@songsid/agend 2.3.5-alpha.4 → 2.3.5-alpha.5

package/dist/hub/policy.js

@@ -0,0 +1,147 @@
+/**
+ * AgEnD Hub P1, slice 3: authorization now (hub.md §2 "Durable delivery", §3, §5 HubPolicy).
+ *
+ * Every boundary — admission, begin, each tool, answer release, and each room read or dispatch — re-resolves the facts
+ * from the persisted message and the current link. The facts are: the same asker, owner, grant and exposure revision,
+ * the room open, the grant active in its window, the exposure published and not frozen, and both people eligible in
+ * the directory NOW. Nothing a caller sends (a person field, a lease DTO) stands in for them.
+ * A lease is a server-owned record: one exact operation (its digest), this link epoch, at most five seconds.
+ */
+import { randomUUID } from "node:crypto";
+import { HubProtocolError } from "./validation.js";
+import { operationDigest, personKeyString } from "./identity.js";
+import { validateAuthorization } from "./protocol.js";
+import { exposureOf, grantApplies, grantOf, readExposure, readGrant } from "./catalog.js";
+import { personFromString } from "./http/core.js";
+export const LEASE_MS = 5_000;
+/** P1 question lifetime (hub.md §2: at most 24 hours). */
+export const QUESTION_LIFETIME_MS = 24 * 60 * 60_000;
+export const TERMINAL = new Set(["rejected", "cancelled", "failed"]);
+const POSITIVE = ["delivered", "consumed", "answered"];
+export const readMessage = (db, id) => db.prepare("SELECT * FROM hub_messages WHERE id=?").get(id);
+/** The message's room, grant and exposure as they are now — the synchronous half of "authorize now". */
+export function messageFacts(db, msg, now) {
+    if (msg.expires_at <= now)
+        return { ok: false, reason: "expired" };
+    if (TERMINAL.has(msg.stage))
+        return { ok: false, reason: "denied" };
+    const room = db.prepare("SELECT state FROM hub_rooms WHERE id=?").get(msg.room_id);
+    if (!room || room.state !== "active")
+        return { ok: false, reason: "revoked" };
+    const g = readGrant(db, msg.grant_id), e = readExposure(db, msg.exposure_id);
+    if (!g || !e)
+        return { ok: false, reason: "revoked" };
+    const grant = grantOf(g), exposure = exposureOf(e);
+    if (grant.revision !== msg.grant_revision || exposure.revision !== msg.exposure_revision)
+        return { ok: false, reason: "stale" };
+    if (exposure.state !== "published" || exposure.fleetId !== msg.fleet_id || personKeyString(exposure.owner) !== msg.owner)
+        return { ok: false, reason: "revoked" };
+    if (!grantApplies(grant, exposure, personFromString(msg.asker), now))
+        return { ok: false, reason: "revoked" };
+    return { ok: true, exposure, grant };
+}
+export class HubPolicyService {
+    core;
+    constructor(core) {
+        this.core = core;
+    }
+    /** Both people of a message are eligible in the directory now (two fresh lookups, bounded). */
+    async peopleEligible(msg) {
+        return (await this.core.eligible(personFromString(msg.asker))) && (await this.core.eligible(personFromString(msg.owner)));
+    }
+    /** A member's `authorize.request` on its current link → a lease for exactly that operation, or a bounded refusal. */
+    async authorize(input, link) {
+        let request;
+        try {
+            request = validateAuthorization(input);
+        }
+        catch {
+            return { ok: false, reasonCode: "invalid" };
+        }
+        const refuse = (reasonCode, msg) => {
+            try {
+                this.core.atomic((_db, tx) => this.core.audit(tx, { requestId: randomUUID(), actor: { kind: "member", fleetId: link.fleetId }, action: `authorize.${request.phase}`,
+                    result: "denied", reasonCode, messageId: request.messageId, fleetId: link.fleetId, ...(msg ? { roomId: msg.room_id, exposureId: msg.exposure_id, ownerAtEvent: personFromString(msg.owner), grantId: msg.grant_id, grantRevision: msg.grant_revision } : {}) }));
+            }
+            catch { /* the refusal stands even when its audit cannot be written */ }
+            return { ok: false, reasonCode };
+        };
+        let first;
+        try {
+            first = this.core.atomic((db) => readMessage(db, request.messageId));
+        }
+        catch {
+            return { ok: false, reasonCode: "unavailable" };
+        }
+        // Another fleet's message is "not-found": a member never learns what it was not sent.
+        if (!first || first.fleet_id !== link.fleetId)
+            return refuse("not-found");
+        if (request.exposureRevision !== first.exposure_revision)
+            return refuse("stale", first);
+        let eligible;
