marifold 0.69.0 → 0.71.0

package/dist/bridge-template/setup/setup.py

@@ -0,0 +1,319 @@
+#!/usr/bin/env python3
+"""Interactive Linux installer for a prepared Marifold bridge package."""
+
+import argparse
+import getpass
+import json
+import os
+from pathlib import Path
+import re
+import secrets
+import shutil
+import socket
+import subprocess
+import sys
+import tempfile
+from urllib.parse import urlsplit
+
+PROJECT = "marifold-personal-bridge"
+DEFAULT_TARGET = Path("/opt/marifold-bridge")
+
+
+def run(args, cwd=None):
+    result = subprocess.run(args, cwd=cwd, text=True, capture_output=True)
+    if result.returncode:
+        # Tool output can contain supplied connection strings. Keep it off the terminal.
+        raise RuntimeError(f"{args[0]} failed (exit {result.returncode}). Configuration is retained; see HOSTING.md for troubleshooting.")
+    return result.stdout.strip()
+
+
+def validate_redis(value):
+    if any(c.isspace() or c in "'\"\\" for c in value):
+        raise ValueError("Redis URL must contain no whitespace or quotes; percent-encode password characters.")
+    try:
+        parsed = urlsplit(value)
+        port = parsed.port
+        valid = parsed.scheme in ("redis", "rediss") and parsed.hostname and not parsed.query and not parsed.fragment
+        valid = valid and re.fullmatch(r"/\d+|", parsed.path) and (port is None or 0 < port < 65536)
+    except ValueError:
+        valid = False
+    if not valid:
+        raise ValueError("Use a Redis TCP URL, optionally ending in /database_number.")
+    if parsed.scheme == "redis" and parsed.hostname not in ("127.0.0.1", "localhost", "::1"):
+        raise ValueError("Use rediss:// for Redis outside this server's loopback network.")
+    return value
+
+
+def validate_domain(value):
+    value = value.lower().strip()
+    labels = value.split(".")
+    if len(value) > 253 or len(labels) < 2 or any(
+        not re.fullmatch(r"[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?", label) for label in labels
+    ):
+        raise ValueError("Enter a DNS hostname such as bridge.example.com, without https:// or a path.")
+    return value
+
+
+def confirm(prompt):
+    return input(prompt + " [y/N]: ").strip().lower() == "y"
+
+
+def check_port(port):
+    with socket.socket() as sock:
+        try:
+            sock.bind(("0.0.0.0", port))
+        except OSError:
+            raise ValueError(f"Port {port} is already in use. Choose existing HTTPS ingress or resolve the conflict first.") from None
+
+
+def write(path, value, mode=0o600):
+    with path.open("x") as output:
+        output.write(value)
+    path.chmod(mode)
+
+
+def compose_config(dedicated, domain):
+    bridge = {
+        "build": {"context": "./package"},
+        "network_mode": "host",
+        "restart": "unless-stopped",
+        "env_file": ["./bridge.env"],
+        "user": "node",
+        "read_only": True,
+        "cap_drop": ["ALL"],
+        "security_opt": ["no-new-privileges:true"],
+        "healthcheck": {
+            "test": ["CMD", "node", "health.cjs"],
+            "interval": "10s", "timeout": "8s", "retries": 12, "start_period": "10s",
+        },
+        "logging": {"driver": "json-file", "options": {"max-size": "10m", "max-file": "3"}},
+    }
+    config = {"name": PROJECT, "services": {"bridge": bridge}, "volumes": {}}
+    if dedicated:
+        config["services"]["redis"] = {
+            "image": "redis:8.8", "network_mode": "host", "restart": "unless-stopped",
+            "command": ["redis-server", "/usr/local/etc/redis/redis.conf"],
+            "volumes": ["./redis.conf:/usr/local/etc/redis/redis.conf:ro", "redis-data:/data"],
+            "logging": bridge["logging"],
+        }
+        bridge["depends_on"] = ["redis"]
+        config["volumes"]["redis-data"] = {}
+    if domain:
+        config["services"]["https"] = {
+            "image": "caddy:2", "network_mode": "host", "restart": "unless-stopped",
+            "volumes": ["./Caddyfile:/etc/caddy/Caddyfile:ro", "caddy-data:/data", "caddy-config:/config"],
+            "depends_on": {"bridge": {"condition": "service_healthy"}},
+            "logging": bridge["logging"],
+        }
+        config["volumes"].update({"caddy-data": {}, "caddy-config": {}})
+    return config
+
+
+def validate_package(source):
+    # Only copy the compiled package inputs; never copy local environment/configuration.
+    required = ["package.json", "dist", "vendor"]
+    for name in required:
