@ccmsg/cli 0.2.1 → 0.2.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ccmsg/cli",
-  "version": "0.2.1",
+  "version": "0.2.4",
   "description": "The ccmsg daemon, CLI and agent plugins for one instance (= one config home)",
   "license": "MIT",
   "author": "kawaz",
@@ -20,7 +20,7 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ccmsg/protocol": "1.4.0"
+    "@ccmsg/protocol": "1.6.0"
   },
   "devDependencies": {
     "@types/bun": "^1.3.0",

package/src/auth/admin.ts

@@ -18,7 +18,6 @@ export type AdminRequest =
       readonly admin: "passkey_add";
       readonly request_id: string;
       readonly endpoint?: Endpoint;
-      readonly rp_id?: string;
       readonly name?: string;
       readonly sub?: Subject;
     }
@@ -45,7 +44,6 @@ export function handleAdmin(auth: Auth, request: AdminRequest): DispatchResult {
           request.request_id,
           auth.issue({
             ...(request.endpoint === undefined ? {} : { endpoint: request.endpoint }),
-            ...(request.rp_id === undefined ? {} : { rpId: request.rp_id }),
             ...(request.name === undefined ? {} : { label: request.name }),
             ...(request.sub === undefined ? {} : { sub: request.sub }),
           }),

package/src/auth/auth.ts

@@ -21,7 +21,12 @@ import type {
   Timestamp,
   TokenFamily,
 } from "@ccmsg/protocol";
-import { AUTH_CHALLENGE_TTL_MS, REGISTER_TTL_MS } from "@ccmsg/protocol";
+import {
+  AUTH_CHALLENGE_TTL_MS,
+  Endpoint as EndpointSchema,
+  REGISTER_TTL_MS,
+  validationErrors,
+} from "@ccmsg/protocol";
 import { type HandlerInput, OpError, type Requester } from "../dispatch/index.ts";
 import { AuthRecords, credentialKey, familyKey } from "./records.ts";
 import {
@@ -35,7 +40,6 @@ import {
   WebAuthnError,
 } from "./webauthn.ts";
 import { CborError } from "./cbor.ts";
-import { ENTRY_PATH } from "../transport/index.ts";
 
 /** How long an access token is accepted, and how long a refresh token is.
  *
@@ -101,10 +105,7 @@ export interface AuthorizedConn {
 export interface AuthDeps {
   readonly self: InstanceId;
   readonly records: AuthRecords;
-  /** The pages allowed to run these exchanges: `clientDataJSON.origin` is
-   * compared against this, and so is the CORS answer (§2.3). */
-  readonly origins: () => readonly string[];
-  /** Where this instance is dialed, which a registration URL is issued against
+  /** Where this instance is reached, which a registration URL is issued against
    * when the operator names none. */
   readonly endpoint: () => Endpoint | undefined;
   /** The instance's name as a person operates it, carried in the URL for
@@ -176,7 +177,6 @@ export class Auth {
    * terminal this ran on. Somebody holding the URL alone cannot register. */
   issue(options: {
     readonly endpoint?: Endpoint;
-    readonly rpId?: string;
     readonly label?: string;
     readonly sub?: Subject;
   }): IssuedRegistration {
@@ -187,14 +187,21 @@ export class Auth {
         "この instance には endpoint が無いので、登録先の URL を引数で渡してください",
       );
     }
-    const host = hostOf(endpoint);
-    const rpId = options.rpId ?? host;
-    // The relying party is a domain the endpoint's host belongs to, and nothing
-    // wider: a credential made for a suffix this instance does not sit under
-    // would be usable at every other host under it (§2.3).
-    if (!isRegistrableSuffix(rpId, host)) {
-      throw new OpError("invalid_args", `${rpId} は ${host} の登録可能なドメインではありません`);
+    // An operator types this one, so it is read here rather than trusted: an
+    // address that is not a base URL would be written into the record and be
+    // compared, forever after, against a request that can never match it.
+    const problems = validationErrors(EndpointSchema, endpoint);
+    if (problems.length > 0) {
+      throw new OpError(
+        "invalid_args",
+        `endpoint は末尾が / の http(s) base URL です (${endpoint}): ${problems.join("; ")}`,
+      );
     }
+    // The relying party is the endpoint's own host and nothing wider. A
+    // registrable suffix of it would make the credential usable at every other
+    // host under that suffix, and there is no deployment this instance supports
+    // where that is what was wanted (DR-0001 §2.3).
+    const rpId = hostOf(endpoint);
     const sub = options.sub ?? this.#nextSubject();
     if (this.deps.records.removed(sub)) {
       throw new OpError("forbidden", `${sub} は削除済みなので、この名前では登録できません`);
@@ -216,7 +223,7 @@ export class Auth {
     this.#pending.set(claims.jti, { claims, secret, code, attempts: 0 });
     return {
       sub,
-      url: `${webOrigin(endpoint)}/#register=${sign(claims, secret)}`,
+      url: `${endpoint}#register=${sign(claims, secret)}`,
       code,
       user_id: claims.user_id,
       expires_at: claims.expires_at,
@@ -378,13 +385,17 @@ export class Auth {
    * here, by whoever the browser reached (§2.6). */
   async register(
     args: AuthRegisterArgs,
-    from: { ip?: string; userAgent?: string } = {},
+    from: { ip?: string; userAgent?: string; path?: string } = {},
   ): Promise<MintedSession> {
     // What the URL says about itself, before anything has vouched for it. It is
     // read to know which relying party the credential should have been made
     // under; nothing is decided by it, because the same fields come back
     // authenticated below and the two are held to each other.
     const stated = claimsOf(args.token);
+    // The endpoint this URL was issued for is where it may be spent: a
+    // registration posted to a neighbour sharing the host is a registration at
+    // an instance the URL never named (contract, `CredentialRecord.endpoint`).
+    this.#servedHere(stated.endpoint, from.path);
     // What the page answered, verified before anything is spent: a challenge is
     // good once, so consuming it for a message that then fails to verify would
     // let a caller burn challenges without ever holding a credential (m9).
@@ -392,7 +403,7 @@ export class Auth {
     const verified = refusable(() =>
       verifyRegistration(args.credential, {
         challenge,
-        origins: this.deps.origins(),
+        origin: originOf(stated.endpoint),
         rpId: stated.rp_id,
       }),
     );
@@ -428,6 +439,7 @@ export class Auth {
       credential_id: verified.credentialId,
       public_key: verified.publicKey,
       user_handle: claims.user_id,
+      endpoint: claims.endpoint,
       rp_id: claims.rp_id,
       sign_count: verified.signCount,
       ...(claims.issued_label === undefined ? {} : { issued_label: claims.issued_label }),
@@ -505,12 +517,16 @@ export class Auth {
 
