machine-bridge-mcp 2.0.0 → 3.0.0-beta.102

package/src/local/wrangler-toolchain/package.json

@@ -0,0 +1,23 @@
+{
+  "name": "machine-bridge-mcp-wrangler-toolchain",
+  "version": "1.0.0",
+  "private": true,
+  "description": "Integrity-locked private Wrangler control-plane toolchain for Machine Bridge.",
+  "engines": {
+    "node": ">=26.0.0",
+    "npm": ">=12.0.0"
+  },
+  "dependencies": {
+    "wrangler": "4.120.0"
+  },
+  "overrides": {
+    "sharp": "0.35.3",
+    "undici": "7.29.0"
+  },
+  "allowScripts": {
+    "esbuild@0.28.1": true,
+    "fsevents": false,
+    "sharp@0.35.3": true,
+    "workerd@1.20260801.1": true
+  }
+}

package/src/local/wrangler-toolchain-verification.mjs

@@ -0,0 +1,135 @@
+import { lstatSync } from "node:fs";
+import path from "node:path";
+import { replaceFileAtomicallySync } from "./exclusive-file.mjs";
+import {
+  isPrivateToolchainIntegrityError,
+  privateToolchainIntegrityError,
+  throwOperationalOrIntegrity,
+} from "./private-toolchain-integrity.mjs";
+import { ensureOwnerOnlyDirectorySync, readBoundedRegularFileSync } from "./secure-file.mjs";
+
+const TOOLCHAIN_SCHEMA_VERSION = 1;
+const TOOLCHAIN_MARKER = ".machine-bridge-mcp-toolchain.json";
+const MAX_TEMPLATE_BYTES = 2 * 1024 * 1024;
+const MAX_TREE_NODES = 20_000;
+
+export async function verifyWranglerToolchain(descriptor, execute, required = false) {
+  try {
+    let info;
+    try { info = lstatSync(descriptor.root); }
+    catch (error) { throwOperationalOrIntegrity(error, "Wrangler toolchain directory is missing or structurally invalid"); }
+    if (info.isSymbolicLink() || !info.isDirectory()) {
+      throw privateToolchainIntegrityError("Wrangler toolchain path is not a real directory");
+    }
+    ensureOwnerOnlyDirectorySync(descriptor.root);
+    requireExactFile(path.join(descriptor.root, "package.json"), descriptor.packageBytes, "Wrangler toolchain package manifest");
+    requireExactFile(path.join(descriptor.root, "package-lock.json"), descriptor.lockBytes, "Wrangler toolchain lockfile");
+    const versionResult = await execute(["--version"]);
+    if (Number(String(versionResult.stdout).trim().split(".")[0]) < 12) throw new Error("Wrangler toolchain requires npm 12 or newer");
+    const treeResult = await execute(
+      ["ls", "wrangler", "undici", "sharp", "--workspaces=false", "--all", "--json"],
+      true,
+    );
+    if (treeResult.code === 124) {
+      const timeout = new Error("Wrangler toolchain npm ls timed out");
+      timeout.code = "ETIMEDOUT";
+      throw timeout;
+    }
+    let tree;
+    try { tree = JSON.parse(treeResult.stdout); }
+    catch {
+      throw new Error(`Wrangler toolchain npm ls failed (${treeResult.code}): ${String(treeResult.stderr || "invalid JSON").slice(0, 600)}`);
+    }
+    validateInstalledTree(tree, descriptor.versions);
+    if (treeResult.code !== 0) throw new Error(`Wrangler toolchain npm ls exited ${treeResult.code} without dependency problems`);
+    return true;
+  } catch (error) {
+    if (required || !isPrivateToolchainIntegrityError(error)) throw error;
+    return false;
+  }
+}
+
+export function readWranglerToolchainMarker(root) {
+  let bytes;
+  try {
+    bytes = readBoundedRegularFileSync(
+      path.join(root, TOOLCHAIN_MARKER), 16 * 1024, "Wrangler toolchain marker",
+      { verifyPathIdentity: true, rejectMultipleLinks: true },
+    );
+  } catch (error) {
+    if (error?.code === "ENOENT") return null;
+    throwOperationalOrIntegrity(error, "Wrangler toolchain marker is structurally invalid");