+        item = source / name
+        if not item.exists() or item.is_symlink():
+            raise ValueError("Run setup from a complete prepared bridge package.")
+        if item.is_dir() and any(p.is_symlink() for p in item.rglob("*")):
+            raise ValueError("Prepared package inputs must not contain symlinks.")
+    manifest = json.loads((source / "package.json").read_text())
+    if manifest.get("name") != "marifold-personal-bridge":
+        raise ValueError("Run marifold workspace bridge prepare first, then use that package's setup.sh.")
+    return required
+
+
+def prepare(source, target, redis_url, domain):
+    required = validate_package(source)
+    target.mkdir(mode=0o700)  # Exclusive creation: never overwrite an existing installation.
+    package = target / "package"
+    package.mkdir(mode=0o755)
+    for name in required:
+        item = source / name
+        if item.is_dir():
+            shutil.copytree(item, package / name)
+        else:
+            shutil.copyfile(item, package / name)
+    for item in package.rglob("*"):
+        item.chmod(0o755 if item.is_dir() else 0o644)
+    # Installer owns its dependency installation; user-selected local node_modules are excluded.
+    write(package / "Dockerfile", "FROM node:24-bookworm-slim\nWORKDIR /app\nCOPY package.json ./\nCOPY vendor ./vendor\nRUN npm install --omit=dev --ignore-scripts\nCOPY dist ./dist\nCOPY health.cjs ./health.cjs\nUSER node\nCMD [\"node\", \"dist/serve.js\"]\n", 0o644)
+    write(package / ".dockerignore", "*\n!package.json\n!vendor/\n!vendor/**\n!dist/\n!dist/**\n!health.cjs\n!Dockerfile\n", 0o644)
+    write(package / "health.cjs", "const Redis = require('ioredis');\nconst client = new Redis(process.env.MARIFOLD_BRIDGE_REDIS_URL, {lazyConnect: true, retryStrategy: () => null, connectTimeout: 3000, maxRetriesPerRequest: 0});\nclient.on('error', () => {});\nconst timeout = setTimeout(() => process.exit(1), 6000);\n(async () => { try { await client.connect(); await client.ping(); const response = await fetch('http://127.0.0.1:32143/health'); if (!response.ok) throw new Error(); clearTimeout(timeout); client.disconnect(); } catch { process.exit(1); } })();\n", 0o644)
+    token = secrets.token_hex(32)
+    dedicated = redis_url is None
+    if dedicated:
+        password = secrets.token_hex(32)
+        redis_url = f"redis://default:{password}@127.0.0.1:32144/0"
+        write(target / "redis.conf", f"bind 127.0.0.1\nport 32144\nprotected-mode yes\nrequirepass {password}\ndir /data\nappendonly yes\nappendfsync everysec\nsave 900 1\nmaxmemory 128mb\nmaxmemory-policy noeviction\n", 0o644)
+    write(target / "bridge.env", f"MARIFOLD_BRIDGE_REDIS_URL='{redis_url}'\nMARIFOLD_BRIDGE_REGISTRATION_TOKEN='{token}'\nHOST=127.0.0.1\nPORT=32143\n")
+    write(target / "registration-token", token + "\n")
+    if domain:
+        write(target / "Caddyfile", f"{domain} {{\n    reverse_proxy 127.0.0.1:32143\n}}\n", 0o644)
+    write(target / "compose.json", json.dumps(compose_config(dedicated, domain), indent=2) + "\n")
+    write(target / "installation.json", json.dumps({"schema": 1, "domain": domain, "dedicatedRedis": dedicated}) + "\n")
+
+
+def start(target):
+    command = ["docker", "compose", "-f", str(target / "compose.json")]
+    run(command + ["config", "--quiet"])
+    print("Building and starting the bridge. The first image download may take several minutes.", flush=True)
+    run(command + ["up", "--detach", "--build", "--wait", "--wait-timeout", "180"])
+    run(command + ["exec", "-T", "bridge", "node", "health.cjs"])
+    print("Bridge is running; Redis PING and local HTTP health passed.")
+    print(f"Read your registration token locally: sudo cat {target}/registration-token")
+    print(f"Service status: sudo docker compose -f {target}/compose.json ps")
+    metadata = json.loads((target / "installation.json").read_text())
+    if metadata["domain"]:
+        print(f"Next verify https://{metadata['domain']}/health, then create your workspace with that HTTPS origin.")
+        print("Public DNS, certificate issuance and the cloud firewall still need to permit HTTPS; local health does not verify them.")
+    else:
+        print("Next route your existing HTTPS proxy or Cloudflare Tunnel to http://127.0.0.1:32143.")
+
+
+def update(source, target):
+    required = validate_package(source)
+    config = json.loads((target / "compose.json").read_text())
+    bridge = config.get("services", {}).get("bridge", {})
