@verentis/sdk 0.2.2 → 0.2.3

package/dist/index.d.cts

@@ -62,6 +62,25 @@ interface VerentisTokenRefreshedMessage extends VerentisMessage {
     requestId: string;
     token: TokenInfo;
 }
+/** Single-use credential for the installation's independently registered backend. */
+interface AppBackendCredential {
+    delegationId: string;
+    backendClientId: string;
+    launchCredential: string;
+    expiresAt: string;
+}
+interface VerentisBackendCredentialRequest extends VerentisMessage {
+    type: 'verentis:backend:request';
+    requestId: string;
+    sessionId: string;
+}
+interface VerentisBackendCredentialResponse extends VerentisMessage {
+    type: 'verentis:backend:response';
+    requestId: string;
+    sessionId: string;
+    credential?: AppBackendCredential;
+    error?: string;
+}
 interface VerentisFileChangedMessage extends VerentisMessage {
     type: 'verentis:file:changed';
     path: string;
@@ -99,13 +118,18 @@ interface VerentisDirtyMessage extends VerentisMessage {
     type: 'verentis:dirty';
     isDirty: boolean;
 }
-type HostToAppMessage = VerentisInitMessage | VerentisActionInvokeMessage | VerentisTokenRefreshedMessage | VerentisFileChangedMessage | VerentisThemeMessage;
-type AppToHostMessage = VerentisReadyMessage | VerentisActionsSetMessage | VerentisActionResultMessage | VerentisTokenRefreshMessage | VerentisNavigateMessage | VerentisResizeMessage | VerentisTitleMessage | VerentisDirtyMessage;
+type HostToAppMessage = VerentisInitMessage | VerentisActionInvokeMessage | VerentisTokenRefreshedMessage | VerentisFileChangedMessage | VerentisThemeMessage | VerentisBackendCredentialResponse;
+type AppToHostMessage = VerentisReadyMessage | VerentisActionsSetMessage | VerentisActionResultMessage | VerentisTokenRefreshMessage | VerentisNavigateMessage | VerentisResizeMessage | VerentisTitleMessage | VerentisDirtyMessage | VerentisBackendCredentialRequest;
 type AppSurface = 'file' | 'workspace';
 interface AppContextBase {
     workspace: WorkspaceInfo;
     entryPoint?: EntryPointInfo;
     apiUrl: string;
+    installation?: {
+        id: string;
+        backendClientId: string;
+        authorizationGeneration: string;
+    };
 }
 /** Context for an application opened against a workspace file. */
 interface FileAppContext extends AppContextBase {
@@ -138,6 +162,8 @@ interface WorkspaceInfo {
     name: string;
 }
 interface FileInfo {
+    nodeId?: string;
+    branch?: string;
     path: string;
     name: string;
     mimeType: string;
@@ -994,8 +1020,11 @@ type BridgeListener = (data: HostToAppMessage) => void;
  * and app-to-host events (navigate, resize, dirty, etc.).
  */
 declare class Bridge {
+    private readonly expectedHostOrigin?;
     private listeners;
     private _initResolve;
+    private _initReject;
+    private _initTimer;
     private _initPromise;
     private _hostOrigin;
     private _messageHandler;
@@ -1003,7 +1032,8 @@ declare class Bridge {
     private sessionId;
     private actions;
     private requests;
-    constructor();
+    private backendRequests;
+    constructor(expectedHostOrigin?: string | undefined);
     /** Post `verentis:ready` to the host to start the handshake */
     sendReady(capabilities?: string[]): void;
     /** Wait for the host to send `verentis:init` with context and token */
@@ -1031,6 +1061,8 @@ declare class Bridge {
     setTitle(title: string): void;
     /** Signal unsaved changes to the host */
     setDirty(isDirty: boolean): void;
+    /** The host, not the app, selects the installation, file, branch and permission ceiling. */
+    requestBackendCredential(): Promise<AppBackendCredential>;
     registerAction(descriptor: HeaderAction, handler: HeaderActionHandler): HeaderActionRegistration;
     private publishActions;
     private invokeAction;
@@ -1119,13 +1151,18 @@ declare class TokenAuth implements AuthStrategy {
  * by requesting a new token from the host when nearing expiry.