+  }
+  try { return parseJsonObject(bytes, "Wrangler toolchain marker"); }
+  catch (error) { throw privateToolchainIntegrityError(error.message, error); }
+}
+
+export function wranglerToolchainMarkerMatches(marker, descriptor) {
+  return Boolean(marker)
+    && marker.schema_version === TOOLCHAIN_SCHEMA_VERSION
+    && marker.digest === descriptor.digest
+    && marker.wrangler === descriptor.versions.wrangler
+    && marker.undici === descriptor.versions.undici
+    && marker.sharp === descriptor.versions.sharp
+    && Number.isFinite(Date.parse(String(marker.audited_at || "")));
+}
+
+export function writeWranglerToolchainMarker(descriptor, nowMs) {
+  const auditedAt = new Date(Number(nowMs)).toISOString();
+  if (!Number.isFinite(Date.parse(auditedAt))) throw new Error("Wrangler toolchain audit timestamp is invalid");
+  replaceFileAtomicallySync(path.join(descriptor.root, TOOLCHAIN_MARKER), `${JSON.stringify({
+    schema_version: TOOLCHAIN_SCHEMA_VERSION,
+    digest: descriptor.digest,
+    wrangler: descriptor.versions.wrangler,
+    undici: descriptor.versions.undici,
+    sharp: descriptor.versions.sharp,
+    audited_at: auditedAt,
+  }, null, 2)}\n`, { mode: 0o600 });
+}
+
+function validateInstalledTree(tree, versions) {
+  if (!tree || typeof tree !== "object" || Array.isArray(tree)) throw privateToolchainIntegrityError("Wrangler toolchain dependency tree is invalid");
+  if (Array.isArray(tree.problems) && tree.problems.length) throw privateToolchainIntegrityError("Wrangler toolchain dependency tree contains invalid edges");
+  const found = new Map([["wrangler", []], ["undici", []], ["sharp", []]]);
+  const counter = { value: 0 };
+  visitDependencyTree(tree.dependencies, found, counter, 0);
+  for (const [name, expected] of Object.entries(versions)) {
+    const actual = found.get(name) || [];
+    if (!actual.length || actual.some((version) => version !== expected)) {
+      throw privateToolchainIntegrityError(`Wrangler toolchain ${name} versions ${actual.join(",") || "missing"} do not match ${expected}`);
+    }
+  }
+}
+
+function visitDependencyTree(dependencies, found, counter, depth) {
+  if (!dependencies || typeof dependencies !== "object" || Array.isArray(dependencies)) return;
+  if (depth > 64) throw privateToolchainIntegrityError("Wrangler toolchain dependency tree exceeds the depth limit");
+  for (const [name, value] of Object.entries(dependencies)) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) continue;
+    counter.value += 1;
+    if (counter.value > MAX_TREE_NODES) throw privateToolchainIntegrityError("Wrangler toolchain dependency tree exceeds the node limit");
+    if (found.has(name)) found.get(name).push(String(value.version || ""));
+    visitDependencyTree(value.dependencies, found, counter, depth + 1);
+  }
+}
+
+function requireExactFile(file, expected, label) {
+  let actual;
+  try {
+    actual = readBoundedRegularFileSync(file, MAX_TEMPLATE_BYTES, label, {
+      verifyPathIdentity: true,
+      rejectMultipleLinks: true,
+    });
+  } catch (error) {
+    throwOperationalOrIntegrity(error, `${label} is missing or structurally invalid`);
+  }
+  if (!actual.equals(expected)) throw privateToolchainIntegrityError(`${label} does not match the packaged template`);
+}
+
+function parseJsonObject(bytes, label) {
+  let value;
+  try { value = JSON.parse(Buffer.from(bytes).toString("utf8")); }
+  catch { throw new Error(`${label} is not valid JSON`); }
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
+  return value;
+}

