@raybase/core 0.0.1 → 0.3.3

package/dist/handoff.js

@@ -0,0 +1,228 @@
+import { randomId } from "./sql.js";
+import { wallNowMs } from "./clock.js";
+import { sha256Hex } from "./internal.js";
+const textEncoder = new TextEncoder();
+const defaultConsumePath = "/_raybase/handoff/consume";
+const defaultTokenTtlSeconds = 5 * 60;
+const maxTokenTtlSeconds = 15 * 60;
+const localOriginHosts = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+export function handoffEnabled(config) {
+    return config.handoff?.enabled === true;
+}
+export function handoffTokenTtlSeconds(config) {
+    const configured = config.handoff?.tokenTtlSeconds;
+    return Number.isInteger(configured) && configured > 0 ? Math.min(configured, maxTokenTtlSeconds) : defaultTokenTtlSeconds;
+}
+export function handoffResourceById(config, id) {
+    return config.handoff?.resources?.find((resource) => resource.id === id) ?? null;
+}
+/**
+ * The `iss` the hub signs with. Configure `handoff.issuer` when the hub is
+ * reachable under more than one hostname: consumers pin one issuer string, so
+ * whichever hostname a visitor arrived on, the token must say the same thing.
+ */
+export function handoffIssuer(config, requestOrigin) {
+    const configured = config.handoff?.issuer?.trim();
+    return (configured || requestOrigin).replace(/\/$/, "");
+}
+export function handoffResourceConsumePath(resource) {
+    return sanitizeHandoffReturnTo(resource.consumePath, defaultConsumePath);
+}
+export function handoffResourceOriginForEnv(config, resource, env) {
+    // The worker env is the only origin channel that tracks the actually running
+    // resource (local dev writes it to .dev.vars after picking a free port;
+    // deployments set it as a var). The config value is baked in at build time
+    // and cannot see runtime port drift. RAYBASE_SITE_ORIGIN is a single value,
+    // so it only overrides an unambiguous single-resource config.
+    const override = env.RAYBASE_SITE_ORIGIN?.trim();
+    if (override && config.handoff?.resources?.length === 1) {
+        try {
+            const parsed = new URL(override);
+            if (parsed.protocol === "http:" || parsed.protocol === "https:")
+                return parsed.origin;
+        }
+        catch {
+            return resource.origin;
+        }
+    }
+    return resource.origin;
+}
+/**
+ * Every issue that would make the registry unusable at runtime. Called by the
+ * worker factory (so a bad registry fails loudly at startup) and by
+ * `raybase doctor`.
+ */
+export function validateHandoffConfig(config) {
+    const issues = [];
+    if (!handoffEnabled(config))
+        return issues;
+    const resources = config.handoff?.resources ?? [];
+    if (!resources.length)
+        issues.push("handoff.enabled requires at least one handoff resource.");
+    const issuer = config.handoff?.issuer;
+    if (issuer !== undefined && !isHandoffIssuerOrigin(issuer)) {
+        issues.push("handoff.issuer must be an https origin with no path (http is allowed for localhost only).");
+    }
+    const ttl = config.handoff?.tokenTtlSeconds;
+    if (ttl !== undefined && (!Number.isInteger(ttl) || ttl <= 0 || ttl > maxTokenTtlSeconds)) {
+        issues.push(`handoff.tokenTtlSeconds must be a whole number of seconds between 1 and ${maxTokenTtlSeconds}.`);
+    }
+    const ids = new Set();
+    for (const resource of resources) {
+        if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(resource.id ?? ""))