+    build = bridge.get("build")
+    if not isinstance(build, dict) or not isinstance(build.get("context"), str):
+        raise ValueError("Only installer-managed bridge builds can be updated.")
+    installed = (target / build["context"]).resolve()
+    if not installed.is_relative_to(target.resolve()):
+        raise ValueError("Bridge build context must stay inside the installation.")
+    for name in ("Dockerfile", ".dockerignore", "health.cjs"):
+        if (installed / name).is_symlink() or not (installed / name).is_file():
+            raise ValueError("Incomplete installed bridge build inputs.")
+    command = ["docker", "compose", "-f", str(target / "compose.json")]
+    container = run(command + ["ps", "--quiet", "bridge"])
+    if not re.fullmatch(r"[a-f0-9]{12,64}", container):
+        raise ValueError("Start the existing bridge before updating it.")
+    image = run(["docker", "inspect", "--format", "{{.Image}}", container])
+    if not re.fullmatch(r"sha256:[a-f0-9]{64}", image):
+        raise ValueError("Could not identify the running bridge image for rollback.")
+    release = Path(tempfile.mkdtemp(prefix="release-", dir=target))
+    release.chmod(0o755)
+    for name in required:
+        item = source / name
+        if item.is_dir():
+            shutil.copytree(item, release / name)
+        else:
+            shutil.copyfile(item, release / name)
+    # Preserve local image-mirror and build settings chosen during installation.
+    for name in ("Dockerfile", ".dockerignore", "health.cjs"):
+        shutil.copyfile(installed / name, release / name)
+    for item in release.rglob("*"):
+        item.chmod(0o755 if item.is_dir() else 0o644)
+    tag = f"{PROJECT}:{release.name}"
+    rollback_tag = tag + "-previous"
+    run(["docker", "tag", image, rollback_tag])
+    previous = json.loads(json.dumps(config))
+    previous["services"]["bridge"]["image"] = rollback_tag
+    previous["services"]["bridge"]["pull_policy"] = "never"
+    backup = target / f"{release.name}-rollback.json"
+    write(backup, json.dumps(previous, indent=2) + "\n")
+    bridge["build"]["context"] = str(release)
+    bridge["image"] = tag
+    bridge["pull_policy"] = "never"
+    candidate = target / f"{release.name}-compose.json"
+    write(candidate, json.dumps(config, indent=2) + "\n")
+    staged = ["docker", "compose", "-f", str(candidate)]
+    run(staged + ["config", "--quiet"])
+    print("Building the new bridge while the existing bridge stays online.", flush=True)
+    run(staged + ["build", "bridge"])
+    print("Replacing only the bridge container; checking health. Existing device connections will reconnect.", flush=True)
+    candidate.replace(target / "compose.json")
+    up = ["up", "--detach", "--no-deps", "--no-build", "--pull", "never", "--wait", "--wait-timeout", "180", "bridge"]
+    try:
+        run(command + up)
+        run(command + ["exec", "-T", "bridge", "node", "health.cjs"])
+    except (RuntimeError, OSError, KeyboardInterrupt):
+        restore = target / f"{release.name}-restore.json"
+        shutil.copyfile(backup, restore)
+        restore.chmod(0o600)
+        restore.replace(target / "compose.json")
+        try:
+            run(command + up)
+        except (RuntimeError, OSError, KeyboardInterrupt):
+            raise RuntimeError(f"Update and automatic rollback failed. Configuration is restored; run docker compose -f {target}/compose.json up -d --no-deps --no-build --pull never bridge. Previous release: {backup}") from None
+        raise RuntimeError("New bridge health failed; the previous bridge image was restored.") from None
+    print("Bridge updated. Local HTTP and Redis PING passed; verify your public HTTPS origin and paired devices.")
+    print(f"Previous release retained for rollback: {backup}")
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    mode = parser.add_mutually_exclusive_group()
+    mode.add_argument("--update", action="store_true", help="Update only the installed bridge, retaining secrets, data and a rollback image")
+    mode.add_argument("--start", action="store_true", help="Start an existing installer-managed installation without replacing secrets/data")
+    args = parser.parse_args()
+    if sys.platform != "linux" or os.geteuid() != 0:
+        raise ValueError("Run sudo bash setup.sh on the Linux ECS/EC2 server, not on your Mac.")
+    for executable in ("docker", "systemctl"):
+        if not shutil.which(executable):