  */
 declare class BridgeAuth implements AuthStrategy {
-    private readonly hostOrigin;
+    private hostOrigin;
     private _token;
     private _expiresAt;
     private _refreshTimer;
     private _pendingRefresh;
     private _messageHandler;
+    private _requestId;
+    private _refreshReject;
+    private _requestTimer;
+    private _destroyed;
     constructor(hostOrigin: string);
+    setHostOrigin(origin: string): void;
     /** Set the initial token received from the host's `verentis:init` message */
     setToken(info: TokenInfo): void;
     getAuthHeader(): Promise<string | null>;
@@ -1135,6 +1172,7 @@ declare class BridgeAuth implements AuthStrategy {
     private requestRefresh;
     private handleMessage;
     private scheduleRefresh;
+    private failRefresh;
 }
 
 /**
@@ -1164,4 +1202,4 @@ declare class BridgeAuth implements AuthStrategy {
  */
 declare function createVerentisClient(options?: VerentisClientOptions): VerentisClient;
 
-export { ApiError, ApiKeyAuth, type AppContext, type AppSurface, type AppToHostMessage, type ApplicationDisplayOptions, type ApplicationEntryPoint, type ApplicationFileType, type ApplicationLaunchConfig, type ApplicationManifest, type ApplicationSpec, type ArchiveFormat, type AuthOptions, type AuthStrategy, Bridge, BridgeAuth, type CatalogImage, ContextModule, type DeleteFileOptions, type EngineFileType, type EngineRuntime, type EngineTool, EnginesModule, type EntryPointInfo, type ExecuteEngineOptions, type Execution, type ExecutionEngine, type ExecutionEngineListOptions, type ExecutionListOptions, type ExecutionLogs, type ExecutionMode, type ExecutionResult, type ExecutionScopedOptions, type ExecutionStatus, type ExecutionTrigger, ExecutionsModule, type ExtractUploadOptions, type FileAppContext, type FileEntry, type FileInfo, FilesModule, type GetFileOptions, type HeaderAction, type HeaderActionHandler, type HeaderActionRegistration, type HeaderActionResult, type HostToAppMessage, HttpTransport, type Installation, type InstallationDetail, type InstallationLifecycleResult, type InstallationListOptions, type InstallationMode, type InstallationScopedOptions, type InstallationStatus, InstallationsModule, type InstalledPackageDescriptor, type InstalledPackagePayload, type ManifestMetadata, type MimeTypeBinding, type MoveFileOptions, type NamespacedSettings, type NavigateOptions, type OAuthConfig, type PagedResult, type ReadArchiveOptions, type RequestOptions, type ResolveInstallationOptions, type ResourceMimeTypeBinding, type ResourceRegistration, type ResourceScopedOptions, ResourcesModule, type RunFileOptions, type SandboxOptions, type SettingDeclaration, type SettingDeclarationType, type SettingGroup, type SettingItem, type SettingOption, type SettingPresence, SettingsModule, type SettingsScopedOptions, TokenAuth, type TokenInfo, type UpdateInstallationOptions, type VerentisActionInvokeMessage, type VerentisActionResultMessage, type VerentisActionsSetMessage, VerentisClient, type VerentisClientOptions, type VerentisDirtyMessage, type VerentisFileChangedMessage, type VerentisInitMessage, type VerentisMessage, type VerentisNavigateMessage, type VerentisReadyMessage, type VerentisResizeMessage, type VerentisThemeMessage, type VerentisTitleMessage, type VerentisTokenRefreshMessage, type VerentisTokenRefreshedMessage, type WaitOptions, type WorkspaceAppContext, type WorkspaceInfo, type WriteFileOptions, createVerentisClient, findBestMatch, isHeaderAction, isTerminalStatus, matchMimeType };