+            issues.push(`Handoff resource id "${resource.id}" must be a stable lowercase slug.`);
+        if (ids.has(resource.id))
+            issues.push(`Handoff resource id "${resource.id}" is duplicated.`);
+        ids.add(resource.id);
+        if (!resource.label?.trim())
+            issues.push(`Handoff resource "${resource.id}" needs a label.`);
+        if (!isHandoffOrigin(resource.origin))
+            issues.push(`Handoff resource "${resource.id}" needs an https origin (http is allowed for localhost only).`);
+        if (resource.kind !== "sso" && resource.kind !== "pass")
+            issues.push(`Handoff resource "${resource.id}" must have kind "sso" or "pass".`);
+        if (resource.kind === "pass" && resource.app)
+            issues.push(`Handoff resource "${resource.id}" is a pass resource and must not name an app; a pass never carries roles.`);
+        if (resource.consumePath !== undefined && !isHandoffPath(resource.consumePath))
+            issues.push(`Handoff resource "${resource.id}" consumePath must be a path starting with "/".`);
+        if (resource.returnTo !== undefined && !isHandoffPath(resource.returnTo))
+            issues.push(`Handoff resource "${resource.id}" returnTo must be a path starting with "/".`);
+    }
+    return issues;
+}
+/** An origin and nothing else: a path or query here would silently change `iss`. */
+function isHandoffIssuerOrigin(value) {
+    if (!isHandoffOrigin(value))
+        return false;
+    const trimmed = value.trim().replace(/\/$/, "");
+    return new URL(trimmed).origin === trimmed;
+}
+function isHandoffOrigin(value) {
+    if (typeof value !== "string" || !value.trim())
+        return false;
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return false;
+    }
+    if (parsed.protocol === "https:")
+        return true;
+    return parsed.protocol === "http:" && localOriginHosts.has(parsed.hostname);
+}
+// The same rule as handoff-consumer.ts's safeHandoffPath, which owns the
+// explanation: one leading slash, no backslash, no control character (the URL
+// parser strips TAB/CR/LF, which would turn "/\t//evil.example" into a
+// protocol-relative URL). Duplicated rather than shared because the consumer
+// imports nothing from Core.
+const handoffPathPattern = /^\/(?!\/)[^\\\x00-\x1f\x7f]*$/;
+function isHandoffPath(value) {
+    return typeof value === "string" && handoffPathPattern.test(value);
+}
+export function parseHandoffPrivateJwk(raw) {
+    if (!raw?.trim())
+        throw new Error("RAYBASE_HANDOFF_PRIVATE_JWK is required when handoff is enabled.");
+    let jwk;
+    try {
+        jwk = JSON.parse(raw);
+    }
+    catch {
+        throw new Error("RAYBASE_HANDOFF_PRIVATE_JWK must be a JSON Web Key.");
+    }
+    if (jwk.kty !== "EC" || jwk.crv !== "P-256" || typeof jwk.d !== "string") {
+        throw new Error("RAYBASE_HANDOFF_PRIVATE_JWK must be an ES256 private JWK.");
+    }
+    return jwk;
+}
+export async function publicJwkFromPrivate(raw) {
+    const privateJwk = parseHandoffPrivateJwk(raw);
+    const publicJwk = { ...privateJwk };
+    delete publicJwk.d;
+    delete publicJwk.key_ops;
+    publicJwk.use = "sig";
+    publicJwk.alg = "ES256";
+    publicJwk.kid = typeof privateJwk.kid === "string" && privateJwk.kid ? privateJwk.kid : await handoffJwkKid(publicJwk);
+    return publicJwk;
+}
+export async function handoffJwks(raw) {
+    return { keys: [await publicJwkFromPrivate(raw)] };
+}
+async function handoffJwkKid(jwk) {