+            raise ValueError("Install Docker Engine with its Compose plugin first: https://docs.docker.com/engine/install/ . Existing Docker installations are never replaced by this script.")
+    run(["docker", "compose", "version"])
+    target = DEFAULT_TARGET
+    if args.start or args.update:
+        if target.is_symlink() or target.stat().st_uid != 0 or target.stat().st_mode & 0o077:
+            raise ValueError("Installation directory must be root-owned, mode 0700, and not a symlink.")
+        for name in ("installation.json", "compose.json", "bridge.env"):
+            if (target / name).is_symlink() or not (target / name).is_file():
+                raise ValueError("Incomplete installation; inspect retained files before recovery.")
+        if json.loads((target / "installation.json").read_text()).get("schema") != 1:
+            raise ValueError("Unrecognized installation metadata.")
+        if args.update:
+            print("Update only the bridge container. Preserve Redis, Caddy, tokens and the configured image mirror. Retain the previous image for rollback.")
+            if confirm("Build and deploy the new bridge with a brief connection interruption?"):
+                update(Path(__file__).resolve().parent.parent, target)
+            return
+        if confirm("Start the existing bridge and enable Docker at boot, preserving its configuration?"):
+            run(["systemctl", "enable", "--now", "docker"])
+            start(target)
+        return
+    if target.exists() or target.is_symlink():
+        raise ValueError("/opt/marifold-bridge already exists. Use --start for a managed installation; setup will not overwrite it.")
+    print("Marifold bridge setup: Docker Compose on Linux, persistent containers with reboot recovery.")
+    print("No changes to an existing Redis configuration, firewall rules, DNS or other projects.")
+    print("Redis: 1) Create a separate persistent Redis on loopback port 32144 (default). 2) Use an existing Redis URL.")
+    choice = input("Redis choice [1/2, default 1]: ").strip() or "1"
+    if choice not in ("1", "2"):
+        raise ValueError("Choose 1 or 2.")
+    redis_url = None
+    if choice == "2":
+        print("Existing Redis must allow PING and bridge commands, persistence and non-eviction. Setup only tests PING; it does not configure or scan that database.")
+        redis_url = validate_redis(getpass.getpass("Redis URL (hidden): "))
+    print("HTTPS: 1) Set up Caddy for a domain. 2) Use an existing proxy/Cloudflare Tunnel (default).")
+    ingress = input("HTTPS choice [1/2, default 2]: ").strip() or "2"
+    if ingress not in ("1", "2"):
+        raise ValueError("Choose 1 or 2.")
+    domain = validate_domain(input("Bridge domain: ")) if ingress == "1" else None
+    ports = [32143] + ([32144] if redis_url is None else []) + ([80, 443] if domain else [])
+    for port in ports:
+        check_port(port)
+    print(f"Install: {target}; Redis: {'separate container' if redis_url is None else 'existing endpoint (credentials hidden)'}; HTTPS: {domain or 'existing ingress'}.")
+    print("Downloads Node/Redis/Caddy images as needed, generates a private token, enables Docker at boot and starts services. Container restarts preserve named data volumes.")
+    if not confirm("Proceed with this installation and its selected Redis connection?"):
+        print("Cancelled; no installation written.")
+        return
+    run(["systemctl", "enable", "--now", "docker"])
+    if run(["docker", "ps", "-a", "--filter", f"label=com.docker.compose.project={PROJECT}", "--format", "{{.ID}}"]):
+        raise ValueError("A Compose project with this name already exists; refusing to reuse its resources.")
+    if run(["docker", "volume", "ls", "--filter", f"label=com.docker.compose.project={PROJECT}", "--format", "{{.Name}}"]):
+        raise ValueError("Volumes from an earlier installation exist; refusing to reuse data with new credentials.")
+    source = Path(__file__).resolve().parent.parent
+    prepare(source, target, redis_url, domain)
+    start(target)
+
+
+if __name__ == "__main__":
+    os.umask(0o077)
+    try:
+        main()
+    except (ValueError, RuntimeError, OSError, EOFError, KeyboardInterrupt) as error:
+        if isinstance(error, OSError):
+            print("Setup failed due to a filesystem or process error. Existing data was not deleted.", file=sys.stderr)
+        else:
+            print(f"Setup stopped: {error}", file=sys.stderr)
+        sys.exit(1)

