@hachej/boring-workspace 0.1.82 → 0.1.83

package/dist/app-server.js

@@ -3330,20 +3330,28 @@ function mintWorkspaceBridgeRuntimeRefreshToken(options) {
   });
 }
 function verifyWorkspaceBridgeRuntimeToken(token, options) {
+  return authorizeWorkspaceBridgeRuntimeToken(
+    verifyWorkspaceBridgeRuntimeTokenClaims(token, options),
+    options.requiredCapabilities
+  );
+}
+function verifyWorkspaceBridgeRuntimeTokenClaims(token, options) {
   assertUsableSecret(options.secret);
   const claims = parseAndVerifyToken(token, options.secret);
   const now = Math.floor((options.nowMs ?? Date.now()) / 1e3);
   ensureLiveTokenClaims(claims, now, WORKSPACE_BRIDGE_TOKEN_AUDIENCE, "Runtime bridge token");
-  const missingCapability = (options.requiredCapabilities ?? []).find(
-    (capability) => !claims.capabilities.includes(capability)
+  return { claims };
+}
+function authorizeWorkspaceBridgeRuntimeToken(verified, requiredCapabilities = []) {
+  const missingCapability = requiredCapabilities.find(
+    (capability) => !verified.claims.capabilities.includes(capability)
   );
   if (missingCapability) {
     throw bridgeTokenError("BRIDGE_CAPABILITY_DENIED" /* CapabilityDenied */, "Runtime bridge token is missing a required capability");
   }
-  const runtimeClaims = claims;
   return {
-    claims: runtimeClaims,
-    authContext: runtimeClaimsToBridgeAuthContext(runtimeClaims)
+    claims: verified.claims,
+    authContext: runtimeClaimsToBridgeAuthContext(verified.claims)
   };
 }
 function verifyWorkspaceBridgeRuntimeRefreshToken(token, options) {
@@ -3565,14 +3573,25 @@ function workspaceBridgeHttpRoutes(app, opts, done) {
       return sendBridgeError(reply, 400, void 0, "BRIDGE_SCHEMA_INVALID" /* SchemaInvalid */, "WorkspaceBridge request body is invalid");
     }
     const body = { ...parsed.data, input: parsed.data.input ?? {} };
+    const authHeader = firstHeader(request.headers.authorization);
+    const runtimeToken = authHeader?.startsWith("Bearer ") ? authHeader.slice("Bearer ".length) : void 0;
+    let verifiedRuntimeToken;
+    if (runtimeToken !== void 0 && opts.assertRuntimeWorkspaceScope) {
+      try {
+        verifiedRuntimeToken = resolveRuntimeClaims(runtimeToken, opts);
+      } catch (err) {
+        const bridgeError = isBridgeError(err) ? err : createWorkspaceBridgeError("BRIDGE_HANDLER_FAILED" /* HandlerFailed */, "WorkspaceBridge transport failed");
+        return sendBridgeError(reply, statusForBridgeError(bridgeError.code), body.requestId, bridgeError.code, bridgeError.message);
+      }
+      await opts.assertRuntimeWorkspaceScope(request, verifiedRuntimeToken.claims);
+    }
     try {
       const registry = await resolveRegistry(request, body, opts);
       const definition = registry.getDefinition(body.op);
       if (!definition) {
         return sendBridgeError(reply, statusForBridgeError("BRIDGE_OP_NOT_FOUND" /* OpNotFound */), body.requestId, "BRIDGE_OP_NOT_FOUND" /* OpNotFound */, "WorkspaceBridge operation is not registered");
       }
-      const authHeader = firstHeader(request.headers.authorization);
-      const authContext = authHeader?.startsWith("Bearer ") ? resolveRuntimeContext(authHeader.slice("Bearer ".length), opts, definition) : await resolveBrowserContext(request, opts, definition, body);