   async assert(
     args: AuthAssertArgs,
-    from: { ip?: string; userAgent?: string } = {},
+    from: { ip?: string; userAgent?: string; path?: string } = {},
   ): Promise<MintedSession> {
     const record = this.deps.records.credential(args.credential.raw_id);
     if (record === undefined) {
       throw new OpError("auth_invalid", "この credential は登録されていません");
     }
+    // The endpoint the credential was registered for, and no other: two
+    // instances may share a host, and this is what keeps one's credential from
+    // being a way into the other (contract, `CredentialRecord.endpoint`).
+    this.#servedHere(record.endpoint, from.path);
     // A resident credential answers with the handle it was created against,
     // which is how a person is found without having named an account. It is
     // held to what the registration settled: a handle naming somebody else is
@@ -535,7 +551,7 @@ export class Auth {
         },
         {
           challenge: args.challenge.challenge,
-          origins: this.deps.origins(),
+          origin: originOf(record.endpoint),
           rpIds: this.#rpIdFor(record),
         },
       ),
@@ -556,33 +572,52 @@ export class Auth {
     return this.mint(record.sub);
   }
 
+  /** Refuse an exchange that arrived somewhere other than the endpoint it is
+   * about.
+   *
+   * The path the request came in on is the carrier's observation, so a caller
+   * cannot state it. A carrier that does not observe one — the mesh, where the
+   * issuer is asked about a URL rather than posted to — states nothing and is
+   * not held to a path it never had. */
+  #servedHere(endpoint: Endpoint, path: string | undefined): void {
+    if (path !== undefined && !servesPath(endpoint, path)) {
+      throw new OpError("auth_invalid", `この要求は ${endpoint} 宛ではありません`);
+    }
+  }
+
   /** The relying party an assertion is checked against.
    *
    * The one the credential was registered under, which the record carries: a
    * passkey only ever answers for the domain it was made under, and the
-   * endpoint being reached says nothing about that (§2.3). Only a record
-   * written before the field existed falls back to the names this instance was
-   * configured to be, and nothing is widened to a suffix. */
+   * endpoint being reached says nothing about that (§2.3). Nothing is widened
+   * to a suffix, and a record from before the field existed names the host of
+   * the endpoint it was registered for. */
   #rpIdFor(record: CredentialRecord): string[] {
-    if (record.rp_id !== undefined) return [record.rp_id];
-    return this.#configuredNames();
+    return [record.rp_id ?? hostOf(record.endpoint)];
   }
 
-  #configuredNames(): string[] {
-    const names = new Set<string>();
-    for (const origin of this.deps.origins()) {
-      try {
-        names.add(new URL(origin).hostname);
-      } catch {
-        // A configured value that is not a URL names no host.
-      }
+  /** The origins whose pages may read these answers: this instance's own, the
+   * ones its credentials were registered at, and the ones its outstanding
+   * registration URLs were issued for.
+   *
+   * Its own is there because a browser may land here holding a URL another
+   * instance issued — the page it runs the exchange from is then this
+   * instance's, and the issuer is only asked to spend the URL (§2.6).
+   *
+   * Read by the HTTP carrier, which compares them whole (§2.3). Not the relying
+   * party: an RP ID is a domain, so a page at any host under it would be let in
+   * — and `/auth/refresh` answers a cookie the browser attaches by domain, so a
+   * sibling subdomain admitted here would read a person's access token. What
+   * this instance serves is its endpoints, so its endpoints are the answer. */
+  knownOrigins(): string[] {
+    const origins = new Set<string>();
+    for (const record of this.deps.records.credentials()) {
+      origins.add(originOf(record.endpoint));
     }
+    for (const held of this.#pending.values()) origins.add(originOf(held.claims.endpoint));
     const endpoint = this.deps.endpoint();
-    if (endpoint !== undefined) names.add(hostOf(endpoint));
-    if (names.size === 0) {
-      throw new OpError("auth_invalid", "この instance には relying party がありません");
-    }
-    return [...names];
+    if (endpoint !== undefined) origins.add(originOf(endpoint));
+    return [...origins];
   }
 
   // --- tokens (§2.4) ---
@@ -964,28 +999,22 @@ export function hostOf(endpoint: Endpoint): string {
   return new URL(endpoint).hostname;
 }
 
-/** Where the page that runs the registration is served from.
+/** Whether a request that arrived at this path was made to this endpoint.
  *
- * The endpoint over HTTP, with the WebSocket's own path segment taken off: an
- * endpoint is the address of a door (`wss://h/personal/ws`), and the web UI is
- * what is served where that door is (`https://h/personal/`). Leaving the
- * segment on would send the person to the WebSocket rather than to the page
- * (DR-0001 §2.2). An endpoint that names no path is an instance whose UI is at
- * the root. */
-export function webOrigin(endpoint: Endpoint): string {
-  const url = new URL(endpoint);
-  url.protocol = url.protocol === "wss:" ? "https:" : "http:";
-  const path = url.pathname.replace(/\/$/, "");
-  const prefix = path.endsWith(ENTRY_PATH) ? path.slice(0, -ENTRY_PATH.length) : path;
-  return `${url.origin}${prefix}`;
+ * The endpoint's own path, compared exactly: `https://h/` and
+ * `https://h/personal/` are two instances that may share a host, so a
+ * credential registered for one is not a way into the other (contract,
+ * `CredentialRecord.endpoint`). The prefix a proxy leaves on the front is what
+ * the carrier already stripped down to when it found the route.
+ *
+ * Whether the origin matches is asked separately: the two together are what
+ * bind a credential to one instance. */
+export function servesPath(endpoint: Endpoint, path: string): boolean {
+  return new URL(endpoint).pathname === path;
 }
 