+export { ApiError, ApiKeyAuth, type AppBackendCredential, type AppContext, type AppSurface, type AppToHostMessage, type ApplicationDisplayOptions, type ApplicationEntryPoint, type ApplicationFileType, type ApplicationLaunchConfig, type ApplicationManifest, type ApplicationSpec, type ArchiveFormat, type AuthOptions, type AuthStrategy, Bridge, BridgeAuth, type CatalogImage, ContextModule, type DeleteFileOptions, type EngineFileType, type EngineRuntime, type EngineTool, EnginesModule, type EntryPointInfo, type ExecuteEngineOptions, type Execution, type ExecutionEngine, type ExecutionEngineListOptions, type ExecutionListOptions, type ExecutionLogs, type ExecutionMode, type ExecutionResult, type ExecutionScopedOptions, type ExecutionStatus, type ExecutionTrigger, ExecutionsModule, type ExtractUploadOptions, type FileAppContext, type FileEntry, type FileInfo, FilesModule, type GetFileOptions, type HeaderAction, type HeaderActionHandler, type HeaderActionRegistration, type HeaderActionResult, type HostToAppMessage, HttpTransport, type Installation, type InstallationDetail, type InstallationLifecycleResult, type InstallationListOptions, type InstallationMode, type InstallationScopedOptions, type InstallationStatus, InstallationsModule, type InstalledPackageDescriptor, type InstalledPackagePayload, type ManifestMetadata, type MimeTypeBinding, type MoveFileOptions, type NamespacedSettings, type NavigateOptions, type OAuthConfig, type PagedResult, type ReadArchiveOptions, type RequestOptions, type ResolveInstallationOptions, type ResourceMimeTypeBinding, type ResourceRegistration, type ResourceScopedOptions, ResourcesModule, type RunFileOptions, type SandboxOptions, type SettingDeclaration, type SettingDeclarationType, type SettingGroup, type SettingItem, type SettingOption, type SettingPresence, SettingsModule, type SettingsScopedOptions, TokenAuth, type TokenInfo, type UpdateInstallationOptions, type VerentisActionInvokeMessage, type VerentisActionResultMessage, type VerentisActionsSetMessage, type VerentisBackendCredentialRequest, type VerentisBackendCredentialResponse, VerentisClient, type VerentisClientOptions, type VerentisDirtyMessage, type VerentisFileChangedMessage, type VerentisInitMessage, type VerentisMessage, type VerentisNavigateMessage, type VerentisReadyMessage, type VerentisResizeMessage, type VerentisThemeMessage, type VerentisTitleMessage, type VerentisTokenRefreshMessage, type VerentisTokenRefreshedMessage, type WaitOptions, type WorkspaceAppContext, type WorkspaceInfo, type WriteFileOptions, createVerentisClient, findBestMatch, isHeaderAction, isTerminalStatus, matchMimeType };

package/dist/index.d.ts

@@ -62,6 +62,25 @@ interface VerentisTokenRefreshedMessage extends VerentisMessage {
     requestId: string;
     token: TokenInfo;
 }
+/** Single-use credential for the installation's independently registered backend. */
+interface AppBackendCredential {
+    delegationId: string;
+    backendClientId: string;
+    launchCredential: string;
+    expiresAt: string;
+}
+interface VerentisBackendCredentialRequest extends VerentisMessage {
+    type: 'verentis:backend:request';
+    requestId: string;
+    sessionId: string;
+}