+      const authContext = runtimeToken !== void 0 ? resolveRuntimeContext(runtimeToken, opts, definition, verifiedRuntimeToken) : await resolveBrowserContext(request, opts, definition, body);
       const idempotencyStore = opts.getIdempotencyStore ? await opts.getIdempotencyStore(request, body) : opts.idempotencyStore;
       const expectedWorkspaceId = opts.getOwnerWorkspaceId ? await opts.getOwnerWorkspaceId(request, body, authContext) : opts.ownerWorkspaceId;
       const response = await runWithWorkspaceBridgeIdempotency(idempotencyStore, {
@@ -3595,12 +3614,21 @@ function workspaceBridgeHttpRoutes(app, opts, done) {
     if (!opts.runtimeTokenSecret || !opts.runtimeRefreshTokenSecret) {
       return sendBridgeError(reply, 401, void 0, "BRIDGE_AUTH_REQUIRED" /* AuthRequired */, "WorkspaceBridge token refresh is not configured");
     }
+    const nowMs = Date.now();
+    let verified;
     try {
-      const nowMs = Date.now();
-      const verified = verifyWorkspaceBridgeRuntimeRefreshToken(authHeader.slice("Bearer ".length), {
+      verified = verifyWorkspaceBridgeRuntimeRefreshToken(authHeader.slice("Bearer ".length), {
         secret: opts.runtimeRefreshTokenSecret,
         nowMs
       });
+    } catch (err) {
+      const bridgeError = isBridgeError(err) ? err : createWorkspaceBridgeError("BRIDGE_INVALID_TOKEN" /* InvalidToken */, "WorkspaceBridge refresh token is invalid");
+      return sendBridgeError(reply, statusForBridgeError(bridgeError.code), void 0, bridgeError.code, bridgeError.message);
+    }
+    if (opts.assertRuntimeWorkspaceScope) {
+      await opts.assertRuntimeWorkspaceScope(request, verified.claims);
+    }
+    try {
       const store = opts.getRuntimeRefreshTokenStore ? await opts.getRuntimeRefreshTokenStore(request, verified.claims) ?? defaultRefreshTokenStore : defaultRefreshTokenStore;
       const refreshUse = await store.recordUse({
         jti: verified.claims.jti,
@@ -3643,7 +3671,10 @@ async function resolveRegistry(request, body, opts) {
   }
   return registry;
 }
-function resolveRuntimeContext(token, opts, definition) {
+function resolveRuntimeContext(token, opts, definition, verified) {
+  if (verified) {
+    return authorizeWorkspaceBridgeRuntimeToken(verified, definition.requiredCapabilities).authContext;
+  }
   if (!opts.runtimeTokenSecret) {
     throw createWorkspaceBridgeError("BRIDGE_AUTH_REQUIRED" /* AuthRequired */, "Runtime bridge token auth is not configured");
   }
@@ -3652,6 +3683,12 @@ function resolveRuntimeContext(token, opts, definition) {
     requiredCapabilities: definition.requiredCapabilities
   }).authContext;
 }
+function resolveRuntimeClaims(token, opts) {
+  if (!opts.runtimeTokenSecret) {
+    throw createWorkspaceBridgeError("BRIDGE_AUTH_REQUIRED" /* AuthRequired */, "Runtime bridge token auth is not configured");
+  }
+  return verifyWorkspaceBridgeRuntimeTokenClaims(token, { secret: opts.runtimeTokenSecret });
+}
 async function resolveBrowserContext(request, opts, definition, body) {
   if (!opts.browserAuthPolicy) {
     throw createWorkspaceBridgeError("BRIDGE_AUTH_REQUIRED" /* AuthRequired */, "Browser bridge auth is not configured");

package/dist/server.d.ts

@@ -232,6 +232,7 @@ interface VerifyWorkspaceBridgeRuntimeTokenOptions {
     nowMs?: number;
     requiredCapabilities?: readonly string[];
 }
