@sentropic/artifacts 0.0.0-stage → 0.1.1

package/dist/codecs.js

@@ -0,0 +1,77 @@
+/**
+ * L-5a — canonical manifest codec (spec-v8 §9).
+ *
+ * Deterministic serialization for content-addressed manifests: key sorting
+ * is recursive, `undefined` object properties are omitted, and the digest is
+ * the SHA-256 of the canonical UTF-8 bytes. `parseManifest` validates the
+ * schema version and digest fail-closed.
+ */
+import { createHash } from 'node:crypto';
+import { assertKnownSchemaVersion } from './contracts.js';
+/**
+ * Recursively sort object keys and drop `undefined` properties. Arrays are
+ * treated as unordered sets: items are canonicalized first, then sorted by
+ * their canonical bytes. Rationale: a manifest lists addressed files — the
+ * file order carries no semantics, while the file set does.
+ */
+function canonicalize(value) {
+    if (Array.isArray(value)) {
+        return value
+            .map(canonicalize)
+            .sort((a, b) => {
+            const sa = JSON.stringify(a);
+            const sb = JSON.stringify(b);
+            return sa < sb ? -1 : sa > sb ? 1 : 0;
+        });
+    }
+    if (typeof value === 'object' && value !== null) {
+        const out = {};
+        for (const key of Object.keys(value).sort()) {
+            const v = value[key];
+            if (v !== undefined)
+                out[key] = canonicalize(v);
+        }
+        return out;
+    }
+    return value;
+}
+/** Deterministic serialization of a manifest (recursive key sort, no `undefined`). */
+export function canonicalManifest(manifest) {
+    return JSON.stringify(canonicalize(manifest));
+}
+/** SHA-256 hex digest of the canonical manifest bytes. */
+export function manifestDigest(manifest) {
+    return createHash('sha256').update(canonicalManifest(manifest), 'utf8').digest('hex');
+}
+/**
+ * Parse and validate a manifest, fail-closed: JSON object, known schema
+ * version, required `artifactId`. A present `digest` must match the body
+ * recomputed without it; an absent digest means unsealed working document
+ * (construction precedes sealing) and is accepted as-is.
+ */
+export function parseManifest(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error('invalid manifest: cannot parse body as JSON');
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new Error('invalid manifest: not an object');
+    }
+    const manifest = parsed;
+    assertKnownSchemaVersion(manifest.schemaVersion);
+    if (typeof manifest.artifactId !== 'string' || manifest.artifactId.length === 0) {
+        throw new Error('invalid manifest: missing artifactId');
+    }
+    if (manifest.digest !== undefined) {
+        const { digest: _drop, ...body } = manifest;
+        void _drop;
+        const expected = manifestDigest(body);
+        if (manifest.digest !== expected) {
+            throw new Error(`invalid manifest: digest mismatch (expected ${expected})`);
+        }
+    }
+    return manifest;
+}

package/dist/content/api-profile.d.ts

@@ -0,0 +1,38 @@
+/**
+ * L-5d — reader-delegation API profile (spec-v8 §9 5d).
+ *
+ * Generic contract for page-initiated business calls: the host profile
+ * fixes exact methods/routes and artifact/release bindings (evaluated by
+ * the pure reader-profile contract); writes additionally require Origin
+ * equality with the content origin and a custom header (simple-request
+ * CSRF defense). A content grant alone never becomes business-write
+ * authority — the receiving API re-verifies reader rights per operation.
+ * Successful calls carry reader attribution for audit.
+ */
+import { type ReaderProfile } from '../server/reader-profile.js';
+export interface ReaderApiCall {
+    subjectId: string;
+    method: string;
+    route: string;
+    artifactId?: string;
+    releaseId?: string;
+    /** Browser Origin header of the calling page (writes only). */
+    origin?: string;
+    /** The content origin the call must come from (writes only). */
+    expectedOrigin?: string;
+    /** True when the call carries a non-simple custom request header. */
+    hasCustomHeader?: boolean;
+}
+export type ReaderApiDecision = {
+    allowed: true;
+    attribution: {
+        subjectId: string;
+        artifactId?: string;
+        releaseId?: string;
+    };
+} | {
+    allowed: false;
+    reason: 'profile' | 'origin' | 'csrf';
+};
+/** Authorize one reader API call against the host profile (deny default). */
+export declare function authorizeReaderApiCall(profile: ReaderProfile, call: ReaderApiCall, isApprovedAccount?: (principalId: string) => boolean): ReaderApiDecision;

