@pikku/core 0.12.137 → 0.12.139

package/dist/services/scoped-content-service.js

@@ -0,0 +1,171 @@
+const MAX_DECODE_PASSES = 4;
+const denied = (value) => {
+    throw new Error(`Access denied to content path: ${value}`);
+};
+const decoded = (value) => {
+    const passes = [value];
+    let current = value;
+    for (let i = 0; i < MAX_DECODE_PASSES; i++) {
+        let next;
+        try {
+            next = decodeURIComponent(current);
+        }
+        catch {
+            return denied(value);
+        }
+        if (next === current)
+            return passes;
+        passes.push(next);
+        current = next;
+    }
+    return denied(value);
+};
+export const normaliseContentPath = (value) => {
+    for (const pass of decoded(value)) {
+        if (pass.includes('\0'))
+            denied(value);
+        if (pass.startsWith('/') || pass.startsWith('\\'))
+            denied(value);
+        for (const segment of pass.split(/[\\/]/)) {
+            if (segment === '..' || segment === '.')
+                denied(value);
+        }
+    }
+    const segments = value.split('/').filter((segment) => segment !== '');
+    return segments.join('/');
+};
+const under = (path, prefix) => path === prefix || path.startsWith(`${prefix}/`);
+const join = (...parts) => parts.filter((part) => part !== '').join('/');
+/**
+ * A `ContentService` narrowed to one folder of the store.
+ *
+ * Whatever bucket the addon names lands under `<root>/<bucket>`, and the keys
+ * and buckets it passes are refused if they climb out. Starting a bucket with
+ * `@` names a path from the root of the store instead, which only works under
+ * a prefix the host granted: `read` allows reads and signed downloads, `write`
+ * adds uploads, writes and deletes, and the longest matching prefix decides.
+ * `signURL` and `copyFile` take a finished URL or a local filesystem path, so
+ * neither can be narrowed to a folder and both are refused.
+ */
+export class ScopedContentService {
+    content;
+    root;
+    grants;
+    constructor(content, root, grants = {}) {
+        this.content = content;
+        this.root = normaliseContentPath(root);
+        if (!this.root)
+            denied(root);
+        this.grants = Object.entries(grants)
+            .map(([prefix, mode]) => {
+            const clean = normaliseContentPath(prefix);
+            if (!clean)
+                denied(prefix);
+            if (mode !== 'read' && mode !== 'write') {
+                throw new Error(`Content grant '${prefix}' must be 'read' or 'write'`);
+            }
+            return [clean, mode];
+        })
+            .sort(([a], [b]) => b.length - a.length);
+    }
+    resolve(bucket, key, need) {
+        const cleanKey = normaliseContentPath(key);
+        return this.resolveClean(bucket, cleanKey, need);
+    }
+    resolveClean(bucket, cleanKey, need) {
+        if (!bucket.startsWith('@')) {
+            return {
+                bucket: join(this.root, normaliseContentPath(bucket)),
+                key: cleanKey,
+            };
+        }
+        const path = normaliseContentPath(bucket.slice(1));
+        const full = join(path, cleanKey);
+        if (under(full, this.root))
+            return { bucket: path, key: cleanKey };
+        const grant = this.grants.find(([prefix]) => under(full, prefix));
+        if (!grant || (need === 'write' && grant[1] !== 'write')) {
+            return denied(bucket);
+        }
+        return { bucket: path, key: cleanKey };
+    }
+    async signContentKey(args) {
+        const { bucket, key } = this.resolve(args.bucket, args.contentKey, 'read');
+        return this.content.signContentKey({ ...args, bucket, contentKey: key });
+    }
+    async signURL(_args) {
+        throw new Error('signURL is not allowed in scoped content service');
+    }
+    async getUploadURL(args) {
+        const { bucket, key } = this.resolve(args.bucket, args.fileKey, 'write');
+        return this.content.getUploadURL({ ...args, bucket, fileKey: key });
+    }
+    async deleteFile(args) {
+        const { bucket, key } = this.resolve(args.bucket, args.key, 'write');
+        return this.content.deleteFile({ ...args, bucket, key });
+    }
+    async writeFile(args) {
+        const { bucket, key } = this.resolve(args.bucket, args.key, 'write');
+        return this.content.writeFile({ ...args, bucket, key });
+    }
+    async copyFile(_args) {
+        throw new Error('copyFile is not allowed in scoped content service');
+    }
+    async readFile(args) {
+        const { bucket, key } = this.resolve(args.bucket, args.key, 'read');
+        return this.content.readFile({ ...args, bucket, key });
+    }
+    async readFileAsBuffer(args) {
+        const { bucket, key } = this.resolve(args.bucket, args.key, 'read');
+        return this.content.readFileAsBuffer({ ...args, bucket, key });
+    }
+    async getDownloadURL(args) {
+        const { bucket, key } = this.resolve(args.bucket, args.key, 'read');
+        return this.content.getDownloadURL({ ...args, bucket, key });
+    }
+    async deleteByPrefix(bucket, prefix, visibility) {
+        const keys = await this.keysUnder(bucket, prefix, 'write', visibility);
+        const target = this.resolvePrefix(bucket, prefix, 'write');
+        let deleted = 0;
+        for (const key of keys) {
+            if (await this.content.deleteFile({
+                bucket: target.bucket,
+                key,
+                visibility,
+            })) {
+                deleted++;
+            }
+        }
+        return deleted;
+    }
+    async listFilesByPrefix(bucket, prefix, visibility) {
+        return this.keysUnder(bucket, prefix, 'read', visibility);
+    }
+    async keysUnder(bucket, prefix, need, visibility) {
+        const target = this.resolvePrefix(bucket, prefix, need);
+        const keys = await this.content.listFilesByPrefix(target.bucket, target.prefix, visibility);
+        if (!bucket.startsWith('@'))
+            return keys;
+        return keys.filter((key) => {
+            try {
+                this.resolveClean(bucket, normaliseContentPath(key), need);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        });
+    }
+    resolvePrefix(bucket, prefix, need) {
+        const clean = normaliseContentPath(prefix);
+        const cleanPrefix = clean && prefix.endsWith('/') ? `${clean}/` : clean;
+        if (!bucket.startsWith('@')) {
+            return {
+                bucket: join(this.root, normaliseContentPath(bucket)),
+                prefix: cleanPrefix,
+            };
+        }
+        const resolved = this.resolveClean(bucket, clean, need);
+        return { bucket: resolved.bucket, prefix: cleanPrefix };
+    }
+}