+type VerifyWorkspaceBridgeRuntimeTokenClaimsOptions = Omit<VerifyWorkspaceBridgeRuntimeTokenOptions, "requiredCapabilities">;
 interface VerifyWorkspaceBridgeRuntimeRefreshTokenOptions {
     secret: string;
     nowMs?: number;
@@ -240,12 +241,17 @@ interface VerifiedWorkspaceBridgeRuntimeToken {
     claims: WorkspaceBridgeRuntimeTokenClaims;
     authContext: BridgeAuthContext;
 }
+interface VerifiedWorkspaceBridgeRuntimeTokenClaims {
+    claims: WorkspaceBridgeRuntimeTokenClaims;
+}
 interface VerifiedWorkspaceBridgeRuntimeRefreshToken {
     claims: WorkspaceBridgeRuntimeRefreshTokenClaims;
 }
 declare function mintWorkspaceBridgeRuntimeToken(options: MintWorkspaceBridgeRuntimeTokenOptions): string;
 declare function mintWorkspaceBridgeRuntimeRefreshToken(options: MintWorkspaceBridgeRuntimeRefreshTokenOptions): string;
 declare function verifyWorkspaceBridgeRuntimeToken(token: string, options: VerifyWorkspaceBridgeRuntimeTokenOptions): VerifiedWorkspaceBridgeRuntimeToken;
+declare function verifyWorkspaceBridgeRuntimeTokenClaims(token: string, options: VerifyWorkspaceBridgeRuntimeTokenClaimsOptions): VerifiedWorkspaceBridgeRuntimeTokenClaims;
+declare function authorizeWorkspaceBridgeRuntimeToken(verified: VerifiedWorkspaceBridgeRuntimeTokenClaims, requiredCapabilities?: readonly string[]): VerifiedWorkspaceBridgeRuntimeToken;
 declare function verifyWorkspaceBridgeRuntimeRefreshToken(token: string, options: VerifyWorkspaceBridgeRuntimeRefreshTokenOptions): VerifiedWorkspaceBridgeRuntimeRefreshToken;
 declare function clampWorkspaceBridgeRuntimeTokenTtlMs(ttlMs: number | undefined): number | undefined;
 declare function runtimeClaimsToBridgeAuthContext(claims: WorkspaceBridgeRuntimeTokenClaims): BridgeAuthContext;
@@ -289,6 +295,7 @@ interface WorkspaceBridgeHttpRoutesOptions {
     runtimeRefreshTokenSecret?: string;
     runtimeRefreshTokenStore?: WorkspaceBridgeRuntimeRefreshTokenStore;
     getRuntimeRefreshTokenStore?: (request: FastifyRequest, claims: WorkspaceBridgeRuntimeRefreshTokenClaims) => WorkspaceBridgeRuntimeRefreshTokenStore | undefined | Promise<WorkspaceBridgeRuntimeRefreshTokenStore | undefined>;
+    assertRuntimeWorkspaceScope?: (request: FastifyRequest, claims: WorkspaceBridgeRuntimeTokenClaims | WorkspaceBridgeRuntimeRefreshTokenClaims) => void | Promise<void>;
     refreshTokenRateLimit?: {
         maxUses?: number;
         windowMs?: number;
@@ -622,4 +629,4 @@ interface RuntimeBackendGatewayOptions {
 }
 declare function runtimeBackendGateway(app: FastifyInstance, opts: RuntimeBackendGatewayOptions): Promise<void>;
 
-export { type BeginIdempotencyOptions, BoringPluginAssetManager, BoringPluginEvent, BoringPluginFrontTarget, BoringPluginFrontTargetResolver, BoringPluginListEntry, type BoringPluginScanResult, BoringPluginSource, BoringPluginSourceInput, BoringServerPluginManifest, BridgeAuthContext, BridgeAuthPolicy, BridgeCallerClass, BridgeIdempotencyPolicy, type CompleteIdempotencyOptions, DEFAULT_WORKSPACE_BRIDGE_RUNTIME_REFRESH_TOKEN_TTL_MS, DEFAULT_WORKSPACE_BRIDGE_RUNTIME_TOKEN_TTL_MS, type IdempotencyBeginResult, type IdempotencyRecordStatus, InMemoryWorkspaceBridgeIdempotencyStore, InMemoryWorkspaceBridgeRuntimeRefreshTokenStore, MAX_WORKSPACE_BRIDGE_RUNTIME_TOKEN_TTL_MS, type MintWorkspaceBridgeRuntimeRefreshTokenOptions, type MintWorkspaceBridgeRuntimeTokenOptions, type PluginRestartWarning, type RuntimeBackendDiagnostic, type