@volter/teams 0.1.11 → 0.1.13

package/LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 supercode contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",
@@ -29,6 +29,7 @@
     "./server/viewer": "./server/viewer.mjs"
   },
   "files": [
+    "LICENSE-MIT",
     "*.mjs",
     "server",
     "viewer",

package/server/delegated.mjs

@@ -19,6 +19,9 @@ const CAPS = {
   folder: { control: ['files'], view: ['observe'] },
   pane: { control: ['observe', 'control'], view: ['observe'] },
 };
+
+/** The daemon caps a surface of `kind` grants at `scope`, capped at the publication's `maxScope` (the narrower wins). */
+export const surfaceCaps = (kind, scope, maxScope = 'control') => CAPS[kind]?.[scope === 'control' && maxScope === 'control' ? 'control' : 'view'] ?? null;
 const KEYS_TTL_MS = 5 * 60 * 1000;
 const SKEW_S = 30;
 // A delegated token lives at most 15 minutes (exp - iat, and exp - now). The viewer asks its page for a fresh one

package/server/machine-link.mjs

@@ -16,7 +16,7 @@
 // and the caps the token names, expiring with the token; its channel closes then, or when the surface is unpublished.
 import { Channel } from '../channel.mjs';
 import { bearer } from './auth.mjs';
-import { delegatedAccessOf, delegatedPrincipal, looksDelegated } from './delegated.mjs';
+import { delegatedAccessOf, delegatedPrincipal, looksDelegated, surfaceCaps } from './delegated.mjs';
 import { delegatedGrantIssuer, publicationFor } from './publications.mjs';
 
 const LINK_PROTOCOL = 'supercode-machine-link.v1';
@@ -196,7 +196,7 @@ async function delegatedChannel(api, teamId, machineId, token) {
     ], [
       // Delegated grants live as long as their tokens; the expired ones go as new ones come.
       { sql: "DELETE FROM machine_grants WHERE team_id=? AND issuer_id LIKE 'delegated:%' AND expires_at<=?", params: [teamId, now] },
-      { sql: 'INSERT INTO machine_grants(team_id,id,machine_id,subject_id,caps_json,targets_json,issuer_id,created_at,expires_at) VALUES (?,?,?,?,?,?,?,?,?)', params: [teamId, id, machineId, principal, JSON.stringify(access.caps), JSON.stringify([publication.target]), issuer, now, access.expiresAt] },
+      { sql: 'INSERT INTO machine_grants(team_id,id,machine_id,subject_id,caps_json,targets_json,issuer_id,created_at,expires_at) VALUES (?,?,?,?,?,?,?,?,?)', params: [teamId, id, machineId, principal, JSON.stringify(surfaceCaps(access.kind, access.scope, publication.max_scope)), JSON.stringify([publication.target]), issuer, now, access.expiresAt] },
     ]);
   } catch (error) {
     if (error.code === 'not_found') return { status: 404, code: 'not_found', message: 'machine not found' };

package/server/migrations/007.mjs

@@ -0,0 +1,6 @@
+// Schema migration 007 (SQLite DDL), applied in order by store-core migrate().
+export default `-- Schema 7: a publication's widest scope. A workplace's token picks view or control, but the custodian
+-- decides what a surface offers: a publication capped at view opens as view whatever the token says, so a
+-- workplace key that is misused can at most watch it. Publications made before this offered control.
+ALTER TABLE machine_publications ADD COLUMN max_scope TEXT NOT NULL DEFAULT 'control' CHECK(max_scope IN ('view','control'));
+`;

package/server/migrations/index.mjs

@@ -5,4 +5,5 @@ import m003 from './003.mjs';
 import m004 from './004.mjs';
 import m005 from './005.mjs';
 import m006 from './006.mjs';
-export const MIGRATIONS = [m001, m002, m003, m004, m005, m006];
+import m007 from './007.mjs';
+export const MIGRATIONS = [m001, m002, m003, m004, m005, m006, m007];

package/server/publications.mjs

@@ -21,7 +21,7 @@ export function publishableTarget(kind, target) {
 }
 
 const originOf = (text) => { try { const url = new URL(text); return (url.protocol === 'https:' || url.protocol === 'http:') && url.origin === text ? text : null; } catch { return null; } };
-const json = (row) => ({ id: row.id, machine_id: row.machine_id, kind: row.kind, target: row.target, workplace: row.workplace, room: row.room, surface_key: row.surface_key, publisher_id: row.publisher_id, created_at: row.created_at });
+const json = (row) => ({ id: row.id, machine_id: row.machine_id, kind: row.kind, target: row.target, workplace: row.workplace, room: row.room, surface_key: row.surface_key, publisher_id: row.publisher_id, max_scope: row.max_scope ?? 'control', created_at: row.created_at });
 /** The grant issuer a delegated grant minted on one publication carries, so unpublishing finds exactly those grants. */
 export const delegatedGrantIssuer = (issuer, publicationId) => `delegated:${new URL(issuer).host}/${publicationId}`;
 
