defaultVisibility?: Exclude<PageVisibility, 'inherit'>;
+    /**
+     * The ONE issuer whose `email` claim is trusted for persona / email-ACL matching
+     * (OB-182 §2.4, B1). Subject-based grants work for any {@link trustedIssuers}
+     * entry, but only a token from `emailAuthority` can satisfy an email persona or
+     * an email ACL. Must be one of {@link trustedIssuers} or every email grant
+     * silently (and safely) stops matching. Defaults to account.book.pub.
+     */
+    emailAuthority?: string;
+    /**
+     * When this instance is a MANAGED workspace (OB-199), the account workspace it
+     * is bound to. Set, the periodic roster sync projects that workspace's roster
+     * (admins / viewers + the workspace owner) into the local `members` table so
+     * `members`-scope + admin/viewer roles resolve for direct (non-edge) access too.
+     * Unset ⇒ a standalone instance; the sync is inert. Additive — absence is the
+     * pre-OB-199 single-instance behaviour. Holds non-secret COORDINATES only; the
+     * credential the instance presents to read the roster is supplied out-of-band
+     * (never persisted in policy). See {@link WorkspaceBinding}.
+     */
+    workspaceBinding?: WorkspaceBinding;
+}
+/**
+ * Binds a managed instance to an account workspace (OB-199). Non-secret
+ * coordinates only — the roster-read credential is injected at runtime, never
+ * stored here. Set by the owner (via the instance-policy route) or learned during
+ * the forwarding/claim flow.
+ */
+export interface WorkspaceBinding {
+    /** The account workspace id this instance serves. */
+    workspaceId: string;
+    /**
+     * Base URL of the account that owns the workspace (where the roster lives).
+     * Defaults to the instance `emailAuthority` (account.book.pub) when omitted.
+     */
+    accountBaseUrl?: string;
+}
+/**
+ * One entry of the account workspace roster (OB-197 contract), as consumed by the
+ * OB-199 sync. Identifies a member by a bound `subject` (`iss#sub`) and/or a
+ * persona `email`, with the workspace role. The account is the producer; the
+ * instance only reads this shape (it never writes the account).
+ */
+export interface WorkspaceRosterEntry {
+    /** Bound `iss#sub` of the member, when the account exposes it. */
+    subject?: string;
+    /** Persona email (any case; lowercased on sync). */
+    email?: string;
+    role: MemberRole;
+}
+/**
+ * The account workspace roster returned by `GET /api/workspaces/:id/members`
+ * (OB-197), as consumed by the OB-199 sync. `ownerSubject` is the workspace
+ * owner's bound subject (`iss#sub`) — admitted as an admin even when it differs
+ * from the instance's own site owner (OB-198 F2), so the workspace owner is never
+ * locked out of a workspace they own.
+ */
+export interface WorkspaceRoster {
+    workspaceId: string;
+    /** Bound `iss#sub` of the workspace owner (admitted as admin). */
+    ownerSubject?: string;
+    members: WorkspaceRosterEntry[];
+}
+export declare const DEFAULT_INSTANCE_CONFIG: InstanceConfig;
+/**
+ * Public view of the instance policy returned by `GET /api/instance` — issuer
+ * URLs only (never private JWKS material), plus the principal resolved for the
+ * *current* request, so a client can render "you are signed in as …" / "guest".
+ */
+export interface InstanceInfo {
+    guestAccess: GuestAccess;
+    ownerSubject: string | null;
+    trustedIssuers: string[];
+    /** This server's audience identifier, so a client can request an `aud`-scoped
+     *  identity token (OB-177). `null` for the single-server (unscoped) model. */
+    audience: string | null;
+    /** Whether this instance *requires* every identity token to be bound to
+     *  {@link audience} (OB-202). Lets a client short-circuit the audience-bind on
+     *  relaunch: when the server already persisted `audience==host && requireAudience`
+     *  it only needs to ensure its own token is scoped, never to relax + re-assert.
+     *  Optional: absent (e.g. a pre-OB-202 server / a test fixture) is treated as `false`. */
+    requireAudience?: boolean;
+    /** Who the server resolved you to be on this request. */
+    you: Principal;
+    /**
+     * Your active-persona roster role on this request (OB-182 §1.1), or `null` if
+     * you aren't an active member. Lets a client gate manager-only UI (the per-page
+     * Share dialog) without a per-page probe: `admin` (and the owner / loopback,
+     * derivable from {@link you} + {@link ownerSubject}) manage sharing.
+     * Optional: absent (a pre-OB-203 server / a test fixture) is treated as `null`.
+     */
+    youRole?: MemberRole | null;
+}
+/** One recorded change — a row of the append-only edit log. */
+export interface StoredEdit {
+    id: string;
+    pageId: string | null;
+    authorSubject: string;
+    authorIssuer: string;
+    authorName: string;
+    verifiedVia: VerifiedVia;
+    /** What kind of change: `page.save`, `page.create`, `page.delete`, `row.update`, … */
+    kind: string;
+    /** The signed credential that authorized it (users only). */
+    assertionKid: string | null;
+    assertionJti: string | null;
+    summary: string;
+    createdAt: string;
+}