-/** Whether a relying party id is the host or a domain the host sits under.
- *
- * The WebAuthn rule as far as this instance can check it: a credential made
- * for a suffix the endpoint does not sit under would be usable at hosts this
- * instance has nothing to do with. Whether the suffix is one a registrar hands
- * out is the browser's to refuse, and it does. */
-export function isRegistrableSuffix(rpId: string, host: string): boolean {
-  return host === rpId || host.endsWith(`.${rpId}`);
+/** The origin an endpoint is served from, which is what a browser writes into
+ * `clientDataJSON.origin`. */
+export function originOf(endpoint: Endpoint): string {
+  return new URL(endpoint).origin;
 }

package/src/auth/http.ts

@@ -46,6 +46,16 @@ export function authRouteOf(pathname: string): Route | undefined {
   return (ROUTES as readonly string[]).includes(name) ? (name as Route) : undefined;
 }
 
+/** The endpoint path a request arrived under: everything before its `auth/`.
+ *
+ * What a credential's endpoint is compared against, so that `https://h/` and
+ * `https://h/personal/` are two instances rather than two spellings of one
+ * (contract, `CredentialRecord.endpoint`). */
+export function endpointPath(pathname: string): string {
+  const at = pathname.lastIndexOf("/auth/");
+  return at === -1 ? "/" : pathname.slice(0, at + 1);
+}
+
 /** The cookie path for a request: everything up to and including its `/auth/`.
  *
  * It narrows what the browser sends where, and nothing more — same-origin
@@ -83,11 +93,11 @@ export function cookieValue(header: string | null, name: string): string | undef
 export interface AuthRoutesDeps {
   readonly auth: Auth;
   readonly self: InstanceId;
-  readonly origins: () => readonly string[];
   readonly log?: (msg: string, fields?: Record<string, unknown>) => void;
 }
 
-/** Serve `/auth/*`, or answer nothing when the request is for something else.
+/** Serve `<endpoint>auth/*`, or answer nothing when the request is for
+ * something else.
  *
  * Everything unauthenticated shares one rate limit and one origin check: these
  * routes are reachable before anything is proven, and the work behind them is a
@@ -101,10 +111,12 @@ export async function handleAuth(
   const route = authRouteOf(url.pathname);
   if (route === undefined) return undefined;
   const origin = request.headers.get("origin");
-  const allowed = deps.origins();
-  // A page from an origin this instance does not serve is refused before
-  // anything else, including the preflight that would tell it to try.
-  if (origin !== null && !allowed.includes(origin)) {
+  // A page from an origin this instance is not one of is refused before
+  // anything else, including the preflight that would tell it to try. Compared
+  // whole rather than by domain: `/auth/refresh` answers with a person's access
+  // token, and a browser attaches the cookie it is asked for by domain, so a
+  // sibling subdomain let in here could read that token (§2.3).
+  if (origin !== null && !deps.auth.knownOrigins().includes(origin)) {
     return new Response("Forbidden", { status: 403 });
   }
   // These routes change state and are reachable before anything is proven, so
@@ -162,6 +174,10 @@ export async function handleAuth(
   const seen = {
     ...(from.ip === undefined ? {} : { ip: from.ip }),
     ...(userAgent === undefined ? {} : { userAgent }),
+    // Where the request actually arrived, which is what an endpoint's path is
+    // compared against. Observed here rather than taken from the body: a caller
+    // stating which instance it reached would be stating the answer.
+    path: endpointPath(url.pathname),
   };
   try {
     switch (route) {

package/src/auth/webauthn.ts

@@ -79,13 +79,13 @@ export function parseAuthenticatorData(bytes: Uint8Array): AuthenticatorData {
  * 11-15): what the browser was doing, which challenge it answered, which page
  * asked, and that the answer belongs to one page rather than an embedded one.
  *
- * The origin is compared against the set the operator configured for the web
- * UI rather than against the endpoint: the endpoint is where the instance is
- * dialed, and the page may be served from another name under the same
- * registrable domain (DR-0001 §2.3). */
+ * The origin is compared against the endpoint the credential is registered
+ * for, which is where the page that runs these exchanges is served: an
+ * endpoint is the base URL of the instance itself, so the page and the
+ * instance are one origin by construction (DR-0001 §2.3). */
 export function checkClientData(
   clientDataJson: Uint8Array,
-  expected: { type: string; challenge: string; origins: readonly string[] },
+  expected: { type: string; challenge: string; origin: string },
 ): void {
   let parsed: ClientData;
   try {
@@ -99,8 +99,8 @@ export function checkClientData(
   if (typeof parsed.challenge !== "string" || !equalStrings(parsed.challenge, expected.challenge)) {
     throw new WebAuthnError("the client data answers another challenge");
   }
-  if (typeof parsed.origin !== "string" || !expected.origins.includes(parsed.origin)) {
-    throw new WebAuthnError(`${String(parsed.origin)} is not an origin this instance serves`);
+  if (typeof parsed.origin !== "string" || parsed.origin !== expected.origin) {
+    throw new WebAuthnError(`${String(parsed.origin)} is not ${expected.origin}`);
   }
   // What is refused is an exchange an embedding page ran, which is what either
   // of these says when it is there to say it. `crossOrigin: false` is not that:
@@ -141,12 +141,12 @@ export interface VerifiedRegistration {
  * page asked for something other than what this instance asked it to. */
 export function verifyRegistration(
   credential: RegistrationCredential,
-  expected: { challenge: string; origins: readonly string[]; rpId: string },
+  expected: { challenge: string; origin: string; rpId: string },
 ): VerifiedRegistration {
   checkClientData(base64UrlDecode(credential.client_data_json), {
     type: "webauthn.create",
     challenge: expected.challenge,
-    origins: expected.origins,
+    origin: expected.origin,
   });
   let attestation: CborValue;
   try {
@@ -187,13 +187,13 @@ export function verifyRegistration(
 export async function verifyAssertion(
   credential: AssertionCredential,
   known: { publicKey: Base64Url; signCount?: number },
-  expected: { challenge: string; origins: readonly string[]; rpIds: readonly string[] },
+  expected: { challenge: string; origin: string; rpIds: readonly string[] },
 ): Promise<{ signCount: number }> {
   const clientDataJson = base64UrlDecode(credential.client_data_json);
   checkClientData(clientDataJson, {
     type: "webauthn.get",
     challenge: expected.challenge,
-    origins: expected.origins,
+    origin: expected.origin,
   });
   const authData = base64UrlDecode(credential.authenticator_data);
   const data = parseAuthenticatorData(authData);