RuntimeBackendDispatchRequest, type RuntimeBackendDispatchResponse, type RuntimeBackendDispatcher, RuntimeBackendError, type RuntimeBackendGatewayOptions, RuntimeBackendRegistry, type RuntimeBackendReloadResult, type TrustedDomainBridgeHandlerOptions, type TrustedDomainBridgeHandlerPolicy, type TrustedDomainBridgeHandlerRegistration, UiBridge, type UiRoutesOptions, type VerifiedWorkspaceBridgeRuntimeRefreshToken, type VerifiedWorkspaceBridgeRuntimeToken, type VerifyWorkspaceBridgeRuntimeRefreshTokenOptions, type VerifyWorkspaceBridgeRuntimeTokenOptions, WORKSPACE_BRIDGE_REFRESH_TOKEN_AUDIENCE, WORKSPACE_BRIDGE_TOKEN_AUDIENCE, WorkspaceBridge, WorkspaceBridgeCallRequest, WorkspaceBridgeCallResponse, WorkspaceBridgeError, WorkspaceBridgeHandler, type WorkspaceBridgeHttpRoutesOptions, type WorkspaceBridgeIdempotencyRecord, type WorkspaceBridgeIdempotencyStore, WorkspaceBridgeOperationDefinition, WorkspaceBridgeRegistry, type WorkspaceBridgeRuntimeCore, type WorkspaceBridgeRuntimeCoreOptions, type WorkspaceBridgeRuntimeRefreshTokenClaims, type WorkspaceBridgeRuntimeRefreshTokenStore, type WorkspaceBridgeRuntimeRefreshTokenUseOptions, type WorkspaceBridgeRuntimeRefreshTokenUseResult, type WorkspaceBridgeRuntimeTokenClaims, WorkspaceServerPluginAsset, aggregatePluginPrompts, boringPluginRoutes, buildBoringSystemPrompt, clampWorkspaceBridgeRuntimeTokenTtlMs, collectRestartWarnings, createExecUiTool, createGetUiStateTool, createWorkspaceBridgeRuntimeCore, createWorkspaceUiTools, definePluginAsset, defineTrustedDomainBridgeHandler, hashNormalizedInput, mintWorkspaceBridgeRuntimeRefreshToken, mintWorkspaceBridgeRuntimeToken, pluginFileSignature, preflightBoringPlugins, readBoringPlugins, readPluginSignatureCache, resolvePluginAssetPath, runWithWorkspaceBridgeIdempotency, runtimeBackendGateway, runtimeClaimsToBridgeAuthContext, scanBoringPlugins, stableStringify, uiRoutes, verifyWorkspaceBridgeRuntimeRefreshToken, verifyWorkspaceBridgeRuntimeToken, workspaceBridgeHttpRoutes, writePluginSignatureCache };
+export { type BeginIdempotencyOptions, BoringPluginAssetManager, BoringPluginEvent, BoringPluginFrontTarget, BoringPluginFrontTargetResolver, BoringPluginListEntry, type BoringPluginScanResult, BoringPluginSource, BoringPluginSourceInput, BoringServerPluginManifest, BridgeAuthContext, BridgeAuthPolicy, BridgeCallerClass, BridgeIdempotencyPolicy, type CompleteIdempotencyOptions, DEFAULT_WORKSPACE_BRIDGE_RUNTIME_REFRESH_TOKEN_TTL_MS, DEFAULT_WORKSPACE_BRIDGE_RUNTIME_TOKEN_TTL_MS, type IdempotencyBeginResult, type IdempotencyRecordStatus, InMemoryWorkspaceBridgeIdempotencyStore, InMemoryWorkspaceBridgeRuntimeRefreshTokenStore, MAX_WORKSPACE_BRIDGE_RUNTIME_TOKEN_TTL_MS, type MintWorkspaceBridgeRuntimeRefreshTokenOptions, type MintWorkspaceBridgeRuntimeTokenOptions, type PluginRestartWarning, type RuntimeBackendDiagnostic, type RuntimeBackendDispatchRequest, type RuntimeBackendDispatchResponse, type RuntimeBackendDispatcher, RuntimeBackendError, type RuntimeBackendGatewayOptions, RuntimeBackendRegistry, type RuntimeBackendReloadResult, type TrustedDomainBridgeHandlerOptions, type TrustedDomainBridgeHandlerPolicy, type TrustedDomainBridgeHandlerRegistration, UiBridge, type UiRoutesOptions, type VerifiedWorkspaceBridgeRuntimeRefreshToken, type VerifiedWorkspaceBridgeRuntimeToken, type