@neta-art/cohub 5.7.0 → 5.8.0

package/dist/protocol/dist/board-url.js

@@ -0,0 +1,83 @@
+import { z } from "zod";
+//#region ../protocol/dist/board-url.js
+const BOARD_REMOTE_URL_MAX_LENGTH = 4096;
+function parseIpv4(host) {
+	const parts = host.split(".").map(Number);
+	return parts.length === 4 && parts.every((part) => Number.isInteger(part) && part >= 0 && part <= 255) ? parts : null;
+}
+function isBlockedIpv4(host) {
+	const parts = parseIpv4(host);
+	if (!parts) return false;
+	const [first, second, third] = parts;
+	if (first === 0 || first === 10 || first === 127) return true;
+	if (first === 100 && second >= 64 && second <= 127) return true;
+	if (first === 169 && second === 254) return true;
+	if (first === 172 && second >= 16 && second <= 31) return true;
+	if (first === 192 && second === 168) return true;
+	if (first === 192 && second === 0 && (third === 0 || third === 2)) return true;
+	if (first === 192 && second === 88 && third === 99) return true;
+	if (first === 198 && (second === 18 || second === 19)) return true;
+	if (first === 198 && second === 51 && third === 100) return true;
+	if (first === 203 && second === 0 && third === 113) return true;
+	return first >= 224;
+}
+function expandIpv6(host) {
+	const [head, tail, extra] = host.toLowerCase().split("::");
+	if (extra !== void 0) return null;
+	const headParts = head ? head.split(":").filter(Boolean) : [];
+	const tailParts = tail ? tail.split(":").filter(Boolean) : [];
+	const missing = 8 - headParts.length - tailParts.length;
+	if (missing < 0 || tail === void 0 && missing !== 0) return null;
+	const parts = [
+		...headParts,
+		...Array.from({ length: missing }, () => "0"),
+		...tailParts
+	];
+	if (parts.length !== 8 || parts.some((part) => !/^[0-9a-f]{1,4}$/.test(part))) return null;
+	return parts.map((part) => part.padStart(4, "0"));
+}
+function isBlockedIpv6(host) {
+	const parts = expandIpv6(host);
+	if (!parts) return true;
+	if (parts.every((part) => part === "0000")) return true;
+	if (parts.slice(0, 7).every((part) => part === "0000") && parts[7] === "0001") return true;
+	if (parts.slice(0, 5).every((part) => part === "0000") && parts[5] === "ffff") {
+		const high = Number.parseInt(parts[6] ?? "0", 16);
+		const low = Number.parseInt(parts[7] ?? "0", 16);
+		return isBlockedIpv4(`${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`);
+	}
+	if (parts.slice(0, 6).every((part) => part === "0000")) return true;
+	const first = Number.parseInt(parts[0] ?? "0", 16);
+	if ((first & 65024) === 64512) return true;
+	if ((first & 65472) === 65152 || (first & 65472) === 65216) return true;
+	if ((first & 65280) === 65280) return true;
+	return parts[0] === "2001" && parts[1] === "0db8";
+}
+function isBlockedHost(hostname) {
+	const host = hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+	if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local") || host.endsWith(".internal")) return true;
+	if (parseIpv4(host)) return isBlockedIpv4(host);
+	return host.includes(":") && isBlockedIpv6(host);
+}
+/**
+* Normalize a browser-loadable public HTTP(S) URL. This blocks explicit local
+* addresses; any future server-side fetcher must additionally validate DNS
+* resolution to defend against rebinding.
+*/
+function normalizeBoardRemoteUrl(value) {
+	if (typeof value !== "string") return void 0;
+	const input = value.trim();
+	if (!input || input.length > 4096) return void 0;
+	try {
+		const url = new URL(input);
+		if (url.protocol !== "https:" && url.protocol !== "http:") return void 0;
+		if (url.username || url.password || isBlockedHost(url.hostname)) return;
+		const normalized = url.toString();
+		return normalized.length <= 4096 ? normalized : void 0;
+	} catch {
+		return;
+	}
+}
+const BoardRemoteUrlSchema = z.string().max(BOARD_REMOTE_URL_MAX_LENGTH).refine((value) => normalizeBoardRemoteUrl(value) !== void 0, { message: "URL must be a public HTTP(S) URL without credentials" });
+//#endregion
+export { BOARD_REMOTE_URL_MAX_LENGTH, BoardRemoteUrlSchema, normalizeBoardRemoteUrl };