+        try {
+            eligible = await this.peopleEligible(first);
+        }
+        catch (e) {
+            return refuse(e instanceof HubProtocolError && e.code === "backpressure" ? "unavailable" : "unavailable", first);
+        }
+        if (!eligible)
+            return refuse("revoked", first);
+        if (!link.current())
+            return { ok: false, reasonCode: "stale" };
+        const now = this.core.now();
+        try {
+            return this.core.atomic((db, tx) => {
+                const msg = readMessage(db, request.messageId);
+                const facts = messageFacts(db, msg, now);
+                if (!facts.ok)
+                    throw new HubProtocolError(facts.reason);
+                if (request.phase === "admit" && msg.stage !== "queued")
+                    throw new HubProtocolError("conflict");
+                if ((request.phase === "begin" || request.phase === "tool") && (msg.stage === "answered" || msg.answer_id))
+                    throw new HubProtocolError("conflict");
+                if (request.phase === "tool" && !facts.exposure.allowedTools.includes(request.tool.name))
+                    throw new HubProtocolError("denied");
+                if (request.phase === "release-answer" && msg.answer_id
+                    && (msg.answer_id !== request.answer.answerId || msg.answer_digest !== request.answer.contentDigest))
+                    throw new HubProtocolError("conflict");
+                if (!link.current())
+                    throw new HubProtocolError("stale");
+                const lease = { decisionId: randomUUID(), messageId: msg.id, operationId: request.operationId, phase: request.phase,
+                    operationDigest: operationDigest(request), revocationVersion: this.core.revocationVersion(), exposureRevision: msg.exposure_revision,
+                    linkEpoch: link.linkEpoch, expiresAt: now + LEASE_MS };
+                db.prepare(`INSERT INTO hub_leases(decision_id, fleet_id, link_epoch, message_id, operation_id, phase, operation_digest, exposure_revision, revocation_version, expires_at)
+          VALUES(?,?,?,?,?,?,?,?,?,?)`).run(lease.decisionId, link.fleetId, lease.linkEpoch, lease.messageId, lease.operationId, lease.phase, lease.operationDigest, lease.exposureRevision, lease.revocationVersion, lease.expiresAt);
+                this.core.audit(tx, { requestId: lease.decisionId, actor: { kind: "member", fleetId: link.fleetId }, action: `authorize.${request.phase}`, result: "allowed",
+                    messageId: msg.id, roomId: msg.room_id, fleetId: link.fleetId, exposureId: msg.exposure_id, ownerAtEvent: personFromString(msg.owner),
+                    grantId: msg.grant_id, grantRevision: msg.grant_revision });
+                return { ok: true, lease };
+            });
+        }
+        catch (e) {
+            const code = e instanceof HubProtocolError ? e.code : "unavailable";
+            return refuse(["denied", "stale", "revoked", "expired", "conflict"].find((c) => c === code) ?? "unavailable", first);
+        }
+    }
+    /**
+     * The release lease an answer frame carries, checked against the Hub's own record of it: same fleet, link epoch,
+     * message, exact answer id/digest (via the operation digest), unexpired, unused. It is then spent.
+     */
+    spendReleaseLease(db, lease, answer, link, now) {
+        const row = db.prepare("SELECT * FROM hub_leases WHERE decision_id=?").get(lease.decisionId);
+        if (!row || row.fleet_id !== link.fleetId || row.link_epoch !== link.linkEpoch || row.phase !== "release-answer" || row.message_id !== answer.messageId)
+            throw new HubProtocolError("denied");
+        const expected = operationDigest({ messageId: answer.messageId, operationId: row.operation_id, exposureRevision: row.exposure_revision, phase: "release-answer",
+            answer: { answerId: answer.answerId, contentDigest: answer.contentDigest } });
+        if (row.operation_digest !== expected || lease.operationDigest !== expected || lease.operationId !== row.operation_id || lease.linkEpoch !== row.link_epoch
+            || lease.expiresAt !== row.expires_at || lease.exposureRevision !== row.exposure_revision || lease.revocationVersion !== row.revocation_version)
+            throw new HubProtocolError("denied");
+        if (row.expires_at <= now)
+            throw new HubProtocolError("expired");
+        if (row.consumed)
+            throw new HubProtocolError("conflict");
+        db.prepare("UPDATE hub_leases SET consumed=1 WHERE decision_id=?").run(lease.decisionId);
+    }
+}
+export { POSITIVE };
+//# sourceMappingURL=policy.js.map

