@neta-art/cohub 5.6.0 → 5.8.0

package/dist/protocol/dist/board-node.js

@@ -0,0 +1,239 @@
+import { BOARD_ARROW_STROKE_SIZE } from "./board-constants.js";
+import { BoardTaskSnapshotSchema } from "./board-document.js";
+import { z } from "zod";
+//#region ../protocol/dist/board-node.js
+const BOARD_COLOR_IDS = [
+	"brand",
+	"neutral",
+	"black",
+	"white",
+	"blue",
+	"green",
+	"amber",
+	"violet",
+	"rose"
+];
+const BoardColorIdSchema = z.enum(BOARD_COLOR_IDS);
+const BOARD_GEO_KINDS = [
+	"rectangle",
+	"rounded",
+	"ellipse",
+	"diamond",
+	"triangle"
+];
+const BoardGeoKindSchema = z.enum(BOARD_GEO_KINDS);
+const BOARD_NATIVE_NODE_TYPES = [
+	"image",
+	"video",
+	"audio",
+	"file",
+	"task",
+	"text",
+	"geo",
+	"draw",
+	"arrow",
+	"frame"
+];
+const metadataSchema = z.record(z.string(), z.unknown());
+const commonData = {
+	locked: z.boolean().optional(),
+	metadata: metadataSchema.optional()
+};
+const pointSchema = z.object({
+	x: z.number().finite(),
+	y: z.number().finite(),
+	p: z.number().finite().min(0).max(1).default(.5)
+}).strict();
+const worldPointSchema = z.object({
+	x: z.number().finite(),
+	y: z.number().finite()
+}).strict();
+const strokeSizeSchema = z.number().finite().min(1).max(64);
+const mediaViewSchema = z.object({
+	title: z.string().optional(),
+	mimeType: z.string().optional(),
+	size: z.number().finite().nonnegative().optional(),
+	mtimeMs: z.number().finite().nonnegative().optional(),
+	naturalWidth: z.number().finite().positive().optional(),
+	naturalHeight: z.number().finite().positive().optional()
+}).strict();
+const audioViewSchema = mediaViewSchema.extend({ durationMs: z.number().finite().nonnegative().optional() });
+const dataSchemas = {
+	text: z.object({
+		...commonData,
+		text: z.string().default(""),
+		color: BoardColorIdSchema.default("neutral"),
+		fontSize: z.number().finite().min(2).max(512).default(24)
+	}).strict(),
+	geo: z.object({
+		...commonData,
+		geo: BoardGeoKindSchema.default("rectangle"),
+		text: z.string().default(""),
+		color: BoardColorIdSchema.default("brand"),
+		fillOpacity: z.number().finite().min(0).max(1).default(0)
+	}).strict(),
+	draw: z.object({
+		...commonData,
+		points: z.array(pointSchema).min(1),
+		color: BoardColorIdSchema.default("brand"),
+		size: strokeSizeSchema.default(4)
+	}).strict(),
+	arrow: z.object({
+		...commonData,
+		start: worldPointSchema,
+		end: worldPointSchema,
+		bend: z.number().finite().min(-.85).max(.85).default(0),
+		color: BoardColorIdSchema.default("brand"),
+		size: strokeSizeSchema.default(BOARD_ARROW_STROKE_SIZE),
+		arrowStart: z.boolean().default(false),
+		arrowEnd: z.boolean().default(true),
+		label: z.string().default("")
+	}).strict(),
+	frame: z.object({
+		...commonData,
+		label: z.string().default("Frame"),
+		color: BoardColorIdSchema.default("neutral")
+	}).strict(),
+	image: z.object({
+		...commonData,
