@hachej/boring-workspace 0.1.81 → 0.1.83

package/dist/app-server.js

@@ -2903,15 +2903,23 @@ function resolvePaneStatusWorkspaceId(request) {
 function paneRenderStatusRoutes(app, opts = {}, done) {
   const store = opts.store ?? createPaneRenderStatusStore();
   const validateReport = createBodyValidator(reportBodySchema);
-  const getWorkspaceId = async (request) => {
-    return await opts.getWorkspaceId?.(request) ?? resolvePaneStatusWorkspaceId(request);
+  const getWorkspaceId = async (request, presentedWorkspaceId) => {
+    return await opts.getWorkspaceId?.(request, presentedWorkspaceId) ?? resolvePaneStatusWorkspaceId(request);
+  };
+  const admitMalformedScopedWorkspaceId = async (request) => {
+    const scoped = request.requestScope !== void 0;
+    const body = request.body;
+    if (!scoped || !body || !Object.prototype.hasOwnProperty.call(body, "workspaceId")) return;
+    if (body.workspaceId !== void 0 && typeof body.workspaceId !== "string") {
+      await getWorkspaceId(request, body.workspaceId);
+    }
   };
   app.put(
     "/api/v1/ui/panels/status",
-    { preHandler: validateReport },
+    { preHandler: [admitMalformedScopedWorkspaceId, validateReport] },
     async (request, reply) => {
       const body = request.body;
-      const workspaceId = await getWorkspaceId(request) ?? body.workspaceId;
+      const workspaceId = await getWorkspaceId(request, body.workspaceId) ?? body.workspaceId;
       const status = store.report({ ...body, workspaceId });
       return reply.code(200).send({ ok: true, status });
     }
@@ -2967,7 +2975,7 @@ function createBodyValidator2(schema) {
 function uiRoutes(app, opts, done) {
   const fallbackBridge = opts.bridge;
   const paneStatusStore = opts.paneStatusStore ?? createPaneRenderStatusStore();
-  const getPaneWorkspaceId = async (request) => await opts.getWorkspaceId?.(request) ?? resolvePaneStatusWorkspaceId(request);
+  const getPaneWorkspaceId = async (request, presentedWorkspaceId) => await opts.getWorkspaceId?.(request, presentedWorkspaceId) ?? resolvePaneStatusWorkspaceId(request);
   const touchUi = async (request) => {
     paneStatusStore.touchUi(await getPaneWorkspaceId(request));
   };
@@ -3322,20 +3330,28 @@ function mintWorkspaceBridgeRuntimeRefreshToken(options) {
   });
 }
 function verifyWorkspaceBridgeRuntimeToken(token, options) {
+  return authorizeWorkspaceBridgeRuntimeToken(
+    verifyWorkspaceBridgeRuntimeTokenClaims(token, options),
+    options.requiredCapabilities
+  );
+}
+function verifyWorkspaceBridgeRuntimeTokenClaims(token, options) {
   assertUsableSecret(options.secret);
   const claims = parseAndVerifyToken(token, options.secret);
   const now = Math.floor((options.nowMs ?? Date.now()) / 1e3);
   ensureLiveTokenClaims(claims, now, WORKSPACE_BRIDGE_TOKEN_AUDIENCE, "Runtime bridge token");
-  const missingCapability = (options.requiredCapabilities ?? []).find(
-    (capability) => !claims.capabilities.includes(capability)
+  return { claims };
+}
+function authorizeWorkspaceBridgeRuntimeToken(verified, requiredCapabilities = []) {
+  const missingCapability = requiredCapabilities.find(
+    (capability) => !verified.claims.capabilities.includes(capability)
   );
   if (missingCapability) {
     throw bridgeTokenError("BRIDGE_CAPABILITY_DENIED" /* CapabilityDenied */, "Runtime bridge token is missing a required capability");
   }
-  const runtimeClaims = claims;
   return {
-    claims: runtimeClaims,
-    authContext: runtimeClaimsToBridgeAuthContext(runtimeClaims)
+    claims: verified.claims,
+    authContext: runtimeClaimsToBridgeAuthContext(verified.claims)
   };
 }
 function verifyWorkspaceBridgeRuntimeRefreshToken(token, options) {
@@ -3557,14 +3573,25 @@ function workspaceBridgeHttpRoutes(app, opts, done) {
       return sendBridgeError(reply, 400, void 0, "BRIDGE_SCHEMA_INVALID" /* SchemaInvalid */, "WorkspaceBridge request body is invalid");
     }
     const body = { ...parsed.data, input: parsed.data.input ?? {} };
+    const authHeader = firstHeader(request.headers.authorization);
+    const runtimeToken = authHeader?.startsWith("Bearer ") ? authHeader.slice("Bearer ".length) : void 0;
+    let verifiedRuntimeToken;
+    if (runtimeToken !== void 0 && opts.assertRuntimeWorkspaceScope) {
+      try {
+        verifiedRuntimeToken = resolveRuntimeClaims(runtimeToken, opts);
+      } catch (err) {
+        const bridgeError = isBridgeError(err) ? err : createWorkspaceBridgeError("BRIDGE_HANDLER_FAILED" /* HandlerFailed */, "WorkspaceBridge transport failed");