package/src/local/wrangler-toolchain.mjs

@@ -0,0 +1,188 @@
+import { createHash } from "node:crypto";
+import {
+  existsSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import path from "node:path";
+import { ensureHardenedNpm } from "./hardened-npm.mjs";
+import { withOwnerStateLock } from "./owner-state-lock.mjs";
+import { nestedNpmEnvironment } from "./npm-environment.mjs";
+import { resolveNpmCli } from "./npm-cli.mjs";
+import { isPrivateToolchainIntegrityError } from "./private-toolchain-integrity.mjs";
+import {
+  readWranglerToolchainMarker,
+  verifyWranglerToolchain,
+  wranglerToolchainMarkerMatches,
+  writeWranglerToolchainMarker,
+} from "./wrangler-toolchain-verification.mjs";
+import { ensureOwnerOnlyDirectorySync, readBoundedRegularFileSync } from "./secure-file.mjs";
+import { defaultStateRoot } from "./state.mjs";
+import { withToolchainOperationLock } from "./toolchain-operation-lock.mjs";
+import { packageRoot as defaultPackageRoot } from "./package-identity.mjs";
+
+const TOOLCHAIN_DIRECTORY = "toolchains";
+const TOOLCHAIN_LOCK = "wrangler-toolchain.lock";
+const DEFAULT_AUDIT_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+const MAX_CLOCK_SKEW_MS = 5 * 60 * 1000;
+const INSTALL_TIMEOUT_MS = 10 * 60 * 1000;
+const AUDIT_TIMEOUT_MS = 2 * 60 * 1000;
+const MAX_TEMPLATE_BYTES = 2 * 1024 * 1024, MAX_COMMAND_OUTPUT_BYTES = 4 * 1024 * 1024;
+
+export async function ensureWranglerToolchain(options = {}) {
+  const runCommand = options.runCommand;
+  if (typeof runCommand !== "function") throw new TypeError("Wrangler toolchain requires an executable runner");
+  const descriptor = wranglerToolchainDescriptor(options);
+  const explicitNpmCli = options.npmCli ? resolveNpmCli(options) : "";
+  const now = typeof options.now === "function" ? options.now : Date.now;
+  const auditMaxAgeMs = positiveInteger(options.auditMaxAgeMs, DEFAULT_AUDIT_MAX_AGE_MS);
+  const parent = path.join(descriptor.stateRoot, TOOLCHAIN_DIRECTORY);
+
+  return withToolchainOperationLock(descriptor.stateRoot, async () => {
+    ensureOwnerOnlyDirectorySync(parent);
+    return withOwnerStateLock(parent, async () => {
+      const npmCli = explicitNpmCli || (await ensureHardenedNpm(parent, options.hardenedNpm || {})).cli;
+    let marker = null;
+    let installed = false;
+    try {
+      marker = readWranglerToolchainMarker(descriptor.root);
+      installed = await verifyWranglerToolchain(descriptor, (args, allowFailure = false) => runNpm(npmCli, args, descriptor.root, runCommand, options, AUDIT_TIMEOUT_MS, allowFailure));
+    } catch (error) {
+      if (!isPrivateToolchainIntegrityError(error)) throw error;
+    }
+    if (!installed) {
+      installToolchain(descriptor);
+      await runNpm(npmCli, [
+        "ci",
+        "--dry-run=false",
+        "--workspaces=false",
+        "--ignore-scripts=false",
+        "--package-lock=true",
+        "--package-lock-only=false",
+        "--omit=dev",
+        "--no-fund",
+        "--audit=false",
+      ], descriptor.root, runCommand, options, INSTALL_TIMEOUT_MS);
+      await verifyWranglerToolchain(descriptor, (args, allowFailure = false) => runNpm(npmCli, args, descriptor.root, runCommand, options, AUDIT_TIMEOUT_MS, allowFailure), true);
+      await auditToolchain(descriptor, npmCli, runCommand, options);
+      writeWranglerToolchainMarker(descriptor, now());
+      return descriptor.root;
+    }
+
+    const checkedAt = now();
+    const auditAgeMs = checkedAt - Date.parse(String(marker?.audited_at || ""));
+    if (!wranglerToolchainMarkerMatches(marker, descriptor) || auditAgeMs < -MAX_CLOCK_SKEW_MS || auditAgeMs >= auditMaxAgeMs) {
+      await auditToolchain(descriptor, npmCli, runCommand, options);
+      writeWranglerToolchainMarker(descriptor, checkedAt);
+    }
+      return descriptor.root;
+    }, {
+      purpose: "wrangler-toolchain",
+      fileName: TOOLCHAIN_LOCK,
+      label: "Wrangler toolchain",
+      timeoutMs: options.lockTimeoutMs,
+    });
+  }, {
+    controlRoot: options.controlRoot,
+    timeoutMs: options.operationLockTimeoutMs,
+  });
+}
+export function wranglerToolchainDescriptor(options = {}) {
+  const packageRoot = path.resolve(String(options.packageRoot || defaultPackageRoot));
+  const stateRoot = path.resolve(String(options.stateRoot || defaultStateRoot()));
+  const templateRoot = path.join(packageRoot, "src", "local", "wrangler-toolchain");
+  const packageBytes = readBoundedRegularFileSync(