package/dist/provenance.js

@@ -0,0 +1,31 @@
+/**
+ * Multi-user instance policy + change provenance (OB-165). The contract the
+ * server and clients share for: the guest-access gate, the set of trusted
+ * identity issuers, and the durable per-change edit log.
+ *
+ * Design: `docs/multi-user-and-backups-2026-06.md`.
+ */
+import { DEFAULT_ACCOUNT_URL } from './account';
+export const DEFAULT_INSTANCE_CONFIG = {
+    guestAccess: 'write',
+    // Trust account.book.pub out of the box — it's the OpenBook identity authority
+    // (the shared root that makes identities federate across instances). Only ever
+    // consulted when an `iss=account.book.pub` assertion is actually presented; the
+    // JWKS is fetched + cached lazily. Override or extend in instance settings.
+    trustedIssuers: [
+        {
+            issuer: DEFAULT_ACCOUNT_URL,
+            jwksUrl: `${DEFAULT_ACCOUNT_URL}/api/identity/jwks`,
+            // Consult account.book.pub's revocation list (OB-106) — signed against the
+            // same JWKS, cached with a last-good offline fallback.
+            revocationsUrl: `${DEFAULT_ACCOUNT_URL}/api/identity/revocations`,
+        },
+    ],
+    // `inherit` at the root resolves here. Private-by-default once claimed (Fork 1);
+    // an unclaimed instance short-circuits before this is ever consulted (rule 0).
+    defaultVisibility: 'members',
+    // account.book.pub is the default email-authority — the one issuer whose `email`
+    // claim drives persona / email-ACL matching (B1). It is already trusted above.
+    emailAuthority: DEFAULT_ACCOUNT_URL,
+};
+//# sourceMappingURL=provenance.js.map

package/dist/provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../src/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAC,mBAAmB,EAAC,MAAM,WAAW,CAAC;AA2H9C,MAAM,CAAC,MAAM,uBAAuB,GAAmB;IACrD,WAAW,EAAE,OAAO;IACpB,+EAA+E;IAC/E,+EAA+E;IAC/E,gFAAgF;IAChF,4EAA4E;IAC5E,cAAc,EAAE;QACd;YACE,MAAM,EAAE,mBAAmB;YAC3B,OAAO,EAAE,GAAG,mBAAmB,oBAAoB;YACnD,2EAA2E;YAC3E,uDAAuD;YACvD,cAAc,EAAE,GAAG,mBAAmB,2BAA2B;SAClE;KACF;IACD,iFAAiF;IACjF,+EAA+E;IAC/E,iBAAiB,EAAE,SAAS;IAC5B,iFAAiF;IACjF,+EAA+E;IAC/E,cAAc,EAAE,mBAAmB;CACpC,CAAC"}

package/dist/routes.d.ts

@@ -82,7 +82,60 @@ export declare const API: {
     readonly comments: (pageId: string) => string;
     /** A single comment: `DELETE`. */
     readonly comment: (id: string) => string;
+    /**
+     * On-demand heavy database compaction (`POST`): VACUUM FULL to physically
+     * reclaim heap bloat. Embedded (PGlite) only — a server backed by external
+     * Postgres answers 409. See OB-164.
+     */
+    readonly compact: "/api/maintenance/compact";
+    /**
+     * Instance multi-user policy: `GET` returns {@link InstanceInfo} (guest
+     * policy, trusted issuer URLs, and the principal resolved for *this* request);
+     * `PUT` updates the policy (owner only).
+     */
+    readonly instance: "/api/instance";
+    /** A page's change provenance (the edit log), newest first: `GET`. */
+    readonly pageEdits: (id: string) => string;
+    /**
+     * The member roster: `GET` (list) / `POST` (invite by email or handle/subject).
+     * Instance-writer (owner/admin/loopback) only — managing or even seeing the
+     * roster is a privileged action.
+     */
+    readonly members: "/api/members";
+    /** A single roster row: `PATCH` (role/status) / `DELETE` (revoke). */
+    readonly member: (id: string) => string;
+    /**
+     * A page's per-page ACL grants: `GET` (list) / `POST` (share to an email or
+     * handle/subject) / `DELETE` (`?subject=` | `?email=` to revoke). Gated on
+     * write of the page itself (you manage sharing of pages you can write).
+     */
+    readonly pageAcl: (id: string) => string;
+    /**
+     * A page's audience-scope visibility (OB-182 §1.1): `GET` returns
+     * `{visibility}` (read-gated); `PUT` `{visibility}` sets it (write-gated — same
+     * "you manage sharing of pages you can write" rule as the ACL).
+     */
+    readonly pageVisibility: (id: string) => string;
+    /**
+     * On-demand roster sync of a managed instance: `GET` reports the binding +
+     * last-sync status; `POST` pulls the bound workspace roster from the account and
+     * reconciles it into the local roster (managed rows only). Instance-writer
+     * (owner/admin/loopback) only. The same sync also runs periodically.
+     */
+    readonly workspaceSync: "/api/workspace/sync";
+    /** Scheduled-backup policy: `GET` returns {@link BackupStatus}; `PUT` updates
+     *  the policy and returns the new status. */
+    readonly backups: "/api/backups";
+    /** Run a backup immediately: `POST` `{cadence?}` → the written file's name. */
+    readonly backupRun: "/api/backups/run";
 };
+/** Result of a {@link API.compact} run: the database's on-disk size before/after,
+ *  in bytes, and how much was reclaimed. */
+export interface CompactResult {
+    before: number;
+    after: number;
+    reclaimed: number;
+}
 /** Error body shape returned by the API for non-2xx responses. */
 export interface ApiError {
     error: string;