+        return sendBridgeError(reply, statusForBridgeError(bridgeError.code), body.requestId, bridgeError.code, bridgeError.message);
+      }
+      await opts.assertRuntimeWorkspaceScope(request, verifiedRuntimeToken.claims);
+    }
     try {
       const registry = await resolveRegistry(request, body, opts);
       const definition = registry.getDefinition(body.op);
       if (!definition) {
         return sendBridgeError(reply, statusForBridgeError("BRIDGE_OP_NOT_FOUND" /* OpNotFound */), body.requestId, "BRIDGE_OP_NOT_FOUND" /* OpNotFound */, "WorkspaceBridge operation is not registered");
       }
-      const authHeader = firstHeader(request.headers.authorization);
-      const authContext = authHeader?.startsWith("Bearer ") ? resolveRuntimeContext(authHeader.slice("Bearer ".length), opts, definition) : await resolveBrowserContext(request, opts, definition, body);
+      const authContext = runtimeToken !== void 0 ? resolveRuntimeContext(runtimeToken, opts, definition, verifiedRuntimeToken) : await resolveBrowserContext(request, opts, definition, body);
       const idempotencyStore = opts.getIdempotencyStore ? await opts.getIdempotencyStore(request, body) : opts.idempotencyStore;
       const expectedWorkspaceId = opts.getOwnerWorkspaceId ? await opts.getOwnerWorkspaceId(request, body, authContext) : opts.ownerWorkspaceId;
       const response = await runWithWorkspaceBridgeIdempotency(idempotencyStore, {
@@ -3587,12 +3614,21 @@ function workspaceBridgeHttpRoutes(app, opts, done) {
     if (!opts.runtimeTokenSecret || !opts.runtimeRefreshTokenSecret) {
       return sendBridgeError(reply, 401, void 0, "BRIDGE_AUTH_REQUIRED" /* AuthRequired */, "WorkspaceBridge token refresh is not configured");
     }
+    const nowMs = Date.now();
+    let verified;
     try {
-      const nowMs = Date.now();
-      const verified = verifyWorkspaceBridgeRuntimeRefreshToken(authHeader.slice("Bearer ".length), {
+      verified = verifyWorkspaceBridgeRuntimeRefreshToken(authHeader.slice("Bearer ".length), {
         secret: opts.runtimeRefreshTokenSecret,
         nowMs
       });
+    } catch (err) {
+      const bridgeError = isBridgeError(err) ? err : createWorkspaceBridgeError("BRIDGE_INVALID_TOKEN" /* InvalidToken */, "WorkspaceBridge refresh token is invalid");
+      return sendBridgeError(reply, statusForBridgeError(bridgeError.code), void 0, bridgeError.code, bridgeError.message);
+    }
+    if (opts.assertRuntimeWorkspaceScope) {
+      await opts.assertRuntimeWorkspaceScope(request, verified.claims);
+    }
+    try {
       const store = opts.getRuntimeRefreshTokenStore ? await opts.getRuntimeRefreshTokenStore(request, verified.claims) ?? defaultRefreshTokenStore : defaultRefreshTokenStore;
       const refreshUse = await store.recordUse({
         jti: verified.claims.jti,
@@ -3635,7 +3671,10 @@ async function resolveRegistry(request, body, opts) {
   }
   return registry;
 }
-function resolveRuntimeContext(token, opts, definition) {
+function resolveRuntimeContext(token, opts, definition, verified) {
+  if (verified) {
+    return authorizeWorkspaceBridgeRuntimeToken(verified, definition.requiredCapabilities).authContext;
+  }
   if (!opts.runtimeTokenSecret) {
     throw createWorkspaceBridgeError("BRIDGE_AUTH_REQUIRED" /* AuthRequired */, "Runtime bridge token auth is not configured");
   }
@@ -3644,6 +3683,12 @@ function resolveRuntimeContext(token, opts, definition) {
     requiredCapabilities: definition.requiredCapabilities
   }).authContext;
 }
+function resolveRuntimeClaims(token, opts) {
+  if (!opts.runtimeTokenSecret) {
+    throw createWorkspaceBridgeError("BRIDGE_AUTH_REQUIRED" /* AuthRequired */, "Runtime bridge token auth is not configured");
+  }
+  return verifyWorkspaceBridgeRuntimeTokenClaims(token, { secret: opts.runtimeTokenSecret });
+}
 async function resolveBrowserContext(request, opts, definition, body) {
   if (!opts.browserAuthPolicy) {
     throw createWorkspaceBridgeError("BRIDGE_AUTH_REQUIRED" /* AuthRequired */, "Browser bridge auth is not configured");

package/dist/server.d.ts

@@ -68,7 +68,7 @@ type PaneRenderStatusStore = ReturnType<typeof createPaneRenderStatusStore>;
 interface UiRoutesOptions {
     bridge?: UiBridge;
     getBridge?: (request: FastifyRequest) => UiBridge | Promise<UiBridge>;
-    getWorkspaceId?: (request: FastifyRequest) => string | undefined | Promise<string | undefined>;
+    getWorkspaceId?: (request: FastifyRequest, presentedWorkspaceId?: unknown) => string | undefined | Promise<string | undefined>;
     /**
      * Server/plugin-owned state slots preserved across browser full-state PUTs.