package/dist/protocol/dist/board.d.ts

@@ -1,5 +1,6 @@
 import { BoardCapability, BoardRenderCost } from "./board-constants.js";
 import "./board-connection.js";
+import "./board-node.js";
 import { z } from "zod";
 //#region ../protocol/dist/board.d.ts
 declare const BOARD_EXTENSION: ".board";
@@ -176,6 +177,10 @@ type BoardDiagnostic = {
   message: string;
   path?: string;
   adaptation?: Record<string, unknown>;
+  expected?: string;
+  received?: unknown;
+  allowedValues?: readonly string[];
+  coordinateSpace?: "frame-local" | "world";
 };
 type BoardValidationResult = {
   valid: boolean;

package/dist/protocol/dist/index.d.ts

@@ -1,7 +1,8 @@
 import { BoardCapability, BoardRenderCost } from "./board-constants.js";
 import { AUTO_BOARD_CONNECTION_ANCHOR, BOARD_CONNECTION_DIRECTIONS, BOARD_CONNECTION_LINES, BOARD_CONNECTION_ROUTINGS, BOARD_CONNECTION_SIDES, BoardConnection, BoardConnectionAnchor, BoardConnectionAnchorSchema, BoardConnectionDirection, BoardConnectionEndpoint, BoardConnectionEndpointSchema, BoardConnectionInput, BoardConnectionLine, BoardConnectionPatch, BoardConnectionPatchSchema, BoardConnectionRecord, BoardConnectionRouting, BoardConnectionRoutingConfig, BoardConnectionRoutingSchema, BoardConnectionSchema, BoardConnectionSide, BoardConnectionStyle, BoardConnectionStyleSchema, BoardConnectionWaypointSchema, BoardRelationSchema, DEFAULT_BOARD_CONNECTION_ROUTING, DEFAULT_BOARD_CONNECTION_STYLE, DEFAULT_BOARD_RELATION, connectionNodeIds, connectionOtherNodeId, connectionTouchesNode, createBoardConnection, flipBoardConnection, normalizeBoardConnectionStyle } from "./board-connection.js";
+import { BOARD_COLOR_IDS, BOARD_GEO_KINDS, BoardColorId, BoardGeoKind, BoardNodeValidationDiagnostic } from "./board-node.js";
 import { BOARD_DOCUMENT_KIND, BOARD_EXTENSION, BoardAssetRef, BoardAssetRefSchema, BoardClip, BoardClipSchema, BoardDiagnostic, BoardEffect, BoardEffectSchema, BoardManifest, BoardManifestSchema, BoardNodeInput, BoardNodeRecord, BoardRecord, BoardSequence, BoardSequenceSchema, BoardTarget, BoardTargetSchema, BoardValidationResult, InvalidBoardFileError, isBoardPath, parseBoardManifest, serializeBoardManifest } from "./board.js";
 import "./realtime/board-awareness.js";
 import "./work.js";
 import "./realtime/types.js";