package/dist/hub/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/hub/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAGtD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAgB,MAAM,gBAAgB,CAAC;AAEhE,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,CAAC;AAC9B,0DAA0D;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AACrD,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;AACrE,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AAQvD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,EAAqB,EAAE,EAAU,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC,GAAG,CAAC,EAAE,CAA2B,CAAC;AAGxJ,wGAAwG;AACxG,MAAM,UAAU,YAAY,CAAC,EAAqB,EAAE,GAAe,EAAE,GAAW;IAC9E,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACnE,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACpE,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAkC,CAAC;IACpH,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC9E,MAAM,CAAC,GAAG,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7E,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,cAAc,IAAI,QAAQ,CAAC,QAAQ,KAAK,GAAG,CAAC,iBAAiB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAChI,IAAI,QAAQ,CAAC,KAAK,KAAK,WAAW,IAAI,QAAQ,CAAC,OAAO,KAAK,GAAG,CAAC,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAClK,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC9G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,OAAO,gBAAgB;IACE,IAAI;IAAjC,YAA6B,IAAa;oBAAb,IAAI;IAAY,CAAC;IAE9C,+FAA+F;IAC/F,KAAK,CAAC,cAAc,CAAC,GAAwC;QAC3D,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5H,CAAC;IAED,qHAAqH;IACrH,KAAK,CAAC,SAAS,CAAC,KAA8B,EAAE,IAAoB;QAClE,IAAI,OAAgC,CAAC;QACrC,IAAI,CAAC;YAAC,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;QAAC,CAAC;QACtG,MAAM,MAAM,GAAG,CAAC,UAAiG,EAAE,GAAgB,EAA0B,EAAE;YAC7J,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,OAAO,CAAC,KAAK,EAAE;oBACjK,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACrQ,CAAC;YAAC,MAAM,CAAC,CAAC,8DAA8D,CAAC,CAAC;YAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QACnC,CAAC,CAAC;QACF,IAAI,KAA6B,CAAC;QAClC,IAAI,CAAC;YAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;QAAC,CAAC;QACxI,sFAAsF;QACtF,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;QAC1E,IAAI,OAAO,CAAC,gBAAgB,KAAK,KAAK,CAAC,iBAAiB;YAAE,OAAO,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACxF,IAAI,QAAiB,CAAC;QACtB,IAAI,CAAC;YAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,OAAO,MAAM,CAAC,CAAC,YAAY,gBAAgB,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QACpL,IAAI,CAAC,QAAQ;YAAE,OAAO,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE;gBACjC,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,CAAE,CAAC;gBAChD,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;gBACzC,IAAI,CAAC,KAAK,CAAC,EAAE;oBAAE,MAAM,IAAI,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACxD,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;oBAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;gBAChG,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,UAAU,IAAI,GAAG,CAAC,SAAS,CAAC;oBAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;gBACnJ,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;gBAC/H,IAAI,OAAO,CAAC,KAAK,KAAK,gBAAgB,IAAI,GAAG,CAAC,SAAS;uBAClD,CAAC,GAAG,CAAC,SAAS,KAAK,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,aAAa,KAAK,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC;oBAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;gBAC/I,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;oBAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBACzD,MAAM,KAAK,GAA0B,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK;oBACxI,eAAe,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,gBAAgB,EAAE,GAAG,CAAC,iBAAiB;oBACpI,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC;gBACzD,EAAE,CAAC,OAAO,CAAC;sCACmB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,eAAe,EACzJ,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;gBACpE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,OAAO,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS;oBAC1J,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC;oBACrI,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;gBAC9D,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,KAAK,EAAE,CAAC;YACtC,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,CAAC,YAAY,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;YACpE,OAAO,MAAM,CAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,CAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,aAAa,EAAE,KAAK,CAAC,CAAC;QAClI,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,EAAqB,EAAE,KAA4B,EAAE,MAAsE,EAAE,IAAoB,EAAE,GAAW;QAC9K,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAC2I,CAAC;QACvO,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,KAAK,KAAK,gBAAgB,IAAI,GAAG,CAAC,UAAU,KAAK,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC9L,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,YAAY,EAAE,gBAAgB,EAAE,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,gBAAgB;YAC7J,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAChF,IAAI,GAAG,CAAC,gBAAgB,KAAK,QAAQ,IAAI,KAAK,CAAC,eAAe,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,GAAG,CAAC,YAAY,IAAI,KAAK,CAAC,SAAS,KAAK,GAAG,CAAC,UAAU;eACtJ,KAAK,CAAC,SAAS,KAAK,GAAG,CAAC,UAAU,IAAI,KAAK,CAAC,gBAAgB,KAAK,GAAG,CAAC,iBAAiB,IAAI,KAAK,CAAC,iBAAiB,KAAK,GAAG,CAAC,kBAAkB;YAAE,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACxL,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG;YAAE,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,GAAG,CAAC,QAAQ;YAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACzD,EAAE,CAAC,OAAO,CAAC,sDAAsD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC3F,CAAC;CACF;AAED,OAAO,EAAE,QAAQ,EAAE,CAAC"}