      * Browser UI snapshots are replace-style for normal workspace state, but
@@ -232,6 +232,7 @@ interface VerifyWorkspaceBridgeRuntimeTokenOptions {
     nowMs?: number;
     requiredCapabilities?: readonly string[];
 }
+type VerifyWorkspaceBridgeRuntimeTokenClaimsOptions = Omit<VerifyWorkspaceBridgeRuntimeTokenOptions, "requiredCapabilities">;
 interface VerifyWorkspaceBridgeRuntimeRefreshTokenOptions {
     secret: string;
     nowMs?: number;
@@ -240,12 +241,17 @@ interface VerifiedWorkspaceBridgeRuntimeToken {
     claims: WorkspaceBridgeRuntimeTokenClaims;
     authContext: BridgeAuthContext;
 }
+interface VerifiedWorkspaceBridgeRuntimeTokenClaims {
+    claims: WorkspaceBridgeRuntimeTokenClaims;
+}
 interface VerifiedWorkspaceBridgeRuntimeRefreshToken {
     claims: WorkspaceBridgeRuntimeRefreshTokenClaims;
 }
 declare function mintWorkspaceBridgeRuntimeToken(options: MintWorkspaceBridgeRuntimeTokenOptions): string;
 declare function mintWorkspaceBridgeRuntimeRefreshToken(options: MintWorkspaceBridgeRuntimeRefreshTokenOptions): string;
 declare function verifyWorkspaceBridgeRuntimeToken(token: string, options: VerifyWorkspaceBridgeRuntimeTokenOptions): VerifiedWorkspaceBridgeRuntimeToken;
+declare function verifyWorkspaceBridgeRuntimeTokenClaims(token: string, options: VerifyWorkspaceBridgeRuntimeTokenClaimsOptions): VerifiedWorkspaceBridgeRuntimeTokenClaims;
+declare function authorizeWorkspaceBridgeRuntimeToken(verified: VerifiedWorkspaceBridgeRuntimeTokenClaims, requiredCapabilities?: readonly string[]): VerifiedWorkspaceBridgeRuntimeToken;
 declare function verifyWorkspaceBridgeRuntimeRefreshToken(token: string, options: VerifyWorkspaceBridgeRuntimeRefreshTokenOptions): VerifiedWorkspaceBridgeRuntimeRefreshToken;
 declare function clampWorkspaceBridgeRuntimeTokenTtlMs(ttlMs: number | undefined): number | undefined;
 declare function runtimeClaimsToBridgeAuthContext(claims: WorkspaceBridgeRuntimeTokenClaims): BridgeAuthContext;
@@ -289,6 +295,7 @@ interface WorkspaceBridgeHttpRoutesOptions {
     runtimeRefreshTokenSecret?: string;
     runtimeRefreshTokenStore?: WorkspaceBridgeRuntimeRefreshTokenStore;
     getRuntimeRefreshTokenStore?: (request: FastifyRequest, claims: WorkspaceBridgeRuntimeRefreshTokenClaims) => WorkspaceBridgeRuntimeRefreshTokenStore | undefined | Promise<WorkspaceBridgeRuntimeRefreshTokenStore | undefined>;
+    assertRuntimeWorkspaceScope?: (request: FastifyRequest, claims: WorkspaceBridgeRuntimeTokenClaims | WorkspaceBridgeRuntimeRefreshTokenClaims) => void | Promise<void>;
     refreshTokenRateLimit?: {
         maxUses?: number;
         windowMs?: number;
@@ -622,4 +629,4 @@ interface RuntimeBackendGatewayOptions {
 }
 declare function runtimeBackendGateway(app: FastifyInstance, opts: RuntimeBackendGatewayOptions): Promise<void>;
 
-export { type BeginIdempotencyOptions, BoringPluginAssetManager, BoringPluginEvent, BoringPluginFrontTarget, BoringPluginFrontTargetResolver, BoringPluginListEntry, type BoringPluginScanResult, BoringPluginSource, BoringPluginSourceInput, BoringServerPluginManifest, BridgeAuthContext, BridgeAuthPolicy, BridgeCallerClass, BridgeIdempotencyPolicy, type CompleteIdempotencyOptions, DEFAULT_WORKSPACE_BRIDGE_RUNTIME_REFRESH_TOKEN_TTL_MS, DEFAULT_WORKSPACE_BRIDGE_RUNTIME_TOKEN_TTL_MS, type IdempotencyBeginResult, type IdempotencyRecordStatus, InMemoryWorkspaceBridgeIdempotencyStore, InMemoryWorkspaceBridgeRuntimeRefreshTokenStore, MAX_WORKSPACE_BRIDGE_RUNTIME_TOKEN_TTL_MS, type