-export { AUTO_BOARD_CONNECTION_ANCHOR, BOARD_CONNECTION_DIRECTIONS, BOARD_CONNECTION_LINES, BOARD_CONNECTION_ROUTINGS, BOARD_CONNECTION_SIDES, BOARD_DOCUMENT_KIND, BOARD_EXTENSION, BoardAssetRef, BoardAssetRefSchema, BoardClip, BoardClipSchema, BoardConnection, BoardConnectionAnchor, BoardConnectionAnchorSchema, BoardConnectionDirection, BoardConnectionEndpoint, BoardConnectionEndpointSchema, BoardConnectionInput, BoardConnectionLine, BoardConnectionPatch, BoardConnectionPatchSchema, BoardConnectionRecord, BoardConnectionRouting, BoardConnectionRoutingConfig, BoardConnectionRoutingSchema, BoardConnectionSchema, BoardConnectionSide, BoardConnectionStyle, BoardConnectionStyleSchema, BoardConnectionWaypointSchema, BoardDiagnostic, BoardEffect, BoardEffectSchema, BoardManifest, BoardManifestSchema, BoardNodeInput, BoardNodeRecord, BoardRecord, BoardRelationSchema, BoardSequence, BoardSequenceSchema, BoardTarget, BoardTargetSchema, BoardValidationResult, DEFAULT_BOARD_CONNECTION_ROUTING, DEFAULT_BOARD_CONNECTION_STYLE, DEFAULT_BOARD_RELATION, InvalidBoardFileError, connectionNodeIds, connectionOtherNodeId, connectionTouchesNode, createBoardConnection, flipBoardConnection, isBoardPath, normalizeBoardConnectionStyle, parseBoardManifest, serializeBoardManifest };
+export { AUTO_BOARD_CONNECTION_ANCHOR, BOARD_COLOR_IDS, BOARD_CONNECTION_DIRECTIONS, BOARD_CONNECTION_LINES, BOARD_CONNECTION_ROUTINGS, BOARD_CONNECTION_SIDES, BOARD_DOCUMENT_KIND, BOARD_EXTENSION, BOARD_GEO_KINDS, BoardAssetRef, BoardAssetRefSchema, BoardClip, BoardClipSchema, BoardColorId, BoardConnection, BoardConnectionAnchor, BoardConnectionAnchorSchema, BoardConnectionDirection, BoardConnectionEndpoint, BoardConnectionEndpointSchema, BoardConnectionInput, BoardConnectionLine, BoardConnectionPatch, BoardConnectionPatchSchema, BoardConnectionRecord, BoardConnectionRouting, BoardConnectionRoutingConfig, BoardConnectionRoutingSchema, BoardConnectionSchema, BoardConnectionSide, BoardConnectionStyle, BoardConnectionStyleSchema, BoardConnectionWaypointSchema, BoardDiagnostic, BoardEffect, BoardEffectSchema, BoardGeoKind, BoardManifest, BoardManifestSchema, BoardNodeInput, BoardNodeRecord, BoardNodeValidationDiagnostic, BoardRecord, BoardRelationSchema, BoardSequence, BoardSequenceSchema, BoardTarget, BoardTargetSchema, BoardValidationResult, DEFAULT_BOARD_CONNECTION_ROUTING, DEFAULT_BOARD_CONNECTION_STYLE, DEFAULT_BOARD_RELATION, InvalidBoardFileError, connectionNodeIds, connectionOtherNodeId, connectionTouchesNode, createBoardConnection, flipBoardConnection, isBoardPath, normalizeBoardConnectionStyle, parseBoardManifest, serializeBoardManifest };