+interface VerentisBackendCredentialResponse extends VerentisMessage {
+    type: 'verentis:backend:response';
+    requestId: string;
+    sessionId: string;
+    credential?: AppBackendCredential;
+    error?: string;
+}
 interface VerentisFileChangedMessage extends VerentisMessage {
     type: 'verentis:file:changed';
     path: string;
@@ -99,13 +118,18 @@ interface VerentisDirtyMessage extends VerentisMessage {
     type: 'verentis:dirty';
     isDirty: boolean;
 }
-type HostToAppMessage = VerentisInitMessage | VerentisActionInvokeMessage | VerentisTokenRefreshedMessage | VerentisFileChangedMessage | VerentisThemeMessage;
-type AppToHostMessage = VerentisReadyMessage | VerentisActionsSetMessage | VerentisActionResultMessage | VerentisTokenRefreshMessage | VerentisNavigateMessage | VerentisResizeMessage | VerentisTitleMessage | VerentisDirtyMessage;
+type HostToAppMessage = VerentisInitMessage | VerentisActionInvokeMessage | VerentisTokenRefreshedMessage | VerentisFileChangedMessage | VerentisThemeMessage | VerentisBackendCredentialResponse;
+type AppToHostMessage = VerentisReadyMessage | VerentisActionsSetMessage | VerentisActionResultMessage | VerentisTokenRefreshMessage | VerentisNavigateMessage | VerentisResizeMessage | VerentisTitleMessage | VerentisDirtyMessage | VerentisBackendCredentialRequest;
 type AppSurface = 'file' | 'workspace';
 interface AppContextBase {
     workspace: WorkspaceInfo;
     entryPoint?: EntryPointInfo;
     apiUrl: string;
+    installation?: {
+        id: string;
+        backendClientId: string;
+        authorizationGeneration: string;
+    };
 }
 /** Context for an application opened against a workspace file. */
 interface FileAppContext extends AppContextBase {
@@ -138,6 +162,8 @@ interface WorkspaceInfo {
     name: string;
 }
 interface FileInfo {
+    nodeId?: string;
+    branch?: string;
     path: string;
     name: string;
     mimeType: string;
@@ -994,8 +1020,11 @@ type BridgeListener = (data: HostToAppMessage) => void;
  * and app-to-host events (navigate, resize, dirty, etc.).
  */
 declare class Bridge {
+    private readonly expectedHostOrigin?;
     private listeners;
     private _initResolve;
+    private _initReject;
+    private _initTimer;
     private _initPromise;
     private _hostOrigin;
     private _messageHandler;
@@ -1003,7 +1032,8 @@ declare class Bridge {
     private sessionId;
     private actions;
     private requests;
-    constructor();
+    private backendRequests;
+    constructor(expectedHostOrigin?: string | undefined);
     /** Post `verentis:ready` to the host to start the handshake */
     sendReady(capabilities?: string[]): void;
     /** Wait for the host to send `verentis:init` with context and token */
@@ -1031,6 +1061,8 @@ declare class Bridge {
     setTitle(title: string): void;
     /** Signal unsaved changes to the host */
     setDirty(isDirty: boolean): void;
+    /** The host, not the app, selects the installation, file, branch and permission ceiling. */
+    requestBackendCredential(): Promise<AppBackendCredential>;
     registerAction(descriptor: HeaderAction, handler: HeaderActionHandler): HeaderActionRegistration;
     private publishActions;
     private invokeAction;
@@ -1119,13 +1151,18 @@ declare class TokenAuth implements AuthStrategy {
  * by requesting a new token from the host when nearing expiry.