MintWorkspaceBridgeRuntimeRefreshTokenOptions, type MintWorkspaceBridgeRuntimeTokenOptions, type PluginRestartWarning, type RuntimeBackendDiagnostic, type RuntimeBackendDispatchRequest, type RuntimeBackendDispatchResponse, type RuntimeBackendDispatcher, RuntimeBackendError, type RuntimeBackendGatewayOptions, RuntimeBackendRegistry, type RuntimeBackendReloadResult, type TrustedDomainBridgeHandlerOptions, type TrustedDomainBridgeHandlerPolicy, type TrustedDomainBridgeHandlerRegistration, UiBridge, type UiRoutesOptions, type VerifiedWorkspaceBridgeRuntimeRefreshToken, type VerifiedWorkspaceBridgeRuntimeToken, type VerifyWorkspaceBridgeRuntimeRefreshTokenOptions, type VerifyWorkspaceBridgeRuntimeTokenOptions, WORKSPACE_BRIDGE_REFRESH_TOKEN_AUDIENCE, WORKSPACE_BRIDGE_TOKEN_AUDIENCE, WorkspaceBridge, WorkspaceBridgeCallRequest, WorkspaceBridgeCallResponse, WorkspaceBridgeError, WorkspaceBridgeHandler, type WorkspaceBridgeHttpRoutesOptions, type WorkspaceBridgeIdempotencyRecord, type WorkspaceBridgeIdempotencyStore, WorkspaceBridgeOperationDefinition, WorkspaceBridgeRegistry, type WorkspaceBridgeRuntimeCore, type WorkspaceBridgeRuntimeCoreOptions, type WorkspaceBridgeRuntimeRefreshTokenClaims, type WorkspaceBridgeRuntimeRefreshTokenStore, type WorkspaceBridgeRuntimeRefreshTokenUseOptions, type WorkspaceBridgeRuntimeRefreshTokenUseResult, type WorkspaceBridgeRuntimeTokenClaims, WorkspaceServerPluginAsset, aggregatePluginPrompts, boringPluginRoutes, buildBoringSystemPrompt, clampWorkspaceBridgeRuntimeTokenTtlMs, collectRestartWarnings, createExecUiTool, createGetUiStateTool, createWorkspaceBridgeRuntimeCore, createWorkspaceUiTools, definePluginAsset, defineTrustedDomainBridgeHandler, hashNormalizedInput, mintWorkspaceBridgeRuntimeRefreshToken, mintWorkspaceBridgeRuntimeToken, pluginFileSignature, preflightBoringPlugins, readBoringPlugins, readPluginSignatureCache, resolvePluginAssetPath, runWithWorkspaceBridgeIdempotency, runtimeBackendGateway, runtimeClaimsToBridgeAuthContext, scanBoringPlugins, stableStringify, uiRoutes, verifyWorkspaceBridgeRuntimeRefreshToken, verifyWorkspaceBridgeRuntimeToken, workspaceBridgeHttpRoutes, writePluginSignatureCache };
+export { type BeginIdempotencyOptions, BoringPluginAssetManager, BoringPluginEvent, BoringPluginFrontTarget, BoringPluginFrontTargetResolver, BoringPluginListEntry, type BoringPluginScanResult, BoringPluginSource, BoringPluginSourceInput, BoringServerPluginManifest, BridgeAuthContext, BridgeAuthPolicy, BridgeCallerClass, BridgeIdempotencyPolicy, type CompleteIdempotencyOptions, DEFAULT_WORKSPACE_BRIDGE_RUNTIME_REFRESH_TOKEN_TTL_MS, DEFAULT_WORKSPACE_BRIDGE_RUNTIME_TOKEN_TTL_MS, type IdempotencyBeginResult, type IdempotencyRecordStatus, InMemoryWorkspaceBridgeIdempotencyStore, InMemoryWorkspaceBridgeRuntimeRefreshTokenStore, MAX_WORKSPACE_BRIDGE_RUNTIME_TOKEN_TTL_MS, type MintWorkspaceBridgeRuntimeRefreshTokenOptions, type MintWorkspaceBridgeRuntimeTokenOptions, type PluginRestartWarning, type RuntimeBackendDiagnostic, type RuntimeBackendDispatchRequest, type RuntimeBackendDispatchResponse, type RuntimeBackendDispatcher, RuntimeBackendError, type RuntimeBackendGatewayOptions, RuntimeBackendRegistry, type RuntimeBackendReloadResult, type TrustedDomainBridgeHandlerOptions, type TrustedDomainBridgeHandlerPolicy, type TrustedDomainBridgeHandlerRegistration, UiBridge, type UiRoutesOptions, type VerifiedWorkspaceBridgeRuntimeRefreshToken, type VerifiedWorkspaceBridgeRuntimeToken, type