+		crop: z.object({
+			x: z.number().finite().min(0).max(1),
+			y: z.number().finite().min(0).max(1),
+			w: z.number().finite().min(0).max(1),
+			h: z.number().finite().min(0).max(1)
+		}).strict().optional()
+	}).strict(),
+	video: z.object(commonData).strict(),
+	audio: z.object(commonData).strict(),
+	file: z.object(commonData).strict(),
+	task: z.object({
+		...commonData,
+		taskRunId: z.string().min(1)
+	}).strict()
+};
+const fileViewSchema = z.object({
+	title: z.string().optional(),
+	mimeType: z.string().optional(),
+	size: z.number().finite().nonnegative().optional(),
+	mtimeMs: z.number().finite().nonnegative().optional(),
+	excerpt: z.string().optional(),
+	coverPath: z.string().optional(),
+	coverUrl: z.string().url().optional()
+}).strict();
+const taskViewSchema = BoardTaskSnapshotSchema;
+const emptyViewSchema = z.object({}).strict();
+const viewSchemas = {
+	image: mediaViewSchema,
+	video: mediaViewSchema,
+	audio: audioViewSchema,
+	file: fileViewSchema,
+	task: taskViewSchema,
+	text: emptyViewSchema,
+	geo: emptyViewSchema,
+	draw: emptyViewSchema,
+	arrow: emptyViewSchema,
+	frame: emptyViewSchema
+};
+const nodeEnvelopeSchema = z.object({
+	nodeId: z.string().min(1).max(160),
+	type: z.string().min(1).max(40),
+	parentId: z.string().min(1).max(160).nullable(),
+	orderKey: z.string().max(4096).nullable(),
+	x: z.number().finite(),
+	y: z.number().finite(),
+	width: z.number().finite().positive(),
+	height: z.number().finite().positive(),
+	rotation: z.number().finite(),
+	refKind: z.string().max(40).nullable(),
+	refPath: z.string().max(4096).nullable(),
+	refUrl: z.string().max(4096).nullable(),
+	view: z.record(z.string(), z.unknown()),
+	style: z.record(z.string(), z.unknown()),
+	data: z.record(z.string(), z.unknown())
+}).strict();
+function jsonSchema(schema) {
+	return z.toJSONSchema(schema);
+}
+jsonSchema(nodeEnvelopeSchema), Object.fromEntries(BOARD_NATIVE_NODE_TYPES.map((type) => [type, jsonSchema(dataSchemas[type])])), Object.fromEntries(BOARD_NATIVE_NODE_TYPES.map((type) => [type, jsonSchema(viewSchemas[type])]));
+function issueDiagnostic(issue, path) {
+	const fullPath = [path, ...issue.path].join(".");
+	const values = "values" in issue && Array.isArray(issue.values) ? issue.values.filter((value) => typeof value === "string") : void 0;
+	return {
+		severity: "error",
+		code: "INVALID_BOARD_NODE",
+		message: `${fullPath}: ${issue.message}`,
+		path: fullPath,
+		...values?.length ? { allowedValues: values } : {}
+	};
+}
+function drawGeometryDiagnostic(node, data, path) {
+	let minX = Number.POSITIVE_INFINITY;
+	let minY = Number.POSITIVE_INFINITY;
+	let maxX = Number.NEGATIVE_INFINITY;
+	let maxY = Number.NEGATIVE_INFINITY;
+	for (const point of data.points) {
+		const radius = Math.max(.5, data.size / 2 * (.5 + point.p));
+		minX = Math.min(minX, point.x - radius);
+		minY = Math.min(minY, point.y - radius);