VerifiedWorkspaceBridgeRuntimeTokenClaims, type VerifyWorkspaceBridgeRuntimeRefreshTokenOptions, type VerifyWorkspaceBridgeRuntimeTokenClaimsOptions, type VerifyWorkspaceBridgeRuntimeTokenOptions, WORKSPACE_BRIDGE_REFRESH_TOKEN_AUDIENCE, WORKSPACE_BRIDGE_TOKEN_AUDIENCE, WorkspaceBridge, WorkspaceBridgeCallRequest, WorkspaceBridgeCallResponse, WorkspaceBridgeError, WorkspaceBridgeHandler, type WorkspaceBridgeHttpRoutesOptions, type WorkspaceBridgeIdempotencyRecord, type WorkspaceBridgeIdempotencyStore, WorkspaceBridgeOperationDefinition, WorkspaceBridgeRegistry, type WorkspaceBridgeRuntimeCore, type WorkspaceBridgeRuntimeCoreOptions, type WorkspaceBridgeRuntimeRefreshTokenClaims, type WorkspaceBridgeRuntimeRefreshTokenStore, type WorkspaceBridgeRuntimeRefreshTokenUseOptions, type WorkspaceBridgeRuntimeRefreshTokenUseResult, type WorkspaceBridgeRuntimeTokenClaims, WorkspaceServerPluginAsset, aggregatePluginPrompts, authorizeWorkspaceBridgeRuntimeToken, boringPluginRoutes, buildBoringSystemPrompt, clampWorkspaceBridgeRuntimeTokenTtlMs, collectRestartWarnings, createExecUiTool, createGetUiStateTool, createWorkspaceBridgeRuntimeCore, createWorkspaceUiTools, definePluginAsset, defineTrustedDomainBridgeHandler, hashNormalizedInput, mintWorkspaceBridgeRuntimeRefreshToken, mintWorkspaceBridgeRuntimeToken, pluginFileSignature, preflightBoringPlugins, readBoringPlugins, readPluginSignatureCache, resolvePluginAssetPath, runWithWorkspaceBridgeIdempotency, runtimeBackendGateway, runtimeClaimsToBridgeAuthContext, scanBoringPlugins, stableStringify, uiRoutes, verifyWorkspaceBridgeRuntimeRefreshToken, verifyWorkspaceBridgeRuntimeToken, verifyWorkspaceBridgeRuntimeTokenClaims, workspaceBridgeHttpRoutes, writePluginSignatureCache };

package/dist/server.js

@@ -1409,20 +1409,28 @@ function mintWorkspaceBridgeRuntimeRefreshToken(options) {
   });
 }
 function verifyWorkspaceBridgeRuntimeToken(token, options) {
+  return authorizeWorkspaceBridgeRuntimeToken(
+    verifyWorkspaceBridgeRuntimeTokenClaims(token, options),
+    options.requiredCapabilities
+  );
+}
+function verifyWorkspaceBridgeRuntimeTokenClaims(token, options) {
   assertUsableSecret(options.secret);
   const claims = parseAndVerifyToken(token, options.secret);
   const now = Math.floor((options.nowMs ?? Date.now()) / 1e3);
   ensureLiveTokenClaims(claims, now, WORKSPACE_BRIDGE_TOKEN_AUDIENCE, "Runtime bridge token");
-  const missingCapability = (options.requiredCapabilities ?? []).find(
-    (capability) => !claims.capabilities.includes(capability)
+  return { claims };
+}
+function authorizeWorkspaceBridgeRuntimeToken(verified, requiredCapabilities = []) {
+  const missingCapability = requiredCapabilities.find(
+    (capability) => !verified.claims.capabilities.includes(capability)
   );
   if (missingCapability) {
     throw bridgeTokenError("BRIDGE_CAPABILITY_DENIED" /* CapabilityDenied */, "Runtime bridge token is missing a required capability");
   }
-  const runtimeClaims = claims;
   return {
-    claims: runtimeClaims,
-    authContext: runtimeClaimsToBridgeAuthContext(runtimeClaims)
+    claims: verified.claims,
+    authContext: runtimeClaimsToBridgeAuthContext(verified.claims)
   };
 }
 function verifyWorkspaceBridgeRuntimeRefreshToken(token, options) {
@@ -1644,14 +1652,25 @@ function workspaceBridgeHttpRoutes(app, opts, done) {