package/dist/protocol/dist/index.js

@@ -1,8 +1,9 @@
 import "./board-constants.js";
 import { AUTO_BOARD_CONNECTION_ANCHOR, BOARD_CONNECTION_DIRECTIONS, BOARD_CONNECTION_LINES, BOARD_CONNECTION_ROUTINGS, BOARD_CONNECTION_SIDES, BoardConnectionAnchorSchema, BoardConnectionEndpointSchema, BoardConnectionPatchSchema, BoardConnectionRoutingSchema, BoardConnectionSchema, BoardConnectionStyleSchema, BoardConnectionWaypointSchema, BoardRelationSchema, DEFAULT_BOARD_CONNECTION_ROUTING, DEFAULT_BOARD_CONNECTION_STYLE, DEFAULT_BOARD_RELATION, connectionNodeIds, connectionOtherNodeId, connectionTouchesNode, createBoardConnection, flipBoardConnection, normalizeBoardConnectionStyle } from "./board-connection.js";
 import { BOARD_DOCUMENT_KIND, BOARD_EXTENSION, BOARD_MANIFEST_KIND, BoardAssetRefSchema, BoardClipSchema, BoardEffectSchema, BoardKeyframeSchema, BoardManifestSchema, BoardNodeInputSchema, BoardSequenceSchema, BoardTargetSchema, InvalidBoardFileError, isBoardPath, parseBoardManifest, serializeBoardManifest } from "./board.js";
+import { BOARD_COLOR_IDS, BOARD_GEO_KINDS, BOARD_NATIVE_NODE_TYPES, BoardColorIdSchema, BoardGeoKindSchema, validateBoardNodeInput } from "./board-node.js";
 import { BoardAwarenessDrawPointSchema, BoardAwarenessFrameSchema, BoardAwarenessGestureSchema, BoardAwarenessNodePreviewSchema, BoardAwarenessPointSchema, BoardAwarenessStateUpdateSchema, BoardAwarenessUpdateSchema } from "./realtime/board-awareness.js";
 import { COHUB_SOURCE_HEADER } from "./provenance.js";
 import { RESERVED_PLATFORM_PATH_SEGMENTS } from "./public-identifiers.js";
 import "./work-view-stats.js";
-export { AUTO_BOARD_CONNECTION_ANCHOR, BOARD_CONNECTION_DIRECTIONS, BOARD_CONNECTION_LINES, BOARD_CONNECTION_ROUTINGS, BOARD_CONNECTION_SIDES, BOARD_DOCUMENT_KIND, BOARD_EXTENSION, BOARD_MANIFEST_KIND, BoardAssetRefSchema, BoardAwarenessDrawPointSchema, BoardAwarenessFrameSchema, BoardAwarenessGestureSchema, BoardAwarenessNodePreviewSchema, BoardAwarenessPointSchema, BoardAwarenessStateUpdateSchema, BoardAwarenessUpdateSchema, BoardClipSchema, BoardConnectionAnchorSchema, BoardConnectionEndpointSchema, BoardConnectionPatchSchema, BoardConnectionRoutingSchema, BoardConnectionSchema, BoardConnectionStyleSchema, BoardConnectionWaypointSchema, BoardEffectSchema, BoardKeyframeSchema, BoardManifestSchema, BoardNodeInputSchema, BoardRelationSchema, BoardSequenceSchema, BoardTargetSchema, COHUB_SOURCE_HEADER, DEFAULT_BOARD_CONNECTION_ROUTING, DEFAULT_BOARD_CONNECTION_STYLE, DEFAULT_BOARD_RELATION, InvalidBoardFileError, RESERVED_PLATFORM_PATH_SEGMENTS, connectionNodeIds, connectionOtherNodeId, connectionTouchesNode, createBoardConnection, flipBoardConnection, isBoardPath, normalizeBoardConnectionStyle, parseBoardManifest, serializeBoardManifest };
+export { AUTO_BOARD_CONNECTION_ANCHOR, BOARD_COLOR_IDS, BOARD_CONNECTION_DIRECTIONS, BOARD_CONNECTION_LINES, BOARD_CONNECTION_ROUTINGS, BOARD_CONNECTION_SIDES, BOARD_DOCUMENT_KIND, BOARD_EXTENSION, BOARD_GEO_KINDS, BOARD_MANIFEST_KIND, BOARD_NATIVE_NODE_TYPES, BoardAssetRefSchema, BoardAwarenessDrawPointSchema, BoardAwarenessFrameSchema, BoardAwarenessGestureSchema, BoardAwarenessNodePreviewSchema, BoardAwarenessPointSchema, BoardAwarenessStateUpdateSchema, BoardAwarenessUpdateSchema, BoardClipSchema, BoardColorIdSchema, BoardConnectionAnchorSchema, BoardConnectionEndpointSchema, BoardConnectionPatchSchema, BoardConnectionRoutingSchema, BoardConnectionSchema, BoardConnectionStyleSchema, BoardConnectionWaypointSchema, BoardEffectSchema, BoardGeoKindSchema, BoardKeyframeSchema, BoardManifestSchema, BoardNodeInputSchema, BoardRelationSchema, BoardSequenceSchema, BoardTargetSchema, COHUB_SOURCE_HEADER, DEFAULT_BOARD_CONNECTION_ROUTING, DEFAULT_BOARD_CONNECTION_STYLE, DEFAULT_BOARD_RELATION, InvalidBoardFileError, RESERVED_PLATFORM_PATH_SEGMENTS, connectionNodeIds, connectionOtherNodeId, connectionTouchesNode, createBoardConnection, flipBoardConnection, isBoardPath, normalizeBoardConnectionStyle, parseBoardManifest, serializeBoardManifest, validateBoardNodeInput };