+    path.join(templateRoot, "package.json"), MAX_TEMPLATE_BYTES, "Wrangler toolchain package manifest",
+    { verifyPathIdentity: true, rejectMultipleLinks: true },
+  );
+  const lockBytes = readBoundedRegularFileSync(
+    path.join(templateRoot, "package-lock.json"), MAX_TEMPLATE_BYTES, "Wrangler toolchain lockfile",
+    { verifyPathIdentity: true, rejectMultipleLinks: true },
+  );
+  const manifest = parseJsonObject(packageBytes, "Wrangler toolchain package manifest");
+  const lock = parseJsonObject(lockBytes, "Wrangler toolchain lockfile");
+  validateTemplate(manifest, lock);
+  const digest = createHash("sha256").update(packageBytes).update("\0").update(lockBytes).digest("hex");
+  const root = path.join(stateRoot, TOOLCHAIN_DIRECTORY, `wrangler-${manifest.dependencies.wrangler}-${digest.slice(0, 16)}`);
+  return Object.freeze({
+    packageRoot,
+    stateRoot,
+    templateRoot,
+    root,
+    digest,
+    packageBytes,
+    lockBytes,
+    versions: Object.freeze({
+      wrangler: String(manifest.dependencies.wrangler),
+      undici: String(manifest.overrides.undici),
+      sharp: String(manifest.overrides.sharp),
+    }),
+  });
+}
+function installToolchain(descriptor) {
+  const parent = path.dirname(descriptor.root);
+  ensureOwnerOnlyDirectorySync(parent);
+  if (existsSync(descriptor.root)) rmSync(descriptor.root, { recursive: true, force: true });
+  ensureOwnerOnlyDirectorySync(descriptor.root);
+  writeFileSync(path.join(descriptor.root, "package.json"), descriptor.packageBytes, { mode: 0o600 });
+  writeFileSync(path.join(descriptor.root, "package-lock.json"), descriptor.lockBytes, { mode: 0o600 });
+}
+
+async function auditToolchain(descriptor, npmCli, runCommand, options) {
+  const audit = await runNpm(npmCli, ["audit", "--workspaces=false", "--omit=dev", "--audit-level=low", "--json"], descriptor.root, runCommand, options, AUDIT_TIMEOUT_MS, true);
+  let report;
+  try { report = JSON.parse(audit.stdout); } catch { throw new Error("Wrangler toolchain npm audit did not return valid JSON"); }
+  const vulnerabilities = report?.metadata?.vulnerabilities;
+  const total = Number(vulnerabilities?.total);
+  if (audit.code !== 0 || !Number.isFinite(total) || total !== 0) {
+    throw new Error(`Wrangler toolchain dependency audit failed (${auditSummary(vulnerabilities)})`);
+  }
+  await runNpm(npmCli, ["audit", "signatures", "--workspaces=false"], descriptor.root, runCommand, options, AUDIT_TIMEOUT_MS);
+}
+
+async function runNpm(npmCli, args, cwd, runCommand, options, timeoutMs, allowFailure = false) {
+  return runCommand(process.execPath, [npmCli, ...args], {
+    cwd,
+    env: nestedNpmEnvironment(options.env || process.env),
+    capture: true,
+    allowFailure,
+    timeoutMs,
+    maxOutputBytes: MAX_COMMAND_OUTPUT_BYTES,
+  });
+}
+
+function validateTemplate(manifest, lock) {
+  if (manifest.private !== true || manifest.dependencies?.wrangler !== "4.120.0") {
+    throw new Error("Wrangler toolchain manifest lost its exact private Wrangler dependency");
+  }
+  if (manifest.overrides?.undici !== "7.29.0" || manifest.overrides?.sharp !== "0.35.3") {
+    throw new Error("Wrangler toolchain manifest lost its security overrides");
+  }
+  const expectedScripts = { "esbuild@0.28.1": true, fsevents: false, "sharp@0.35.3": true, "workerd@1.20260801.1": true };
+  if (JSON.stringify(manifest.allowScripts) !== JSON.stringify(expectedScripts)) {
+    throw new Error("Wrangler toolchain manifest lost its exact install-script policy");
+  }
+  if (lock.lockfileVersion !== 3
+      || lock.packages?.["node_modules/wrangler"]?.version !== manifest.dependencies.wrangler
+      || lock.packages?.["node_modules/undici"]?.version !== manifest.overrides.undici
+      || lock.packages?.["node_modules/sharp"]?.version !== manifest.overrides.sharp) {
+    throw new Error("Wrangler toolchain lockfile does not match the exact security contract");
+  }
+}
+
+function parseJsonObject(bytes, label) {
+  let value;
+  try { value = JSON.parse(Buffer.from(bytes).toString("utf8")); } catch { throw new Error(`${label} is not valid JSON`); }
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
+  return value;
+}
+
+function auditSummary(value = {}) {
+  return ["critical", "high", "moderate", "low", "info"]
+    .map((key) => `${key}=${Number(value?.[key]) || 0}`).join(", ");
+}
+
+function positiveInteger(value, fallback) {
+  const number = Number(value);
+  return Number.isFinite(number) && number > 0 ? Math.floor(number) : fallback;
+}