+		maxX = Math.max(maxX, point.x + radius);
+		maxY = Math.max(maxY, point.y + radius);
+	}
+	const width = Math.max(1, maxX - minX);
+	const height = Math.max(1, maxY - minY);
+	const tolerance = Math.max(.01, node.width * 1e-6, node.height * 1e-6);
+	if (Math.abs(minX) <= tolerance && Math.abs(minY) <= tolerance && Math.abs(width - node.width) <= tolerance && Math.abs(height - node.height) <= tolerance) return null;
+	return {
+		severity: "error",
+		code: "INVALID_BOARD_GEOMETRY",
+		message: `${path}.data.points must use frame-local coordinates and match the node frame`,
+		path: `${path}.data.points`,
+		expected: "frame-local points with bounds matching width and height",
+		coordinateSpace: "frame-local"
+	};
+}
+function validateBoardNodeInput(node, path = "node") {
+	const envelopeResult = nodeEnvelopeSchema.safeParse(node);
+	if (!envelopeResult.success) return envelopeResult.error.issues.map((issue) => issueDiagnostic(issue, path));
+	if (typeof node.type !== "string" || !BOARD_NATIVE_NODE_TYPES.includes(node.type)) return [{
+		severity: "error",
+		code: "INVALID_BOARD_NODE",
+		message: `${path}.type is not supported`,
+		path: `${path}.type`,
+		expected: "BoardNativeNodeType",
+		received: node.type,
+		allowedValues: BOARD_NATIVE_NODE_TYPES
+	}];
+	const type = node.type;
+	const dataResult = dataSchemas[type].safeParse(node.data ?? {});
+	if (!dataResult.success) return dataResult.error.issues.map((issue) => issueDiagnostic(issue, `${path}.data`));
+	const viewResult = viewSchemas[type].safeParse(node.view ?? {});
+	if (!viewResult.success) return viewResult.error.issues.map((issue) => issueDiagnostic(issue, `${path}.view`));
+	if (type === "image" || type === "video" || type === "audio" || type === "file") {
+		if (node.refKind !== "space_file" || typeof node.refPath !== "string" || !node.refPath) return [{
+			severity: "error",
+			code: "INVALID_BOARD_NODE",
+			message: `${path} requires a space file reference`,
+			path: `${path}.refPath`,
+			expected: "non-empty refPath with refKind space_file"
+		}];
+	}
+	if (type === "draw") {
+		const diagnostic = drawGeometryDiagnostic(node, dataResult.data, path);
+		return diagnostic ? [diagnostic] : [];
+	}
+	if (type === "arrow") {
+		const data = dataResult.data;
+		const inside = (point) => point.x >= node.x && point.x <= node.x + node.width && point.y >= node.y && point.y <= node.y + node.height;
+		if (!inside(data.start) || !inside(data.end)) return [{
+			severity: "error",
+			code: "INVALID_BOARD_GEOMETRY",
+			message: `${path}.data endpoints must be covered by the node frame`,
+			path: `${path}.data`,
+			expected: "world-space endpoints inside the node frame",
+			coordinateSpace: "world"
+		}];
+	}
+	return [];
+}
+//#endregion
+export { BOARD_COLOR_IDS, BOARD_GEO_KINDS, BOARD_NATIVE_NODE_TYPES, BoardColorIdSchema, BoardGeoKindSchema, validateBoardNodeInput };