package/dist/hub/preview.d.ts

@@ -0,0 +1,32 @@
+/** Optional authority-free preview origin: HTML arrives only through the fleet shim's postMessage. */
+import type { IncomingMessage, ServerResponse } from "node:http";
+export interface HubPreviewSettings {
+    host: string;
+    port: number;
+    origin: string;
+}
+export interface HubPreviewView {
+    dashboardOrigin: string;
+    previewOrigin: string | null;
+    bootId: string | null;
+    reasonCode?: "notOffered";
+    reason?: string;
+}
+/** Local setting, outside the sealed initialization digest, but included in runtime reload admission. */
+export declare function hubPreviewReloadKey(web: unknown): string;
+export declare function hubPreviewSettings(input: {
+    web?: unknown;
+    webOrigin: string;
+    memberOrigin: string;
+    webListen: {
+        host: string;
+        port: number;
+    };
+    memberListen: {
+        host: string;
+        port: number;
+    };
+}): HubPreviewSettings | null;
+export declare function hubPreviewView(webOrigin: string, settings: HubPreviewSettings | null, bootId: string): Readonly<HubPreviewView>;
+/** No session, file, token, Cookie, Origin or Referer is read. Exact Host + GET /frame is the entire surface. */
+export declare function createHubPreviewHandler(settings: HubPreviewSettings, webOrigin: string, bootId: string, current: () => boolean): (req: IncomingMessage, res: ServerResponse) => void;