VerifiedWorkspaceBridgeRuntimeTokenClaims, type VerifyWorkspaceBridgeRuntimeRefreshTokenOptions, type VerifyWorkspaceBridgeRuntimeTokenClaimsOptions, type VerifyWorkspaceBridgeRuntimeTokenOptions, WORKSPACE_BRIDGE_REFRESH_TOKEN_AUDIENCE, WORKSPACE_BRIDGE_TOKEN_AUDIENCE, WorkspaceBridge, WorkspaceBridgeCallRequest, WorkspaceBridgeCallResponse, WorkspaceBridgeError, WorkspaceBridgeHandler, type WorkspaceBridgeHttpRoutesOptions, type WorkspaceBridgeIdempotencyRecord, type WorkspaceBridgeIdempotencyStore, WorkspaceBridgeOperationDefinition, WorkspaceBridgeRegistry, type WorkspaceBridgeRuntimeCore, type WorkspaceBridgeRuntimeCoreOptions, type WorkspaceBridgeRuntimeRefreshTokenClaims, type WorkspaceBridgeRuntimeRefreshTokenStore, type WorkspaceBridgeRuntimeRefreshTokenUseOptions, type WorkspaceBridgeRuntimeRefreshTokenUseResult, type WorkspaceBridgeRuntimeTokenClaims, WorkspaceServerPluginAsset, aggregatePluginPrompts, authorizeWorkspaceBridgeRuntimeToken, boringPluginRoutes, buildBoringSystemPrompt, clampWorkspaceBridgeRuntimeTokenTtlMs, collectRestartWarnings, createExecUiTool, createGetUiStateTool, createWorkspaceBridgeRuntimeCore, createWorkspaceUiTools, definePluginAsset, defineTrustedDomainBridgeHandler, hashNormalizedInput, mintWorkspaceBridgeRuntimeRefreshToken, mintWorkspaceBridgeRuntimeToken, pluginFileSignature, preflightBoringPlugins, readBoringPlugins, readPluginSignatureCache, resolvePluginAssetPath, runWithWorkspaceBridgeIdempotency, runtimeBackendGateway, runtimeClaimsToBridgeAuthContext, scanBoringPlugins, stableStringify, uiRoutes, verifyWorkspaceBridgeRuntimeRefreshToken, verifyWorkspaceBridgeRuntimeToken, verifyWorkspaceBridgeRuntimeTokenClaims, workspaceBridgeHttpRoutes, writePluginSignatureCache };

package/dist/server.js

@@ -166,15 +166,23 @@ function resolvePaneStatusWorkspaceId(request) {
 function paneRenderStatusRoutes(app, opts = {}, done) {
   const store = opts.store ?? createPaneRenderStatusStore();
   const validateReport = createBodyValidator(reportBodySchema);
-  const getWorkspaceId = async (request) => {
-    return await opts.getWorkspaceId?.(request) ?? resolvePaneStatusWorkspaceId(request);
+  const getWorkspaceId = async (request, presentedWorkspaceId) => {
+    return await opts.getWorkspaceId?.(request, presentedWorkspaceId) ?? resolvePaneStatusWorkspaceId(request);
+  };
+  const admitMalformedScopedWorkspaceId = async (request) => {
+    const scoped = request.requestScope !== void 0;
+    const body = request.body;
+    if (!scoped || !body || !Object.prototype.hasOwnProperty.call(body, "workspaceId")) return;
+    if (body.workspaceId !== void 0 && typeof body.workspaceId !== "string") {
+      await getWorkspaceId(request, body.workspaceId);
+    }
   };
   app.put(
     "/api/v1/ui/panels/status",
-    { preHandler: validateReport },
+    { preHandler: [admitMalformedScopedWorkspaceId, validateReport] },
     async (request, reply) => {
       const body = request.body;
-      const workspaceId = await getWorkspaceId(request) ?? body.workspaceId;
+      const workspaceId = await getWorkspaceId(request, body.workspaceId) ?? body.workspaceId;
       const status = store.report({ ...body, workspaceId });
       return reply.code(200).send({ ok: true, status });
     }
@@ -230,7 +238,7 @@ function createBodyValidator2(schema) {
 function uiRoutes(app, opts, done) {
   const fallbackBridge = opts.bridge;
   const paneStatusStore = opts.paneStatusStore ?? createPaneRenderStatusStore();