package/dist/protocol/dist/board-url.d.ts

@@ -0,0 +1,12 @@
+import { z } from "zod";
+//#region ../protocol/dist/board-url.d.ts
+declare const BOARD_REMOTE_URL_MAX_LENGTH = 4096;
+/**
+ * Normalize a browser-loadable public HTTP(S) URL. This blocks explicit local
+ * addresses; any future server-side fetcher must additionally validate DNS
+ * resolution to defend against rebinding.
+ */
+declare function normalizeBoardRemoteUrl(value: unknown): string | undefined;
+declare const BoardRemoteUrlSchema: z.ZodString;
+//#endregion
+export { BOARD_REMOTE_URL_MAX_LENGTH, BoardRemoteUrlSchema, normalizeBoardRemoteUrl };

package/dist/protocol/dist/board-url.js

@@ -0,0 +1,83 @@
+import { z } from "zod";
+//#region ../protocol/dist/board-url.js
+const BOARD_REMOTE_URL_MAX_LENGTH = 4096;
+function parseIpv4(host) {
+	const parts = host.split(".").map(Number);
+	return parts.length === 4 && parts.every((part) => Number.isInteger(part) && part >= 0 && part <= 255) ? parts : null;
+}
+function isBlockedIpv4(host) {
+	const parts = parseIpv4(host);
+	if (!parts) return false;
+	const [first, second, third] = parts;
+	if (first === 0 || first === 10 || first === 127) return true;
+	if (first === 100 && second >= 64 && second <= 127) return true;
+	if (first === 169 && second === 254) return true;
+	if (first === 172 && second >= 16 && second <= 31) return true;
+	if (first === 192 && second === 168) return true;
+	if (first === 192 && second === 0 && (third === 0 || third === 2)) return true;
+	if (first === 192 && second === 88 && third === 99) return true;
+	if (first === 198 && (second === 18 || second === 19)) return true;
+	if (first === 198 && second === 51 && third === 100) return true;
+	if (first === 203 && second === 0 && third === 113) return true;
+	return first >= 224;
+}
+function expandIpv6(host) {
+	const [head, tail, extra] = host.toLowerCase().split("::");
+	if (extra !== void 0) return null;
+	const headParts = head ? head.split(":").filter(Boolean) : [];
+	const tailParts = tail ? tail.split(":").filter(Boolean) : [];
+	const missing = 8 - headParts.length - tailParts.length;
+	if (missing < 0 || tail === void 0 && missing !== 0) return null;
+	const parts = [
+		...headParts,
+		...Array.from({ length: missing }, () => "0"),
+		...tailParts
+	];
+	if (parts.length !== 8 || parts.some((part) => !/^[0-9a-f]{1,4}$/.test(part))) return null;
+	return parts.map((part) => part.padStart(4, "0"));
+}
+function isBlockedIpv6(host) {
+	const parts = expandIpv6(host);
+	if (!parts) return true;
+	if (parts.every((part) => part === "0000")) return true;
+	if (parts.slice(0, 7).every((part) => part === "0000") && parts[7] === "0001") return true;
+	if (parts.slice(0, 5).every((part) => part === "0000") && parts[5] === "ffff") {
+		const high = Number.parseInt(parts[6] ?? "0", 16);
+		const low = Number.parseInt(parts[7] ?? "0", 16);
+		return isBlockedIpv4(`${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`);
+	}
+	if (parts.slice(0, 6).every((part) => part === "0000")) return true;
+	const first = Number.parseInt(parts[0] ?? "0", 16);
+	if ((first & 65024) === 64512) return true;
+	if ((first & 65472) === 65152 || (first & 65472) === 65216) return true;
+	if ((first & 65280) === 65280) return true;
+	return parts[0] === "2001" && parts[1] === "0db8";
+}
+function isBlockedHost(hostname) {
+	const host = hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+	if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local") || host.endsWith(".internal")) return true;
+	if (parseIpv4(host)) return isBlockedIpv4(host);
+	return host.includes(":") && isBlockedIpv6(host);
+}
+/**
+* Normalize a browser-loadable public HTTP(S) URL. This blocks explicit local
+* addresses; any future server-side fetcher must additionally validate DNS
+* resolution to defend against rebinding.
+*/
+function normalizeBoardRemoteUrl(value) {
+	if (typeof value !== "string") return void 0;
+	const input = value.trim();
+	if (!input || input.length > 4096) return void 0;
+	try {
+		const url = new URL(input);
+		if (url.protocol !== "https:" && url.protocol !== "http:") return void 0;
+		if (url.username || url.password || isBlockedHost(url.hostname)) return;
+		const normalized = url.toString();
+		return normalized.length <= 4096 ? normalized : void 0;
+	} catch {
+		return;
+	}
+}
+const BoardRemoteUrlSchema = z.string().max(BOARD_REMOTE_URL_MAX_LENGTH).refine((value) => normalizeBoardRemoteUrl(value) !== void 0, { message: "URL must be a public HTTP(S) URL without credentials" });
+//#endregion
+export { BOARD_REMOTE_URL_MAX_LENGTH, BoardRemoteUrlSchema, normalizeBoardRemoteUrl };