+    return `raybase-handoff-${(await sha256Hex(JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y }))).slice(0, 16)}`;
+}
+function base64url(bytes) {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+async function importHandoffSigningKey(jwk) {
+    return crypto.subtle.importKey("jwk", jwk, { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"]);
+}
+export async function signHandoffToken(input) {
+    const privateJwk = parseHandoffPrivateJwk(input.privateJwk);
+    const now = Math.floor(wallNowMs() / 1000);
+    const exp = now + input.ttlSeconds;
+    const payload = {
+        iss: input.issuer.replace(/\/$/, ""),
+        aud: `raybase-handoff:${input.resource.id}`,
+        sub: input.user.id,
+        email: input.user.email,
+        email_verified: input.user.emailVerified === true,
+        name: input.user.name,
+        // appId says which app's membership the roles belong to, so it belongs to
+        // the same handoff the roles do and to no other.
+        ...(input.appId && input.resource.kind === "sso" ? { appId: input.appId } : {}),
+        resource: input.resource.id,
+        kind: input.resource.kind,
+        // A pass names a resource and a person, never a role: the claim is absent
+        // rather than empty so a consumer cannot mistake one for a membership.
+        ...(input.resource.kind === "sso" ? { roles: input.user.appRoles ?? [] } : {}),
+        iat: now,
+        exp,
+        jti: randomId("handoff")
+    };
+    const publicJwk = await publicJwkFromPrivate(input.privateJwk);
+    const header = { alg: "ES256", typ: "JWT", kid: publicJwk.kid };
+    const signingInput = `${base64url(textEncoder.encode(JSON.stringify(header)))}.${base64url(textEncoder.encode(JSON.stringify(payload)))}`;
+    const signature = new Uint8Array(await crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, await importHandoffSigningKey(privateJwk), textEncoder.encode(signingInput)));
+    return {
+        token: `${signingInput}.${base64url(signature)}`,
+        payload,
+        expiresAt: new Date(exp * 1000).toISOString()
+    };
+}
+export function handoffConsumeUrl(resource, origin, token, returnTo, state) {
+    const url = new URL(handoffResourceConsumePath(resource), origin);
+    url.searchParams.set("token", token);
+    url.searchParams.set("return", returnTo);
+    // Echoed verbatim: the resource minted it and only the resource checks it.
+    if (state)
+        url.searchParams.set("state", state);
+    return url.toString();
+}
+/** Path-only, so a return value can never send a browser off the resource. */
+export function sanitizeHandoffReturnTo(value, fallback) {
+    return isHandoffPath(value) ? value : fallback;
+}
+/**
+ * Reduce a caller-supplied return target to a path on the resource. An absolute
+ * URL is accepted only when it is on the resource's own origin, so the bounce
+ * can hand back the URL the visitor actually asked for.
+ */
+export function handoffReturnPath(resource, origin, value) {
+    const fallback = sanitizeHandoffReturnTo(resource.returnTo, "/");
+    if (typeof value === "string" && /^https?:\/\//i.test(value)) {
+        try {
+            const requested = new URL(value);
+            if (requested.origin !== new URL(origin).origin)
+                return fallback;
+            return sanitizeHandoffReturnTo(`${requested.pathname}${requested.search}`, fallback);
+        }
+        catch {
+            return fallback;
+        }
+    }
+    return sanitizeHandoffReturnTo(value, fallback);
+}
+//# sourceMappingURL=handoff.js.map

