machine-bridge-mcp 1.2.11 → 2.0.0

package/src/shared/daemon-auth.d.mts

@@ -0,0 +1,20 @@
+export const DAEMON_AUTH_SCHEME: "device-signature-v1";
+export const DAEMON_PREFLIGHT_SCHEME: "device-preflight-v1";
+export const DAEMON_AUTH_CHALLENGE_TTL_SECONDS: number;
+export const DAEMON_PREFLIGHT_TTL_SECONDS: number;
+export function daemonAuthTranscript(input: {
+  challenge: unknown;
+  workerOrigin: unknown;
+  server: unknown;
+  version: unknown;
+  instanceId: unknown;
+  issuedAt: unknown;
+}): string;
+
+export function daemonPreflightTranscript(input: {
+  workerOrigin: unknown;
+  server: unknown;
+  version: unknown;
+  nonce: unknown;
+  issuedAt: unknown;
+}): string;

package/src/shared/daemon-auth.mjs

@@ -0,0 +1,55 @@
+export const DAEMON_AUTH_SCHEME = "device-signature-v1";
+export const DAEMON_PREFLIGHT_SCHEME = "device-preflight-v1";
+export const DAEMON_AUTH_CHALLENGE_TTL_SECONDS = 30;
+export const DAEMON_PREFLIGHT_TTL_SECONDS = 5 * 60;
+
+
+export function daemonPreflightTranscript(input = {}) {
+  const values = [
+    DAEMON_PREFLIGHT_SCHEME,
+    requiredOrigin(input.workerOrigin),
+    requiredText(input.server, "server", 1, 128),
+    requiredText(input.version, "version", 1, 64),
+    requiredText(input.nonce, "preflight nonce", 24, 128),
+    requiredInteger(input.issuedAt, "preflight issued at"),
+  ];
+  return values.join("\0");
+}
+
+export function daemonAuthTranscript(input = {}) {
+  const values = [
+    DAEMON_AUTH_SCHEME,
+    requiredText(input.challenge, "challenge", 16, 256),
+    requiredOrigin(input.workerOrigin),
+    requiredText(input.server, "server", 1, 128),
+    requiredText(input.version, "version", 1, 64),
+    requiredText(input.instanceId, "instance id", 16, 128),
+    requiredInteger(input.issuedAt, "issued at"),
+  ];
+  return values.join("\0");
+}
+
+function requiredText(value, label, minimum, maximum) {
+  const text = String(value || "");
+  if (text.length < minimum || text.length > maximum || /[\0\r\n]/.test(text)) {
+    throw new Error(`daemon authentication ${label} is invalid`);
+  }
+  return text;
+}
+
+function requiredOrigin(value) {
+  let url;
+  try { url = new URL(String(value || "")); } catch { throw new Error("daemon authentication Worker origin is invalid"); }
+  const secure = url.protocol === "https:";
+  const loopback = url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+  if ((!secure && !loopback) || url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+    throw new Error("daemon authentication Worker origin is invalid");
+  }
+  return url.origin;
+}
+
+function requiredInteger(value, label) {
+  const number = Number(value);
+  if (!Number.isSafeInteger(number) || number <= 0) throw new Error(`daemon authentication ${label} is invalid`);
+  return String(number);
+}

package/src/worker/account-admin.ts

@@ -1,4 +1,6 @@
+import { ADMIN_AUTH_SCHEME, ADMIN_AUTH_TTL_SECONDS, adminAuthTranscript } from "../shared/admin-auth.mjs";
 import { json, methodNotAllowed, parseRequestBody } from "./http.ts";
+import { consumeBoundedNonce } from "./nonce-store.ts";
 import {
   accountByName, createAccount, publicAccount, replaceAccountPassword, revokeAccountCredentials,
   safeEqual, updateAccount, type AccountRecord, type OAuthStore,
@@ -7,10 +9,67 @@ import {
 const BODY_LIMIT_BYTES = 64 * 1024;
 const MAX_ACCOUNTS = 64;
 