package/src/cli.ts

@@ -166,10 +166,12 @@ const ROOT: Command = {
             {
               name: "add",
               summary: "登録用 URL と 6 桁コードを 1 組発行する (10 分で失効)",
-              usage:
-                "ccmsg daemon passkey add <unit> [endpoint] [--rp-id <domain>] [--name <ラベル>]",
+              usage: "ccmsg daemon passkey add <unit> [endpoint] [--name <ラベル>]",
               options: [
-                ["--rp-id <domain>", "WebAuthn の relying party。既定は endpoint のホスト"],
+                [
+                  "[endpoint]",
+                  "登録先の公開 base URL (末尾 /)。既定はこの instance が確定した endpoint",
+                ],
                 ["--name <ラベル>", "誰宛に発行した URL かの管理ラベル"],
               ],
               run: (args) => passkeyAdd(args),
@@ -620,20 +622,18 @@ async function passkeyAsk(unit: string | undefined, request: Record<string, unkn
  * anything the instance hands out — so that holding the URL is not enough to
  * register (DR-0001 §2.2). */
 async function passkeyAdd(args: readonly string[]): Promise<unknown> {
-  const parsed = options(args, ["rp-id", "name"]);
+  const parsed = options(args, ["name"]);
   const [unit, endpoint] = parsed.rest;
   if (unit === undefined) {
     throw new CommandError(
       "invalid_args",
-      "使い方: ccmsg daemon passkey add <unit> [endpoint] [--rp-id <domain>] [--name <ラベル>]",
+      "使い方: ccmsg daemon passkey add <unit> [endpoint] [--name <ラベル>]",
     );
   }
-  const rpId = parsed.named.get("rp-id");
   const name = parsed.named.get("name");
   return await passkeyAsk(unit, {
     admin: "passkey_add",
     ...(endpoint === undefined ? {} : { endpoint }),
-    ...(rpId === undefined ? {} : { rp_id: rpId }),
     ...(name === undefined ? {} : { name }),
   });
 }

package/src/instance/config.ts

@@ -14,12 +14,6 @@ export interface EntryConfig {
   /** Source addresses allowed to connect. Empty means every address the bind
    * itself already permits, which for the default loopback bind is this host. */
   readonly source_ips: readonly string[];
-  /** `Origin` values a browser connection may present. Empty admits no
-   * browser at all: a request carrying no `Origin` is not a browser's and is
-   * judged on the address and the token alone, so the list only ever widens
-   * what reaches the socket, and an unlisted webui is refused rather than
-   * let in by default. */
-  readonly origins: readonly string[];
 }
 
 /** One value a launch recipe's command reads, as the operator declares it. */
@@ -87,18 +81,10 @@ export interface UpstreamConfig {
 }
 
 export interface InstanceConfig {
-  /** Where other instances reach this one (§7.1). Stated rather than
-   * discovered: an instance may be reached through a proxy or an alias, so the
-   * URL a peer is to dial is not a thing the process can read off its own
-   * socket. Required of an instance that has a mesh.
-   *
-   * Its `ws(s)://` form is what the mesh handshake compares as `aud`; the
-   * `http(s)://` URL with the same host and path is where the mesh's own
-   * routes hang. */
-  readonly self?: Endpoint;
-  /** Mesh endpoints to dial (§7.2). The same list goes to every instance, and
-   * it may name this one: an instance takes itself out of the list it dials,
-   * so one file can be copied to every host unchanged (§8.2). */
+  /** Every mesh endpoint, this instance's own among them (§7.1). The same list
+   * goes to every instance and names none of them in particular: which entry is
+   * this one is settled at startup by the probe, so one file can be copied to
+   * every host unchanged (§8.2). */
   readonly peers: readonly Endpoint[];
   /** Absent when this instance serves the unix socket only. */
   readonly entry?: EntryConfig;
@@ -236,8 +222,7 @@ export function settingsFor(shared: SharedConfig, dir: string): Record<string, u
 
 /** One instance's settings, read at the shape the instance uses them. */
 export function parseConfig(file: string, fields: Record<string, unknown>): InstanceConfig {
-  const config = {
-    ...(fields["self"] === undefined ? {} : { self: endpointOf(file, "self", fields["self"]) }),
+  return {
     peers: peersOf(file, fields["peers"]),
     ...(fields["entry"] === undefined ? {} : { entry: entryOf(file, fields["entry"]) }),
     upstream: upstreamOf(file, fields["upstream"]),
@@ -249,13 +234,6 @@ export function parseConfig(file: string, fields: Record<string, unknown>): Inst
     ),
     fork_origin: flagOf(file, "fork_origin", fields["fork_origin"], DEFAULT_CONFIG.fork_origin),
   };
-  // A mesh instance is dialled by its peers, and where they dial it is the one
-  // thing it cannot work out for itself. Refused here rather than at the first
-  // handshake, for the reason any broken setting is (DV-Q9).
-  if (config.self === undefined && config.peers.length > 0 && config.entry !== undefined) {
-    throw new ConfigError(file, "self must name this instance's endpoint URL when peers are set");
-  }
-  return config;
 }
 
 function flagOf(file: string, at: string, raw: unknown, fallback: boolean): boolean {
@@ -264,13 +242,20 @@ function flagOf(file: string, at: string, raw: unknown, fallback: boolean): bool
   return raw;
 }
 