package/dist/content/api-profile.js

@@ -0,0 +1,40 @@
+/**
+ * L-5d — reader-delegation API profile (spec-v8 §9 5d).
+ *
+ * Generic contract for page-initiated business calls: the host profile
+ * fixes exact methods/routes and artifact/release bindings (evaluated by
+ * the pure reader-profile contract); writes additionally require Origin
+ * equality with the content origin and a custom header (simple-request
+ * CSRF defense). A content grant alone never becomes business-write
+ * authority — the receiving API re-verifies reader rights per operation.
+ * Successful calls carry reader attribution for audit.
+ */
+import { evaluateReaderProfile, } from '../server/reader-profile.js';
+const SAFE_METHODS = new Set(['GET', 'HEAD']);
+/** Authorize one reader API call against the host profile (deny default). */
+export function authorizeReaderApiCall(profile, call, isApprovedAccount = () => false) {
+    const inProfile = evaluateReaderProfile(profile, {
+        subject: call.subjectId,
+        method: call.method,
+        route: call.route,
+        artifactId: call.artifactId,
+        releaseId: call.releaseId,
+    }, isApprovedAccount);
+    if (!inProfile)
+        return { allowed: false, reason: 'profile' };
+    if (!SAFE_METHODS.has(call.method)) {
+        if (call.expectedOrigin === undefined || call.origin !== call.expectedOrigin) {
+            return { allowed: false, reason: 'origin' };
+        }
+        if (call.hasCustomHeader !== true)
+            return { allowed: false, reason: 'csrf' };
+    }
+    return {
+        allowed: true,
+        attribution: {
+            subjectId: call.subjectId,
+            ...(call.artifactId === undefined ? {} : { artifactId: call.artifactId }),
+            ...(call.releaseId === undefined ? {} : { releaseId: call.releaseId }),
+        },
+    };
+}

package/dist/content/grants.d.ts

@@ -0,0 +1,57 @@
+export declare const CONTENT_GRANT_TTL_SECONDS = 55;
+export declare const CONTENT_CUTOFF_BUDGET_SECONDS = 60;
+export declare const CONTENT_TICKET_TTL_SECONDS = 120;
+export interface ContentGrantClaims {
+    subjectId: string;
+    artifactId: string;
+    releaseId?: string;
+    scope: 'read';
+    issuedAt: number;
+    expiresAt: number;
+}
+export interface GrantIssueInput {
+    subjectId: string;
+    artifactId: string;
+    releaseId?: string;
+}
+export interface GrantSigner {
+    issue(input: GrantIssueInput): string;
+    verify(token: string): ContentGrantClaims;
+}
+/** Create an HMAC grant signer over an injected secret and clock. */
+export declare function createHmacGrantSigner(options: {
+    secret: string | Uint8Array;
+    clock?: () => number;
+    ttlSeconds?: number;
+}): GrantSigner;
+export interface TicketBinding extends GrantIssueInput {
+    releaseId: string;
+    channel: 'stable' | 'pinned';
+}
+export interface TicketRecord extends TicketBinding {
+    ticketId: string;
+    expiresAt: number;
+}
+export interface TicketStore {
+    put(record: TicketRecord): Promise<void>;
+    peek(ticketId: string): Promise<TicketRecord | undefined>;
+    /** Atomically remove and return the record (single-use consumption). */
+    take(ticketId: string): Promise<TicketRecord | undefined>;
+    remove(ticketId: string): Promise<void>;
+}
+/** In-memory TicketStore double for unit tests. */
+export declare function createMemoryTicketStore(): TicketStore;
+export interface TicketService {
+    issue(input: TicketBinding): Promise<{
+        ticketId: string;
+        expiresAt: number;
+    }>;
+    redeem(ticketId: string, expected: TicketBinding): Promise<TicketRecord>;
+}
+/** Single-use bound tickets; mismatched attempts do not consume the ticket. */
+export declare function createTicketService(options: {
+    store: TicketStore;
+    clock?: () => number;
+    ids?: () => string;
+    ttlSeconds?: number;
+}): TicketService;