-  const getPaneWorkspaceId = async (request) => await opts.getWorkspaceId?.(request) ?? resolvePaneStatusWorkspaceId(request);
+  const getPaneWorkspaceId = async (request, presentedWorkspaceId) => await opts.getWorkspaceId?.(request, presentedWorkspaceId) ?? resolvePaneStatusWorkspaceId(request);
   const touchUi = async (request) => {
     paneStatusStore.touchUi(await getPaneWorkspaceId(request));
   };
@@ -1401,20 +1409,28 @@ function mintWorkspaceBridgeRuntimeRefreshToken(options) {
   });
 }
 function verifyWorkspaceBridgeRuntimeToken(token, options) {
+  return authorizeWorkspaceBridgeRuntimeToken(
+    verifyWorkspaceBridgeRuntimeTokenClaims(token, options),
+    options.requiredCapabilities
+  );
+}
+function verifyWorkspaceBridgeRuntimeTokenClaims(token, options) {
   assertUsableSecret(options.secret);
   const claims = parseAndVerifyToken(token, options.secret);
   const now = Math.floor((options.nowMs ?? Date.now()) / 1e3);
   ensureLiveTokenClaims(claims, now, WORKSPACE_BRIDGE_TOKEN_AUDIENCE, "Runtime bridge token");
-  const missingCapability = (options.requiredCapabilities ?? []).find(
-    (capability) => !claims.capabilities.includes(capability)
+  return { claims };
+}
+function authorizeWorkspaceBridgeRuntimeToken(verified, requiredCapabilities = []) {
+  const missingCapability = requiredCapabilities.find(
+    (capability) => !verified.claims.capabilities.includes(capability)
   );
   if (missingCapability) {
     throw bridgeTokenError("BRIDGE_CAPABILITY_DENIED" /* CapabilityDenied */, "Runtime bridge token is missing a required capability");
   }
-  const runtimeClaims = claims;
   return {
-    claims: runtimeClaims,
-    authContext: runtimeClaimsToBridgeAuthContext(runtimeClaims)
+    claims: verified.claims,
+    authContext: runtimeClaimsToBridgeAuthContext(verified.claims)
   };
 }
 function verifyWorkspaceBridgeRuntimeRefreshToken(token, options) {
@@ -1636,14 +1652,25 @@ function workspaceBridgeHttpRoutes(app, opts, done) {
       return sendBridgeError(reply, 400, void 0, "BRIDGE_SCHEMA_INVALID" /* SchemaInvalid */, "WorkspaceBridge request body is invalid");
     }
     const body = { ...parsed.data, input: parsed.data.input ?? {} };
+    const authHeader = firstHeader2(request.headers.authorization);
+    const runtimeToken = authHeader?.startsWith("Bearer ") ? authHeader.slice("Bearer ".length) : void 0;
+    let verifiedRuntimeToken;
+    if (runtimeToken !== void 0 && opts.assertRuntimeWorkspaceScope) {
+      try {
+        verifiedRuntimeToken = resolveRuntimeClaims(runtimeToken, opts);
+      } catch (err) {
+        const bridgeError = isBridgeError(err) ? err : createWorkspaceBridgeError("BRIDGE_HANDLER_FAILED" /* HandlerFailed */, "WorkspaceBridge transport failed");
+        return sendBridgeError(reply, statusForBridgeError(bridgeError.code), body.requestId, bridgeError.code, bridgeError.message);
+      }
+      await opts.assertRuntimeWorkspaceScope(request, verifiedRuntimeToken.claims);
+    }
     try {
       const registry = await resolveRegistry(request, body, opts);
       const definition = registry.getDefinition(body.op);
       if (!definition) {
         return sendBridgeError(reply, statusForBridgeError("BRIDGE_OP_NOT_FOUND" /* OpNotFound */), body.requestId, "BRIDGE_OP_NOT_FOUND" /* OpNotFound */, "WorkspaceBridge operation is not registered");
       }
-      const authHeader = firstHeader2(request.headers.authorization);