package/dist/handoff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handoff.js","sourceRoot":"","sources":["../src/handoff.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AA4B1C,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AACtC,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AACvD,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,CAAC;AACtC,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,CAAC;AACnC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAE7E,MAAM,UAAU,cAAc,CAAC,MAAqB;IAClD,OAAO,MAAM,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAqB;IAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC;IACnD,OAAO,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAW,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC;AAC9H,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAqB,EAAE,EAAU;IACnE,OAAO,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;AACnF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,MAAqB,EAAE,aAAqB;IACxE,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAClD,OAAO,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,QAAsC;IAC/E,OAAO,uBAAuB,CAAC,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,MAAqB,EACrB,QAAsC,EACtC,GAAqC;IAErC,6EAA6E;IAC7E,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC,MAAM,CAAC;QACxF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC,MAAM,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAqB;IACzD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,SAAS,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,MAAM,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC;IAC5C,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,kBAAkB,CAAC,EAAE,CAAC;QAC1F,MAAM,CAAC,IAAI,CAAC,2EAA2E,kBAAkB,GAAG,CAAC,CAAC;IAChH,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,QAAQ,CAAC,EAAE,oCAAoC,CAAC,CAAC;QAC/I,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,wBAAwB,QAAQ,CAAC,EAAE,kBAAkB,CAAC,CAAC;QAC7F,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE;YAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,QAAQ,CAAC,EAAE,kBAAkB,CAAC,CAAC;QAC7F,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,QAAQ,CAAC,EAAE,+DAA+D,CAAC,CAAC;QACpJ,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,QAAQ,CAAC,EAAE,mCAAmC,CAAC,CAAC;QAC1I,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,IAAI,QAAQ,CAAC,GAAG;YAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,QAAQ,CAAC,EAAE,4EAA4E,CAAC,CAAC;QACxK,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,QAAQ,CAAC,EAAE,iDAAiD,CAAC,CAAC;QAC/K,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,QAAQ,CAAC,EAAE,8CAA8C,CAAC,CAAC;IACxK,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oFAAoF;AACpF,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,OAAO,GAAI,KAAgB,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5D,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC;AAC7C,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC9E,CAAC;AAED,yEAAyE;AACzE,8EAA8E;AAC9E,uEAAuE;AACvE,6EAA6E;AAC7E,6BAA6B;AAC7B,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAE3D,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAuB;IAC5D,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtG,IAAI,GAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAuB;IAChE,MAAM,UAAU,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAqB,EAAE,GAAG,UAAU,EAAE,CAAC;IACtD,OAAO,SAAS,CAAC,CAAC,CAAC;IACnB,OAAO,SAAS,CAAC,OAAO,CAAC;IACzB,SAAS,CAAC,GAAG,GAAG,KAAK,CAAC;IACtB,SAAS,CAAC,GAAG,GAAG,OAAO,CAAC;IACxB,SAAS,CAAC,GAAG,GAAG,OAAO,UAAU,CAAC,GAAG,KAAK,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IACvH,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAuB;IACvD,OAAO,EAAE,IAAI,EAAE,CAAC,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAqB;IAChD,OAAO,mBAAmB,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACjI,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,GAAqB;IAC1D,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AACtG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAOtC;IACC,MAAM,UAAU,GAAG,sBAAsB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC;IACnC,MAAM,OAAO,GAA6B;QACxC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACpC,GAAG,EAAE,mBAAmB,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE;QAC3C,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;QAClB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;QACvB,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,aAAa,KAAK,IAAI;QACjD,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;QACrB,0EAA0E;QAC1E,iDAAiD;QACjD,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;QAC3B,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;QACzB,0EAA0E;QAC1E,uEAAuE;QACvE,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,GAAG,EAAE,GAAG;QACR,GAAG;QACH,GAAG,EAAE,QAAQ,CAAC,SAAS,CAAC;KACzB,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC;IAChE,MAAM,YAAY,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1I,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,uBAAuB,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5K,OAAO;QACL,KAAK,EAAE,GAAG,YAAY,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE;QAChD,OAAO;QACP,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KAC9C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,QAAsC,EACtC,MAAc,EACd,KAAa,EACb,QAAgB,EAChB,KAAc;IAEd,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,0BAA0B,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAClE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACzC,2EAA2E;IAC3E,IAAI,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAChD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,uBAAuB,CAAC,KAAc,EAAE,QAAgB;IACtE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAsC,EAAE,MAAc,EAAE,KAAc;IACtG,MAAM,QAAQ,GAAG,uBAAuB,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,SAAS,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM;gBAAE,OAAO,QAAQ,CAAC;YACjE,OAAO,uBAAuB,CAAC,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,uBAAuB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC"}