package/dist/hub/preview.js

@@ -0,0 +1,64 @@
+import { previewFrameResponse } from "../web-preview.js";
+import { HubStateError } from "./db.js";
+const record = (v) => v !== null && typeof v === "object" && !Array.isArray(v) ? v : null;
+/** Local setting, outside the sealed initialization digest, but included in runtime reload admission. */
+export function hubPreviewReloadKey(web) {
+    if (web === undefined)
+        return "off";
+    const value = record(web);
+    if (!value)
+        return JSON.stringify(["invalid", web]);
+    return Object.prototype.hasOwnProperty.call(value, "preview_port") ? JSON.stringify(["port", value.preview_port]) : "off";
+}
+export function hubPreviewSettings(input) {
+    const bad = (detail) => { throw new HubStateError("hub-unsealed", `hub.web.preview_port ${detail}`); };
+    if (input.web === undefined)
+        return null;
+    const web = record(input.web);
+    if (!web)
+        return bad("requires hub.web to be an object");
+    if (!Object.prototype.hasOwnProperty.call(web, "preview_port"))
+        return null;
+    const port = web.preview_port;
+    if (typeof port !== "number" || !Number.isInteger(port) || port < 1 || port > 65535)
+        return bad("must be an integer from 1 to 65535 (omit it to disable previews)");
+    let origin;
+    try {
+        origin = new URL(input.webOrigin);
+    }
+    catch {
+        return bad("requires a bare HTTPS Hub web origin");
+    }
+    if (origin.protocol !== "https:" || origin.username || origin.password || origin.search || origin.hash || origin.pathname !== "/")
+        return bad("requires a bare HTTPS Hub web origin");
+    const dashboardOrigin = origin.origin;
+    origin.port = String(port);
+    if (origin.origin === dashboardOrigin || origin.origin === new URL(input.memberOrigin).origin
+        || port === input.webListen.port || port === input.memberListen.port)
+        return bad("must differ from the Hub web and member listeners and origins");
+    return { host: input.webListen.host, port, origin: origin.origin };
+}
+export function hubPreviewView(webOrigin, settings, bootId) {
+    const dashboardOrigin = new URL(webOrigin).origin;
+    const view = settings ? { dashboardOrigin, previewOrigin: settings.origin, bootId }
+        : { dashboardOrigin, previewOrigin: null, bootId: null, reasonCode: "notOffered", reason: "HTML previews are not configured on this Hub." };
+    return Object.freeze(view);
+}
+/** No session, file, token, Cookie, Origin or Referer is read. Exact Host + GET /frame is the entire surface. */
+export function createHubPreviewHandler(settings, webOrigin, bootId, current) {
+    const response = previewFrameResponse(bootId, [new URL(webOrigin).origin], { cdn: false });
+    const host = new URL(settings.origin).host;
+    return (req, res) => {
+        if (!current()) {
+            res.writeHead(503, { "Cache-Control": "no-store" }).end();
+            return;
+        }
+        if (req.method !== "GET" || req.url !== "/frame" || typeof req.headers.host !== "string" || req.headers.host.toLowerCase() !== host) {
+            res.writeHead(404, { "Cache-Control": "no-store" }).end();
+            return;
+        }
+        res.writeHead(200, response.headers);
+        res.end(response.body);
+    };
+}
+//# sourceMappingURL=preview.js.map

package/dist/hub/preview.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview.js","sourceRoot":"","sources":["../../src/hub/preview.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAOxC,MAAM,MAAM,GAAG,CAAC,CAAU,EAAkC,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAA4B,CAAC,CAAC,CAAC,IAAI,CAAC;AAE9J,yGAAyG;AACzG,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;IACpD,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5H,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAGlC;IACC,MAAM,GAAG,GAAG,CAAC,MAAc,EAAS,EAAE,GAAG,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,wBAAwB,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtH,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC,kCAAkC,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC;IAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK;QAAE,OAAO,GAAG,CAAC,kEAAkE,CAAC,CAAC;IACpK,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,GAAG,CAAC,sCAAsC,CAAC,CAAC;IAAC,CAAC;IACxG,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACtL,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC;IACtC,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM;WACxF,IAAI,KAAK,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,KAAK,KAAK,CAAC,YAAY,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC,+DAA+D,CAAC,CAAC;IACpJ,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,QAAmC,EAAE,MAAc;IACnG,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;IAClD,MAAM,IAAI,GAAmB,QAAQ,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE;QACjG,CAAC,CAAC,EAAE,eAAe,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;IAC9I,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,uBAAuB,CAAC,QAA4B,EAAE,SAAiB,EAAE,MAAc,EAAE,OAAsB;IAC7H,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,EAAE,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;IAC3C,OAAO,CAAC,GAAoB,EAAE,GAAmB,EAAQ,EAAE;QACzD,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QACtF,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;YACpI,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YAAC,OAAO;QACpE,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC,CAAC;AACJ,CAAC"}

package/dist/hub/private-files.d.ts

@@ -0,0 +1,5 @@
+export declare function privatePath(home: string, suffix: string, directory?: boolean): string;
+export declare function ensurePrivateDirectory(home: string, suffix: string): string;
+export declare function readPrivateFile(home: string, suffix: string, maximum?: number, options?: {
+    preserveBom?: boolean;
+}): string;