-      const authContext = authHeader?.startsWith("Bearer ") ? resolveRuntimeContext(authHeader.slice("Bearer ".length), opts, definition) : await resolveBrowserContext(request, opts, definition, body);
+      const authContext = runtimeToken !== void 0 ? resolveRuntimeContext(runtimeToken, opts, definition, verifiedRuntimeToken) : await resolveBrowserContext(request, opts, definition, body);
       const idempotencyStore = opts.getIdempotencyStore ? await opts.getIdempotencyStore(request, body) : opts.idempotencyStore;
       const expectedWorkspaceId = opts.getOwnerWorkspaceId ? await opts.getOwnerWorkspaceId(request, body, authContext) : opts.ownerWorkspaceId;
       const response = await runWithWorkspaceBridgeIdempotency(idempotencyStore, {
@@ -1666,12 +1693,21 @@ function workspaceBridgeHttpRoutes(app, opts, done) {
     if (!opts.runtimeTokenSecret || !opts.runtimeRefreshTokenSecret) {
       return sendBridgeError(reply, 401, void 0, "BRIDGE_AUTH_REQUIRED" /* AuthRequired */, "WorkspaceBridge token refresh is not configured");
     }
+    const nowMs = Date.now();
+    let verified;
     try {
-      const nowMs = Date.now();
-      const verified = verifyWorkspaceBridgeRuntimeRefreshToken(authHeader.slice("Bearer ".length), {
+      verified = verifyWorkspaceBridgeRuntimeRefreshToken(authHeader.slice("Bearer ".length), {
         secret: opts.runtimeRefreshTokenSecret,
         nowMs
       });
+    } catch (err) {
+      const bridgeError = isBridgeError(err) ? err : createWorkspaceBridgeError("BRIDGE_INVALID_TOKEN" /* InvalidToken */, "WorkspaceBridge refresh token is invalid");
+      return sendBridgeError(reply, statusForBridgeError(bridgeError.code), void 0, bridgeError.code, bridgeError.message);
+    }
+    if (opts.assertRuntimeWorkspaceScope) {
+      await opts.assertRuntimeWorkspaceScope(request, verified.claims);
+    }
+    try {
       const store = opts.getRuntimeRefreshTokenStore ? await opts.getRuntimeRefreshTokenStore(request, verified.claims) ?? defaultRefreshTokenStore : defaultRefreshTokenStore;
       const refreshUse = await store.recordUse({
         jti: verified.claims.jti,
@@ -1714,7 +1750,10 @@ async function resolveRegistry(request, body, opts) {
   }
   return registry;
 }
-function resolveRuntimeContext(token, opts, definition) {
+function resolveRuntimeContext(token, opts, definition, verified) {
+  if (verified) {
+    return authorizeWorkspaceBridgeRuntimeToken(verified, definition.requiredCapabilities).authContext;
+  }
   if (!opts.runtimeTokenSecret) {
     throw createWorkspaceBridgeError("BRIDGE_AUTH_REQUIRED" /* AuthRequired */, "Runtime bridge token auth is not configured");
   }
@@ -1723,6 +1762,12 @@ function resolveRuntimeContext(token, opts, definition) {
     requiredCapabilities: definition.requiredCapabilities
   }).authContext;
 }
+function resolveRuntimeClaims(token, opts) {
+  if (!opts.runtimeTokenSecret) {
+    throw createWorkspaceBridgeError("BRIDGE_AUTH_REQUIRED" /* AuthRequired */, "Runtime bridge token auth is not configured");
+  }
+  return verifyWorkspaceBridgeRuntimeTokenClaims(token, { secret: opts.runtimeTokenSecret });
+}
 async function resolveBrowserContext(request, opts, definition, body) {
   if (!opts.browserAuthPolicy) {
     throw createWorkspaceBridgeError("BRIDGE_AUTH_REQUIRED" /* AuthRequired */, "Browser bridge auth is not configured");
@@ -3792,6 +3837,7 @@ export {
   WorkspaceBridgeErrorCode,
   WorkspaceBridgeRegistry,
   aggregatePluginPrompts,
+  authorizeWorkspaceBridgeRuntimeToken,