package/dist/services/webhook-service.d.ts

@@ -87,9 +87,9 @@ export declare const DEFAULT_WEBHOOK_RETRIES = 3;
 export declare abstract class WebhookService {
     abstract send<T extends SendWebhookInput>(input: Safe<T>): Promise<SendWebhookResult>;
     /** Produces the header value, `sha256=<hex>`, not the bare digest. */
-    protected sign(secret: string, body: string): string;
+    protected sign(secret: string, body: string): Promise<string>;
     /** Public because receivers verify with it; they share the signing scheme. */
-    verify(secret: string, signature: string, body: string): boolean;
+    verify(secret: string, signature: string, body: string): Promise<boolean>;
     /**
      * The three methods below are optional capability: the default queue-only
      * service keeps no history, and a store-backed implementation (e.g.

package/dist/services/webhook-service.js

@@ -5,12 +5,14 @@ export const DEFAULT_WEBHOOK_SIGNATURE_HEADER = 'X-Pikku-Signature';
 export const DEFAULT_WEBHOOK_RETRIES = 3;
 export class WebhookService {
     /** Produces the header value, `sha256=<hex>`, not the bare digest. */
-    sign(secret, body) {
-        return `sha256=${hmacSha256Hex(secret, body)}`;
+    async sign(secret, body) {
+        return `sha256=${await hmacSha256Hex(secret, body)}`;
     }
     /** Public because receivers verify with it; they share the signing scheme. */
-    verify(secret, signature, body) {
-        return timingSafeStringEqual(this.sign(secret, body), signature);
+    async verify(secret, signature, body) {
+        if (!secret || !signature)
+            return false;
+        return timingSafeStringEqual(await this.sign(secret, body), signature);
     }
     /**
      * The three methods below are optional capability: the default queue-only