package/dist/hub/private-files.js

@@ -0,0 +1,44 @@
+/** Hub-on composition only. Native Windows callers need a verified ACL adapter before support can be enabled. */
+import { lstatSync, mkdirSync, readFileSync, realpathSync } from "node:fs";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+export function privatePath(home, suffix, directory = false) {
+    if (process.platform === "win32")
+        throw Error("Hub private Windows ACL verification is unavailable");
+    const root = resolve(home), path = resolve(root, suffix), rel = relative(root, path);
+    if (isAbsolute(suffix) || rel.startsWith(`..${sep}`) || rel === ".." || isAbsolute(rel))
+        throw Error("Invalid Hub private path");
+    for (const part of [root, ...rel.split(sep).filter(Boolean).map((_, i, pieces) => join(root, ...pieces.slice(0, i + 1)))]) {
+        const s = lstatSync(part), last = part === path;
+        if (s.isSymbolicLink() || s.uid !== process.getuid?.() || (s.mode & 0o077) !== 0
+            || last && (directory ? !s.isDirectory() : !s.isFile()) || !last && !s.isDirectory())
+            throw Error("Hub private file permissions are invalid");
+    }
+    if (realpathSync(path) !== path)
+        throw Error("Hub private path changed");
+    return path;
+}
+export function ensurePrivateDirectory(home, suffix) {
+    privatePath(home, "", true);
+    let current = "";
+    for (const part of suffix.split("/")) {
+        if (!part || part === "." || part === ".." || part.includes("\\"))
+            throw Error("Invalid Hub private directory");
+        current = current ? `${current}/${part}` : part;
+        try {
+            mkdirSync(join(home, current), { mode: 0o700 });
+        }
+        catch (e) {
+            if (e.code !== "EEXIST")
+                throw e;
+        }
+        privatePath(home, current, true);
+    }
+    return join(home, suffix);
+}
+export function readPrivateFile(home, suffix, maximum = 64 * 1024, options = {}) {
+    const path = privatePath(home, suffix), s = lstatSync(path);
+    if (s.size > maximum)
+        throw Error("Hub private file is too large");
+    return new TextDecoder("utf-8", { fatal: true, ignoreBOM: options.preserveBom === true }).decode(readFileSync(path));
+}
+//# sourceMappingURL=private-files.js.map

package/dist/hub/private-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-files.js","sourceRoot":"","sources":["../../src/hub/private-files.ts"],"names":[],"mappings":"AAAA,iHAAiH;AACjH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACrE,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,MAAc,EAAE,SAAS,GAAG,KAAK;IACzE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACrG,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrF,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACjI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1H,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC;QAChD,IAAI,CAAC,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;eAC3E,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,MAAM,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAClJ,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI;QAAE,MAAM,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC;AACd,CAAC;AACD,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,MAAc;IACjE,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAChH,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAChD,IAAI,CAAC;YAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,CAAC,CAAC;QAAC,CAAC;QACnI,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC5B,CAAC;AACD,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,MAAc,EAAE,OAAO,GAAG,EAAE,GAAG,IAAI,EAAE,OAAO,GAA8B,EAAE;IACxH,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC,CAAC,IAAI,GAAG,OAAO;QAAE,MAAM,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnE,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;AACvH,CAAC"}

package/dist/hub/profile.d.ts

@@ -0,0 +1,59 @@
+import { z } from "zod";
+import { type HubPairingIdentity } from "./pairing.js";
+export declare const profileSchema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    hub: z.ZodObject<{
+        hubId: z.ZodString;
+        memberOrigin: z.ZodString;
+        webOrigin: z.ZodString;
+        spkiSha256: z.ZodString;
+        issuerPublicKey: z.ZodString;
+    }, z.core.$strict>;
+    owner: z.ZodObject<{
+        realm: z.ZodString;
+        objectId: z.ZodString;
+    }, z.core.$strict>;
+    fleetId: z.ZodString;
+    certificatePem: z.ZodString;
+    credential: z.ZodString;
+    issuerKeyId: z.ZodString;
+}, z.core.$strict>;
+export declare const pendingSchema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    hub: z.ZodObject<{
+        hubId: z.ZodString;
+        memberOrigin: z.ZodString;
+        webOrigin: z.ZodString;
+        spkiSha256: z.ZodString;
+        issuerPublicKey: z.ZodString;
+    }, z.core.$strict>;
+    owner: z.ZodObject<{
+        realm: z.ZodString;
+        objectId: z.ZodString;
+    }, z.core.$strict>;
+    fleetId: z.ZodString;
+    certificatePem: z.ZodString;
+    pairingId: z.ZodString;
+    claimSecret: z.ZodString;
+    fingerprint: z.ZodString;
+    expiresAt: z.ZodNumber;
+}, z.core.$strict>;
+export type HubMemberProfile = z.infer<typeof profileSchema>;
+export type HubPendingPairing = z.infer<typeof pendingSchema>;
+export declare function validateHubBinding<T extends {
+    hub: HubPairingIdentity;
+    certificatePem: string;
+}>(input: T, now?: number | null): T;
+export declare class HubMemberProfileStore {
+    private readonly home;
+    readonly hubId: string;
+    constructor(home: string, hubId: string);
+    private suffix;
+    private read;
+    readProfile(): HubMemberProfile;
+    readPending(): HubPendingPairing;
+    profileDigest(): string | null;
+    savePending(input: HubPendingPairing, current: () => boolean): void;
+    saveProfile(input: HubMemberProfile, expectedDigest: string | null, current: () => boolean): void;
+    clearPending(): void;
+}