package/dist/host-auth.d.ts

@@ -0,0 +1,47 @@
+import type { SqlExecutor } from "./db.js";
+import type { RaybaseUser } from "./policies.js";
+export { hostUserIdPrefix, isHostUserId } from "./host-user.js";
+/**
+ * A person the host platform has already signed in, as the host vouches for
+ * them on one request. `subject` must be stable for that person and unique
+ * within the provider (for example: the host account plus the host's own user id).
+ */
+export type RaybaseHostIdentity = {
+    subject: string;
+    /** Display name for the admin panel and audit; defaults to "<provider> user". */
+    name?: string;
+};
+/**
+ * Lets an app that runs inside another platform's signed-in surface (an
+ * app embedded in that platform's admin, for example) let its users reach
+ * Raybase agent routes (the Guide and other agents) without a Raybase
+ * session.
+ *
+ * Raybase calls `resolve` only on agent routes and only when the request has
+ * no Raybase session. A non-null identity becomes a Raybase user row
+ * (`hostuser_<provider>_…`, appRoles ["user"], no password, no sign-in
+ * method, an undeliverable `.invalid` email) created on first use, so
+ * conversations, memory and audit entries have a real user to point at.
+ * The host can never grant admin or operator roles; an admin who bans that
+ * user in /admin cuts off their access. A layered runtime with its own
+ * session resolver (Raybase Pro) makes its own users from the identity
+ * through its profile's `session.host`, and ignores this hook without one.
+ */
+export type RaybaseHostAuth<Env = unknown> = {
+    /** Short lowercase id for the host platform, e.g. "acme". */
+    provider: string;
+    resolve(input: {
+        request: Request;
+        env: Env;
+    }): Promise<RaybaseHostIdentity | null> | RaybaseHostIdentity | null;
+};
+export declare function defineRaybaseHostAuth<Env = unknown>(hostAuth: RaybaseHostAuth<Env>): RaybaseHostAuth<Env>;
+export declare function hostUserId(provider: string, subject: string): Promise<string>;
+/**
+ * Returns the Raybase user for a host-vouched identity, creating the row on
+ * first use. Returns null when an admin has banned that user. Roles are
+ * always plain ["user"], whatever the row says, so a host user is never an
+ * admin even if someone edits the row.
+ */
+export declare function ensureHostUser(db: SqlExecutor, provider: string, identity: RaybaseHostIdentity): Promise<RaybaseUser | null>;
+//# sourceMappingURL=host-auth.d.ts.map

package/dist/host-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-auth.d.ts","sourceRoot":"","sources":["../src/host-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAG3C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEhE;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,eAAe,CAAC,GAAG,GAAG,OAAO,IAAI;IAC3C,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,GAAG,mBAAmB,GAAG,IAAI,CAAC;CAClH,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,GAAG,GAAG,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,CAGzG;AAcD,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGnF;AAID;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CA4BlI"}

package/dist/host-auth.js

@@ -0,0 +1,59 @@
+import { authUserTableName } from "./auth-schema.js";
+import { hostUserIdPrefix } from "./host-user.js";
+export { hostUserIdPrefix, isHostUserId } from "./host-user.js";
+export function defineRaybaseHostAuth(hostAuth) {
+    assertHostProvider(hostAuth.provider);
+    return hostAuth;
+}
+function assertHostProvider(provider) {
+    if (!/^[a-z][a-z0-9-]{0,31}$/.test(provider)) {
+        throw new Error(`Host auth provider must be a short lowercase id (got ${JSON.stringify(provider)})`);
+    }
+}
+async function subjectDigest(provider, subject) {
+    const bytes = new TextEncoder().encode(`${provider}\u0000${subject}`);
+    const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
+    return Array.from(digest.slice(0, 12), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+export async function hostUserId(provider, subject) {
+    assertHostProvider(provider);
+    return `${hostUserIdPrefix}${provider}_${await subjectDigest(provider, subject)}`;
+}
+/**
+ * Returns the Raybase user for a host-vouched identity, creating the row on
+ * first use. Returns null when an admin has banned that user. Roles are
+ * always plain ["user"], whatever the row says, so a host user is never an
+ * admin even if someone edits the row.
+ */
+export async function ensureHostUser(db, provider, identity) {
+    const subject = identity.subject.trim();
+    if (!subject)
+        throw new Error("Host identity subject is required");
+    const id = await hostUserId(provider, subject);
+    const name = (identity.name?.trim() || `${provider} user`).slice(0, 200);
+    const now = Date.now();
+    // The email column is unique, so a guessable address could be registered
+    // first by someone else and block this person's row. A random part set on
+    // first insert (and never changed after) makes it unguessable.
+    const email = `${randomHex(16)}@${provider}.host.invalid`;
+    await db.run(`INSERT INTO "${authUserTableName}" ("id", "name", "email", "emailVerified", "createdAt", "updatedAt", "operatorRole", "appRoles", "banned")
+     VALUES (?, ?, ?, 0, ?, ?, NULL, ?, 0)
+     ON CONFLICT ("id") DO UPDATE SET "name" = excluded."name", "updatedAt" = excluded."updatedAt"
+     WHERE "${authUserTableName}"."name" <> excluded."name"`, [id, name, email, now, now, JSON.stringify(["user"])]);
+    const row = await db.first(`SELECT "id", "email", "name", "banned" FROM "${authUserTableName}" WHERE "id" = ?`, [id]);
+    if (!row || row.banned === true || row.banned === 1)
+        return null;
+    return {
+        id: row.id,
+        email: row.email,
+        name: row.name,
+        operatorRole: null,
+        appRoles: ["user"],
+        emailVerified: false,
+        disabled: false
+    };
+}
+function randomHex(bytes) {
+    return Array.from(crypto.getRandomValues(new Uint8Array(bytes)), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+//# sourceMappingURL=host-auth.js.map