package/src/shared/access-contract.json

@@ -1,7 +1,13 @@
 {
-  "revision": 1,
+  "revision": 4,
   "defaultRole": "reviewer",
   "ownerRole": "owner",
+  "ownerOnlyTools": [
+    "diagnose_runtime",
+    "list_local_resources",
+    "stage_job",
+    "start_job"
+  ],
   "roles": {
     "reviewer": {
       "profile": "review",

package/src/shared/activation-recovery.mjs

@@ -0,0 +1,49 @@
+// @ts-check
+
+/** @type {Readonly<Record<string, string>>} */
+const DETAIL_BY_REASON = Object.freeze({
+  relay_authentication_failed: "candidate relay authentication failed after readiness",
+  autostart_install_failed: "candidate autostart installation failed after readiness",
+  autostart_start_failed: "candidate autostart start failed after readiness",
+});
+
+/** @param {unknown} value */
+export function isActivationRecoveryReason(value) {
+  return typeof value === "string" && Object.hasOwn(DETAIL_BY_REASON, value);
+}
+
+/** @param {unknown} reason */
+export function canonicalActivationRecoveryDetail(reason) {
+  if (typeof reason !== "string") throw new Error("activation recovery reason is invalid");
+  const detail = DETAIL_BY_REASON[reason];
+  if (!detail) throw new Error("activation recovery reason is invalid");
+  return detail;
+}
+
+/**
+ * Normalize recovered-activation metadata without retaining lower-layer error text.
+ * `detail` is still validated so historical schema-2 records fail closed when their
+ * bounded shape is corrupt, but every accepted record/result projects the fixed
+ * reason-owned detail instead of replaying the stored text.
+ * @param {{recovered: unknown, reason?: unknown, detail?: unknown}} value
+ */
+export function normalizeActivationRecovery(value) {
+  if (typeof value.recovered !== "boolean") throw new Error("activation recovery flag is invalid");
+  const reason = value.reason === null || value.reason === undefined ? "" : value.reason;
+  const detail = value.detail === null || value.detail === undefined ? "" : value.detail;
+  if (!value.recovered) {
+    if (reason || detail) throw new Error("activation recovery metadata is inconsistent");
+    return Object.freeze({ recovered: false, reason: "", detail: "" });
+  }
+  if (typeof reason !== "string") throw new Error("activation recovery reason is invalid");
+  if (typeof detail !== "string") throw new Error("activation recovery detail is invalid");
+  if (!isActivationRecoveryReason(reason)) throw new Error("activation recovery reason is invalid");
+  if (!detail || detail.length > 600 || /[\r\n\t]/.test(detail)) {
+    throw new Error("activation recovery detail is invalid");
+  }
+  return Object.freeze({
+    recovered: true,
+    reason,
+    detail: canonicalActivationRecoveryDetail(reason),
+  });
+}