-export async function accountAdminAuthorized(request: Request, expected: string): Promise<boolean> {
-  const header = request.headers.get("authorization") ?? "";
-  const supplied = /^Bearer\s+(.+)$/i.exec(header)?.[1] ?? "";
-  return Boolean(expected && await safeEqual(supplied, expected));
+export interface AccountAdminAuthorization {
+  nonce: string;
+  expiresAt: number;
+}
+
+export async function accountAdminAuthorized(
+  request: Request,
+  expected: string,
+  now = Math.floor(Date.now() / 1000),
+): Promise<AccountAdminAuthorization | null> {
+  if (!expected) return null;
+  const scheme = request.headers.get("X-Bridge-Admin-Scheme") || "";
+  const issuedAt = Number(request.headers.get("X-Bridge-Admin-Time"));
+  const nonce = request.headers.get("X-Bridge-Admin-Nonce") || "";
+  const bodyHash = request.headers.get("X-Bridge-Admin-Body-SHA256") || "";
+  const suppliedSignature = request.headers.get("X-Bridge-Admin-Signature") || "";
+  if (scheme !== ADMIN_AUTH_SCHEME) return null;
+  if (!Number.isSafeInteger(issuedAt) || Math.abs(now - issuedAt) > ADMIN_AUTH_TTL_SECONDS) return null;
+  if (!/^[A-Za-z0-9_-]{32,128}$/.test(nonce) || !/^[a-f0-9]{64}$/.test(bodyHash) || !/^[A-Za-z0-9_-]{43}$/.test(suppliedSignature)) return null;
+  let transcript: string;
+  try {
+    transcript = adminAuthTranscript({
+      origin: new URL(request.url).origin,
+      method: request.method.toUpperCase(),
+      pathname: new URL(request.url).pathname,
+      bodyHash,
+      issuedAt,
+      nonce,
+    });
+  } catch {
+    return null;
+  }
+  const key = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(expected),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"],
+  );
+  const expectedSignature = base64Url(new Uint8Array(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(transcript))));
+  if (!(await safeEqual(suppliedSignature, expectedSignature))) return null;
+  const body = new Uint8Array(await request.clone().arrayBuffer());
+  if (body.byteLength > BODY_LIMIT_BYTES) return null;
+  const actualBodyHash = hex(new Uint8Array(await crypto.subtle.digest("SHA-256", body)));
+  if (!(await safeEqual(bodyHash, actualBodyHash))) return null;
+  return { nonce, expiresAt: Math.max(now, issuedAt) + ADMIN_AUTH_TTL_SECONDS };
+}
+
+export async function consumeAccountAdminNonce(
+  storage: DurableObjectStorage,
+  authorization: AccountAdminAuthorization,
+  now = Math.floor(Date.now() / 1000),
+): Promise<boolean> {
+  return consumeBoundedNonce(storage, {
+    key: "account-admin-nonces",
+    nonce: authorization.nonce,
+    expiresAt: authorization.expiresAt,
+    now,
+    noncePattern: /^[A-Za-z0-9_-]{32,128}$/,
+    maximum: 256,
+  });
 }
 
 export async function handleAccountAdminOperation(options: {
@@ -101,3 +160,13 @@ async function rotatePassword(request: Request, store: OAuthStore, save: () => P
 function activeOwnerCount(store: OAuthStore): number {
   return Object.values(store.accounts).filter((account) => account.active && account.role === "owner").length;
 }
+
+function base64Url(bytes: Uint8Array): string {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+
+function hex(bytes: Uint8Array): string {
+  return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}