package/dist/host-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-auth.js","sourceRoot":"","sources":["../src/host-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGlD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAmChE,MAAM,UAAU,qBAAqB,CAAgB,QAA8B;IACjF,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,wDAAwD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACvG,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,QAAgB,EAAE,OAAe;IAC5D,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,QAAQ,SAAS,OAAO,EAAE,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5E,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAgB,EAAE,OAAe;IAChE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC7B,OAAO,GAAG,gBAAgB,GAAG,QAAQ,IAAI,MAAM,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;AACpF,CAAC;AAID;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAe,EAAE,QAAgB,EAAE,QAA6B;IACnG,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACnE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,GAAG,QAAQ,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,yEAAyE;IACzE,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,KAAK,GAAG,GAAG,SAAS,CAAC,EAAE,CAAC,IAAI,QAAQ,eAAe,CAAC;IAC1D,MAAM,EAAE,CAAC,GAAG,CACV,gBAAgB,iBAAiB;;;cAGvB,iBAAiB,6BAA6B,EACxD,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CACtD,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAc,gDAAgD,iBAAiB,kBAAkB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACnI,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,YAAY,EAAE,IAAI;QAClB,QAAQ,EAAE,CAAC,MAAM,CAAC;QAClB,aAAa,EAAE,KAAK;QACpB,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC1H,CAAC"}

package/dist/host-user.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Host users (see RaybaseHostAuth) are Raybase user rows that a host platform
+ * vouches for on agent routes. They are plain users by construction: these
+ * helpers keep them that way wherever Core turns a stored row into a user,
+ * so an edited row (or a role granted by mistake) never takes effect.
+ * Dependency-free so every user reader can import it.
+ */
+export declare const hostUserIdPrefix = "hostuser_";
+export declare function isHostUserId(id: unknown): boolean;
+/** Caps a host user at the plain "user" role; any other user passes through unchanged. */
+export declare function withHostUserRoleCeiling<T extends {
+    id: string;
+}>(user: T): T;
+export declare function assertNotHostUser(userId: string, change: string): void;
+//# sourceMappingURL=host-user.d.ts.map

package/dist/host-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-user.d.ts","sourceRoot":"","sources":["../src/host-user.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAE5C,wBAAgB,YAAY,CAAC,EAAE,EAAE,OAAO,GAAG,OAAO,CAEjD;AAED,0FAA0F;AAC1F,wBAAgB,uBAAuB,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAG5E;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAItE"}