  */
 declare class BridgeAuth implements AuthStrategy {
-    private readonly hostOrigin;
+    private hostOrigin;
     private _token;
     private _expiresAt;
     private _refreshTimer;
     private _pendingRefresh;
     private _messageHandler;
+    private _requestId;
+    private _refreshReject;
+    private _requestTimer;
+    private _destroyed;
     constructor(hostOrigin: string);
+    setHostOrigin(origin: string): void;
     /** Set the initial token received from the host's `verentis:init` message */
     setToken(info: TokenInfo): void;
     getAuthHeader(): Promise<string | null>;
@@ -1135,6 +1172,7 @@ declare class BridgeAuth implements AuthStrategy {
     private requestRefresh;
     private handleMessage;
     private scheduleRefresh;
+    private failRefresh;
 }
 
 /**
@@ -1164,4 +1202,4 @@ declare class BridgeAuth implements AuthStrategy {
  */
 declare function createVerentisClient(options?: VerentisClientOptions): VerentisClient;
 
-export { ApiError, ApiKeyAuth, type AppContext, type AppSurface, type AppToHostMessage, type ApplicationDisplayOptions, type ApplicationEntryPoint, type ApplicationFileType, type ApplicationLaunchConfig, type ApplicationManifest, type ApplicationSpec, type ArchiveFormat, type AuthOptions, type AuthStrategy, Bridge, BridgeAuth, type CatalogImage, ContextModule, type DeleteFileOptions, type EngineFileType, type EngineRuntime, type EngineTool, EnginesModule, type EntryPointInfo, type ExecuteEngineOptions, type Execution, type ExecutionEngine, type ExecutionEngineListOptions, type ExecutionListOptions, type ExecutionLogs, type ExecutionMode, type ExecutionResult, type ExecutionScopedOptions, type ExecutionStatus, type ExecutionTrigger, ExecutionsModule, type ExtractUploadOptions, type FileAppContext, type FileEntry, type FileInfo, FilesModule, type GetFileOptions, type HeaderAction, type HeaderActionHandler, type HeaderActionRegistration, type HeaderActionResult, type HostToAppMessage, HttpTransport, type Installation, type InstallationDetail, type InstallationLifecycleResult, type InstallationListOptions, type InstallationMode, type InstallationScopedOptions, type InstallationStatus, InstallationsModule, type InstalledPackageDescriptor, type InstalledPackagePayload, type ManifestMetadata, type MimeTypeBinding, type MoveFileOptions, type NamespacedSettings, type NavigateOptions, type OAuthConfig, type PagedResult, type ReadArchiveOptions, type RequestOptions, type ResolveInstallationOptions, type ResourceMimeTypeBinding, type ResourceRegistration, type ResourceScopedOptions, ResourcesModule, type RunFileOptions, type SandboxOptions, type SettingDeclaration, type SettingDeclarationType, type SettingGroup, type SettingItem, type SettingOption, type SettingPresence, SettingsModule, type SettingsScopedOptions, TokenAuth, type TokenInfo, type UpdateInstallationOptions, type VerentisActionInvokeMessage, type VerentisActionResultMessage, type VerentisActionsSetMessage, VerentisClient, type VerentisClientOptions, type VerentisDirtyMessage, type VerentisFileChangedMessage, type VerentisInitMessage, type VerentisMessage, type VerentisNavigateMessage, type VerentisReadyMessage, type VerentisResizeMessage, type VerentisThemeMessage, type VerentisTitleMessage, type VerentisTokenRefreshMessage, type VerentisTokenRefreshedMessage, type WaitOptions, type WorkspaceAppContext, type WorkspaceInfo, type WriteFileOptions, createVerentisClient, findBestMatch, isHeaderAction, isTerminalStatus, matchMimeType };
