@promptbook/remote-server 0.112.0-136 → 0.112.0-138

package/esm/src/commitments/_common/teamInternalAgentAccess.d.ts

@@ -26,7 +26,15 @@ export type TeamInternalAgentAccessHeadersOptions = {
 /**
  * Resolves the internal token used by same-server TEAM calls.
  *
- * @returns Hashed token, or `null` when the server does not have a private secret.
+ * `PROMPTBOOK_TEAM_AGENT_ACCESS_TOKEN` must be a dedicated secret — falling
+ * back to `ADMIN_PASSWORD`, `SUPABASE_SERVICE_ROLE_KEY`, or any other shared
+ * credential would let a leak of one secret compromise both authentication
+ * boundaries (admin login and same-server teammate-agent access). When the
+ * dedicated variable is missing, this function returns `null` so the calling
+ * server fails closed — same-server TEAM access is disabled and no header is
+ * sent — instead of silently authorizing requests with the wrong secret.
+ *
+ * @returns Hashed token, or `null` when the dedicated secret is not configured.
  *
  * @private internal Agents Server access wiring
  */

package/esm/src/utils/isTimingSafeEqualString.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Compares two strings in constant time to prevent timing attacks.
+ *
+ * Plain JavaScript `===` / `!==` string comparisons short-circuit on the first
+ * byte that differs, which lets a remote attacker who can measure response
+ * timing recover the expected value one byte at a time. This helper performs
+ * the comparison through Node's `timingSafeEqual`, which always inspects every
+ * byte of the equal-length buffers.
+ *
+ * Returning `false` early when the byte lengths differ does not expose
+ * character content — only length — which is an acceptable trade-off, since
+ * `timingSafeEqual` requires equal-length buffers and length is typically not
+ * secret.
+ *
+ * `null` and `undefined` inputs are treated as non-matching so callers can
+ * forward raw request values (for example `request.headers.get(name)`) without
+ * an extra guard.
+ *
+ * @param candidate - Value supplied by the caller (for example a request header or cookie).
+ * @param expected - Value to compare against (for example a configured secret).
+ * @returns `true` when both values are strings of equal length with identical bytes.
+ *
+ * @private internal helper function
+ */
+export declare function isTimingSafeEqualString(candidate: string | null | undefined, expected: string | null | undefined): boolean;

package/esm/src/version.d.ts

@@ -15,7 +15,7 @@ export declare const BOOK_LANGUAGE_VERSION: string_semantic_version;
 export declare const PROMPTBOOK_ENGINE_VERSION: string_promptbook_version;
 /**
  * Represents the version string of the Promptbook engine.
- * It follows semantic versioning (e.g., `0.112.0-135`).
+ * It follows semantic versioning (e.g., `0.112.0-137`).
  *
  * @generated
  */

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@promptbook/remote-server",
-    "version": "0.112.0-136",
+    "version": "0.112.0-138",
     "description": "Promptbook: Create persistent AI agents that turn your company's scattered knowledge into action",
     "private": false,
     "sideEffects": false,
@@ -99,13 +99,14 @@
     "types": "./esm/src/_packages/remote-server.index.d.ts",
     "typings": "./esm/src/_packages/remote-server.index.d.ts",
     "peerDependencies": {
-        "@promptbook/core": "0.112.0-136"
+        "@promptbook/core": "0.112.0-138"
     },
     "dependencies": {
         "@mozilla/readability": "0.6.0",
         "@openai/agents": "0.4.15",
         "bottleneck": "2.19.5",
         "colors": "1.4.0",
+        "crypto": "1.0.1",
         "crypto-js": "4.2.0",
         "express": "4.21.2",
         "express-openapi-validator": "5.4.9",