package/dist/types/core.types.d.ts

@@ -1,3 +1,4 @@
+import type { AbortScope } from '../function/abort-scope.js';
 import type { IncomingWebhookService } from '../services/incoming-webhook-service.js';
 import type { TriggerSourceStore } from '../services/trigger-source-store.js';
 import type { LeaseService } from '../services/lease-service.js';
@@ -287,7 +288,15 @@ export type PikkuWire<In = unknown, Out = unknown, HasInitialSession extends boo
     beginChanges: () => Promise<void>;
 }>;
 /** Wire as constructed by runners, before the function runner adds `rpc` and the credential readers. */
-export type PikkuRawWire = Omit<PikkuWire, 'rpc' | 'getCredential' | 'getCredentials'> & Partial<Pick<PikkuWire, 'getCredential' | 'getCredentials'>>;
+export type PikkuRawWire = Omit<PikkuWire, 'rpc' | 'getCredential' | 'getCredentials'> & Partial<Pick<PikkuWire, 'getCredential' | 'getCredentials'>> & {
+    /**
+     * Whether whatever asked for this work is still there. Set by wirings that
+     * can be abandoned (an interrupted agent run); the function runner binds
+     * `wire.beginChanges` to it. Carried through nested `rpc` calls by the
+     * wire spread, so a sub-call observes the same scope.
+     */
+    abortScope?: AbortScope;
+};
 export type CoreServices<SingletonServices = CoreSingletonServices> = SingletonServices;
 /** Strips `secrets` from a services type. */
 export type SecretlessServices<Services> = Omit<Services, 'secrets'>;

package/dist/types/state.types.d.ts

@@ -42,6 +42,8 @@ export interface PikkuPackageState {
             expose?: boolean | string[];
             /** Required of every function in this package, on top of the function's own */
             scopes?: string[];
+            /** Addons this instance may call: the package it was written against -> the namespace it is wired under here */
+            uses?: Record<string, string>;
             /** Per-instance name-aliases: logical name the addon reads -> actual project secret name */
             secretOverrides?: Record<string, string>;
             /** Per-instance name-aliases: logical name the addon reads -> actual project variable name */
@@ -56,6 +58,12 @@ export interface PikkuPackageState {
             globalSecrets?: string;
             /** Why this instance gets the whole `CredentialService` rather than one scoped to its declared credentials */
             globalCredentials?: string;
+            /** The folder of the content store this instance owns; defaults to its wired name */
+            contentBucket?: string;
+            /** Paths outside its own folder this instance may read or write, by path prefix */
+            contentGrants?: Record<string, 'read' | 'write'>;
+            /** Why this instance gets the whole `ContentService` rather than one scoped to its folder */
+            globalContent?: string;
             /** Set by `wireRemoteAddon`: this namespace is consumed remotely over HTTP, not bundled */
             remote?: boolean;
             /** Remote host base URL (wireRemoteAddon) — string or resolver over singleton services */