package/dist/bridge-template/setup.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+if ! command -v python3 >/dev/null 2>&1; then
+  echo 'Python 3 is required. Install your Linux distribution python3 package first.' >&2
+  exit 1
+fi
+script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+exec python3 "$script_dir/setup/setup.py" "$@"

package/dist/bridge-template/vendor/workspace-protocol/dist/identity.d.ts

@@ -0,0 +1,15 @@
+import type { EncryptedMessage, MessageHeader, Membership, PrivateIdentity, PublicIdentity, SignedMembership } from './types';
+export declare function randomId(): string;
+export declare function digest(value: string): string;
+export declare function publicIdentity(identity: PrivateIdentity): PublicIdentity;
+export declare function createIdentity(): Promise<PrivateIdentity>;
+export declare function signText(identity: PrivateIdentity, text: string): string;
+export declare function verifyText(identity: PublicIdentity, text: string, signature: string): boolean;
+export declare function issueMembership(host: PrivateIdentity, membership: Membership): SignedMembership;
+export declare function validMembership(certificate: SignedMembership, host: PublicIdentity): boolean;
+export declare function encryptMessage(identity: PrivateIdentity, recipient: PublicIdentity, header: MessageHeader, value: unknown): Promise<EncryptedMessage>;
+export declare function decryptMessage(identity: PrivateIdentity, sender: PublicIdentity, message: EncryptedMessage, expected: {
+    workspaceId: string;
+    recipient: string;
+}): Promise<unknown>;
+//# sourceMappingURL=identity.d.ts.map

package/dist/bridge-template/vendor/workspace-protocol/dist/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,gBAAgB,EAChB,aAAa,EACb,UAAU,EACV,eAAe,EACf,cAAc,EACd,gBAAgB,EACjB,MAAM,SAAS,CAAC;AAIjB,wBAAgB,QAAQ,IAAI,MAAM,CAEjC;AACD,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5C;AACD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,eAAe,GAAG,cAAc,CAExE;AACD,wBAAsB,cAAc,IAAI,OAAO,CAAC,eAAe,CAAC,CAS/D;AACD,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAMxE;AACD,wBAAgB,UAAU,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAW7F;AACD,wBAAgB,eAAe,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,GAAG,gBAAgB,CAE/F;AACD,wBAAgB,eAAe,CAAC,WAAW,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAM5F;AACD,wBAAsB,cAAc,CAClC,QAAQ,EAAE,eAAe,EACzB,SAAS,EAAE,cAAc,EACzB,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,gBAAgB,CAAC,CAgB3B;AACD,wBAAsB,cAAc,CAClC,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,gBAAgB,EACzB,QAAQ,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACnD,OAAO,CAAC,OAAO,CAAC,CAuBlB"}