package/dist/hub/profile.js

@@ -0,0 +1,73 @@
+/** Local-owner-only pairing receipts. The UI receives projections, never these secrets. */
+import { existsSync, unlinkSync } from "node:fs";
+import { join } from "node:path";
+import { createPublicKey } from "node:crypto";
+import { z } from "zod";
+import { atomicWriteFileSync } from "../atomic-write.js";
+import { ensurePrivateDirectory, readPrivateFile } from "./private-files.js";
+import { hubOrigin, verifyHubCertificate, verifyHubCertificateBinding } from "./tls.js";
+import { hash, person, token, uuid, epoch, validated, parseStrictJson, HubProtocolError } from "./validation.js";
+import { sha256, issuerKeyId } from "./identity.js";
+import { hubPairingFingerprint } from "./pairing.js";
+const identity = z.strictObject({ hubId: uuid, memberOrigin: z.string(), webOrigin: z.string(), spkiSha256: hash, issuerPublicKey: z.string().max(2048) });
+const base = { v: z.literal(1), hub: identity, owner: person, fleetId: uuid, certificatePem: z.string().max(16 * 1024) };
+export const profileSchema = z.strictObject({ ...base, credential: token, issuerKeyId: hash });
+export const pendingSchema = z.strictObject({ ...base, pairingId: uuid, claimSecret: token, fingerprint: hash, expiresAt: epoch });
+export function validateHubBinding(input, now = Date.now()) {
+    if (hubOrigin(input.hub.memberOrigin) !== input.hub.memberOrigin || hubOrigin(input.hub.webOrigin) !== input.hub.webOrigin || input.hub.memberOrigin === input.hub.webOrigin)
+        throw new HubProtocolError();
+    if (now === null)
+        verifyHubCertificateBinding(input.certificatePem, input.hub.memberOrigin, input.hub.spkiSha256);
+    else
+        verifyHubCertificate(input.certificatePem, input.hub.memberOrigin, input.hub.spkiSha256, now);
+    const key = createPublicKey(input.hub.issuerPublicKey);
+    if (key.asymmetricKeyType !== "ed25519" || key.export({ type: "spki", format: "pem" }).toString() !== input.hub.issuerPublicKey)
+        throw new HubProtocolError();
+    return input;
+}
+export class HubMemberProfileStore {
+    home;
+    hubId;
+    constructor(home, hubId) {
+        this.home = home;
+        this.hubId = hubId;
+        validated(uuid, hubId);
+    }
+    suffix(name) { return `hub-member/${this.hubId}/${name}.json`; }
+    read(name) { return parseStrictJson(readPrivateFile(this.home, this.suffix(name))); }
+    readProfile() {
+        const p = validateHubBinding(validated(profileSchema, this.read("pairing")), null);
+        if (p.hub.hubId !== this.hubId || issuerKeyId(createPublicKey(p.hub.issuerPublicKey)) !== p.issuerKeyId)
+            throw new HubProtocolError();
+        return p;
+    }
+    readPending() {
+        const p = validateHubBinding(validated(pendingSchema, this.read("pending")), null);
+        if (p.hub.hubId !== this.hubId || p.fingerprint !== hubPairingFingerprint(p.hub, p.pairingId, p.owner, sha256(p.claimSecret)))
+            throw new HubProtocolError();
+        return p;
+    }
+    profileDigest() { return existsSync(join(this.home, this.suffix("pairing"))) ? sha256(readPrivateFile(this.home, this.suffix("pairing"))) : null; }
+    savePending(input, current) {
+        const p = validateHubBinding(validated(pendingSchema, input));
+        if (!current() || p.hub.hubId !== this.hubId || p.fingerprint !== hubPairingFingerprint(p.hub, p.pairingId, p.owner, sha256(p.claimSecret)))
+            throw new HubProtocolError("stale");
+        ensurePrivateDirectory(this.home, `hub-member/${this.hubId}`);
+        if (existsSync(join(this.home, this.suffix("pending"))))
+            throw new HubProtocolError("conflict");
+        atomicWriteFileSync(join(this.home, this.suffix("pending")), JSON.stringify(p), { mode: 0o600, beforeRename: () => { if (!current())
+                throw new HubProtocolError("stale"); } });
+    }
+    saveProfile(input, expectedDigest, current) {
+        const p = validateHubBinding(validated(profileSchema, input));
+        if (!current() || p.hub.hubId !== this.hubId || this.profileDigest() !== expectedDigest || issuerKeyId(createPublicKey(p.hub.issuerPublicKey)) !== p.issuerKeyId)
+            throw new HubProtocolError("stale");
+        ensurePrivateDirectory(this.home, `hub-member/${this.hubId}`);
+        atomicWriteFileSync(join(this.home, this.suffix("pairing")), JSON.stringify(p), { mode: 0o600, beforeRename: () => {
+                if (!current() || this.profileDigest() !== expectedDigest)
+                    throw new HubProtocolError("stale");
+            } });
+    }
+    clearPending() { readPrivateFile(this.home, this.suffix("pending")); unlinkSync(join(this.home, this.suffix("pending"))); }
+}
+//# sourceMappingURL=profile.js.map