package/src/worker/daemon-auth.ts

@@ -0,0 +1,205 @@
+import { DAEMON_AUTH_CHALLENGE_TTL_SECONDS, DAEMON_AUTH_SCHEME, DAEMON_PREFLIGHT_SCHEME, DAEMON_PREFLIGHT_TTL_SECONDS, daemonAuthTranscript, daemonPreflightTranscript } from "../shared/daemon-auth.mjs";
+import { safeEqual } from "./oauth-state.ts";
+import { consumeBoundedNonce } from "./nonce-store.ts";
+
+export interface DaemonChallenge {
+  scheme: typeof DAEMON_AUTH_SCHEME;
+  challenge: string;
+  issuedAt: number;
+  expiresAt: number;
+  workerOrigin: string;
+}
+
+export function createDaemonChallenge(workerOrigin: string, now = Math.floor(Date.now() / 1000)): DaemonChallenge {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  return {
+    scheme: DAEMON_AUTH_SCHEME,
+    challenge: `daemon_challenge_${base64Url(bytes)}`,
+    issuedAt: now,
+    expiresAt: now + DAEMON_AUTH_CHALLENGE_TTL_SECONDS,
+    workerOrigin: normalizeWorkerOrigin(workerOrigin),
+  };
+}
+
+
+export function sanitizeDaemonChallengeAttachment(value: Record<string, unknown>): Partial<{
+  authChallenge: string;
+  authIssuedAt: number;
+  authExpiresAt: number;
+  workerOrigin: string;
+}> {
+  const authChallenge = typeof value.authChallenge === "string" && /^daemon_challenge_[A-Za-z0-9_-]{40,96}$/.test(value.authChallenge)
+    ? value.authChallenge
+    : undefined;
+  const authIssuedAt = positiveSafeInteger(value.authIssuedAt);
+  const authExpiresAt = positiveSafeInteger(value.authExpiresAt);
+  let workerOrigin: string | undefined;
+  try { workerOrigin = normalizeWorkerOrigin(String(value.workerOrigin || "")); } catch {}
+  return { authChallenge, authIssuedAt, authExpiresAt, workerOrigin };
+}
+
+export interface DaemonPreflightAuthorization {
+  nonce: string;
+  expiresAt: number;
+}
+
+export async function verifyDaemonPreflight(input: {
+  publicKeyJson: string;
+  headers: Headers;
+  workerOrigin: string;
+  server: string;
+  version: string;
+  now?: number;
+}): Promise<DaemonPreflightAuthorization | null> {
+  const now = Number.isSafeInteger(input.now) ? Number(input.now) : Math.floor(Date.now() / 1000);
+  const scheme = input.headers.get("X-Bridge-Device-Scheme") || "";
+  const keyId = input.headers.get("X-Bridge-Device-Key") || "";
+  const nonce = input.headers.get("X-Bridge-Device-Nonce") || "";
+  const issuedAt = Number(input.headers.get("X-Bridge-Device-Time"));
+  const signature = decodeBase64Url(input.headers.get("X-Bridge-Device-Signature") || "", 64);
+  if (scheme !== DAEMON_PREFLIGHT_SCHEME || !signature) return null;
+  if (!Number.isSafeInteger(issuedAt) || Math.abs(now - issuedAt) > DAEMON_PREFLIGHT_TTL_SECONDS) return null;
+  if (!/^[A-Za-z0-9_-]{24,128}$/.test(nonce)) return null;
+  let publicJwk: JsonWebKey;
+  try { publicJwk = parsePublicJwk(input.publicKeyJson); } catch { return null; }
+  if (!(await safeEqual(keyId, await publicKeyId(publicJwk)))) return null;
+  let transcript: string;
+  try {
+    transcript = daemonPreflightTranscript({
+      workerOrigin: input.workerOrigin,
+      server: input.server,
+      version: input.version,
+      nonce,
+      issuedAt,
+    });
+  } catch {
+    return null;
+  }
+  try {
+    const key = await crypto.subtle.importKey("jwk", publicJwk, { name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]);
+    const valid = await crypto.subtle.verify(
+      { name: "ECDSA", hash: "SHA-256" },
+      key,
+      signature,
+      new TextEncoder().encode(transcript),
+    );
+    return valid ? { nonce, expiresAt: issuedAt + DAEMON_PREFLIGHT_TTL_SECONDS } : null;
+  } catch {
+    return null;
+  }
+}
+
+
+export async function consumeDaemonPreflightNonce(
+  storage: DurableObjectStorage,
+  authorization: DaemonPreflightAuthorization,
+  now = Math.floor(Date.now() / 1000),
+): Promise<boolean> {
+  return consumeBoundedNonce(storage, {
+    key: "daemon-preflight-nonces",
+    nonce: authorization.nonce,
+    expiresAt: authorization.expiresAt,
+    now,