package/dist/utils/hmac.d.ts

@@ -1,22 +1,37 @@
 /**
- * HMAC-SHA256 of a payload, hex-encoded. Senders wrap this in their own scheme
- * prefix (`sha256=`, `v0=`, …).
+ * Web Crypto only: no `node:crypto` and no `Buffer`, so this loads on edge
+ * runtimes. Web Crypto is async, so everything that touches a key returns a
+ * Promise; `timingSafeStringEqual` is plain JS and stays synchronous.
  */
-export declare function hmacSha256Hex(secret: string, payload: string): string;
 /**
- * Constant-time signature comparison. Returns false on a length mismatch,
- * where `timingSafeEqual` itself throws.
+ * Constant-time string comparison (pure JS; for opaque tokens, not HMACs, which
+ * `verifyHmacSignature` checks with Web Crypto). Returns false on a length mismatch
+ * (the lengths of the two values are not secret).
  */
 export declare function timingSafeStringEqual(a: string, b: string): boolean;
 export type WebhookPayload = string | Uint8Array;
 export type HmacAlgorithm = 'sha1' | 'sha256' | 'sha512';
 export type SecretEncoding = 'utf8' | 'hex' | 'base64';
+/**
+ * HMAC-SHA256 of a payload, hex-encoded. Senders wrap this in their own scheme
+ * prefix (`sha256=`, `v0=`, …).
+ */
+export declare function hmacSha256Hex(secret: string, payload: string): Promise<string>;
 /** The HMAC of `payload` under `secret`, for handshakes that answer with a digest. */
-export declare function hmacDigest(secret: string, algorithm: HmacAlgorithm, payload: WebhookPayload, encoding: 'hex' | 'base64', secretEncoding?: SecretEncoding): string;
-/** Whether `signature` is the HMAC of `payload` under `secret`, compared in constant time. */
-export declare function verifyHmacSignature(secret: string, signature: string | undefined, algorithm: HmacAlgorithm, payload: WebhookPayload, encoding: 'hex' | 'base64', secretEncoding?: SecretEncoding): boolean;
-/** Whether `signature` (base64) is `payload` signed by the private half of `publicKey` (PEM). */
+export declare function hmacDigest(secret: string, algorithm: HmacAlgorithm, payload: WebhookPayload, encoding: 'hex' | 'base64', secretEncoding?: SecretEncoding): Promise<string>;
+/**
+ * Whether `signature` is the HMAC of `payload` under `secret`. Fails closed on
+ * an empty secret (or one that decodes to an empty key) and on a missing or
+ * malformed signature. The comparison is `crypto.subtle.verify('HMAC', ...)`,
+ * so it runs in the platform's constant-time implementation.
+ */
+export declare function verifyHmacSignature(secret: string, signature: string | undefined, algorithm: HmacAlgorithm, payload: WebhookPayload, encoding: 'hex' | 'base64', secretEncoding?: SecretEncoding): Promise<boolean>;
+/**
+ * Whether `signature` (base64) is `payload` signed by the private half of
+ * `publicKey` (an RSA, EC or Ed25519 PEM `SPKI` key). RSA-PSS keys are not
+ * supported and verify as false. Ed25519 ignores `algorithm` and `dsaEncoding`.
+ */
 export declare function verifyPublicKeySignature(publicKey: string, signature: string | undefined, payload: WebhookPayload, options?: {
     algorithm?: string;
     dsaEncoding?: 'der' | 'ieee-p1363';
-}): boolean;
+}): Promise<boolean>;