-const ENDPOINT = /^wss?:\/\/[^\s?#]+$/;
+/** An endpoint as the contract spells it: the instance's public base URL, with
+ * the trailing slash and no route of its own. What hangs below it — `ws`,
+ * `mesh/*`, `auth/*`, `webhook/*` — is a route rather than part of the address
+ * (contract, `Endpoint`). */
+const ENDPOINT = /^https?:\/\/[^\s?#]*\/$/;
 
 function endpointOf(file: string, at: string, raw: unknown): Endpoint {
   if (typeof raw !== "string" || !ENDPOINT.test(raw)) {
-    throw new ConfigError(file, `${at} must be a ws:// or wss:// URL, got ${String(raw)}`);
+    throw new ConfigError(
+      file,
+      `${at} must be an http:// or https:// base URL ending in /, got ${String(raw)}`,
+    );
   }
-  return raw;
+  return raw as Endpoint;
 }
 
 function peersOf(file: string, raw: unknown): readonly Endpoint[] {
@@ -293,7 +278,6 @@ function entryOf(file: string, raw: unknown): EntryConfig {
     host,
     port,
     source_ips: stringsOf(file, "entry.source_ips", fields["source_ips"]),
-    origins: stringsOf(file, "entry.origins", fields["origins"]),
   };
 }
 

package/src/instance/instance.ts

@@ -3,7 +3,6 @@ import { join } from "node:path";
 import {
   type AuthRecord,
   type Capability,
-  type Endpoint,
   type InstanceId,
   type InstancePingResult,
   type NetOnlineEvent,
@@ -182,10 +181,10 @@ export async function start(options: StartOptions = {}): Promise<StartOutcome> {
     const id = instanceIdentity(paths.instanceIdFile);
     // 5. the endpoint list, for an instance that has a mesh.
     //
-    // `self` is configured, so nothing has to be settled; what the probe does
-    // is check it, and it has to arrive at a listener — so the WebSocket is
-    // bound here and handed to the instance. A `self` that answers as somebody
-    // else ends the start.
+    // Which entry of it is this instance is settled by the probe, and the probe
+    // has to arrive at a listener — so the WebSocket is bound here and handed
+    // to the instance. A list that names this instance no times, or twice, ends
+    // the start.
     const mesh = meshFor(id, config, log, options.meshTiming);
     const wiring = mesh === undefined ? undefined : await bindForMesh(config, mesh);
     // 6-8 are the instance's own construction and listen.
@@ -222,12 +221,9 @@ function meshFor(
   log: Log,
   timing?: MeshTiming,
 ): Mesh | undefined {
-  if (config.peers.length === 0 || config.entry === undefined || config.self === undefined) {
-    return undefined;
-  }
+  if (config.peers.length === 0 || config.entry === undefined) return undefined;
   return new Mesh({
     id,
-    self: config.self,
     peers: config.peers,
     conns: new ConnRegistry(),
     log: (msg, fields) => {
@@ -250,7 +246,7 @@ export interface MeshWiring {
   attach(instance: Instance): void;
 }
 
-/** Bind the WebSocket, settle `self` against the peer list, and hand both on.
+/** Bind the WebSocket, settle which endpoint this instance is, and hand both on.
  *
  * The listener answers the two pre-authentication routes from the moment it is
  * up — the probe of self-identification and the key of mesh-peer-auth §6 — and
@@ -275,7 +271,7 @@ async function bindForMesh(config: InstanceConfig, mesh: Mesh): Promise<MeshWiri
     },
   });
   try {
-    await mesh.verify();
+    await mesh.identify();
   } catch (cause) {
     // The listener is bound before the endpoint list is checked, so it is this
     // function's to release when the check refuses — nothing else holds it yet,
@@ -424,7 +420,7 @@ export class Instance {
     // 6. `last_live` and the inbox, read as the domains are constructed.
     this.#sessions = new Sessions({
       self: this.self,
-      endpoint: selfEndpoint(config),
+      ...(this.#mesh === undefined ? {} : { endpoint: this.#mesh.self }),
       authExpiresAt: (conn) => this.#auth.expiresAt(conn),
       configHome: paths.configHome,
       stateDir: paths.stateDir,
@@ -524,8 +520,7 @@ export class Instance {
     this.#auth = new Auth({
       self: this.self,
       records,
-      origins: () => config.entry?.origins ?? [],
-      endpoint: () => selfEndpoint(config),
+      endpoint: () => this.#mesh?.self,
       unit: paths.key,
       ...(this.#mesh === undefined
         ? {}
@@ -674,11 +669,7 @@ export class Instance {
     // The person's authentication comes first: it is the one route reached
     // before anything is proven, and the gateway's webhook carries its own
     // secret and cannot be confused with it (DR-0001 §2.7).
-    const authorized = await handleAuth(
-      request,
-      { auth: this.#auth, self: this.self, origins: () => this.config.entry?.origins ?? [] },
-      {},
-    );
+    const authorized = await handleAuth(request, { auth: this.#auth, self: this.self }, {});
     if (authorized !== undefined) return authorized;
     return await this.#gateway.route(request);
   }
@@ -918,34 +909,18 @@ export class Instance {
   }
 }
 
-/** Where this instance says it is reached, or nothing when it is reached by
- * no URL at all.
- *
- * The config's `self` when there is one, which is the answer for anything with
- * a mesh. Without one the bound address stands in, and an instance serving only
- * the unix socket has neither — so it states no endpoint rather than a URL that
- * reaches nothing (DR-0001 §2.1). A client on the unix socket already has the
- * instance it is talking to. */
-export function selfEndpoint(config: InstanceConfig): Endpoint | undefined {
-  if (config.self !== undefined) return config.self;
-  const entry = config.entry;
-  if (entry === undefined || entry.port === 0) return undefined;
-  return `ws://${entry.host}:${entry.port}`;
-}
-
-/** Who may reach the WebSocket at all (§3.1): an Origin the operator named and
- * an address the operator named.
+/** Who may reach the WebSocket at all (§3.1): an address the operator named.
  *
- * The two config lists are read as allowlists in both directions. An empty
- * `origins` admits no browser: a permission that was never granted is not a
- * permission, and the one deployment that would want "any page may connect" is
- * the one that must say so. An empty `source_ips` leaves the addresses to the
- * bind, which for the default loopback host is this machine.
+ * An empty `source_ips` leaves the addresses to the bind, which for the default
+ * loopback host is this machine. The `Origin` a request carries is not read:
+ * a WebSocket is authorized by the access token it presents (DR-0001 §2.5), and
+ * an allowlist of pages would be a second answer to a question the token has
+ * already answered — one the operator has to keep in step with every URL the
+ * instance is reached through.
  *
- * Neither of them says who came, which is what the access token on the
- * handshake answers (DR-0001 §2.5): every connection that is not a peer's
- * presents one, and a handshake without one is refused rather than let in as an
- * anonymous person. */
+ * The address does not say who came either. Every connection that is not a
+ * peer's presents a token, and a handshake without one is refused rather than
+ * let in as an anonymous person. */
 function entryPolicy(
   config: InstanceConfig,
   mesh: boolean,
@@ -954,11 +929,7 @@ function entryPolicy(
   const entry = config.entry;
   if (entry === undefined) return {};
   return {
-    allowRequest(request: Request, source: string | undefined): boolean {
-      const origin = request.headers.get("origin");
-      // A request carrying no `Origin` is not a browser's, and there is nothing
-      // to compare: it stands or falls on the address and the token below.
-      if (origin !== null && !entry.origins.includes(origin)) return false;
+    allowRequest(_request: Request, source: string | undefined): boolean {
       if (entry.source_ips.length === 0) return true;
       // The address the server observed, not one a header claims: a forwarding
       // header is written by whoever is in front of us, and anyone who can