+    noncePattern: /^[A-Za-z0-9_-]{24,128}$/,
+    maximum: 128,
+  });
+}
+
+export async function verifyDaemonAuthentication(input: {
+  publicKeyJson: string;
+  authentication: unknown;
+  challenge: DaemonChallenge;
+  server: string;
+  version: string;
+  instanceId: string;
+  now?: number;
+}): Promise<boolean> {
+  const now = Number.isSafeInteger(input.now) ? Number(input.now) : Math.floor(Date.now() / 1000);
+  if (now < input.challenge.issuedAt - 5 || now > input.challenge.expiresAt) return false;
+  if (!input.authentication || typeof input.authentication !== "object" || Array.isArray(input.authentication)) return false;
+  const auth = input.authentication as Record<string, unknown>;
+  if (auth.scheme !== DAEMON_AUTH_SCHEME) return false;
+  if (!(await safeEqual(String(auth.challenge || ""), input.challenge.challenge))) return false;
+  if (Number(auth.issued_at) !== input.challenge.issuedAt) return false;
+  const signature = decodeBase64Url(String(auth.signature || ""), 64);
+  if (!signature) return false;
+  let publicJwk: JsonWebKey;
+  try { publicJwk = parsePublicJwk(input.publicKeyJson); } catch { return false; }
+  const expectedKeyId = await publicKeyId(publicJwk);
+  if (!(await safeEqual(String(auth.key_id || ""), expectedKeyId))) return false;
+  let transcript: string;
+  try {
+    transcript = daemonAuthTranscript({
+      challenge: input.challenge.challenge,
+      workerOrigin: input.challenge.workerOrigin,
+      server: input.server,
+      version: input.version,
+      instanceId: input.instanceId,
+      issuedAt: input.challenge.issuedAt,
+    });
+  } catch {
+    return false;
+  }
+  try {
+    const key = await crypto.subtle.importKey("jwk", publicJwk, { name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]);
+    return crypto.subtle.verify(
+      { name: "ECDSA", hash: "SHA-256" },
+      key,
+      signature,
+      new TextEncoder().encode(transcript),
+    );
+  } catch {
+    return false;
+  }
+}
+
+function parsePublicJwk(value: string): JsonWebKey {
+  const parsed = JSON.parse(value) as JsonWebKey;
+  if (!parsed || parsed.kty !== "EC" || parsed.crv !== "P-256") throw new Error("invalid device public key");
+  if (typeof parsed.x !== "string" || typeof parsed.y !== "string" || parsed.d !== undefined) throw new Error("invalid device public key");
+  return { kty: "EC", crv: "P-256", x: parsed.x, y: parsed.y, ext: true, key_ops: ["verify"] };
+}
+
+async function publicKeyId(jwk: JsonWebKey): Promise<string> {
+  const canonical = JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y });
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonical));
+  return `device_${base64Url(new Uint8Array(digest)).slice(0, 32)}`;
+}
+
+function decodeBase64Url(value: string, expectedBytes: number): Uint8Array<ArrayBuffer> | null {
+  if (!/^[A-Za-z0-9_-]+$/.test(value)) return null;
+  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+  const padding = "=".repeat((4 - (normalized.length % 4)) % 4);
+  try {
+    const binary = atob(normalized + padding);
+    if (binary.length !== expectedBytes) return null;
+    const bytes = new Uint8Array(expectedBytes);
+    for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
+    return bytes;
+  } catch {
+    return null;
+  }
+}
+
+function base64Url(bytes: Uint8Array): string {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+
+
+function positiveSafeInteger(value: unknown): number | undefined {
+  const number = Number(value);
+  return Number.isSafeInteger(number) && number > 0 ? number : undefined;
+}
+
+function normalizeWorkerOrigin(value: string): string {
+  const url = new URL(value);
+  const secure = url.protocol === "https:";
+  const loopback = url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+  if ((!secure && !loopback) || url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+    throw new Error("invalid Worker origin");
+  }
+  return url.origin;
+}