package/dist/bridge-template/vendor/workspace-protocol/dist/identity.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.randomId = randomId;
+exports.digest = digest;
+exports.publicIdentity = publicIdentity;
+exports.createIdentity = createIdentity;
+exports.signText = signText;
+exports.verifyText = verifyText;
+exports.issueMembership = issueMembership;
+exports.validMembership = validMembership;
+exports.encryptMessage = encryptMessage;
+exports.decryptMessage = decryptMessage;
+const node_crypto_1 = require("node:crypto");
+const core_1 = require("@hpke/core");
+const types_1 = require("./types");
+const suite = new core_1.CipherSuite({ kem: new core_1.DhkemP256HkdfSha256(), kdf: new core_1.HkdfSha256(), aead: new core_1.Aes256Gcm() });
+const encoder = new TextEncoder();
+function randomId() {
+    return (0, node_crypto_1.randomBytes)(16).toString('hex');
+}
+function digest(value) {
+    return (0, node_crypto_1.createHash)('sha256').update(value).digest('hex');
+}
+function publicIdentity(identity) {
+    return { signingKey: identity.signingKey, encryptionKey: identity.encryptionKey };
+}
+async function createIdentity() {
+    const keys = (0, node_crypto_1.generateKeyPairSync)('ed25519');
+    const encryption = await suite.kem.generateKeyPair();
+    return {
+        signingKey: keys.publicKey.export({ type: 'spki', format: 'der' }).toString('base64'),
+        signingPrivateKey: keys.privateKey.export({ type: 'pkcs8', format: 'der' }).toString('base64'),
+        encryptionKey: await crypto.subtle.exportKey('jwk', encryption.publicKey),
+        encryptionPrivateKey: await crypto.subtle.exportKey('jwk', encryption.privateKey),
+    };
+}
+function signText(identity, text) {
+    return (0, node_crypto_1.sign)(null, Buffer.from(text), (0, node_crypto_1.createPrivateKey)({ key: Buffer.from(identity.signingPrivateKey, 'base64'), type: 'pkcs8', format: 'der' })).toString('base64');
+}
+function verifyText(identity, text, signature) {
+    try {
+        return (0, node_crypto_1.verify)(null, Buffer.from(text), (0, node_crypto_1.createPublicKey)({ key: Buffer.from(identity.signingKey, 'base64'), type: 'spki', format: 'der' }), Buffer.from(signature, 'base64'));
+    }
+    catch {
+        return false;
+    }
+}
+function issueMembership(host, membership) {
+    return { membership, signature: signText(host, JSON.stringify(membership)) };
+}
+function validMembership(certificate, host) {
+    return (certificate.membership.version === 1 &&
+        certificate.membership.host.signingKey === host.signingKey &&
+        verifyText(host, JSON.stringify(certificate.membership), certificate.signature));
+}
+async function encryptMessage(identity, recipient, header, value) {
+    const plaintext = encoder.encode(JSON.stringify(value));
+    if (plaintext.length > types_1.MAX_FRAME_BYTES / 2)
+        throw new Error('Message exceeds frame limit; use bounded transfers.');
+    const key = await suite.kem.importKey('jwk', recipient.encryptionKey, true);
+    const context = await suite.createSenderContext({
+        recipientPublicKey: key,
+        info: encoder.encode('marifold.workspace.v1'),
+    });
+    const ciphertext = Buffer.from(await context.seal(plaintext, (0, types_1.headerBytes)(header))).toString('base64');
+    const encapsulatedKey = Buffer.from(context.enc).toString('base64');
+    return {
+        header,
+        encapsulatedKey,
+        ciphertext,
+        signature: signText(identity, JSON.stringify([header, encapsulatedKey, ciphertext])),
+    };
+}
+async function decryptMessage(identity, sender, message, expected) {
+    if (Buffer.byteLength(JSON.stringify(message)) > types_1.MAX_FRAME_BYTES)
+        throw new Error('Frame too large.');
+    const header = (0, types_1.parseHeader)(message.header);
+    if (header.workspaceId !== expected.workspaceId || header.recipient !== expected.recipient)
+        throw new Error('Message belongs to a different workspace or device.');
+    if (header.expiresAt < Date.now() || header.expiresAt > Date.now() + types_1.MESSAGE_TTL_MS + 5000)
+        throw new Error('Message expired or has an invalid lifetime.');
+    if (!verifyText(sender, JSON.stringify([message.header, message.encapsulatedKey, message.ciphertext]), message.signature))
+        throw new Error('Invalid message signature.');
+    const key = await suite.kem.importKey('jwk', identity.encryptionPrivateKey, false);
+    const context = await suite.createRecipientContext({
+        recipientKey: key,
+        enc: Buffer.from(message.encapsulatedKey, 'base64'),
+        info: encoder.encode('marifold.workspace.v1'),
+    });
+    const plaintext = await context.open(Buffer.from(message.ciphertext, 'base64'), (0, types_1.headerBytes)(header));
+    return JSON.parse(new TextDecoder().decode(plaintext));
+}
+//# sourceMappingURL=identity.js.map