       return sendBridgeError(reply, 400, void 0, "BRIDGE_SCHEMA_INVALID" /* SchemaInvalid */, "WorkspaceBridge request body is invalid");
     }
     const body = { ...parsed.data, input: parsed.data.input ?? {} };
+    const authHeader = firstHeader2(request.headers.authorization);
+    const runtimeToken = authHeader?.startsWith("Bearer ") ? authHeader.slice("Bearer ".length) : void 0;
+    let verifiedRuntimeToken;
+    if (runtimeToken !== void 0 && opts.assertRuntimeWorkspaceScope) {
+      try {
+        verifiedRuntimeToken = resolveRuntimeClaims(runtimeToken, opts);
+      } catch (err) {
+        const bridgeError = isBridgeError(err) ? err : createWorkspaceBridgeError("BRIDGE_HANDLER_FAILED" /* HandlerFailed */, "WorkspaceBridge transport failed");
+        return sendBridgeError(reply, statusForBridgeError(bridgeError.code), body.requestId, bridgeError.code, bridgeError.message);
+      }
+      await opts.assertRuntimeWorkspaceScope(request, verifiedRuntimeToken.claims);
+    }
     try {
       const registry = await resolveRegistry(request, body, opts);
       const definition = registry.getDefinition(body.op);
       if (!definition) {
         return sendBridgeError(reply, statusForBridgeError("BRIDGE_OP_NOT_FOUND" /* OpNotFound */), body.requestId, "BRIDGE_OP_NOT_FOUND" /* OpNotFound */, "WorkspaceBridge operation is not registered");
       }
-      const authHeader = firstHeader2(request.headers.authorization);
-      const authContext = authHeader?.startsWith("Bearer ") ? resolveRuntimeContext(authHeader.slice("Bearer ".length), opts, definition) : await resolveBrowserContext(request, opts, definition, body);
+      const authContext = runtimeToken !== void 0 ? resolveRuntimeContext(runtimeToken, opts, definition, verifiedRuntimeToken) : await resolveBrowserContext(request, opts, definition, body);
       const idempotencyStore = opts.getIdempotencyStore ? await opts.getIdempotencyStore(request, body) : opts.idempotencyStore;
       const expectedWorkspaceId = opts.getOwnerWorkspaceId ? await opts.getOwnerWorkspaceId(request, body, authContext) : opts.ownerWorkspaceId;
       const response = await runWithWorkspaceBridgeIdempotency(idempotencyStore, {
@@ -1674,12 +1693,21 @@ function workspaceBridgeHttpRoutes(app, opts, done) {
     if (!opts.runtimeTokenSecret || !opts.runtimeRefreshTokenSecret) {
       return sendBridgeError(reply, 401, void 0, "BRIDGE_AUTH_REQUIRED" /* AuthRequired */, "WorkspaceBridge token refresh is not configured");
     }
+    const nowMs = Date.now();
+    let verified;
     try {
-      const nowMs = Date.now();
-      const verified = verifyWorkspaceBridgeRuntimeRefreshToken(authHeader.slice("Bearer ".length), {
+      verified = verifyWorkspaceBridgeRuntimeRefreshToken(authHeader.slice("Bearer ".length), {
         secret: opts.runtimeRefreshTokenSecret,
         nowMs
       });
+    } catch (err) {
+      const bridgeError = isBridgeError(err) ? err : createWorkspaceBridgeError("BRIDGE_INVALID_TOKEN" /* InvalidToken */, "WorkspaceBridge refresh token is invalid");
+      return sendBridgeError(reply, statusForBridgeError(bridgeError.code), void 0, bridgeError.code, bridgeError.message);
+    }
+    if (opts.assertRuntimeWorkspaceScope) {
+      await opts.assertRuntimeWorkspaceScope(request, verified.claims);
+    }
+    try {