package/dist/protocol/dist/board.d.ts

@@ -1,5 +1,6 @@
 import { BoardCapability, BoardRenderCost } from "./board-constants.js";
 import "./board-connection.js";
+import "./board-node.js";
 import { z } from "zod";
 //#region ../protocol/dist/board.d.ts
 declare const BOARD_EXTENSION: ".board";
@@ -176,6 +177,10 @@ type BoardDiagnostic = {
   message: string;
   path?: string;
   adaptation?: Record<string, unknown>;
+  expected?: string;
+  received?: unknown;
+  allowedValues?: readonly string[];
+  coordinateSpace?: "frame-local" | "world";
 };
 type BoardValidationResult = {
   valid: boolean;

package/dist/protocol/dist/index.d.ts

@@ -1,7 +1,8 @@
 import { BoardCapability, BoardRenderCost } from "./board-constants.js";
 import { AUTO_BOARD_CONNECTION_ANCHOR, BOARD_CONNECTION_DIRECTIONS, BOARD_CONNECTION_LINES, BOARD_CONNECTION_ROUTINGS, BOARD_CONNECTION_SIDES, BoardConnection, BoardConnectionAnchor, BoardConnectionAnchorSchema, BoardConnectionDirection, BoardConnectionEndpoint, BoardConnectionEndpointSchema, BoardConnectionInput, BoardConnectionLine, BoardConnectionPatch, BoardConnectionPatchSchema, BoardConnectionRecord, BoardConnectionRouting, BoardConnectionRoutingConfig, BoardConnectionRoutingSchema, BoardConnectionSchema, BoardConnectionSide, BoardConnectionStyle, BoardConnectionStyleSchema, BoardConnectionWaypointSchema, BoardRelationSchema, DEFAULT_BOARD_CONNECTION_ROUTING, DEFAULT_BOARD_CONNECTION_STYLE, DEFAULT_BOARD_RELATION, connectionNodeIds, connectionOtherNodeId, connectionTouchesNode, createBoardConnection, flipBoardConnection, normalizeBoardConnectionStyle } from "./board-connection.js";
+import { BOARD_COLOR_IDS, BOARD_GEO_KINDS, BoardColorId, BoardGeoKind, BoardNodeValidationDiagnostic } from "./board-node.js";
 import { BOARD_DOCUMENT_KIND, BOARD_EXTENSION, BoardAssetRef, BoardAssetRefSchema, BoardClip, BoardClipSchema, BoardDiagnostic, BoardEffect, BoardEffectSchema, BoardManifest, BoardManifestSchema, BoardNodeInput, BoardNodeRecord, BoardRecord, BoardSequence, BoardSequenceSchema, BoardTarget, BoardTargetSchema, BoardValidationResult, InvalidBoardFileError, isBoardPath, parseBoardManifest, serializeBoardManifest } from "./board.js";
 import "./realtime/board-awareness.js";
 import "./work.js";
 import "./realtime/types.js";