package/src/worker/daemon-sockets.ts

@@ -1,6 +1,7 @@
 import { isLiveDaemonAttachment, withDaemonLastSeenAt, type DaemonRole } from "./daemon-liveness.ts";
 import { sanitizeMetadataText } from "./http.ts";
 import { sanitizeDaemonPolicy, sanitizeDaemonTools, type DaemonPolicy } from "./policy.ts";
+import { sanitizeDaemonChallengeAttachment, type DaemonChallenge } from "./daemon-auth.ts";
 
 export interface DaemonAttachment {
   role: DaemonRole;
@@ -10,6 +11,10 @@ export interface DaemonAttachment {
   instanceId?: string;
   policy?: DaemonPolicy;
   tools?: string[];
+  authChallenge?: string;
+  authIssuedAt?: number;
+  authExpiresAt?: number;
+  workerOrigin?: string;
 }
 
 interface WebSocketContext {
@@ -33,6 +38,7 @@ export class DaemonSocketRegistry {
       instanceId: sanitizeDaemonInstanceId(candidate.instanceId),
       policy,
       tools: sanitizeDaemonTools(candidate.tools, policy),
+      ...sanitizeDaemonChallengeAttachment(candidate as Record<string, unknown>),
     };
   }
 
@@ -52,8 +58,15 @@ export class DaemonSocketRegistry {
     return this.context.getWebSockets().filter((socket) => this.attachment(socket)?.role !== "daemon" && socket.readyState === WebSocket.OPEN);
   }
 
-  beginCandidate(socket: WebSocket, connectedAt = new Date().toISOString()): void {
-    socket.serializeAttachment({ role: "candidate", connectedAt } satisfies DaemonAttachment);
+  beginCandidate(socket: WebSocket, challenge: DaemonChallenge, connectedAt = new Date().toISOString()): void {
+    socket.serializeAttachment({
+      role: "candidate",
+      connectedAt,
+      authChallenge: challenge.challenge,
+      authIssuedAt: challenge.issuedAt,
+      authExpiresAt: challenge.expiresAt,
+      workerOrigin: challenge.workerOrigin,
+    } satisfies DaemonAttachment);
   }
 
   beginProbe(socket: WebSocket, values: { connectedAt: string; probeId: string; instanceId: string; policy: DaemonPolicy; tools: string[] }): void {

package/src/worker/index.ts

@@ -11,6 +11,7 @@ import {
   isFreshDaemonCandidate,
 } from "./daemon-liveness.ts";
 import { DaemonSocketRegistry } from "./daemon-sockets.ts";
+import { consumeDaemonPreflightNonce, createDaemonChallenge, verifyDaemonAuthentication, verifyDaemonPreflight } from "./daemon-auth.ts";
 import { mcpClientRequestKey, resolveMcpSession } from "./mcp-session.ts";
 import { daemonToolTimeoutMs } from "./tool-timeout.ts";
 import { WorkerObservability } from "./observability.ts";
@@ -20,7 +21,7 @@ import { accountRoleAllowsTool, accountRoleToolNames, type AccountRole } from ".
 import { OAuthController, type AuthorizedToken, type OAuthControllerEnv } from "./oauth-controller.ts";
 import { accountAuthoritySnapshot, decorateProjectOverview, describeDaemonCeiling } from "./authority.ts";
 import { serverInfoTool, workspaceTools } from "./tool-catalog.ts";
-import { OFFLINE_ACCESS_SCOPE, randomToken, safeEqual } from "./oauth-state.ts";
+import { OFFLINE_ACCESS_SCOPE, randomToken } from "./oauth-state.ts";
 import {
   HttpError, applyCors, baseUrl, bearerToken, corsPreflight, json, methodNotAllowed,
   parseJsonRequest, workerErrorClass,
@@ -34,7 +35,7 @@ import {
 } from "./websocket-protocol.ts";
 