package/dist/protocol/dist/provenance.js

@@ -6,6 +6,7 @@ const COHUB_SOURCE_HEADER = {
 	turn: "X-Cohub-Source-Turn",
 	toolCall: "X-Cohub-Source-Tool-Call",
 	client: "X-Cohub-Source-Client",
+	sandboxVersion: "X-Cohub-Source-Sandbox",
 	via: "X-Cohub-Source-Via"
 };
 Object.values(COHUB_SOURCE_HEADER);

package/docs/work-runtime-guide.md

@@ -218,7 +218,7 @@ result needs `taskrun.view` (a work scope).
 | Read task run detail | `client.tasks.get(taskRunId)` | `taskrun.view` | work |
 | List viewer's spaces | `client.spaces.list()` | `user.space.list` | viewer |
 | List viewer's sessions | `client.user.listSessions()` | `user.session.list` | viewer |
-| Read viewer's usage | `client.user.getUsage()` | `user.usage.read` | viewer |
+| Read viewer's activity | `client.user.getActivity()` | `user.usage.read` | viewer |
 | Commerce: entitlements | `client.work.commerce.getEntitlements()` | *(runtime only, no scope)* | — |
 | Commerce: consume credits | `client.work.commerce.consumeCredits()` | *(runtime only, no scope)* | — |
 | Commerce: purchase | `client.work.commerce.purchase()` | *(runtime only, no scope)* | — |
@@ -280,7 +280,7 @@ when a deployment needs reproducible dependency updates.
 ### Environment detection — critical
 
 The SDK defaults to **production**. A Work running on a dev/staging host
-(e.g. `dev.cohub.run`, a `/dev/` path prefix) **must** pass `env: "dev"`
+(e.g. `dev.cohub.live`, a `/dev/` path prefix) **must** pass `env: "dev"`
 explicitly — browsers do not inject `ENV` like Node does. If you omit this,
 your Work will call the production API while the runtime host expects dev,
 causing silent auth failures.
@@ -304,7 +304,7 @@ iframe), pass the `work` option so the SDK can fall back to broker mode:
 const client = createCohubClient({
   env: isDevWork ? "dev" : "prod",
   work: {
-    brokerOrigin: isDevWork ? "https://dev.cohub.run" : "https://cohub.run",
+    brokerOrigin: isDevWork ? "https://dev.cohub.live" : "https://cohub.live",
     workId: "<your-published-work-id>",
   },
 });
@@ -332,7 +332,7 @@ All three values are known before publishing:
 const client = createCohubClient({
   env: isDevWork ? "dev" : "prod",
   work: {
-    brokerOrigin: isDevWork ? "https://dev.cohub.run" : "https://cohub.run",
+    brokerOrigin: isDevWork ? "https://dev.cohub.live" : "https://cohub.live",
     ownerUsername,
     spaceSlug,
     workSlug,
@@ -618,12 +618,12 @@ await client.auth.request({
 });
 const { sessions } = await client.user.listSessions({ limit: 20 });
 
-// Read aggregated usage — needs user.usage.read
+// Read activity — needs user.usage.read
 await client.auth.request({
   scopes: ["user.usage.read"],
-  reason: "Show your usage summary.",
+  reason: "Show your activity.",
 });
-const usage = await client.user.getUsage(30); // last 30 days
+const activity = await client.user.getActivity({ days: 30 }); // last 30 days
 ```
 
 ### Commerce (`work.commerce`)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neta-art/cohub",
-  "version": "5.7.0",
+  "version": "5.8.0",
   "description": "Cohub SDK for spaces, sessions, boards, and realtime agent collaboration.",
   "license": "Apache-2.0",
   "private": false,