package/dist/content/grants.js

@@ -0,0 +1,143 @@
+/**
+ * L-5d — content grants and activation tickets (spec-v8 §9 5d).
+ *
+ * Short signed grants authorize content reads on the separate content
+ * domain: 55-second grant TTL inside a 60-second total cutoff budget
+ * (grant + skew/propagation). Grants are HMAC-SHA256 signed with a
+ * host-injected secret, bound to subject + artifact (+ pinned release),
+ * and verified fail-closed (signature, shape, lifetime cap, expiry,
+ * future-issued beyond the skew budget). Activation tickets are
+ * single-use and bound to an exact release and channel; ticket IDs come from an injected
+ * port and MUST be unguessable (default: crypto UUIDs). A grant never
+ * replaces the per-request ACL recheck in the content handler.
+ */
+import { createHmac, timingSafeEqual } from 'node:crypto';
+export const CONTENT_GRANT_TTL_SECONDS = 55;
+export const CONTENT_CUTOFF_BUDGET_SECONDS = 60;
+export const CONTENT_TICKET_TTL_SECONDS = 120;
+const SKEW_MS = (CONTENT_CUTOFF_BUDGET_SECONDS - CONTENT_GRANT_TTL_SECONDS) * 1000;
+function encodeClaims(claims) {
+    return Buffer.from(JSON.stringify(claims), 'utf8').toString('base64url');
+}
+function sign(secret, payload) {
+    return createHmac('sha256', secret).update(payload, 'utf8').digest('base64url');
+}
+/** Create an HMAC grant signer over an injected secret and clock. */
+export function createHmacGrantSigner(options) {
+    const secret = typeof options.secret === 'string'
+        ? new TextEncoder().encode(options.secret)
+        : options.secret;
+    if (secret.length === 0)
+        throw new Error('invalid grant signer: empty secret');
+    const clock = options.clock ?? (() => Date.now());
+    const ttlMs = (options.ttlSeconds ?? CONTENT_GRANT_TTL_SECONDS) * 1000;
+    return {
+        issue(input) {
+            if (input.subjectId.length === 0 || input.artifactId.length === 0) {
+                throw new Error('invalid grant: empty subject or artifact');
+            }
+            const issuedAt = clock();
+            const claims = {
+                subjectId: input.subjectId,
+                artifactId: input.artifactId,
+                ...(input.releaseId === undefined ? {} : { releaseId: input.releaseId }),
+                scope: 'read',
+                issuedAt,
+                expiresAt: issuedAt + ttlMs,
+            };
+            const payload = encodeClaims(claims);
+            return `${payload}.${sign(secret, payload)}`;
+        },
+        verify(token) {
+            const parts = token.split('.');
+            if (parts.length !== 2 || parts[0] === undefined || parts[1] === undefined) {
+                throw new Error('invalid grant: malformed token');
+            }
+            const expected = Buffer.from(sign(secret, parts[0]), 'utf8');
+            const actual = Buffer.from(parts[1], 'utf8');
+            if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) {
+                throw new Error('invalid grant: signature mismatch');
+            }
+            let claims;
+            try {
+                claims = JSON.parse(Buffer.from(parts[0], 'base64url').toString('utf8'));
+            }
+            catch {
+                throw new Error('invalid grant: malformed claims');
+            }
+            if (typeof claims.subjectId !== 'string' || claims.subjectId.length === 0 ||
+                typeof claims.artifactId !== 'string' || claims.artifactId.length === 0 ||
+                claims.scope !== 'read' ||
+                !Number.isFinite(claims.issuedAt) || !Number.isFinite(claims.expiresAt) ||
+                claims.expiresAt <= claims.issuedAt ||
+                claims.expiresAt - claims.issuedAt > CONTENT_GRANT_TTL_SECONDS * 1000) {
+                throw new Error('invalid grant: malformed claims');
+            }
+            const now = clock();
+            if (claims.issuedAt > now + SKEW_MS)
+                throw new Error('invalid grant: issued in the future');
+            if (now > claims.expiresAt)
+                throw new Error('grant expired');
+            return claims;
+        },
+    };
+}
+/** In-memory TicketStore double for unit tests. */
+export function createMemoryTicketStore() {
+    const tickets = new Map();
+    return {
+        put(record) { tickets.set(record.ticketId, record); return Promise.resolve(); },
+        peek(ticketId) { return Promise.resolve(tickets.get(ticketId)); },
+        take(ticketId) {
+            const record = tickets.get(ticketId);
+            tickets.delete(ticketId);
+            return Promise.resolve(record);
+        },
+        remove(ticketId) { tickets.delete(ticketId); return Promise.resolve(); },
+    };
+}
+/** Single-use bound tickets; mismatched attempts do not consume the ticket. */
+export function createTicketService(options) {
+    const clock = options.clock ?? (() => Date.now());
+    const ids = options.ids ?? (() => crypto.randomUUID());
+    const ttlMs = (options.ttlSeconds ?? CONTENT_TICKET_TTL_SECONDS) * 1000;
+    if (!Number.isFinite(ttlMs) || ttlMs <= 0)
+        throw new Error('invalid ticket: lifetime');
+    return {
+        async issue(input) {
+            if (typeof input.subjectId !== 'string' || input.subjectId.length === 0 ||
+                typeof input.artifactId !== 'string' || input.artifactId.length === 0 ||
+                typeof input.releaseId !== 'string' || input.releaseId.length === 0 ||
+                (input.channel !== 'stable' && input.channel !== 'pinned'))
+                throw new Error('invalid ticket: binding');
+            const ticketId = ids();
+            const expiresAt = clock() + ttlMs;
+            await options.store.put({
+                ticketId,
+                subjectId: input.subjectId,
+                artifactId: input.artifactId,
+                releaseId: input.releaseId,
+                channel: input.channel,
+                expiresAt,
+            });
+            return { ticketId, expiresAt };
+        },
+        async redeem(ticketId, expected) {
+            const record = await options.store.peek(ticketId);
+            if (record === undefined)
+                throw new Error('invalid ticket');
+            if (clock() >= record.expiresAt) {
+                await options.store.remove(ticketId);
+                throw new Error('ticket expired');
+            }
+            if (record.subjectId !== expected.subjectId || record.artifactId !== expected.artifactId ||
+                record.releaseId !== expected.releaseId || record.channel !== expected.channel) {
+                throw new Error('invalid ticket: binding mismatch');
+            }
+            const taken = await options.store.take(ticketId);
+            if (taken === undefined)
+                throw new Error('invalid ticket');
+            return taken;
+        },
+    };
+}