+export { ApiError, ApiKeyAuth, type AppBackendCredential, type AppContext, type AppSurface, type AppToHostMessage, type ApplicationDisplayOptions, type ApplicationEntryPoint, type ApplicationFileType, type ApplicationLaunchConfig, type ApplicationManifest, type ApplicationSpec, type ArchiveFormat, type AuthOptions, type AuthStrategy, Bridge, BridgeAuth, type CatalogImage, ContextModule, type DeleteFileOptions, type EngineFileType, type EngineRuntime, type EngineTool, EnginesModule, type EntryPointInfo, type ExecuteEngineOptions, type Execution, type ExecutionEngine, type ExecutionEngineListOptions, type ExecutionListOptions, type ExecutionLogs, type ExecutionMode, type ExecutionResult, type ExecutionScopedOptions, type ExecutionStatus, type ExecutionTrigger, ExecutionsModule, type ExtractUploadOptions, type FileAppContext, type FileEntry, type FileInfo, FilesModule, type GetFileOptions, type HeaderAction, type HeaderActionHandler, type HeaderActionRegistration, type HeaderActionResult, type HostToAppMessage, HttpTransport, type Installation, type InstallationDetail, type InstallationLifecycleResult, type InstallationListOptions, type InstallationMode, type InstallationScopedOptions, type InstallationStatus, InstallationsModule, type InstalledPackageDescriptor, type InstalledPackagePayload, type ManifestMetadata, type MimeTypeBinding, type MoveFileOptions, type NamespacedSettings, type NavigateOptions, type OAuthConfig, type PagedResult, type ReadArchiveOptions, type RequestOptions, type ResolveInstallationOptions, type ResourceMimeTypeBinding, type ResourceRegistration, type ResourceScopedOptions, ResourcesModule, type RunFileOptions, type SandboxOptions, type SettingDeclaration, type SettingDeclarationType, type SettingGroup, type SettingItem, type SettingOption, type SettingPresence, SettingsModule, type SettingsScopedOptions, TokenAuth, type TokenInfo, type UpdateInstallationOptions, type VerentisActionInvokeMessage, type VerentisActionResultMessage, type VerentisActionsSetMessage, type VerentisBackendCredentialRequest, type VerentisBackendCredentialResponse, VerentisClient, type VerentisClientOptions, type VerentisDirtyMessage, type VerentisFileChangedMessage, type VerentisInitMessage, type VerentisMessage, type VerentisNavigateMessage, type VerentisReadyMessage, type VerentisResizeMessage, type VerentisThemeMessage, type VerentisTitleMessage, type VerentisTokenRefreshMessage, type VerentisTokenRefreshedMessage, type WaitOptions, type WorkspaceAppContext, type WorkspaceInfo, type WriteFileOptions, createVerentisClient, findBestMatch, isHeaderAction, isTerminalStatus, matchMimeType };

package/dist/index.js

@@ -28,6 +28,14 @@ var BridgeAuth = class {
   _refreshTimer = null;
   _pendingRefresh = null;
   _messageHandler;
+  _requestId = null;
+  _refreshReject = null;
+  _requestTimer = null;
+  _destroyed = false;
+  setHostOrigin(origin) {
+    if (!origin || origin === "*" || origin === "null") throw new Error("A trusted host origin is required.");
+    this.hostOrigin = origin;
+  }
   /** Set the initial token received from the host's `verentis:init` message */
   setToken(info) {
     this._token = info.accessToken;
@@ -42,7 +50,9 @@ var BridgeAuth = class {
     return `Bearer ${this._token}`;
   }
   destroy() {
+    this._destroyed = true;
     if (this._refreshTimer) clearTimeout(this._refreshTimer);
+    this.failRefresh("Authentication has been destroyed.");
     if (typeof window !== "undefined") {
       window.removeEventListener("message", this._messageHandler);
     }
@@ -52,11 +62,16 @@ var BridgeAuth = class {
   }
   _refreshResolve = null;
   requestRefresh() {
+    if (this._destroyed || this.hostOrigin === "*")
+      return Promise.reject(new Error("Authentication is not initialized."));
     if (this._pendingRefresh) return this._pendingRefresh;
     const requestId = crypto.randomUUID();
-    this._pendingRefresh = new Promise((resolve) => {
+    this._requestId = requestId;
+    this._pendingRefresh = new Promise((resolve, reject) => {
       this._refreshResolve = resolve;
+      this._refreshReject = reject;
     });
+    this._requestTimer = setTimeout(() => this.failRefresh("Token refresh timed out."), 2e4);
     const message = {
       type: "verentis:token:refresh",
       version: 1,
@@ -66,21 +81,35 @@ var BridgeAuth = class {
     return this._pendingRefresh;
   }
   handleMessage(event) {