package/src/shared/admin-auth.d.mts

@@ -1,10 +1,11 @@
-export const ADMIN_AUTH_SCHEME: "hmac-sha256-v1";
+export const ADMIN_AUTH_SCHEME: "device-admin-signature-v1";
 export const ADMIN_AUTH_TTL_SECONDS: number;
 export function adminAuthTranscript(input: {
   origin: unknown;
   method: unknown;
   pathname: unknown;
   bodyHash: unknown;
+  keyId: unknown;
   issuedAt: unknown;
   nonce: unknown;
 }): string;

package/src/shared/admin-auth.mjs

@@ -1,4 +1,4 @@
-export const ADMIN_AUTH_SCHEME = "hmac-sha256-v1";
+export const ADMIN_AUTH_SCHEME = "device-admin-signature-v1";
 export const ADMIN_AUTH_TTL_SECONDS = 5 * 60;
 
 export function adminAuthTranscript(input = {}) {
@@ -6,12 +6,12 @@ export function adminAuthTranscript(input = {}) {
   const method = requiredToken(input.method, "method", /^[A-Z]{3,10}$/);
   const pathname = requiredToken(input.pathname, "pathname", /^\/[A-Za-z0-9/_-]{1,255}$/);
   const bodyHash = requiredToken(input.bodyHash, "body hash", /^[a-f0-9]{64}$/);
+  const keyId = requiredToken(input.keyId, "session key id", /^device_[A-Za-z0-9_-]{32}$/);
   const issuedAt = requiredInteger(input.issuedAt, "issued at");
   const nonce = requiredToken(input.nonce, "nonce", /^[A-Za-z0-9_-]{32,128}$/);
-  return [ADMIN_AUTH_SCHEME, origin, method, pathname, bodyHash, issuedAt, nonce].join("\0");
+  return [ADMIN_AUTH_SCHEME, origin, method, pathname, bodyHash, keyId, issuedAt, nonce].join("\0");
 }
 
-
 function requiredOrigin(value) {
   let url;
   try { url = new URL(String(value || "")); } catch { throw new Error("admin authentication origin is invalid"); }

package/src/shared/authority-revocation.d.mts

@@ -0,0 +1,9 @@
+export type AuthorityRevocation = Readonly<{
+  accountId: string;
+  accountVersion: number;
+  clientId?: string;
+  familyId?: string;
+}>;
+
+export function normalizeAuthorityRevocation(value: unknown): AuthorityRevocation | null;
+export function recordMatchesAuthorityRevocation(record: object, revocation: AuthorityRevocation): boolean;