package/dist/content/handler.d.ts

@@ -0,0 +1,34 @@
+import type { AclStore } from '../server/access.js';
+import type { LifecycleService } from '../server/lifecycle.js';
+import type { PublicationBlobStore, PublicationService } from '../server/publication.js';
+import { type GrantSigner, type TicketService } from './grants.js';
+export interface ContentRequest {
+    method: string;
+    host: string;
+    path: string;
+    /** Host-resolved authenticated subject (edge session), when present. */
+    actorId?: string;
+    cookie?: string;
+    ticket?: string;
+}
+export interface ContentResponse {
+    status: number;
+    headers: Record<string, string>;
+    bytes?: Uint8Array;
+    body?: unknown;
+}
+export interface ContentHandlerDeps {
+    acls: AclStore;
+    lifecycle: LifecycleService;
+    publication: PublicationService;
+    blobs: PublicationBlobStore;
+    grants: GrantSigner;
+    tickets: TicketService;
+    baseDomain: string;
+    isApprovedAccount?: (principalId: string) => boolean;
+    assetCacheSeconds?: number;
+}
+/** Create the content handler over injected host ports (no server). */
+export declare function createContentHandler(deps: ContentHandlerDeps): {
+    handle(request: ContentRequest): Promise<ContentResponse>;
+};