package/src/mesh/mesh.ts

@@ -135,8 +135,8 @@ export interface MeshHost {
 export interface MeshDeps {
   /** This instance's id, which is what it is called on the wire. */
   readonly id: InstanceId;
-  /** Where peers reach this instance, from config (DR-0001 §2.7). */
-  readonly self: Endpoint;
+  /** Every mesh endpoint, this instance's own among them. Which one that is is
+   * settled by `identify`, not configured (DR-0001 §2.7). */
   readonly peers: readonly Endpoint[];
   readonly conns: ConnRegistry;
   readonly log?: (msg: string, fields?: Record<string, unknown>) => void;
@@ -260,10 +260,9 @@ export class Mesh {
   readonly #retries = new Map<Endpoint, ReturnType<typeof setTimeout>>();
   readonly #backoff = new Map<Endpoint, number>();
   readonly #probe = new PeerProbe();
-  /** The configured endpoints that turned out to be this instance, filled in by
-   * `verify`. `self` is always among them; an alias of it that a peer list also
-   * names joins it there, and none of them is dialled. */
-  readonly #ours = new Set<Endpoint>();
+  /** Which of the configured endpoints is this instance, settled by `identify`
+   * before anything is dialled and fixed from then on (§5.5). */
+  #self: Endpoint | undefined;
   /** The authenticated endpoint-to-id mapping (DR-0001 §2.1), in both
    * directions: a handshake writes it, `to_instance` reads it to find the link
    * to dial down, and a disconnection leaves it standing so a peer that is out
@@ -294,11 +293,6 @@ export class Mesh {
   readonly relay: Relay;
 
   constructor(private readonly deps: MeshDeps) {
-    // The table opens with the one binding this instance did not have to learn:
-    // its own. That is what makes "an id already answering elsewhere" cover the
-    // case of a peer claiming to be us — which is what the instance at a moved
-    // instance's old URL looks like from the new one.
-    this.#bind(deps.self, deps.id);
     this.relay = new Relay({
       publish: (topic, data, instance) => {
         this.#host?.publish(topic, data, instance);
@@ -335,15 +329,23 @@ export class Mesh {
   /** The peers this instance dials: the configured list without itself.
    *
    * The list is the same on every instance, which is what lets one file be
-   * distributed to all of them (§8.2) — and it may name this instance, so
-   * removing ourselves is the reader's job rather than the writer's. `verify`
-   * is what found which entries are ours, the configured `self` among them. */
+   * distributed to all of them (§8.2) — and it names this instance too, so
+   * removing ourselves is the reader's job rather than the writer's. `identify`
+   * is what found which entry that is. */
   get peers(): Endpoint[] {
-    return this.deps.peers.filter((peer) => !this.#ours.has(peer));
+    const self = this.self;
+    return this.deps.peers.filter((peer) => peer !== self);
   }
 
+  /** Where peers reach this instance, as the probe settled it (§7.1).
+   *
+   * Asked only after `identify`: everything that reads it — the handshake's
+   * `aud`, the mesh's own routes, what `hello` reports — happens on an instance
+   * that has already started, and a start where the probe did not settle ends
+   * instead. */
   get self(): Endpoint {
-    return this.deps.self;
+    if (this.#self === undefined) throw new Error("this mesh has not identified itself yet");
+    return this.#self;
   }
 
   get id(): InstanceId {
@@ -364,7 +366,7 @@ export class Mesh {
    * peer whose link is down, which is the one a reader is looking for. */
   instances(): InstanceInfo[] {
     return [
-      { id: this.deps.id, endpoint: this.deps.self, host: hostname(), reachable: true },
+      { id: this.deps.id, endpoint: this.self, host: hostname(), reachable: true },
       ...this.peers.map((peer) => {
         const id = this.#idOf.get(peer);
         return {
@@ -578,15 +580,21 @@ export class Mesh {
     else conn.send(frame);
   }
 
-  /** Check the endpoint list against reality before anything is dialled (§7.1).
+  /** Settle which configured endpoint is this instance, before anything is
+   * dialled (§7.1).
    *
-   * Run once the listener is up, because the probe this instance sends to its
-   * own `self` has to arrive somewhere — and that probe is the whole test: a
-   * `self` that answers as somebody else ends the start, while a peer that is
-   * merely asleep is recorded and dialled later. */
-  async verify(): Promise<PeerReport> {
-    const report = await this.#probe.verify(this.deps.self, this.deps.peers);
-    for (const ours of report.ours) this.#ours.add(ours);
+   * Run once the listener is up, because the probe this instance sends itself
+   * has to arrive somewhere. A list that reaches this instance no times or
+   * more than once ends the start; a peer that is merely asleep is recorded
+   * and dialled later. */
+  async identify(): Promise<PeerReport> {
+    const report = await this.#probe.identify(this.deps.peers);
+    this.#self = report.self;
+    // The table opens with the one binding this instance did not have to learn:
+    // its own. That is what makes "an id already answering elsewhere" cover the
+    // case of a peer claiming to be us — which is what the instance at a moved
+    // instance's old URL looks like from the new one.
+    this.#bind(report.self, this.deps.id);
     return report;
   }
 