   bootstrapServer,
   boringPluginRoutes,
   buildBoringSystemPrompt,
@@ -3832,6 +3878,7 @@ export {
   validateWorkspaceBridgeOperationDefinition,
   verifyWorkspaceBridgeRuntimeRefreshToken,
   verifyWorkspaceBridgeRuntimeToken,
+  verifyWorkspaceBridgeRuntimeTokenClaims,
   workspaceBridgeHttpRoutes,
   writePluginSignatureCache
 };

package/dist/workspace.css

@@ -6171,6 +6171,9 @@
   .grid {
     display: grid;
   }
+  .inline {
+    display: inline;
+  }
   .inline-block {
     display: inline-block;
   }
@@ -6220,6 +6223,9 @@
   .h-1 {
     height: var(--spacing);
   }
+  .h-2 {
+    height: calc(var(--spacing) * 2);
+  }
   .h-2\.5 {
     height: calc(var(--spacing) * 2.5);
   }
@@ -8424,6 +8430,64 @@
       height: calc(var(--spacing) * 4);
     }
   }
+  .\[\&\:\:-moz-progress-bar\]\:rounded-full {
+    &::-moz-progress-bar {
+      border-radius: calc(infinity * 1px);
+    }
+  }
+  .\[\&\:\:-moz-progress-bar\]\:bg-\[color\:var\(--boring-warning\,var\(--accent-foreground\)\)\] {
+    &::-moz-progress-bar {
+      background-color: var(--boring-warning,var(--accent-foreground));
+    }
+  }
+  .\[\&\:\:-moz-progress-bar\]\:bg-destructive {
+    &::-moz-progress-bar {
+      background-color: var(--boring-destructive);
+    }
+  }
+  .\[\&\:\:-moz-progress-bar\]\:bg-primary {
+    &::-moz-progress-bar {
+      background-color: var(--boring-primary);
+    }
+  }
+  .\[\&\:\:-webkit-progress-bar\]\:bg-muted {
+    &::-webkit-progress-bar {
+      background-color: var(--boring-muted);
+    }
+  }
+  .\[\&\:\:-webkit-progress-value\]\:rounded-full {
+    &::-webkit-progress-value {
+      border-radius: calc(infinity * 1px);
+    }
+  }
+  .\[\&\:\:-webkit-progress-value\]\:bg-\[color\:var\(--boring-warning\,var\(--accent-foreground\)\)\] {
+    &::-webkit-progress-value {
+      background-color: var(--boring-warning,var(--accent-foreground));
+    }
+  }
+  .\[\&\:\:-webkit-progress-value\]\:bg-destructive {
+    &::-webkit-progress-value {
+      background-color: var(--boring-destructive);
+    }
+  }
+  .\[\&\:\:-webkit-progress-value\]\:bg-primary {
+    &::-webkit-progress-value {
+      background-color: var(--boring-primary);
+    }
+  }
+  .\[\&\:\:-webkit-progress-value\]\:transition-all {
+    &::-webkit-progress-value {
+      transition-property: all;
+      transition-timing-function: var(--tw-ease, var(--default-transition-timing-function));
+      transition-duration: var(--tw-duration, var(--default-transition-duration));
+    }
+  }
+  .\[\&\:\:-webkit-progress-value\]\:duration-300 {
+    &::-webkit-progress-value {
+      --tw-duration: 300ms;
+      transition-duration: 300ms;
+    }
+  }
   .\[\&\:\:-webkit-scrollbar\]\:hidden {
     &::-webkit-scrollbar {
       display: none;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hachej/boring-workspace",
-  "version": "0.1.81",
+  "version": "0.1.83",
   "type": "module",
   "license": "MIT",
   "description": "Workspace UI, plugin, and bridge package for composing chat, files, catalogs, editors, and app-specific panes.",
@@ -139,9 +139,9 @@
     "tailwind-merge": "^2.0.0",
     "zod": "^3.23.0",
     "zustand": "^5.0.14",
-    "@hachej/boring-agent": "0.1.81",
-    "@hachej/boring-ui-kit": "0.1.81",
-    "@hachej/boring-ui-plugin-cli": "0.1.81"
+    "@hachej/boring-agent": "0.1.83",
+    "@hachej/boring-ui-kit": "0.1.83",
+    "@hachej/boring-ui-plugin-cli": "0.1.83"
   },
   "devDependencies": {
     "@tailwindcss/postcss": "^4.3.1",