@@ -72,7 +72,10 @@ export async function publicationRoute({ api, req, res, auth, machineId, publica
   }
   if (req.method === 'POST' && !publicationId) {
     if (!custodian) fail(403, 'forbidden', "only the machine's custodian publishes its panes and folders");
-    const body = await parseJson(req); exact(body, ['kind', 'target', 'workplace', 'room', 'surface_key']);
+    const body = await parseJson(req); exact(body, ['kind', 'target', 'workplace', 'room', 'surface_key', 'max_scope']);
+    // The widest a workplace's token can open the surface: control (watch and drive) unless the custodian caps it at view.
+    const maxScope = body.max_scope ?? 'control';
+    if (maxScope !== 'view' && maxScope !== 'control') fail(400, 'invalid_request', 'max_scope must be view or control');
     if (body.kind !== 'pane' && body.kind !== 'folder') fail(400, 'invalid_request', 'kind must be pane or folder');
     if (!publishableTarget(body.kind, body.target)) fail(400, 'invalid_request', body.kind === 'pane' ? 'target must be one pane, pane:<key> (no wildcard)' : 'target must be one absolute folder, root:/path (not root:/, no wildcard, normalized)');
     const workplace = typeof body.workplace === 'string' ? originOf(body.workplace) : null;
@@ -82,13 +85,14 @@ export async function publicationRoute({ api, req, res, auth, machineId, publica
     if (body.surface_key !== undefined && (typeof body.surface_key !== 'string' || !body.surface_key || body.surface_key.length > 256)) fail(400, 'invalid_request', 'surface_key must be a non-empty string');
     const existing = await api.store.one('SELECT * FROM machine_publications WHERE team_id=? AND machine_id=? AND target=? AND workplace=? AND room=?', [auth.team_id, machineId, body.target, workplace, body.room]);
     // Publishing the same surface again answers the record already there.
-    if (existing && existing.kind === body.kind) return send(res, 200, result(api, auth, json(existing)), requestId);
+    if (existing && existing.kind === body.kind && (existing.max_scope ?? 'control') === maxScope) return send(res, 200, result(api, auth, json(existing)), requestId);
+    if (existing && existing.kind === body.kind) fail(409, 'conflict', `that surface is already published with max scope ${existing.max_scope}; unpublish it first`);
     if (existing) fail(409, 'conflict', 'that target is already published as another kind');
     const now = api.clock.nowMs(), id = api.ids.next('publication');
-    const row = { id, machine_id: machineId, kind: body.kind, target: body.target, workplace, room: body.room, surface_key: body.surface_key ?? null, publisher_id: auth.principal_id, created_at: now };
+    const row = { id, machine_id: machineId, kind: body.kind, target: body.target, workplace, room: body.room, surface_key: body.surface_key ?? null, publisher_id: auth.principal_id, max_scope: maxScope, created_at: now };
     const response = result(api, auth, json(row));
     await guardedMutation(api, res, auth, [{ sql: 'SELECT 1 ok FROM machines WHERE team_id=? AND id=? AND custodian_id=? AND revoked_at IS NULL', params: [auth.team_id, machineId, auth.principal_id], code: 'not_found', status: 404, message: 'machine not found' }], [
-      { sql: 'INSERT INTO machine_publications(team_id,id,machine_id,kind,target,workplace,room,surface_key,publisher_id,created_at) VALUES (?,?,?,?,?,?,?,?,?,?)', params: [auth.team_id, id, machineId, row.kind, row.target, row.workplace, row.room, row.surface_key, row.publisher_id, now] },
+      { sql: 'INSERT INTO machine_publications(team_id,id,machine_id,kind,target,workplace,room,surface_key,publisher_id,max_scope,created_at) VALUES (?,?,?,?,?,?,?,?,?,?,?)', params: [auth.team_id, id, machineId, row.kind, row.target, row.workplace, row.room, row.surface_key, row.publisher_id, maxScope, now] },
     ], { status: 201, body: response, targetId: id });
     return send(res, 201, response, requestId);
   }