package/dist/host-user.js

@@ -0,0 +1,23 @@
+/**
+ * Host users (see RaybaseHostAuth) are Raybase user rows that a host platform
+ * vouches for on agent routes. They are plain users by construction: these
+ * helpers keep them that way wherever Core turns a stored row into a user,
+ * so an edited row (or a role granted by mistake) never takes effect.
+ * Dependency-free so every user reader can import it.
+ */
+export const hostUserIdPrefix = "hostuser_";
+export function isHostUserId(id) {
+    return typeof id === "string" && id.startsWith(hostUserIdPrefix);
+}
+/** Caps a host user at the plain "user" role; any other user passes through unchanged. */
+export function withHostUserRoleCeiling(user) {
+    if (!isHostUserId(user.id))
+        return user;
+    return { ...user, operatorRole: null, appRoles: ["user"] };
+}
+export function assertNotHostUser(userId, change) {
+    if (isHostUserId(userId)) {
+        throw new Error(`${change} is not available for host users: they are signed in by the host platform and always hold the plain user role`);
+    }
+}
+//# sourceMappingURL=host-user.js.map

package/dist/host-user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-user.js","sourceRoot":"","sources":["../src/host-user.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAE5C,MAAM,UAAU,YAAY,CAAC,EAAW;IACtC,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;AACnE,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,uBAAuB,CAA2B,IAAO;IACvE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,MAAc;IAC9D,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,+GAA+G,CAAC,CAAC;IAC5I,CAAC;AACH,CAAC"}

package/dist/html.d.ts

@@ -0,0 +1,35 @@
+import { type RaybaseConfig } from "./schema.js";
+export type AuthPageExternalProvider = {
+    id: string;
+    label: string;
+};
+export declare function escapeHtml(value: unknown): string;
+export declare function jsonScript(value: unknown): string;
+export type PageAsset = {
+    href?: string;
+    src?: string;
+    integrity?: string;
+};
+export declare function faviconDataUri(appName?: string): string;
+export declare function page(title: string, body: string, options?: {
+    appName?: string;
+    headScript?: string;
+    script?: string;
+    style?: string;
+    assets?: PageAsset[];
+}): string;
+export declare function loginPage(config: RaybaseConfig, message?: string, options?: {
+    local?: boolean;
+    externalProviders?: AuthPageExternalProvider[];
+}): string;
+export declare function forgotPasswordPage(config: RaybaseConfig, message?: string): string;
+export declare function resetPasswordPage(config: RaybaseConfig, token?: string, message?: string): string;
+export declare function verifyEmailPage(config: RaybaseConfig, token?: string, email?: string, message?: string): string;
+export declare function signupPage(config: RaybaseConfig, message?: string, options?: {
+    externalProviders?: AuthPageExternalProvider[];
+}): string;
+export declare function accessDeniedPage(config: RaybaseConfig): string;
+export declare function setupPage(config: RaybaseConfig, token: string, purpose: "owner-setup" | "invite", email?: string, options?: {
+    externalProviders?: AuthPageExternalProvider[];
+}): string;
+//# sourceMappingURL=html.d.ts.map

package/dist/html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../src/html.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0C,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAGzF,MAAM,MAAM,wBAAwB,GAAG;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAOjD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEjD;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAKF,wBAAgB,cAAc,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAIvD;AAeD,wBAAgB,IAAI,CAClB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAA;CAAO,GAC7G,MAAM,CA+DR;AAgCD,wBAAgB,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,SAAK,EAAE,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,iBAAiB,CAAC,EAAE,wBAAwB,EAAE,CAAA;CAAO,GAAG,MAAM,CA4CxJ;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,SAAK,GAAG,MAAM,CAkB9E;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,SAAK,EAAE,OAAO,SAAK,GAAG,MAAM,CAmBzF;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,SAAK,EAAE,KAAK,SAAK,EAAE,OAAO,SAAK,GAAG,MAAM,CAoBnG;AAED,wBAAgB,UAAU,CACxB,MAAM,EAAE,aAAa,EACrB,OAAO,SAAK,EACZ,OAAO,GAAE;IAAE,iBAAiB,CAAC,EAAE,wBAAwB,EAAE,CAAA;CAAO,GAC/D,MAAM,CA4BR;AAID,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAa9D;AAED,wBAAgB,SAAS,CACvB,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,aAAa,GAAG,QAAQ,EACjC,KAAK,SAAK,EACV,OAAO,GAAE;IAAE,iBAAiB,CAAC,EAAE,wBAAwB,EAAE,CAAA;CAAO,GAC/D,MAAM,CAmCR"}