package/dist/bridge-template/vendor/workspace-protocol/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAQqB;AACrB,qCAAqF;AACrF,mCAAoF;AAUpF,MAAM,KAAK,GAAG,IAAI,kBAAW,CAAC,EAAE,GAAG,EAAE,IAAI,0BAAmB,EAAE,EAAE,GAAG,EAAE,IAAI,iBAAU,EAAE,EAAE,IAAI,EAAE,IAAI,gBAAS,EAAE,EAAE,CAAC,CAAC;AAChH,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC;IACE,OAAO,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AACD,gBAAuB,KAAa;IAClC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AACD,wBAA+B,QAAyB;IACtD,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;AACpF,CAAC;AACM,KAAK;IACV,MAAM,IAAI,GAAG,IAAA,iCAAmB,EAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;IACrD,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACrF,iBAAiB,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC9F,aAAa,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC;QACzE,oBAAoB,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,CAAC;KAClF,CAAC;AACJ,CAAC;AACD,kBAAyB,QAAyB,EAAE,IAAY;IAC9D,OAAO,IAAA,kBAAI,EACT,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EACjB,IAAA,8BAAgB,EAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAC3G,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACvB,CAAC;AACD,oBAA2B,QAAwB,EAAE,IAAY,EAAE,SAAiB;IAClF,IAAI,CAAC;QACH,OAAO,IAAA,oBAAM,EACX,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EACjB,IAAA,6BAAe,EAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EACjG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CACjC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,yBAAgC,IAAqB,EAAE,UAAsB;IAC3E,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;AAC/E,CAAC;AACD,yBAAgC,WAA6B,EAAE,IAAoB;IACjF,OAAO,CACL,WAAW,CAAC,UAAU,CAAC,OAAO,KAAK,CAAC;QACpC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU;QAC1D,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,SAAS,CAAC,CAChF,CAAC;AACJ,CAAC;AACM,KAAK,yBACV,QAAyB,EACzB,SAAyB,EACzB,MAAqB,EACrB,KAAc;IAEd,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,IAAI,SAAS,CAAC,MAAM,GAAG,uBAAe,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACnH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC;QAC9C,kBAAkB,EAAE,GAAG;QACvB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,uBAAuB,CAAC;KAC9C,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAA,mBAAW,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtG,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpE,OAAO;QACL,MAAM;QACN,eAAe;QACf,UAAU;QACV,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC;KACrF,CAAC;AACJ,CAAC;AACM,KAAK,yBACV,QAAyB,EACzB,MAAsB,EACtB,OAAyB,EACzB,QAAoD;IAEpD,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,uBAAe;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtG,MAAM,MAAM,GAAG,IAAA,mBAAW,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;QACxF,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAc,GAAG,IAAI;QACxF,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,IACE,CAAC,UAAU,CACT,MAAM,EACN,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,EAC7E,OAAO,CAAC,SAAS,CAClB;QAED,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC;QACjD,YAAY,EAAE,GAAG;QACjB,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC;QACnD,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,uBAAuB,CAAC;KAC9C,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,IAAA,mBAAW,EAAC,MAAM,CAAC,CAAC,CAAC;IACrG,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;AACzD,CAAC"}

package/dist/bridge-template/vendor/workspace-protocol/dist/index.d.ts

@@ -0,0 +1,3 @@
+export * from './types';
+export * from './identity';
+//# sourceMappingURL=index.d.ts.map

package/dist/bridge-template/vendor/workspace-protocol/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,YAAY,CAAC"}

package/dist/bridge-template/vendor/workspace-protocol/dist/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./types"), exports);
+__exportStar(require("./identity"), exports);
+//# sourceMappingURL=index.js.map

package/dist/bridge-template/vendor/workspace-protocol/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,6CAA2B"}

package/dist/bridge-template/vendor/workspace-protocol/dist/types.d.ts

@@ -0,0 +1,97 @@
+export declare const PROTOCOL_VERSION = 1;
+export declare const MAX_FRAME_BYTES: number;
+export declare const INVITATION_TTL_MS: number;
+export declare const MESSAGE_TTL_MS = 60000;
+export declare const RELAY_RETENTION_MS: number;
+export interface PublicIdentity {
+    signingKey: string;
+    encryptionKey: JsonWebKey;
+}
+export interface PrivateIdentity extends PublicIdentity {
+    signingPrivateKey: string;
+    encryptionPrivateKey: JsonWebKey;
+}
+export interface Membership {
+    version: 1;
+    workspaceId: string;
+    deviceId: string;
+    name: string;
+    identity: PublicIdentity;
+    host: PublicIdentity;
+    issuedAt: number;
+}
+export interface SignedMembership {
+    membership: Membership;
+    signature: string;
+}
+export interface Invitation {
+    version: 1;
+    workspaceId: string;
+    bridgeUrl: string;
+    host: PublicIdentity;
+    secret: string;
+    expiresAt: number;
+}
+export interface WorkspaceDevice {
+    id: string;
+    name: string;
+    platform: string;
+    architecture: string;
+    executor: boolean;
+    online: boolean;
+}
+export interface WorkspaceSummary {
+    executor?: boolean;
+    id: string;
+    name: string;
+    role: 'host' | 'guest';
+    bridgeUrl: string;
+    deviceId: string;
+    hostDeviceId: string;
+    online: boolean;
+}
+export interface WorkspaceExecutionContext {
+    workspaceId: string;
+    originDeviceId: string;
+    executionDeviceId: string;
+}
+export interface MessageHeader {
+    version: 1;
+    workspaceId: string;
+    sender: string;
+    recipient: string;
+    id: string;
+    expiresAt: number;
+}
+export interface EncryptedMessage {
+    header: MessageHeader;
+    encapsulatedKey: string;
+    ciphertext: string;
+    signature: string;
+}
+export interface WorkspaceRequest {
+    type: 'request';
+    id: string;
+    operation: string;
+    input: unknown;
+}
+export interface WorkspaceResponse {
+    type: 'response';
+    id: string;
+    ok: boolean;
+    value?: unknown;
+    error?: string;
+}
+export interface WorkspaceEvent {
+    type: 'event';
+    topic: string;
+    value: unknown;
+}
+export type WorkspaceMessage = WorkspaceRequest | WorkspaceResponse | WorkspaceEvent;
+export declare function record(value: unknown): Record<string, unknown>;
+export declare function identifier(value: unknown): string;
+export declare function label(value: unknown): string;
+export declare function bridgeOrigin(input: string): string;
+export declare function parseHeader(value: unknown): MessageHeader;
+export declare function headerBytes(h: MessageHeader): Uint8Array;
+//# sourceMappingURL=types.d.ts.map