@@ -606,7 +614,7 @@ export class Mesh {
    * that fails any step throws, which is what leaves the connection anonymous
    * (§3.2 step 7). */
   async greet(conn: Requester, claim: MeshClaim): Promise<void> {
-    const self = this.deps.self;
+    const self = this.self;
     // 1-3 of §5.7, asked before the key is fetched: the cheap comparisons come
     // first because the fetch reaches out to another host.
     if (claim.ver !== MESH_VER) {
@@ -770,15 +778,19 @@ export class Mesh {
   /** Answer the two requests that are served before anything is proven, or
    * nothing when the request is not one of them. */
   async route(request: Request): Promise<Response | undefined> {
-    // Below `self` and nowhere else. The mesh's routes are the one part of the
-    // surface that stays tied to the configured endpoint, because that tie is
-    // what keeps two instances on one origin from answering for each other's
-    // keys (mesh-peer-auth §6.3). The person's entry is matched by the end of
-    // the path instead (DR-0001 §2.7).
     const pathname = new URL(request.url).pathname;
-    const base = this.deps.self;
-    if (isProbePath(pathname, base)) return await this.#answerProbe(request);
-    const kid = kidOfPath(pathname, base);
+    // The probe is matched by the end of the path, because it is what settles
+    // which endpoint this instance is: while one is arriving there is no
+    // endpoint to hang it under.
+    if (isProbePath(pathname)) return await this.#answerProbe(request);
+    // The key is below this instance's own endpoint and nowhere else, which is
+    // what keeps two instances on one origin from answering for each other's
+    // keys (mesh-peer-auth §6.3); the person's entry is matched by the end of
+    // the path instead (DR-0001 §2.7). The probe has settled that endpoint by
+    // the time any key is asked for: a request arriving before then belongs to
+    // no handshake, since nothing has been dialled yet.
+    if (this.#self === undefined) return undefined;
+    const kid = kidOfPath(pathname, this.#self);
     if (kid !== undefined) return await this.#serveKey(kid, request);
     return undefined;
   }
@@ -824,7 +836,7 @@ export class Mesh {
     // one. The two meet at the `kid`.
     const claim = {
       ver: MESH_VER,
-      iss: this.deps.self,
+      iss: this.self,
       aud: minted.aud,
       challenge: asked.challenge,
       exp: Math.floor((Date.now() + PROOF_LIFETIME_MS) / 1000),
@@ -853,7 +865,7 @@ export class Mesh {
 
   async #dial(peer: Endpoint): Promise<void> {
     if (this.#stopping || this.#links.has(peer)) return;
-    const self = this.deps.self;
+    const self = this.self;
     const key = new EphemeralKey();
     const minted: Minted = { key, aud: peer };
     this.#minted.set(key.kid, minted);
@@ -968,7 +980,7 @@ export class Mesh {
    * Both connections are verified before either is dropped, so whichever
    * survives is one that was proven (§8.1). */
   #hold(peer: Endpoint, conn: Requester, dialledByUs: boolean): void {
-    const self = this.deps.self;
+    const self = this.self;
     const held = this.#links.get(peer);
     if (held !== undefined) {
       if (held.conn === conn) return;

package/src/mesh/probe.ts

@@ -6,15 +6,14 @@ import { probeEndpoint, type ProbeBody } from "./wire.ts";
  *
  * An endpoint that does not answer is either asleep or misconfigured, and
  * waiting longer tells the two apart no better. It bounds startup rather than
- * deciding correctness: only the probe this instance sends itself decides
- * anything. */
+ * deciding correctness: only the probe that lands back here decides anything. */
 export const PROBE_TIMEOUT_MS = 3_000;
 
-/** The configured endpoints do not describe this instance.
+/** The configured endpoints do not say which instance this is.
  *
  * Its own class so startup can refuse the same way a broken config does (§8.3,
- * DV-Q9): `self` is a setting, and one that does not reach this process is a
- * setting that is wrong. */
+ * DV-Q9): a list that names this instance zero times, or twice, is a list that
+ * cannot be acted on. */
 export class SelfEndpointError extends Error {
   constructor(msg: string) {
     super(msg);
@@ -22,12 +21,10 @@ export class SelfEndpointError extends Error {
   }
 }
 
-/** What one round of probes found. */
+/** What one round of probes settled. */
 export interface PeerReport {
-  /** The configured endpoints that turned out to be this instance — `self`,
-   * and any alias of it a peer list happens to name. They are not dialled: a
-   * link to ourselves is not a link. */
-  readonly ours: readonly Endpoint[];
+  /** The one configured endpoint that turned out to be this instance. */
+  readonly self: Endpoint;
   /** The endpoints that did not answer. Recorded and not refused: a peer that
    * is asleep is the normal state of this mesh (§7.1, DV-Q11). */
   readonly unreachable: readonly Endpoint[];
@@ -35,13 +32,17 @@ export interface PeerReport {
 
 /** The probes in flight, and the endpoint each was sent to.
  *
- * Since `self` is configured (DR-0001 §2.7), this no longer settles an identity:
- * it checks the setting. The probe to `self` has to come back here, which is
- * what catches a `self` that names somebody else, and the rest of the list is
- * probed to record what can be reached before anything is dialled.
+ * This is where an instance learns which of the configured endpoints it is
+ * (mesh-self-identification §5). A `token` is minted per endpoint and sent
+ * there; the one that arrives back at this process was sent to this process,
+ * and the endpoint it was addressed to is therefore this instance's own.
+ *
+ * Every endpoint is probed, this instance's own included: the probe to
+ * ourselves is the one that always lands, which is what makes a peer echoing
+ * a stolen token show up as two matches rather than as a wrong answer (§4.2).
  *
  * The table is destroyed when the run finishes: what the exercise leaves behind
- * is the report and nothing else (§7.3). */
+ * is the settled endpoint and nothing else (§7.3). */
 export class PeerProbe {
   #sent = new Map<string, Endpoint>();
   readonly #matched = new Set<Endpoint>();
@@ -54,10 +55,14 @@ export class PeerProbe {
     if (sentTo !== undefined) this.#matched.add(sentTo);
   }
 