 const SERVER_NAME = String(serverMetadata.name);
-const SERVER_VERSION = "1.2.11";
+const SERVER_VERSION = "2.0.0";
 const MCP_PROTOCOL_VERSION = String(serverMetadata.protocolVersion);
 const MCP_SUPPORTED_PROTOCOL_VERSIONS = serverMetadata.supportedProtocolVersions.map((value) => String(value));
 const DEFAULT_MAX_BODY_BYTES = 8 * 1024 * 1024;
@@ -46,7 +47,7 @@ const DAEMON_RECONNECT_GRACE_MS = 30_000;
 interface BridgeEnv extends OAuthControllerEnv {
   BRIDGE: DurableObjectNamespace<BridgeRoom>;
   ACCOUNT_ADMIN_SECRET: string;
-  DAEMON_SHARED_SECRET: string;
+  DAEMON_DEVICE_PUBLIC_KEY: string;
   OAUTH_TOKEN_VERSION: string;
   MBM_WORKER_MAX_BODY_BYTES?: string;
   MBM_ALLOWED_ORIGINS?: string;
@@ -179,12 +180,34 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
         await this.scheduleSocketAlarms();
         return;
       }
-      const daemonPolicy = sanitizeDaemonPolicy(body.policy);
       const instanceId = daemonInstanceId(body.instance_id);
       if (!instanceId) {
         rejectDaemonMessage(ws, "invalid_daemon_instance", 1002, "daemon instance id required");
         return;
       }
+      if (!socketAttachment.authChallenge || !socketAttachment.authIssuedAt || !socketAttachment.authExpiresAt || !socketAttachment.workerOrigin) {
+        rejectDaemonMessage(ws, "missing_daemon_challenge", 1008, "daemon challenge missing");
+        return;
+      }
+      const authenticated = await verifyDaemonAuthentication({
+        publicKeyJson: this.env.DAEMON_DEVICE_PUBLIC_KEY ?? "",
+        authentication: body.authentication,
+        challenge: {
+          scheme: "device-signature-v1",
+          challenge: socketAttachment.authChallenge,
+          issuedAt: socketAttachment.authIssuedAt,
+          expiresAt: socketAttachment.authExpiresAt,
+          workerOrigin: socketAttachment.workerOrigin,
+        },
+        server: SERVER_NAME,
+        version: SERVER_VERSION,
+        instanceId,
+      });
+      if (!authenticated) {
+        rejectDaemonMessage(ws, "daemon_authentication_failed", 1008, "daemon authentication failed");
+        return;
+      }
+      const daemonPolicy = sanitizeDaemonPolicy(body.policy);
       const authenticatedAt = new Date().toISOString();
       const probeId = randomToken("probe");
       this.daemonRegistry.beginProbe(ws, {
@@ -482,7 +505,12 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
       try {
         socket.send(JSON.stringify({
           type: "tool_call", id, tool: name, arguments: args, timeout_ms: timeoutMs,
-          authorization: { account_id: authorized.accountId, account_version: authorized.accountVersion, role: authorized.role },
+          authorization: {
+            account_id: authorized.accountId,
+            account_version: authorized.accountVersion,
+            client_id: authorized.clientId,
+            role: authorized.role,
+          },
         }));
       } catch {
         this.pending.reject(id, new WorkerToolError("network_error", "failed to send daemon tool call", true), socket);
@@ -508,9 +536,19 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
 
   private async acceptDaemonWebSocket(request: Request): Promise<Response> {
     if (request.headers.get("Upgrade")?.toLowerCase() !== "websocket") return new Response("Expected Upgrade: websocket", { status: 426 });
-    const expected = this.env.DAEMON_SHARED_SECRET ?? "";
-    const supplied = request.headers.get("X-Bridge-Token") ?? "";
-    if (!expected || !(await safeEqual(supplied, expected))) return new Response("Unauthorized daemon", { status: 401 });
+    if (!this.env.DAEMON_DEVICE_PUBLIC_KEY) return new Response("Daemon device identity is not configured", { status: 503 });
+    const workerOrigin = new URL(request.url).origin;
+    const preflight = await verifyDaemonPreflight({
+      publicKeyJson: this.env.DAEMON_DEVICE_PUBLIC_KEY,
+      headers: request.headers,
+      workerOrigin,
+      server: SERVER_NAME,
+      version: SERVER_VERSION,
+    });
+    if (!preflight || !(await consumeDaemonPreflightNonce(this.ctx.storage, preflight))) {
+      return new Response("Unauthorized daemon device", { status: 401 });
+    }
+    const challenge = createDaemonChallenge(workerOrigin);
 