package/dist/content/handler.js

@@ -0,0 +1,129 @@
+/**
+ * L-5d — transport-free content handler (spec-v8 §9 5d). Serves raw
+ * release bytes on the separate content domain (never HTML on the
+ * control origin). Per-version activation: a single-use ticket redeemed
+ * by the host-authenticated subject mints a short subject+artifact+
+ * release grant as a host-only cookie. Every request re-verifies the
+ * grant AND live ACL/lifecycle state, so withdrawal cuts readers at the
+ * next request (inside the 60s budget, no cache reliance). Republish
+ * demands fresh consent on the stable origin (401); pinned origins keep
+ * their release. Unknown/unreadable → same 404; bad grants → 401.
+ */
+import { errorBody } from '../http.js';
+import { CONTENT_GRANT_TTL_SECONDS } from './grants.js';
+import { contentHeaders, grantCookie, parseGrantCookie } from './headers.js';
+import { isServiceWorkerPath, parseContentHost, resolveContentPath } from './routing.js';
+function fail(status) {
+    return { status, headers: { 'content-type': 'application/json' }, body: errorBody(status) };
+}
+/** Create the content handler over injected host ports (no server). */
+export function createContentHandler(deps) {
+    const isApproved = deps.isApprovedAccount ?? (() => false);
+    async function canReadNow(artifactId, subjectId) {
+        const acl = await deps.acls.getArtifactAcl(artifactId);
+        if (acl === undefined)
+            return false;
+        const state = await deps.lifecycle.stateOf(artifactId);
+        return deps.lifecycle.canRead({ artifactId, state }, acl, subjectId, 'read', isApproved);
+    }
+    async function serveFile(artifactId, manifest, filePath) {
+        const acl = await deps.acls.getArtifactAcl(artifactId);
+        if (acl === undefined)
+            return fail(404);
+        if (acl.storageScopeId === undefined)
+            return fail(500);
+        const parsed = JSON.parse(manifest);
+        const file = (parsed.files ?? []).find((entry) => entry.path === filePath);
+        if (file === undefined || typeof file.digest !== 'string')
+            return fail(404);
+        const hex = file.digest.startsWith('sha256:') ? file.digest.slice(7) : file.digest;
+        const bytes = await deps.blobs.getBlob(`artifacts/${acl.storageScopeId}/blobs/sha256/${hex}`);
+        if (bytes === undefined)
+            return fail(404);
+        if (typeof file.size === 'number' && bytes.length !== file.size)
+            return fail(422);
+        return {
+            status: 200,
+            headers: contentHeaders({
+                mimeType: typeof file.mimeType === 'string' ? file.mimeType : 'application/octet-stream',
+                size: bytes.length,
+                assetCacheSeconds: deps.assetCacheSeconds,
+            }),
+            bytes,
+        };
+    }
+    return {
+        async handle(request) {
+            if (request.method !== 'GET' && request.method !== 'HEAD')
+                return fail(404);
+            const origin = parseContentHost(request.host, deps.baseDomain);
+            if (origin === undefined)
+                return fail(404);
+            let artifactId;
+            let release;
+            if (origin.kind === 'stable') {
+                artifactId = origin.artifactId;
+                release = await deps.publication.getCurrent(artifactId);
+            }
+            else {
+                release = await deps.publication.getRelease(origin.releaseId);
+                if (release === undefined)
+                    return fail(404);
+                const owner = JSON.parse(release.manifest).artifactId;
+                if (typeof owner !== 'string')
+                    return fail(404);
+                artifactId = owner;
+            }
+            if (release === undefined)
+                return fail(404);
+            if (request.ticket !== undefined) {
+                if (request.actorId === undefined || request.actorId.length === 0)
+                    return fail(401);
+                try {
+                    await deps.tickets.redeem(request.ticket, {
+                        subjectId: request.actorId, artifactId, releaseId: release.releaseId, channel: origin.kind,
+                    });
+                }
+                catch {
+                    return fail(401);
+                }
+                if (!(await canReadNow(artifactId, request.actorId)))
+                    return fail(404);
+                const token = deps.grants.issue({
+                    subjectId: request.actorId,
+                    artifactId,
+                    releaseId: release.releaseId,
+                });
+                return {
+                    status: 200,
+                    headers: {
+                        'content-type': 'application/json',
+                        'set-cookie': grantCookie(token, CONTENT_GRANT_TTL_SECONDS),
+                    },
+                    body: { activated: true, artifactId, releaseId: release.releaseId },
+                };
+            }
+            const token = parseGrantCookie(request.cookie);
+            if (token === undefined)
+                return fail(401);
+            let claims;
+            try {
+                claims = deps.grants.verify(token);
+            }
+            catch {
+                return fail(401);
+            }
+            if (claims.artifactId !== artifactId || claims.releaseId !== release.releaseId) {
+                return fail(401); // fresh version consent: activate this release
+            }
+            if (request.actorId !== undefined && request.actorId !== claims.subjectId)
+                return fail(401);
+            if (!(await canReadNow(artifactId, claims.subjectId)))
+                return fail(404);
+            const filePath = resolveContentPath(request.path);
+            if (filePath === undefined || isServiceWorkerPath(filePath))
+                return fail(404);
+            return serveFile(artifactId, release.manifest, filePath);
+        },
+    };
+}