       const store = opts.getRuntimeRefreshTokenStore ? await opts.getRuntimeRefreshTokenStore(request, verified.claims) ?? defaultRefreshTokenStore : defaultRefreshTokenStore;
       const refreshUse = await store.recordUse({
         jti: verified.claims.jti,
@@ -1722,7 +1750,10 @@ async function resolveRegistry(request, body, opts) {
   }
   return registry;
 }
-function resolveRuntimeContext(token, opts, definition) {
+function resolveRuntimeContext(token, opts, definition, verified) {
+  if (verified) {
+    return authorizeWorkspaceBridgeRuntimeToken(verified, definition.requiredCapabilities).authContext;
+  }
   if (!opts.runtimeTokenSecret) {
     throw createWorkspaceBridgeError("BRIDGE_AUTH_REQUIRED" /* AuthRequired */, "Runtime bridge token auth is not configured");
   }
@@ -1731,6 +1762,12 @@ function resolveRuntimeContext(token, opts, definition) {
     requiredCapabilities: definition.requiredCapabilities
   }).authContext;
 }
+function resolveRuntimeClaims(token, opts) {
+  if (!opts.runtimeTokenSecret) {
+    throw createWorkspaceBridgeError("BRIDGE_AUTH_REQUIRED" /* AuthRequired */, "Runtime bridge token auth is not configured");
+  }
+  return verifyWorkspaceBridgeRuntimeTokenClaims(token, { secret: opts.runtimeTokenSecret });
+}
 async function resolveBrowserContext(request, opts, definition, body) {
   if (!opts.browserAuthPolicy) {
     throw createWorkspaceBridgeError("BRIDGE_AUTH_REQUIRED" /* AuthRequired */, "Browser bridge auth is not configured");
@@ -3800,6 +3837,7 @@ export {
   WorkspaceBridgeErrorCode,
   WorkspaceBridgeRegistry,
   aggregatePluginPrompts,
+  authorizeWorkspaceBridgeRuntimeToken,
   bootstrapServer,
   boringPluginRoutes,
   buildBoringSystemPrompt,
@@ -3840,6 +3878,7 @@ export {
   validateWorkspaceBridgeOperationDefinition,
   verifyWorkspaceBridgeRuntimeRefreshToken,
   verifyWorkspaceBridgeRuntimeToken,
+  verifyWorkspaceBridgeRuntimeTokenClaims,
   workspaceBridgeHttpRoutes,
   writePluginSignatureCache
 };

package/dist/workspace.css

@@ -6028,7 +6028,6 @@
     --tracking-widest: 0.1em;
     --leading-snug: 1.375;
     --radius-xs: 0.125rem;
-    --ease-out: cubic-bezier(0, 0, 0.2, 1);
     --ease-in-out: cubic-bezier(0.4, 0, 0.2, 1);
     --animate-spin: spin 1s linear infinite;
     --animate-pulse: pulse 2s cubic-bezier(0.4, 0, 0.6, 1) infinite;
@@ -6172,6 +6171,9 @@
   .grid {
     display: grid;
   }
+  .inline {
+    display: inline;
+  }
   .inline-block {
     display: inline-block;
   }
@@ -6714,9 +6716,6 @@
   .bg-\[color\:var\(--boring-success-soft\,var\(--secondary\)\)\] {
     background-color: var(--boring-success-soft,var(--secondary));
   }
-  .bg-\[color\:var\(--boring-warning\,var\(--accent-foreground\)\)\] {
-    background-color: var(--boring-warning,var(--accent-foreground));
-  }
   .bg-\[color\:var\(--boring-warning-soft\,var\(--accent\)\)\] {
     background-color: var(--boring-warning-soft,var(--accent));
   }
@@ -7134,11 +7133,6 @@
     transition-timing-function: var(--tw-ease, var(--default-transition-timing-function));
     transition-duration: var(--tw-duration, var(--default-transition-duration));
   }
-  .transition-\[width\] {
-    transition-property: width;
-    transition-timing-function: var(--tw-ease, var(--default-transition-timing-function));
-    transition-duration: var(--tw-duration, var(--default-transition-duration));
-  }
   .transition-all {