     for (const socket of this.daemonRegistry.nonReadySockets()) {
       closeWebSocketQuietly(socket, 1012, "replaced by newer daemon candidate");
@@ -520,9 +558,20 @@ export class BridgeRoom extends DurableObject<BridgeEnv> {
     const [client, server] = Object.values(pair) as [WebSocket, WebSocket];
     this.ctx.acceptWebSocket(server);
     this.observability.socketCandidate();
-    this.daemonRegistry.beginCandidate(server);
+    this.daemonRegistry.beginCandidate(server, challenge);
     await this.scheduleSocketAlarms();
-    server.send(JSON.stringify({ type: "welcome", server: SERVER_NAME, version: SERVER_VERSION }));
+    server.send(JSON.stringify({
+      type: "welcome",
+      server: SERVER_NAME,
+      version: SERVER_VERSION,
+      worker_origin: workerOrigin,
+      authentication: {
+        scheme: challenge.scheme,
+        challenge: challenge.challenge,
+        issued_at: challenge.issuedAt,
+        expires_at: challenge.expiresAt,
+      },
+    }));
     return new Response(null, { status: 101, webSocket: client });
   }
 

package/src/worker/nonce-store.ts

@@ -0,0 +1,79 @@
+interface NonceStorage {
+  get<T = unknown>(key: string): Promise<T | undefined>;
+  put(key: string, value: unknown): Promise<void>;
+}
+
+interface TransactionalNonceStorage extends NonceStorage {
+  transaction<T>(callback: (transaction: NonceStorage) => Promise<T>): Promise<T>;
+}
+
+export async function consumeBoundedNonce(
+  storage: DurableObjectStorage | NonceStorage,
+  options: {
+    key: string;
+    nonce: string;
+    expiresAt: number;
+    now: number;
+    noncePattern: RegExp;
+    maximum: number;
+  },
+): Promise<boolean> {
+  validateOptions(options);
+  const consume = (target: NonceStorage) => consumeInStorage(target, options);
+  if (hasTransactions(storage)) return storage.transaction(consume);
+  return consume(storage);
+}
+
+async function consumeInStorage(
+  storage: NonceStorage,
+  options: {
+    key: string;
+    nonce: string;
+    expiresAt: number;
+    now: number;
+    noncePattern: RegExp;
+    maximum: number;
+  },
+): Promise<boolean> {
+  const raw = await storage.get<unknown>(options.key);
+  if (raw !== undefined && !validNonceRecord(raw, options.noncePattern)) return false;
+  const nonces: Record<string, number> = raw ? { ...raw as Record<string, number> } : {};
+  for (const [nonce, expiresAt] of Object.entries(nonces)) {
+    if (expiresAt <= options.now) delete nonces[nonce];
+  }
+  if (nonces[options.nonce]) return false;
+  nonces[options.nonce] = options.expiresAt;
+  const entries = Object.entries(nonces).sort((left, right) => left[1] - right[1] || left[0].localeCompare(right[0]));
+  while (entries.length > options.maximum) {
+    const [nonce] = entries.shift()!;
+    delete nonces[nonce];
+  }
+  await storage.put(options.key, nonces);
+  return true;
+}
+
+function validateOptions(options: {
+  key: string;
+  nonce: string;
+  expiresAt: number;
+  now: number;
+  noncePattern: RegExp;
+  maximum: number;
+}): void {
+  if (!/^[a-z][a-z0-9-]{1,127}$/.test(options.key)) throw new Error("nonce-store key is invalid");
+  if (!options.noncePattern.test(options.nonce)) throw new Error("nonce-store nonce is invalid");
+  if (!Number.isSafeInteger(options.now) || options.now <= 0) throw new Error("nonce-store current time is invalid");
+  if (!Number.isSafeInteger(options.expiresAt) || options.expiresAt <= options.now) throw new Error("nonce-store expiration is invalid");
+  if (!Number.isSafeInteger(options.maximum) || options.maximum < 1 || options.maximum > 4096) throw new Error("nonce-store maximum is invalid");
+}
+
+function validNonceRecord(value: unknown, noncePattern: RegExp): value is Record<string, number> {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  return Object.entries(value).every(([nonce, expiresAt]) => (
+    noncePattern.test(nonce) && Number.isSafeInteger(expiresAt) && expiresAt > 0
+  ));
+}
+
+function hasTransactions(storage: DurableObjectStorage | NonceStorage): storage is TransactionalNonceStorage {
+  return typeof (storage as Partial<TransactionalNonceStorage>).transaction === "function";
+}