package/dist/utils/hmac.js

@@ -1,42 +1,220 @@
-import { createHmac, createVerify, timingSafeEqual } from 'node:crypto';
+/**
+ * Web Crypto only: no `node:crypto` and no `Buffer`, so this loads on edge
+ * runtimes. Web Crypto is async, so everything that touches a key returns a
+ * Promise; `timingSafeStringEqual` is plain JS and stays synchronous.
+ */
+const encoder = new TextEncoder();
+const subtle = () => {
+    const s = globalThis.crypto?.subtle;
+    if (!s)
+        throw new Error('WebCrypto not available');
+    return s;
+};
+const bytesToHex = (bytes) => {
+    let out = '';
+    for (const b of bytes)
+        out += b.toString(16).padStart(2, '0');
+    return out;
+};
+const bytesToBase64 = (bytes) => {
+    let binary = '';
+    for (const b of bytes)
+        binary += String.fromCharCode(b);
+    return btoa(binary);
+};
+/** Lenient like Node's `Buffer.from(_, 'hex')`: stops at the first bad pair. */
+const hexToBytes = (hex) => {
+    const out = [];
+    for (let i = 0; i + 1 < hex.length; i += 2) {
+        const pair = hex.slice(i, i + 2);
+        if (!/^[0-9a-fA-F]{2}$/.test(pair))
+            break;
+        out.push(parseInt(pair, 16));
+    }
+    return Uint8Array.from(out);
+};
+/** Lenient like Node's `Buffer.from(_, 'base64')`: accepts base64url, ignores junk. */
+const base64ToBytes = (value) => {
+    let clean = value
+        .replace(/-/g, '+')
+        .replace(/_/g, '/')
+        .replace(/[^A-Za-z0-9+/]/g, '');
+    if (clean.length % 4 === 1)
+        clean = clean.slice(0, -1);
+    clean += '='.repeat((4 - (clean.length % 4)) % 4);
+    const binary = atob(clean);
+    const out = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        out[i] = binary.charCodeAt(i);
+    return out;
+};
+/**
+ * Constant-time string comparison (pure JS; for opaque tokens, not HMACs, which
+ * `verifyHmacSignature` checks with Web Crypto). Returns false on a length mismatch
+ * (the lengths of the two values are not secret).
+ */
+export function timingSafeStringEqual(a, b) {
+    const left = encoder.encode(a);
+    const right = encoder.encode(b);
+    if (left.length !== right.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < left.length; i++)
+        diff |= left[i] ^ right[i];
+    return diff === 0;
+}
+const HMAC_HASH = {
+    sha1: 'SHA-1',
+    sha256: 'SHA-256',
+    sha512: 'SHA-512',
+};
+const rawSecretBytes = (secret, encoding) => encoding === 'hex'
+    ? hexToBytes(secret)
+    : encoding === 'base64'
+        ? base64ToBytes(secret)
+        : encoder.encode(secret);
+const secretBytes = (secret, encoding) => {
+    const bytes = rawSecretBytes(secret, encoding);
+    // Web Crypto refuses a zero-length key. HMAC zero-pads the key to the block
+    // size, so a single zero byte is the same key as an empty one. Only signing
+    // reaches here: verification refuses an empty key outright.
+    return bytes.length ? bytes : new Uint8Array(1);
+};
+const hmacBytes = async (secret, algorithm, payload, secretEncoding = 'utf8') => {
+    const hash = HMAC_HASH[algorithm];
+    if (!hash)
+        throw new Error(`Unsupported HMAC algorithm '${algorithm}'`);
+    const key = await subtle().importKey('raw', secretBytes(secret, secretEncoding), { name: 'HMAC', hash }, false, ['sign']);
+    const data = typeof payload === 'string' ? encoder.encode(payload) : payload;
+    return new Uint8Array(await subtle().sign('HMAC', key, data));
+};
 /**
  * HMAC-SHA256 of a payload, hex-encoded. Senders wrap this in their own scheme
  * prefix (`sha256=`, `v0=`, …).
  */
-export function hmacSha256Hex(secret, payload) {
-    return createHmac('sha256', secret).update(payload).digest('hex');
+export async function hmacSha256Hex(secret, payload) {
+    return bytesToHex(await hmacBytes(secret, 'sha256', payload));
+}
+/** The HMAC of `payload` under `secret`, for handshakes that answer with a digest. */
+export async function hmacDigest(secret, algorithm, payload, encoding, secretEncoding = 'utf8') {
+    const digest = await hmacBytes(secret, algorithm, payload, secretEncoding);
+    return encoding === 'hex' ? bytesToHex(digest) : bytesToBase64(digest);
 }
 /**
- * Constant-time signature comparison. Returns false on a length mismatch,
- * where `timingSafeEqual` itself throws.
+ * Whether `signature` is the HMAC of `payload` under `secret`. Fails closed on
+ * an empty secret (or one that decodes to an empty key) and on a missing or
+ * malformed signature. The comparison is `crypto.subtle.verify('HMAC', ...)`,
+ * so it runs in the platform's constant-time implementation.
  */
-export function timingSafeStringEqual(a, b) {
+export async function verifyHmacSignature(secret, signature, algorithm, payload, encoding, secretEncoding = 'utf8') {
+    if (!secret || !signature)
+        return false;
     try {
-        return timingSafeEqual(Buffer.from(a), Buffer.from(b));
+        const hash = HMAC_HASH[algorithm];
+        if (!hash)
+            return false;
+        const keyBytes = rawSecretBytes(secret, secretEncoding);
+        if (!keyBytes.length)
+            return false;
+        if (encoding === 'hex' && !/^(?:[0-9a-fA-F]{2})+$/.test(signature)) {
+            return false;
+        }
+        const sig = encoding === 'hex' ? hexToBytes(signature) : base64ToBytes(signature);