package/dist/hub/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/hub/profile.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,UAAU,CAAC;AACxF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACjH,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAA2B,MAAM,cAAc,CAAC;AAC9E,MAAM,QAAQ,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC3J,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;AACzH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;AAGnI,MAAM,UAAU,kBAAkB,CAAgE,KAAQ,EAAE,GAAG,GAAkB,IAAI,CAAC,GAAG,EAAE;IACzI,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,YAAY,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,KAAK,KAAK,CAAC,GAAG,CAAC,SAAS;QAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;IAC3M,IAAI,GAAG,KAAK,IAAI;QAAE,2BAA2B,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;;QAC7G,oBAAoB,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACnG,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACvD,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,KAAK,CAAC,GAAG,CAAC,eAAe;QAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;IAC9J,OAAO,KAAK,CAAC;AACf,CAAC;AACD,MAAM,OAAO,qBAAqB;IACH,IAAI;IAAmB,KAAK;IAAzD,YAA6B,IAAY,EAAW,KAAa;oBAApC,IAAI;qBAAmB,KAAK;QAAY,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IACtF,MAAM,CAAC,IAAY,IAAY,OAAO,cAAc,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC,IAAY,IAAa,OAAO,eAAe,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9G,WAAW;QACT,MAAM,CAAC,GAAG,kBAAkB,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACnF,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW;YAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;QAAC,OAAO,CAAC,CAAC;IAClJ,CAAC;IACD,WAAW;QACT,MAAM,CAAC,GAAG,kBAAkB,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACnF,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,WAAW,KAAK,qBAAqB,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;QAAC,OAAO,CAAC,CAAC;IACxK,CAAC;IACD,aAAa,KAAoB,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAClK,WAAW,CAAC,KAAwB,EAAE,OAAsB;QAC1D,MAAM,CAAC,GAAG,kBAAkB,CAAC,SAAS,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,WAAW,KAAK,qBAAqB,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACjL,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9D,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAChG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE;gBAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjL,CAAC;IACD,WAAW,CAAC,KAAuB,EAAE,cAA6B,EAAE,OAAsB;QACxF,MAAM,CAAC,GAAG,kBAAkB,CAAC,SAAS,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,aAAa,EAAE,KAAK,cAAc,IAAI,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW;YAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACtM,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9D,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE;gBAChH,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,aAAa,EAAE,KAAK,cAAc;oBAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACjG,CAAC,EAAE,CAAC,CAAC;IACP,CAAC;IACD,YAAY,KAAW,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAClI"}