-export { AUTO_BOARD_CONNECTION_ANCHOR, BOARD_CONNECTION_DIRECTIONS, BOARD_CONNECTION_LINES, BOARD_CONNECTION_ROUTINGS, BOARD_CONNECTION_SIDES, BOARD_DOCUMENT_KIND, BOARD_EXTENSION, BoardAssetRef, BoardAssetRefSchema, BoardClip, BoardClipSchema, BoardConnection, BoardConnectionAnchor, BoardConnectionAnchorSchema, BoardConnectionDirection, BoardConnectionEndpoint, BoardConnectionEndpointSchema, BoardConnectionInput, BoardConnectionLine, BoardConnectionPatch, BoardConnectionPatchSchema, BoardConnectionRecord, BoardConnectionRouting, BoardConnectionRoutingConfig, BoardConnectionRoutingSchema, BoardConnectionSchema, BoardConnectionSide, BoardConnectionStyle, BoardConnectionStyleSchema, BoardConnectionWaypointSchema, BoardDiagnostic, BoardEffect, BoardEffectSchema, BoardManifest, BoardManifestSchema, BoardNodeInput, BoardNodeRecord, BoardRecord, BoardRelationSchema, BoardSequence, BoardSequenceSchema, BoardTarget, BoardTargetSchema, BoardValidationResult, DEFAULT_BOARD_CONNECTION_ROUTING, DEFAULT_BOARD_CONNECTION_STYLE, DEFAULT_BOARD_RELATION, InvalidBoardFileError, connectionNodeIds, connectionOtherNodeId, connectionTouchesNode, createBoardConnection, flipBoardConnection, isBoardPath, normalizeBoardConnectionStyle, parseBoardManifest, serializeBoardManifest };
+export { AUTO_BOARD_CONNECTION_ANCHOR, BOARD_COLOR_IDS, BOARD_CONNECTION_DIRECTIONS, BOARD_CONNECTION_LINES, BOARD_CONNECTION_ROUTINGS, BOARD_CONNECTION_SIDES, BOARD_DOCUMENT_KIND, BOARD_EXTENSION, BOARD_GEO_KINDS, BoardAssetRef, BoardAssetRefSchema, BoardClip, BoardClipSchema, BoardColorId, BoardConnection, BoardConnectionAnchor, BoardConnectionAnchorSchema, BoardConnectionDirection, BoardConnectionEndpoint, BoardConnectionEndpointSchema, BoardConnectionInput, BoardConnectionLine, BoardConnectionPatch, BoardConnectionPatchSchema, BoardConnectionRecord, BoardConnectionRouting, BoardConnectionRoutingConfig, BoardConnectionRoutingSchema, BoardConnectionSchema, BoardConnectionSide, BoardConnectionStyle, BoardConnectionStyleSchema, BoardConnectionWaypointSchema, BoardDiagnostic, BoardEffect, BoardEffectSchema, BoardGeoKind, BoardManifest, BoardManifestSchema, BoardNodeInput, BoardNodeRecord, BoardNodeValidationDiagnostic, BoardRecord, BoardRelationSchema, BoardSequence, BoardSequenceSchema, BoardTarget, BoardTargetSchema, BoardValidationResult, DEFAULT_BOARD_CONNECTION_ROUTING, DEFAULT_BOARD_CONNECTION_STYLE, DEFAULT_BOARD_RELATION, InvalidBoardFileError, connectionNodeIds, connectionOtherNodeId, connectionTouchesNode, createBoardConnection, flipBoardConnection, isBoardPath, normalizeBoardConnectionStyle, parseBoardManifest, serializeBoardManifest };