+        if (!sig.length)
+            return false;
+        const key = await subtle().importKey('raw', keyBytes, { name: 'HMAC', hash }, false, ['verify']);
+        const data = typeof payload === 'string' ? encoder.encode(payload) : payload;
+        return await subtle().verify('HMAC', key, sig, data);
     }
     catch {
         return false;
     }
 }
-/** The HMAC of `payload` under `secret`, for handshakes that answer with a digest. */
-export function hmacDigest(secret, algorithm, payload, encoding, secretEncoding = 'utf8') {
-    return createHmac(algorithm, Buffer.from(secret, secretEncoding))
-        .update(payload)
-        .digest(encoding);
-}
-/** Whether `signature` is the HMAC of `payload` under `secret`, compared in constant time. */
-export function verifyHmacSignature(secret, signature, algorithm, payload, encoding, secretEncoding = 'utf8') {
-    return (!!signature &&
-        timingSafeStringEqual(signature, hmacDigest(secret, algorithm, payload, encoding, secretEncoding)));
-}
-/** Whether `signature` (base64) is `payload` signed by the private half of `publicKey` (PEM). */
-export function verifyPublicKeySignature(publicKey, signature, payload, options = {}) {
-    if (!signature)
+// DER prefixes of the SPKI algorithm identifiers we can import.
+const OID_RSA = '06092a864886f70d010101';
+const OID_EC = '06072a8648ce3d0201';
+const OID_ED25519 = '06032b6570';
+const EC_CURVES = {
+    '06082a8648ce3d030107': { name: 'P-256', size: 32 },
+    '06052b81040022': { name: 'P-384', size: 48 },
+    '06052b81040023': { name: 'P-521', size: 66 },
+};
+const SIGNATURE_HASH = {
+    sha1: 'SHA-1',
+    sha256: 'SHA-256',
+    sha384: 'SHA-384',
+    sha512: 'SHA-512',
+};
+const pemToDer = (pem) => base64ToBytes(pem.replace(/-----[A-Z ]+-----/g, '').replace(/\s+/g, ''));
+/** Reads an ASN.1 DER length at `offset`; returns [length, bytesUsed]. */
+const readLength = (der, offset) => {
+    const first = der[offset];
+    if (first < 0x80)
+        return [first, 1];
+    const count = first & 0x7f;
+    let length = 0;
+    for (let i = 0; i < count; i++)
+        length = (length << 8) | der[offset + 1 + i];
+    return [length, 1 + count];
+};
+/** An ECDSA signature as DER `SEQUENCE { r, s }` to the fixed-width `r || s` Web Crypto expects. */
+const derToP1363 = (der, size) => {
+    if (der[0] !== 0x30)
+        throw new Error('Invalid DER signature');
+    let offset = 1 + readLength(der, 1)[1];
+    const out = new Uint8Array(size * 2);
+    for (let part = 0; part < 2; part++) {
+        if (der[offset] !== 0x02)
+            throw new Error('Invalid DER signature');
+        const [length, used] = readLength(der, offset + 1);
+        let integer = der.slice(offset + 1 + used, offset + 1 + used + length);
+        while (integer.length > size && integer[0] === 0)
+            integer = integer.slice(1);
+        if (integer.length > size)
+            throw new Error('Invalid DER signature');
+        out.set(integer, part * size + (size - integer.length));
+        offset += 1 + used + length;
+    }
+    return out;
+};
+/**
+ * Whether `signature` (base64) is `payload` signed by the private half of
+ * `publicKey` (an RSA, EC or Ed25519 PEM `SPKI` key). RSA-PSS keys are not
+ * supported and verify as false. Ed25519 ignores `algorithm` and `dsaEncoding`.
+ */
+export async function verifyPublicKeySignature(publicKey, signature, payload, options = {}) {
+    if (!publicKey || !signature)
         return false;
     try {
-        return createVerify(options.algorithm ?? 'sha256')
-            .update(payload)
-            .verify({ key: publicKey, dsaEncoding: options.dsaEncoding }, signature, 'base64');
+        const der0 = pemToDer(publicKey);
+        if (bytesToHex(der0).includes(OID_ED25519)) {
+            const key = await subtle().importKey('spki', der0, { name: 'Ed25519' }, false, ['verify']);
+            return await subtle().verify({ name: 'Ed25519' }, key, base64ToBytes(signature), (typeof payload === 'string'
+                ? encoder.encode(payload)
+                : payload));
+        }
+        const hash = SIGNATURE_HASH[(options.algorithm ?? 'sha256')
+            .toLowerCase()
+            .replace(/^rsa-/, '')
+            .replace(/-/g, '')];
+        if (!hash)
+            return false;
+        const der = pemToDer(publicKey);
+        const hex = bytesToHex(der);
+        const data = typeof payload === 'string' ? encoder.encode(payload) : payload;
+        const sig = base64ToBytes(signature);
+        if (hex.includes(OID_RSA)) {
+            const key = await subtle().importKey('spki', der, { name: 'RSASSA-PKCS1-v1_5', hash }, false, ['verify']);
+            return await subtle().verify('RSASSA-PKCS1-v1_5', key, sig, data);
+        }
+        const curve = hex.includes(OID_EC)
+            ? Object.entries(EC_CURVES).find(([oid]) => hex.includes(oid))?.[1]
+            : undefined;
+        if (!curve)
+            return false;
+        const key = await subtle().importKey('spki', der, { name: 'ECDSA', namedCurve: curve.name }, false, ['verify']);
+        const raw = options.dsaEncoding === 'ieee-p1363' ? sig : derToP1363(sig, curve.size);
+        return await subtle().verify({ name: 'ECDSA', hash }, key, raw, data);
     }
     catch {
         return false;