package/src/shared/authority-revocation.mjs

@@ -0,0 +1,28 @@
+const ACCOUNT_ID = /^acct_[A-Za-z0-9_-]{20,96}$/;
+const CLIENT_ID = /^mcp_client_[A-Za-z0-9_-]{43}$/;
+const FAMILY_ID = /^mcp_family_[A-Za-z0-9_-]{43}$/;
+
+export function normalizeAuthorityRevocation(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const accountId = String(value.account_id || "");
+  const accountVersion = Number(value.account_version);
+  const clientId = value.client_id === undefined ? "" : String(value.client_id || "");
+  const familyId = value.family_id === undefined ? "" : String(value.family_id || "");
+  if (!ACCOUNT_ID.test(accountId) || !Number.isSafeInteger(accountVersion) || accountVersion <= 0) return null;
+  if (clientId && !CLIENT_ID.test(clientId)) return null;
+  if (familyId && (!clientId || !FAMILY_ID.test(familyId))) return null;
+  return Object.freeze({
+    accountId,
+    accountVersion,
+    ...(clientId ? { clientId } : {}),
+    ...(familyId ? { familyId } : {}),
+  });
+}
+
+export function recordMatchesAuthorityRevocation(record, revocation) {
+  if (!record || !revocation || record.owner_kind !== "account") return false;
+  if (record.owner_account_id !== revocation.accountId || record.owner_account_version !== revocation.accountVersion) return false;
+  if (revocation.clientId && record.owner_client_id !== revocation.clientId) return false;
+  if (revocation.familyId && record.owner_family_id !== revocation.familyId) return false;
+  return true;
+}

package/src/shared/daemon-auth.d.mts

@@ -1,7 +1,9 @@
 export const DAEMON_AUTH_SCHEME: "device-signature-v1";
 export const DAEMON_PREFLIGHT_SCHEME: "device-preflight-v1";
+export const DAEMON_HTTP_RELAY_SCHEME: "device-http-relay-v1";
 export const DAEMON_AUTH_CHALLENGE_TTL_SECONDS: number;
 export const DAEMON_PREFLIGHT_TTL_SECONDS: number;
+export const DAEMON_HTTP_RELAY_TTL_SECONDS: number;
 export function daemonAuthTranscript(input: {
   challenge: unknown;
   workerOrigin: unknown;
@@ -18,3 +20,12 @@ export function daemonPreflightTranscript(input: {
   nonce: unknown;
   issuedAt: unknown;
 }): string;
+
+export function daemonHttpRelayTranscript(input: {
+  workerOrigin: unknown;
+  server: unknown;
+  version: unknown;
+  nonce: unknown;
+  issuedAt: unknown;
+  bodySha256: unknown;
+}): string;

package/src/shared/daemon-auth.mjs

@@ -1,7 +1,9 @@
 export const DAEMON_AUTH_SCHEME = "device-signature-v1";
 export const DAEMON_PREFLIGHT_SCHEME = "device-preflight-v1";
+export const DAEMON_HTTP_RELAY_SCHEME = "device-http-relay-v1";
 export const DAEMON_AUTH_CHALLENGE_TTL_SECONDS = 30;
 export const DAEMON_PREFLIGHT_TTL_SECONDS = 5 * 60;
+export const DAEMON_HTTP_RELAY_TTL_SECONDS = 30;
 
 
 export function daemonPreflightTranscript(input = {}) {
@@ -29,6 +31,21 @@ export function daemonAuthTranscript(input = {}) {
   return values.join("\0");
 }
 
+export function daemonHttpRelayTranscript(input = {}) {
+  const values = [
+    DAEMON_HTTP_RELAY_SCHEME,
+    "POST",
+    "/daemon/http",
+    requiredOrigin(input.workerOrigin),
+    requiredText(input.server, "server", 1, 128),
+    requiredText(input.version, "version", 1, 64),
+    requiredText(input.nonce, "HTTP relay nonce", 24, 128),
+    requiredInteger(input.issuedAt, "HTTP relay issued at"),
+    requiredText(input.bodySha256, "HTTP relay body SHA-256", 43, 43),
+  ];
+  return values.join("\0");
+}
+
 function requiredText(value, label, minimum, maximum) {
   const text = String(value || "");
   if (text.length < minimum || text.length > maximum || /[\0\r\n]/.test(text)) {