package/umd/index.umd.js

@@ -1,8 +1,8 @@
 (function (global, factory) {
-    typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports, require('path'), require('child_process'), require('colors'), require('spacetrim'), require('waitasecond'), require('http'), require('express'), require('socket.io'), require('fs/promises'), require('@mozilla/readability'), require('jsdom'), require('crypto-js'), require('crypto-js/enc-hex'), require('showdown'), require('express-openapi-validator'), require('swagger-ui-express'), require('react'), require('react-dom/server'), require('rxjs'), require('moment'), require('mime-types'), require('crypto-js/sha256'), require('papaparse'), require('@openai/agents'), require('bottleneck'), require('openai')) :
-    typeof define === 'function' && define.amd ? define(['exports', 'path', 'child_process', 'colors', 'spacetrim', 'waitasecond', 'http', 'express', 'socket.io', 'fs/promises', '@mozilla/readability', 'jsdom', 'crypto-js', 'crypto-js/enc-hex', 'showdown', 'express-openapi-validator', 'swagger-ui-express', 'react', 'react-dom/server', 'rxjs', 'moment', 'mime-types', 'crypto-js/sha256', 'papaparse', '@openai/agents', 'bottleneck', 'openai'], factory) :
-    (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global["promptbook-remote-server"] = {}, global.path, global.child_process, global.colors, global._spaceTrim, global.waitasecond, global.http, global.express, global.socket_io, global.promises, global.readability, global.jsdom, global.CryptoJS, global.hexEncoder, global.showdown, global.OpenApiValidator, global.swaggerUi, global.react, global.server, global.rxjs, global.moment, global.mimeTypes, global.sha256, global.papaparse, global.agents, global.Bottleneck, global.OpenAI));
-})(this, (function (exports, path, child_process, colors, _spaceTrim, waitasecond, http, express, socket_io, promises, readability, jsdom, CryptoJS, hexEncoder, showdown, OpenApiValidator, swaggerUi, react, server, rxjs, moment, mimeTypes, sha256, papaparse, agents, Bottleneck, OpenAI) { 'use strict';
+    typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports, require('path'), require('child_process'), require('colors'), require('spacetrim'), require('waitasecond'), require('http'), require('express'), require('socket.io'), require('fs/promises'), require('@mozilla/readability'), require('jsdom'), require('crypto-js'), require('crypto-js/enc-hex'), require('showdown'), require('express-openapi-validator'), require('swagger-ui-express'), require('react'), require('react-dom/server'), require('rxjs'), require('crypto'), require('moment'), require('mime-types'), require('crypto-js/sha256'), require('papaparse'), require('@openai/agents'), require('bottleneck'), require('openai')) :
+    typeof define === 'function' && define.amd ? define(['exports', 'path', 'child_process', 'colors', 'spacetrim', 'waitasecond', 'http', 'express', 'socket.io', 'fs/promises', '@mozilla/readability', 'jsdom', 'crypto-js', 'crypto-js/enc-hex', 'showdown', 'express-openapi-validator', 'swagger-ui-express', 'react', 'react-dom/server', 'rxjs', 'crypto', 'moment', 'mime-types', 'crypto-js/sha256', 'papaparse', '@openai/agents', 'bottleneck', 'openai'], factory) :
+    (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global["promptbook-remote-server"] = {}, global.path, global.child_process, global.colors, global._spaceTrim, global.waitasecond, global.http, global.express, global.socket_io, global.promises, global.readability, global.jsdom, global.CryptoJS, global.hexEncoder, global.showdown, global.OpenApiValidator, global.swaggerUi, global.react, global.server, global.rxjs, null, global.moment, global.mimeTypes, global.sha256, global.papaparse, global.agents, global.Bottleneck, global.OpenAI));
+})(this, (function (exports, path, child_process, colors, _spaceTrim, waitasecond, http, express, socket_io, promises, readability, jsdom, CryptoJS, hexEncoder, showdown, OpenApiValidator, swaggerUi, react, server, rxjs, crypto, moment, mimeTypes, sha256, papaparse, agents, Bottleneck, OpenAI) { 'use strict';
 
     function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'default' in e ? e : { 'default': e }; }
 
@@ -53,7 +53,7 @@
      * @generated
      * @see https://github.com/webgptorg/promptbook
      */
-    const PROMPTBOOK_ENGINE_VERSION = '0.112.0-136';
+    const PROMPTBOOK_ENGINE_VERSION = '0.112.0-138';
     /**
      * TODO: string_promptbook_version should be constrained to the all versions of Promptbook engine
      * Note: [💞] Ignore a discrepancy between file name and entity name