package/dist/protocol/dist/index.js

@@ -1,8 +1,9 @@
 import "./board-constants.js";
 import { AUTO_BOARD_CONNECTION_ANCHOR, BOARD_CONNECTION_DIRECTIONS, BOARD_CONNECTION_LINES, BOARD_CONNECTION_ROUTINGS, BOARD_CONNECTION_SIDES, BoardConnectionAnchorSchema, BoardConnectionEndpointSchema, BoardConnectionPatchSchema, BoardConnectionRoutingSchema, BoardConnectionSchema, BoardConnectionStyleSchema, BoardConnectionWaypointSchema, BoardRelationSchema, DEFAULT_BOARD_CONNECTION_ROUTING, DEFAULT_BOARD_CONNECTION_STYLE, DEFAULT_BOARD_RELATION, connectionNodeIds, connectionOtherNodeId, connectionTouchesNode, createBoardConnection, flipBoardConnection, normalizeBoardConnectionStyle } from "./board-connection.js";
 import { BOARD_DOCUMENT_KIND, BOARD_EXTENSION, BOARD_MANIFEST_KIND, BoardAssetRefSchema, BoardClipSchema, BoardEffectSchema, BoardKeyframeSchema, BoardManifestSchema, BoardNodeInputSchema, BoardSequenceSchema, BoardTargetSchema, InvalidBoardFileError, isBoardPath, parseBoardManifest, serializeBoardManifest } from "./board.js";
+import { BOARD_COLOR_IDS, BOARD_GEO_KINDS, BOARD_NATIVE_NODE_TYPES, BoardColorIdSchema, BoardGeoKindSchema, validateBoardNodeInput } from "./board-node.js";
 import { BoardAwarenessDrawPointSchema, BoardAwarenessFrameSchema, BoardAwarenessGestureSchema, BoardAwarenessNodePreviewSchema, BoardAwarenessPointSchema, BoardAwarenessStateUpdateSchema, BoardAwarenessUpdateSchema } from "./realtime/board-awareness.js";
 import { COHUB_SOURCE_HEADER } from "./provenance.js";
 import { RESERVED_PLATFORM_PATH_SEGMENTS } from "./public-identifiers.js";
 import "./work-view-stats.js";
-export { AUTO_BOARD_CONNECTION_ANCHOR, BOARD_CONNECTION_DIRECTIONS, BOARD_CONNECTION_LINES, BOARD_CONNECTION_ROUTINGS, BOARD_CONNECTION_SIDES, BOARD_DOCUMENT_KIND, BOARD_EXTENSION, BOARD_MANIFEST_KIND, BoardAssetRefSchema, BoardAwarenessDrawPointSchema, BoardAwarenessFrameSchema, BoardAwarenessGestureSchema, BoardAwarenessNodePreviewSchema, BoardAwarenessPointSchema, BoardAwarenessStateUpdateSchema, BoardAwarenessUpdateSchema, BoardClipSchema, BoardConnectionAnchorSchema, BoardConnectionEndpointSchema, BoardConnectionPatchSchema, BoardConnectionRoutingSchema, BoardConnectionSchema, BoardConnectionStyleSchema, BoardConnectionWaypointSchema, BoardEffectSchema, BoardKeyframeSchema, BoardManifestSchema, BoardNodeInputSchema, BoardRelationSchema, BoardSequenceSchema, BoardTargetSchema, COHUB_SOURCE_HEADER, DEFAULT_BOARD_CONNECTION_ROUTING, DEFAULT_BOARD_CONNECTION_STYLE, DEFAULT_BOARD_RELATION, InvalidBoardFileError, RESERVED_PLATFORM_PATH_SEGMENTS, connectionNodeIds, connectionOtherNodeId, connectionTouchesNode, createBoardConnection, flipBoardConnection, isBoardPath, normalizeBoardConnectionStyle, parseBoardManifest, serializeBoardManifest };
+export { AUTO_BOARD_CONNECTION_ANCHOR, BOARD_COLOR_IDS, BOARD_CONNECTION_DIRECTIONS, BOARD_CONNECTION_LINES, BOARD_CONNECTION_ROUTINGS, BOARD_CONNECTION_SIDES, BOARD_DOCUMENT_KIND, BOARD_EXTENSION, BOARD_GEO_KINDS, BOARD_MANIFEST_KIND, BOARD_NATIVE_NODE_TYPES, BoardAssetRefSchema, BoardAwarenessDrawPointSchema, BoardAwarenessFrameSchema, BoardAwarenessGestureSchema, BoardAwarenessNodePreviewSchema, BoardAwarenessPointSchema, BoardAwarenessStateUpdateSchema, BoardAwarenessUpdateSchema, BoardClipSchema, BoardColorIdSchema, BoardConnectionAnchorSchema, BoardConnectionEndpointSchema, BoardConnectionPatchSchema, BoardConnectionRoutingSchema, BoardConnectionSchema, BoardConnectionStyleSchema, BoardConnectionWaypointSchema, BoardEffectSchema, BoardGeoKindSchema, BoardKeyframeSchema, BoardManifestSchema, BoardNodeInputSchema, BoardRelationSchema, BoardSequenceSchema, BoardTargetSchema, COHUB_SOURCE_HEADER, DEFAULT_BOARD_CONNECTION_ROUTING, DEFAULT_BOARD_CONNECTION_STYLE, DEFAULT_BOARD_RELATION, InvalidBoardFileError, RESERVED_PLATFORM_PATH_SEGMENTS, connectionNodeIds, connectionOtherNodeId, connectionTouchesNode, createBoardConnection, flipBoardConnection, isBoardPath, normalizeBoardConnectionStyle, parseBoardManifest, serializeBoardManifest, validateBoardNodeInput };