-    if (event.origin !== this.hostOrigin) return;
+    if (this._destroyed || event.origin !== this.hostOrigin || event.source !== window.parent) return;
     const data = event.data;
-    if (data?.type !== "verentis:token:refreshed") return;
+    if (data?.version !== 1 || data?.type !== "verentis:token:refreshed" || !this._requestId || data.requestId !== this._requestId || typeof data.token?.accessToken !== "string" || !Number.isFinite(Date.parse(data.token.expiresAt)) || Date.parse(data.token.expiresAt) <= Date.now() + SKEW_MS) return;
+    if (this._requestTimer) clearTimeout(this._requestTimer);
+    this._requestTimer = null;
+    this._requestId = null;
     this._token = data.token.accessToken;
     this._expiresAt = new Date(data.token.expiresAt).getTime();
     this._pendingRefresh = null;
     this._refreshResolve?.();
     this._refreshResolve = null;
+    this._refreshReject = null;
     this.scheduleRefresh();
   }
   scheduleRefresh() {
     if (this._refreshTimer) clearTimeout(this._refreshTimer);
     if (this._expiresAt === 0) return;
     const delay2 = Math.max(0, this._expiresAt - Date.now() - SKEW_MS);
-    this._refreshTimer = setTimeout(() => void this.requestRefresh(), delay2);
+    this._refreshTimer = setTimeout(() => void this.requestRefresh().catch(() => {
+    }), delay2);
+  }
+  failRefresh(message) {
+    if (this._requestTimer) clearTimeout(this._requestTimer);
+    this._requestTimer = null;
+    this._requestId = null;
+    this._pendingRefresh = null;
+    this._refreshReject?.(new Error(message));
+    this._refreshReject = null;
+    this._refreshResolve = null;
   }
 };
 
@@ -752,8 +781,24 @@ function isHeaderAction(value) {
 
 // src/transport/bridge.transport.ts
 var Bridge = class {
+  constructor(expectedHostOrigin) {
+    this.expectedHostOrigin = expectedHostOrigin;
+    this._initPromise = new Promise((resolve, reject) => {
+      this._initResolve = resolve;
+      this._initReject = reject;
+    });
+    void this._initPromise.catch(() => {
+    });
+    this._messageHandler = this.handleMessage.bind(this);
+    if (typeof window !== "undefined") {
+      window.addEventListener("message", this._messageHandler);
+    }
+  }
+  expectedHostOrigin;
   listeners = /* @__PURE__ */ new Map();
   _initResolve;
+  _initReject;
+  _initTimer;
   _initPromise;
   _hostOrigin = null;
   _messageHandler;
@@ -761,15 +806,7 @@ var Bridge = class {
   sessionId = null;
   actions = /* @__PURE__ */ new Map();
   requests = /* @__PURE__ */ new Set();
-  constructor() {
-    this._initPromise = new Promise((resolve) => {
-      this._initResolve = resolve;
-    });
-    this._messageHandler = this.handleMessage.bind(this);
-    if (typeof window !== "undefined") {
-      window.addEventListener("message", this._messageHandler);
-    }
-  }
+  backendRequests = /* @__PURE__ */ new Map();
   /** Post `verentis:ready` to the host to start the handshake */
   sendReady(capabilities) {
     console.info("[Verentis SDK] Sending verentis:ready to host");
@@ -782,6 +819,12 @@ var Bridge = class {
   }
   /** Wait for the host to send `verentis:init` with context and token */
   waitForInit() {
+    if (!this._hostOrigin && !this._destroyed && !this._initTimer) {
+      this._initTimer = setTimeout(() => {
+        this._initReject(new Error("Workspace handshake timed out."));
+        this.destroy();
+      }, 2e4);
+    }
     return this._initPromise;
   }
   /** Get the host origin (available after init) */
@@ -825,6 +868,28 @@ var Bridge = class {
   setDirty(isDirty) {
     this.postToHost({ type: "verentis:dirty", version: 1, isDirty });
   }
+  /** The host, not the app, selects the installation, file, branch and permission ceiling. */
+  requestBackendCredential() {
+    if (this._destroyed || !this.sessionId || !this._hostOrigin)
+      return Promise.reject(new Error("An initialized workspace host is required."));
+    if (this.backendRequests.size >= 4)