package/dist/wirings/addon/addon-reach.d.ts

@@ -0,0 +1,3 @@
+import type { PikkuRawWire } from '../../types/core.types.js';
+export declare const addonMayReach: (caller: string, funcName: string) => boolean;
+export declare const addonCallerOf: (wire: PikkuRawWire) => string | undefined;

package/dist/wirings/addon/addon-reach.js

@@ -0,0 +1,21 @@
+import { ForbiddenError } from '../../errors/errors.js';
+import { ADDON_HEADER } from '../../middleware/addon-scope-cap.js';
+import { pikkuState } from '../../pikku-state.js';
+export const addonMayReach = (caller, funcName) => {
+    const target = funcName.slice(0, Math.max(funcName.indexOf(':'), 0));
+    if (!target)
+        return false;
+    if (target === caller)
+        return true;
+    const uses = pikkuState(null, 'addons', 'packages').get(caller)?.uses;
+    return !!uses && Object.values(uses).includes(target);
+};
+export const addonCallerOf = (wire) => {
+    const name = wire.http?.request?.header(ADDON_HEADER);
+    if (!name)
+        return undefined;
+    if (!pikkuState(null, 'addons', 'packages').has(name)) {
+        throw new ForbiddenError(`Unknown addon '${name}'`);
+    }
+    return name;
+};