-  /** Ask `self` and every peer who answers there, and refuse to start if the
-   * endpoint this instance calls its own is somebody else's. */
-  async verify(self: Endpoint, peers: readonly Endpoint[]): Promise<PeerReport> {
-    const targets = [...new Set([self, ...peers])];
+  /** Probe every configured endpoint and settle which one is this instance.
+   *
+   * An endpoint that did not answer is left out of the count rather than
+   * refused, so a mesh whose other host is asleep still starts (DV-Q11): the
+   * count only ever decides on endpoints that answered, and the probe to
+   * ourselves always does. */
+  async identify(peers: readonly Endpoint[]): Promise<PeerReport> {
+    const targets = [...new Set(peers)];
     this.#sent = new Map(targets.map((target) => [randomId(), target]));
     const unreachable: Endpoint[] = [];
     await Promise.all(
@@ -65,17 +70,17 @@ export class PeerProbe {
         if (!(await this.#probe(target, token))) unreachable.push(target);
       }),
     );
-    const ours = [...this.#matched];
+    const matched = [...this.#matched];
     this.#sent = new Map();
     this.#matched.clear();
-    if (!ours.includes(self)) {
+    if (matched.length !== 1) {
       throw new SelfEndpointError(
-        unreachable.includes(self)
-          ? `self is ${self}, which did not answer this instance's probe`
-          : `self is ${self}, which answers as another instance`,
+        matched.length === 0
+          ? `none of the configured endpoints reached this instance: ${targets.join(", ")}`
+          : `several configured endpoints reach this instance: ${matched.join(", ")}`,
       );
     }
-    return { ours, unreachable };
+    return { self: matched[0] as Endpoint, unreachable };
   }
 
   /** Whether the endpoint answered. What it answered does not matter: the

package/src/mesh/wire.ts

@@ -1,54 +1,63 @@
 import type { Endpoint } from "@ccmsg/protocol";
 import type { MeshJwk } from "./keys.ts";
 
-/** The paths an instance's endpoint URL stands in front of.
+/** The routes an instance's endpoint stands in front of.
  *
- * An `Endpoint` is compared whole, path included (contract, `Endpoint`), so
- * everything an instance serves hangs below it. That is also what keeps two
- * instances sharing one origin apart: the key of `wss://h/a` is only ever
- * fetched from below `/a`, so `wss://h/b` cannot answer for it and a proof made
- * with b's key cannot pass as a's (mesh-peer-auth §6.3). The separation is the
- * shape of the URLs rather than a rule written somewhere. */
-const WS_PATH = "/ws";
-const JWK_PATH = "/mesh/jwk/";
-const PROBE_PATH = "/mesh/probe";
+ * An `Endpoint` is the instance's public base URL, ending in a slash and
+ * naming no route of its own (contract, `Endpoint`), so everything an instance
+ * serves is reached by appending to it. That is also what keeps two instances
+ * sharing one origin apart: the key of `https://h/a/` is only ever fetched from
+ * below `/a/`, so `https://h/b/` cannot answer for it and a proof made with b's
+ * key cannot pass as a's (mesh-peer-auth §6.3). The separation is the shape of
+ * the URLs rather than a rule written somewhere.
+ *
+ * The probe is the exception, and has to be: it is what tells an instance which
+ * endpoint it is, so while one is arriving there is nothing yet to hang it
+ * under. */
+const WS_ROUTE = "ws";
+const JWK_ROUTE = "mesh/jwk/";
+const PROBE_ROUTE = "mesh/probe";
+const PROBE_PATH = `/${PROBE_ROUTE}`;
 
-/** Where a peer's mesh link is dialled. */
+/** Where a peer's mesh link is dialled.
+ *
+ * The endpoint's own scheme, kept: the link is an HTTP connection upgraded in
+ * place, so there is no second scheme to rewrite it into (DR-0001 §2.7). */
 export function wsEndpoint(endpoint: Endpoint): string {
-  return `${endpoint}${WS_PATH}`;
+  return `${endpoint}${WS_ROUTE}`;
 }
 
 /** Where one connection's key is fetched, and the challenge for it left.
  *
- * `http` rather than `ws` because this is the second connection of §6, which
- * carries one request and closes: the protocol asks that it be a connection of
- * its own outside the one being authenticated, not that it be a WebSocket. */
+ * A plain request rather than a frame on the link, because this is the second
+ * connection of §6: the protocol asks that the key be fetched outside the
+ * connection being authenticated. */
 export function jwkEndpoint(endpoint: Endpoint, kid: string): string {
-  return `${httpBase(endpoint)}${JWK_PATH}${encodeURIComponent(kid)}`;
+  return `${endpoint}${JWK_ROUTE}${encodeURIComponent(kid)}`;
 }
 
 export function probeEndpoint(endpoint: Endpoint): string {
-  return `${httpBase(endpoint)}${PROBE_PATH}`;
+  return `${endpoint}${PROBE_ROUTE}`;
 }
 
 /** The `kid` a request names, or nothing when the path is not a key request. */
 export function kidOfPath(pathname: string, self: Endpoint): string | undefined {
-  const prefix = `${new URL(self).pathname.replace(/\/$/, "")}${JWK_PATH}`;
+  const prefix = `${new URL(self).pathname}${JWK_ROUTE}`;
   if (!pathname.startsWith(prefix)) return undefined;
   const kid = decodeURIComponent(pathname.slice(prefix.length));
   return kid === "" ? undefined : kid;
 }
 
-export function isProbePath(pathname: string, self: Endpoint): boolean {
-  return pathname === `${new URL(self).pathname.replace(/\/$/, "")}${PROBE_PATH}`;
-}
-
-/** The same authority and path, reached over HTTP. A `ws` URL and the `http`
- * one beside it are one server; the scheme differs and nothing else does. */
-function httpBase(endpoint: Endpoint): string {
-  const url = new URL(endpoint);
-  url.protocol = url.protocol === "wss:" ? "https:" : "http:";
-  return url.href.replace(/\/$/, "");
+/** Whether this request is a probe.
+ *
+ * Matched by the end of the path and not below an endpoint, because a probe is
+ * what settles which endpoint this instance is: at the moment one arrives there
+ * is no endpoint to hang it under, and the prefix it came in on is whatever the
+ * sender's list or a proxy in front of it says. Nothing is decided here anyway
+ * — the receiver only echoes acceptance, and the comparison belongs to whoever
+ * minted the token (§5.1). */
+export function isProbePath(pathname: string): boolean {
+  return pathname.endsWith(PROBE_PATH);
 }
 
 /** The subprotocol a dialling instance offers.