package/dist/content/headers.d.ts

@@ -0,0 +1,25 @@
+/**
+ * L-5d — content response headers and the grant cookie (spec-v8 §9 5d).
+ *
+ * Untrusted HTML is served only on the separate content domain with
+ * no-store caching, MIME sniffing disabled, framing denied (embed mode
+ * is refused in this pilot) and a restrictive CSP. The declared manifest
+ * MIME type is authoritative — types are never sniffed from bytes.
+ * Non-HTML assets may be cached only when the host explicitly sets an
+ * asset cache budget; the default stays no-store (cache is never a
+ * revocation mechanism). The grant cookie is host-only (`__Host-`
+ * prefix: Secure, Path=/, no Domain attribute).
+ */
+export declare const GRANT_COOKIE_NAME = "__Host-artifacts_grant";
+export interface ContentHeaderInput {
+    mimeType: string;
+    size: number;
+    /** Explicit host opt-in for non-HTML asset caching (seconds). */
+    assetCacheSeconds?: number;
+}
+/** Security/cache headers for one served file (declared MIME wins). */
+export declare function contentHeaders(input: ContentHeaderInput): Record<string, string>;
+/** Host-only grant cookie header value (no Domain attribute, ever). */
+export declare function grantCookie(token: string, maxAgeSeconds: number): string;
+/** Extract the grant token from a Cookie header (undefined when absent). */
+export declare function parseGrantCookie(cookieHeader: string | undefined): string | undefined;

package/dist/content/headers.js

@@ -0,0 +1,56 @@
+/**
+ * L-5d — content response headers and the grant cookie (spec-v8 §9 5d).
+ *
+ * Untrusted HTML is served only on the separate content domain with
+ * no-store caching, MIME sniffing disabled, framing denied (embed mode
+ * is refused in this pilot) and a restrictive CSP. The declared manifest
+ * MIME type is authoritative — types are never sniffed from bytes.
+ * Non-HTML assets may be cached only when the host explicitly sets an
+ * asset cache budget; the default stays no-store (cache is never a
+ * revocation mechanism). The grant cookie is host-only (`__Host-`
+ * prefix: Secure, Path=/, no Domain attribute).
+ */
+export const GRANT_COOKIE_NAME = '__Host-artifacts_grant';
+const HTML_CSP = [
+    "default-src 'self'",
+    "script-src 'self' 'unsafe-inline'",
+    "style-src 'self' 'unsafe-inline'",
+    "img-src 'self' data:",
+    "connect-src 'self'",
+    "base-uri 'none'",
+    "form-action 'none'",
+    "frame-ancestors 'none'",
+].join('; ');
+/** Security/cache headers for one served file (declared MIME wins). */
+export function contentHeaders(input) {
+    const mimeType = input.mimeType.length === 0 ? 'application/octet-stream' : input.mimeType;
+    const isHtml = mimeType === 'text/html';
+    const withCharset = mimeType.startsWith('text/') ? `${mimeType}; charset=utf-8` : mimeType;
+    const cacheable = !isHtml && input.assetCacheSeconds !== undefined && input.assetCacheSeconds > 0;
+    return {
+        'content-type': withCharset,
+        'content-length': String(input.size),
+        'x-content-type-options': 'nosniff',
+        'cache-control': cacheable ? `private, max-age=${input.assetCacheSeconds}` : 'no-store',
+        'x-frame-options': 'DENY',
+        'referrer-policy': 'no-referrer',
+        ...(isHtml ? { 'content-security-policy': HTML_CSP } : {}),
+    };
+}
+/** Host-only grant cookie header value (no Domain attribute, ever). */
+export function grantCookie(token, maxAgeSeconds) {
+    return `${GRANT_COOKIE_NAME}=${token}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${maxAgeSeconds}`;
+}
+/** Extract the grant token from a Cookie header (undefined when absent). */
+export function parseGrantCookie(cookieHeader) {
+    if (cookieHeader === undefined)
+        return undefined;
+    for (const part of cookieHeader.split(';')) {
+        const trimmed = part.trim();
+        if (trimmed.startsWith(`${GRANT_COOKIE_NAME}=`)) {
+            const value = trimmed.slice(GRANT_COOKIE_NAME.length + 1);
+            return value.length === 0 ? undefined : value;
+        }
+    }
+    return undefined;
+}

package/dist/content/routing.d.ts

@@ -0,0 +1,13 @@
+export type ContentOrigin = {
+    kind: 'stable';
+    artifactId: string;
+} | {
+    kind: 'pinned';
+    releaseId: string;
+};
+/** Parse a content Host header against the configured base domain. */
+export declare function parseContentHost(host: string, baseDomain: string): ContentOrigin | undefined;
+/** Resolve a request path to a manifest file path (undefined = refuse). */
+export declare function resolveContentPath(path: string): string | undefined;
+/** True for service-worker script paths (denied in this pilot). */
+export declare function isServiceWorkerPath(filePath: string): boolean;