package/dist/wirings/addon/addon-runner.d.ts

@@ -13,6 +13,12 @@ export type AddonInstance = {
     globalSecrets?: string;
     /** Set by the consuming app to opt this instance out of credential scoping. */
     globalCredentials?: string;
+    /** Set by the consuming app: the folder of the content store this instance owns. */
+    contentBucket?: string;
+    /** Set by the consuming app: paths outside its folder this instance may read or write. */
+    contentGrants?: Record<string, 'read' | 'write'>;
+    /** Set by the consuming app to opt this instance out of content scoping. */
+    globalContent?: string;
 };
 export declare const getOrCreatePackageSingletonServices: (packageName: string, parentServices: CoreSingletonServices, addonInstance?: AddonInstance) => Promise<CoreSingletonServices>;
 export declare const addonInstanceForNamespace: (namespace: string | undefined, expectedPackage: string) => AddonInstance | undefined;

package/dist/wirings/addon/addon-runner.js

@@ -1,6 +1,7 @@
 import { pikkuState } from '../../pikku-state.js';
 import { ScopedSecretService } from '../../services/scoped-secret-service.js';
 import { ScopedCredentialService } from '../../services/scoped-credential-service.js';
+import { ScopedContentService } from '../../services/scoped-content-service.js';
 /**
  * What the addon declared, plus what the host lent it. Scoping runs outside the
  * aliaser, so every name here is the one the addon reads — which is why an
@@ -105,6 +106,7 @@ const scopeWebhookService = (service, namespace) => {
     return scoped;
 };
 export const getOrCreatePackageSingletonServices = async (packageName, parentServices, addonInstance) => {
+    addonInstance ??= addonInstanceForNamespace(findAddonNamespaceForPackage(packageName) ?? undefined, packageName);
     const cacheKey = addonInstance?.namespace ?? packageName;
     const cachedServices = pikkuState(cacheKey, 'package', 'singletonServices');
     if (cachedServices) {
@@ -137,6 +139,14 @@ export const getOrCreatePackageSingletonServices = async (packageName, parentSer
         };
     }
     const namespace = addonInstance?.namespace ?? findAddonNamespaceForPackage(packageName);
+    if (!addonInstance?.globalContent && existingServices.content) {
+        existingServices = {
+            ...existingServices,
+            content: new ScopedContentService(existingServices.content, addonInstance?.contentBucket ??
+                namespace ??
+                packageName.replace(/[^A-Za-z0-9._-]+/g, '-').replace(/^-+|-+$/g, ''), addonInstance?.contentGrants),
+        };
+    }
     if (namespace && existingServices.webhookService) {
         existingServices = {
             ...existingServices,
@@ -176,5 +186,8 @@ export const addonInstanceForNamespace = (namespace, expectedPackage) => {
         credentialGrants: cfg.credentialGrants,
         globalSecrets: cfg.globalSecrets,
         globalCredentials: cfg.globalCredentials,
+        contentBucket: cfg.contentBucket,
+        contentGrants: cfg.contentGrants,
+        globalContent: cfg.globalContent,
     };
 };

package/dist/wirings/addon/define-screens.d.ts

@@ -0,0 +1,32 @@
+type AddonScreenBase = {
+    /** Where the screen mounts under the addon, e.g. `/` or `/:id`. */
+    path: string;
+    title: string;
+    /** Lists the screen in the host's navigation. */
+    nav?: boolean;
+    /** Required of the viewer to see the screen. The addon's functions must enforce the same scopes: hiding a screen is not access control. */
+    scopes?: string[];
+};
+/** A screen rendered by the host from the addon's source. */
+export type AddonComponentScreen = AddonScreenBase & {
+    component: () => Promise<{
+        default: unknown;
+    }>;
+};
+/** A static program the host serves in a sandboxed iframe. */
+export type AddonAppScreen = AddonScreenBase & {
+    /** Directory of the built program, relative to the addon package. */
+    app: string;
+};
+export type AddonScreen = AddonComponentScreen | AddonAppScreen;
+export type ScreensManifest = {
+    title: string;
+    icon?: string;
+    screens: AddonScreen[];
+};
+/**
+ * Declares the screens an addon ships, which the host mounts when it is wired
+ * with `ui: true`. Read statically by `pikku all`, so `path`, `title`, `nav`, `scopes` and `app` must be literals.
+ */
+export declare const defineScreens: (manifest: ScreensManifest) => ScreensManifest;
+export {};