package/src/shared/device-session-auth.d.mts

@@ -0,0 +1,20 @@
+export const DEVICE_SESSION_CERTIFICATE_SCHEME: "device-session-certificate-v1";
+export const DEVICE_SESSION_MAX_LIFETIME_SECONDS: number;
+
+export function deviceSessionCertificateTranscript(input?: {
+  workerOrigin?: unknown;
+  server?: unknown;
+  version?: unknown;
+  rootKeyId?: unknown;
+  publicJwk?: unknown;
+  issuedAt?: unknown;
+  expiresAt?: unknown;
+  nonce?: unknown;
+}): string;
+
+export function canonicalPublicJwk(value: unknown): {
+  kty: "EC";
+  crv: "P-256";
+  x: string;
+  y: string;
+};

package/src/shared/device-session-auth.mjs

@@ -0,0 +1,51 @@
+export const DEVICE_SESSION_CERTIFICATE_SCHEME = "device-session-certificate-v1";
+export const DEVICE_SESSION_MAX_LIFETIME_SECONDS = 24 * 60 * 60;
+
+export function deviceSessionCertificateTranscript(input = {}) {
+  const publicJwk = canonicalPublicJwk(input.publicJwk);
+  return [
+    DEVICE_SESSION_CERTIFICATE_SCHEME,
+    requiredOrigin(input.workerOrigin),
+    requiredText(input.server, "server", 1, 128),
+    requiredText(input.version, "version", 1, 64),
+    requiredText(input.rootKeyId, "root key id", 16, 128),
+    JSON.stringify(publicJwk),
+    requiredInteger(input.issuedAt, "issued at"),
+    requiredInteger(input.expiresAt, "expires at"),
+    requiredText(input.nonce, "nonce", 24, 128),
+  ].join("\0");
+}
+
+export function canonicalPublicJwk(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("device session public key is invalid");
+  if (value.kty !== "EC" || value.crv !== "P-256" || typeof value.x !== "string" || typeof value.y !== "string" || value.d !== undefined) {
+    throw new Error("device session public key is invalid");
+  }
+  if (!/^[A-Za-z0-9_-]{42,44}$/.test(value.x) || !/^[A-Za-z0-9_-]{42,44}$/.test(value.y)) {
+    throw new Error("device session public key is invalid");
+  }
+  return { crv: "P-256", kty: "EC", x: value.x, y: value.y };
+}
+
+function requiredOrigin(value) {
+  let url;
+  try { url = new URL(String(value || "")); } catch { throw new Error("device session Worker origin is invalid"); }
+  const secure = url.protocol === "https:";
+  const loopback = url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+  if ((!secure && !loopback) || url.username || url.password || url.pathname !== "/" || url.search || url.hash) {
+    throw new Error("device session Worker origin is invalid");
+  }
+  return url.origin;
+}
+
+function requiredText(value, label, minimum, maximum) {
+  const text = String(value || "");
+  if (text.length < minimum || text.length > maximum || /[\0\r\n]/.test(text)) throw new Error(`device session ${label} is invalid`);
+  return text;
+}
+
+function requiredInteger(value, label) {
+  const number = Number(value);
+  if (!Number.isSafeInteger(number) || number <= 0) throw new Error(`device session ${label} is invalid`);
+  return String(number);
+}

package/src/shared/foreground-timeout.d.mts

@@ -0,0 +1,15 @@
+export const REMOTE_FOREGROUND_TIMEOUT_SECONDS: number;
+export const REMOTE_DURABLE_PROCESS_DEFAULT_TIMEOUT_SECONDS: number;
+export const REMOTE_DURABLE_PROCESS_MAXIMUM_TIMEOUT_SECONDS: number;
+export function isConfigurableForegroundTool(name: string): boolean;
+export function isRemoteDurableProcessTool(name: string): boolean;
+export function remoteDurableProcessTimeoutSeconds(value: unknown): number;
+export function remoteForegroundDefaultSeconds(name: string): number;
+export function remoteForegroundMaximumSeconds(name: string): number;
+export function effectiveForegroundTimeoutSeconds(input: Readonly<{
+  tool: string;
+  value: unknown;
+  remote: boolean;
+  localDefault: number;
+  localMaximum: number;
+}>): number;