+      return Promise.reject(new Error("A backend credential request is already pending."));
+    const requestId = crypto.randomUUID();
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        this.backendRequests.delete(requestId);
+        reject(new Error("Backend authorization timed out."));
+      }, 2e4);
+      this.backendRequests.set(requestId, { resolve, reject, timer });
+      try {
+        this.postToHost({ type: "verentis:backend:request", version: 1, requestId, sessionId: this.sessionId });
+      } catch {
+        clearTimeout(timer);
+        this.backendRequests.delete(requestId);
+        reject(new Error("The workspace host is unavailable."));
+      }
+    });
+  }
   registerAction(descriptor, handler) {
     if (!this.sessionId || this._destroyed) throw new Error("Header actions require an initialized workspace host.");
     if (!isHeaderAction(descriptor)) throw new Error("Invalid header action.");
@@ -901,9 +966,17 @@ var Bridge = class {
   /** Clean up event listeners */
   destroy() {
     this._destroyed = true;
+    clearTimeout(this._initTimer);
+    this._initTimer = void 0;
+    if (!this._hostOrigin) this._initReject(new Error("Bridge has been destroyed."));
     this.actions.clear();
     this.requests.clear();
     this.listeners.clear();
+    for (const pending of this.backendRequests.values()) {
+      clearTimeout(pending.timer);
+      pending.reject(new Error("Bridge has been destroyed."));
+    }
+    this.backendRequests.clear();
     if (typeof window !== "undefined") {
       window.removeEventListener("message", this._messageHandler);
     }
@@ -913,8 +986,12 @@ var Bridge = class {
     const data = event.data;
     if (event.source !== window.parent || data?.version !== 1 || typeof data?.type !== "string" || !data.type.startsWith("verentis:")) return;
     if (this._hostOrigin && event.origin !== this._hostOrigin) return;
+    if (this.expectedHostOrigin && event.origin !== this.expectedHostOrigin) return;
     if (data.type === "verentis:init") {
       if (this._hostOrigin) return;
+      if (!data.context?.workspace?.id || !data.token || event.origin === "null") return;
+      clearTimeout(this._initTimer);
+      this._initTimer = void 0;
       this._hostOrigin = event.origin;
       this.sessionId = typeof data.sessionId === "string" ? data.sessionId : null;
       console.info("[Verentis SDK] Received verentis:init from host", {
@@ -925,6 +1002,18 @@ var Bridge = class {
       const initData = data;
       this._initResolve({ context: initData.context, token: initData.token });
     }
+    if (data.type === "verentis:backend:response") {
+      if (!this._hostOrigin || data.sessionId !== this.sessionId) return;
+      const pending = this.backendRequests.get(data.requestId);
+      if (!pending) return;
+      clearTimeout(pending.timer);
+      this.backendRequests.delete(data.requestId);
+      const value = data.credential;
+      if (data.error || !value || typeof value.launchCredential !== "string" || value.launchCredential.length > 512 || !value.launchCredential || typeof value.delegationId !== "string" || typeof value.backendClientId !== "string" || !Number.isFinite(Date.parse(value.expiresAt)) || Date.parse(value.expiresAt) <= Date.now())
+        pending.reject(new Error("Backend authorization was denied or is not configured."));
+      else pending.resolve(value);
+      return;
+    }
     if (data.type === "verentis:action:invoke") {
       void this.invokeAction(data);
       return;
@@ -1110,7 +1199,7 @@ var VerentisClient = class {
     this.bridge.sendReady();
     const { context, token } = await this.bridge.waitForInit();
     const hostOrigin = this.bridge.hostOrigin;
-    Object.assign(bridgeAuth, new BridgeAuth(hostOrigin));
+    bridgeAuth.setHostOrigin(hostOrigin);
     bridgeAuth.setToken(token);
     this.context.setFromAppContext(context);
     const http = new HttpTransport(