     transition-property: all;
     transition-timing-function: var(--tw-ease, var(--default-transition-timing-function));
@@ -7175,18 +7169,10 @@
     --tw-duration: 200ms;
     transition-duration: 200ms;
   }
-  .duration-300 {
-    --tw-duration: 300ms;
-    transition-duration: 300ms;
-  }
   .ease-in-out {
     --tw-ease: var(--ease-in-out);
     transition-timing-function: var(--ease-in-out);
   }
-  .ease-out {
-    --tw-ease: var(--ease-out);
-    transition-timing-function: var(--ease-out);
-  }
   .outline-none {
     --tw-outline-style: none;
     outline-style: none;
@@ -8444,6 +8430,64 @@
       height: calc(var(--spacing) * 4);
     }
   }
+  .\[\&\:\:-moz-progress-bar\]\:rounded-full {
+    &::-moz-progress-bar {
+      border-radius: calc(infinity * 1px);
+    }
+  }
+  .\[\&\:\:-moz-progress-bar\]\:bg-\[color\:var\(--boring-warning\,var\(--accent-foreground\)\)\] {
+    &::-moz-progress-bar {
+      background-color: var(--boring-warning,var(--accent-foreground));
+    }
+  }
+  .\[\&\:\:-moz-progress-bar\]\:bg-destructive {
+    &::-moz-progress-bar {
+      background-color: var(--boring-destructive);
+    }
+  }
+  .\[\&\:\:-moz-progress-bar\]\:bg-primary {
+    &::-moz-progress-bar {
+      background-color: var(--boring-primary);
+    }
+  }
+  .\[\&\:\:-webkit-progress-bar\]\:bg-muted {
+    &::-webkit-progress-bar {
+      background-color: var(--boring-muted);
+    }
+  }
+  .\[\&\:\:-webkit-progress-value\]\:rounded-full {
+    &::-webkit-progress-value {
+      border-radius: calc(infinity * 1px);
+    }
+  }
+  .\[\&\:\:-webkit-progress-value\]\:bg-\[color\:var\(--boring-warning\,var\(--accent-foreground\)\)\] {
+    &::-webkit-progress-value {
+      background-color: var(--boring-warning,var(--accent-foreground));
+    }
+  }
+  .\[\&\:\:-webkit-progress-value\]\:bg-destructive {
+    &::-webkit-progress-value {
+      background-color: var(--boring-destructive);
+    }
+  }
+  .\[\&\:\:-webkit-progress-value\]\:bg-primary {
+    &::-webkit-progress-value {
+      background-color: var(--boring-primary);
+    }
+  }
+  .\[\&\:\:-webkit-progress-value\]\:transition-all {
+    &::-webkit-progress-value {
+      transition-property: all;
+      transition-timing-function: var(--tw-ease, var(--default-transition-timing-function));
+      transition-duration: var(--tw-duration, var(--default-transition-duration));
+    }
+  }
+  .\[\&\:\:-webkit-progress-value\]\:duration-300 {
+    &::-webkit-progress-value {
+      --tw-duration: 300ms;
+      transition-duration: 300ms;
+    }
+  }
   .\[\&\:\:-webkit-scrollbar\]\:hidden {
     &::-webkit-scrollbar {
       display: none;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hachej/boring-workspace",
-  "version": "0.1.82",
+  "version": "0.1.83",
   "type": "module",
   "license": "MIT",
   "description": "Workspace UI, plugin, and bridge package for composing chat, files, catalogs, editors, and app-specific panes.",
@@ -139,9 +139,9 @@
     "tailwind-merge": "^2.0.0",
     "zod": "^3.23.0",
     "zustand": "^5.0.14",
-    "@hachej/boring-agent": "0.1.82",
-    "@hachej/boring-ui-plugin-cli": "0.1.82",
-    "@hachej/boring-ui-kit": "0.1.82"
+    "@hachej/boring-agent": "0.1.83",
+    "@hachej/boring-ui-kit": "0.1.83",
+    "@hachej/boring-ui-plugin-cli": "0.1.83"
   },
   "devDependencies": {
     "@tailwindcss/postcss": "^4.3.1",