package/dist/protocol/dist/provenance.js

@@ -6,6 +6,7 @@ const COHUB_SOURCE_HEADER = {
 	turn: "X-Cohub-Source-Turn",
 	toolCall: "X-Cohub-Source-Tool-Call",
 	client: "X-Cohub-Source-Client",
+	sandboxVersion: "X-Cohub-Source-Sandbox",
 	via: "X-Cohub-Source-Via"
 };
 Object.values(COHUB_SOURCE_HEADER);

package/docs/work-runtime-guide.md

@@ -218,7 +218,7 @@ result needs `taskrun.view` (a work scope).
 | Read task run detail | `client.tasks.get(taskRunId)` | `taskrun.view` | work |
 | List viewer's spaces | `client.spaces.list()` | `user.space.list` | viewer |
 | List viewer's sessions | `client.user.listSessions()` | `user.session.list` | viewer |
-| Read viewer's usage | `client.user.getUsage()` | `user.usage.read` | viewer |
+| Read viewer's activity | `client.user.getActivity()` | `user.usage.read` | viewer |
 | Commerce: entitlements | `client.work.commerce.getEntitlements()` | *(runtime only, no scope)* | — |
 | Commerce: consume credits | `client.work.commerce.consumeCredits()` | *(runtime only, no scope)* | — |
 | Commerce: purchase | `client.work.commerce.purchase()` | *(runtime only, no scope)* | — |
@@ -280,7 +280,7 @@ when a deployment needs reproducible dependency updates.
 ### Environment detection — critical
 
 The SDK defaults to **production**. A Work running on a dev/staging host
-(e.g. `dev.cohub.run`, a `/dev/` path prefix) **must** pass `env: "dev"`
+(e.g. `dev.cohub.live`, a `/dev/` path prefix) **must** pass `env: "dev"`
 explicitly — browsers do not inject `ENV` like Node does. If you omit this,
 your Work will call the production API while the runtime host expects dev,
 causing silent auth failures.
@@ -304,7 +304,7 @@ iframe), pass the `work` option so the SDK can fall back to broker mode:
 const client = createCohubClient({
   env: isDevWork ? "dev" : "prod",
   work: {
-    brokerOrigin: isDevWork ? "https://dev.cohub.run" : "https://cohub.run",
+    brokerOrigin: isDevWork ? "https://dev.cohub.live" : "https://cohub.live",
     workId: "<your-published-work-id>",
   },
 });
@@ -332,7 +332,7 @@ All three values are known before publishing:
 const client = createCohubClient({
   env: isDevWork ? "dev" : "prod",
   work: {
-    brokerOrigin: isDevWork ? "https://dev.cohub.run" : "https://cohub.run",
+    brokerOrigin: isDevWork ? "https://dev.cohub.live" : "https://cohub.live",
     ownerUsername,
     spaceSlug,
     workSlug,
@@ -618,12 +618,12 @@ await client.auth.request({
 });
 const { sessions } = await client.user.listSessions({ limit: 20 });
 
-// Read aggregated usage — needs user.usage.read
+// Read activity — needs user.usage.read
 await client.auth.request({
   scopes: ["user.usage.read"],
-  reason: "Show your usage summary.",
+  reason: "Show your activity.",
 });
-const usage = await client.user.getUsage(30); // last 30 days
+const activity = await client.user.getActivity({ days: 30 }); // last 30 days
 ```
 
 ### Commerce (`work.commerce`)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neta-art/cohub",
-  "version": "5.6.0",
+  "version": "5.8.0",
   "description": "Cohub SDK for spaces, sessions, boards, and realtime agent collaboration.",
   "license": "Apache-2.0",
   "private": false,