package/dist/bridge-template/vendor/workspace-protocol/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAClC,eAAO,MAAM,eAAe,QAAa,CAAC;AAC1C,eAAO,MAAM,iBAAiB,QAAc,CAAC;AAC7C,eAAO,MAAM,cAAc,QAAS,CAAC;AACrC,eAAO,MAAM,kBAAkB,QAAa,CAAC;AAE7C,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,UAAU,CAAC;CAC3B;AACD,MAAM,WAAW,eAAgB,SAAQ,cAAc;IACrD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,EAAE,UAAU,CAAC;CAClC;AACD,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,cAAc,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AACD,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;CACnB;AACD,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AACD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;CACjB;AACD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;CACjB;AACD,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AACD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;CACnB;AACD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,aAAa,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AACD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;CAChB;AACD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,UAAU,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AACD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;CAChB;AACD,MAAM,MAAM,gBAAgB,GAAG,gBAAgB,GAAG,iBAAiB,GAAG,cAAc,CAAC;AAErF,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAG9D;AACD,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGjD;AACD,wBAAgB,KAAK,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAI5C;AACD,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUlD;AACD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,CAYzD;AACD,wBAAgB,WAAW,CAAC,CAAC,EAAE,aAAa,GAAG,UAAU,CAExD"}

package/dist/bridge-template/vendor/workspace-protocol/dist/types.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RELAY_RETENTION_MS = exports.MESSAGE_TTL_MS = exports.INVITATION_TTL_MS = exports.MAX_FRAME_BYTES = exports.PROTOCOL_VERSION = void 0;
+exports.record = record;
+exports.identifier = identifier;
+exports.label = label;
+exports.bridgeOrigin = bridgeOrigin;
+exports.parseHeader = parseHeader;
+exports.headerBytes = headerBytes;
+exports.PROTOCOL_VERSION = 1;
+exports.MAX_FRAME_BYTES = 256 * 1024;
+exports.INVITATION_TTL_MS = 15 * 60_000;
+exports.MESSAGE_TTL_MS = 60_000;
+exports.RELAY_RETENTION_MS = 5 * 60_000;
+function record(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('Expected an object.');
+    return value;
+}
+function identifier(value) {
+    if (typeof value !== 'string' || !/^[A-Za-z0-9_-]{1,100}$/.test(value))
+        throw new Error('Invalid identifier.');
+    return value;
+}
+function label(value) {
+    if (typeof value !== 'string' || !value.trim() || value.length > 80 || /[\x00-\x1f\x7f]/.test(value))
+        throw new Error('Invalid display name.');
+    return value.trim();
+}
+function bridgeOrigin(input) {
+    const url = new URL(input);
+    if (url.username || url.password || url.search || url.hash || url.pathname !== '/')
+        throw new Error('Bridge URL must be an origin without credentials.');
+    if (url.protocol !== 'https:' &&
+        !(url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname)))
+        throw new Error('Bridge requires HTTPS (HTTP is allowed only on loopback).');
+    return url.origin;
+}
+function parseHeader(value) {
+    const h = record(value);
+    if (h.version !== 1 || typeof h.expiresAt !== 'number' || !Number.isSafeInteger(h.expiresAt))
+        throw new Error('Invalid message header.');
+    return {
+        version: 1,
+        workspaceId: identifier(h.workspaceId),
+        sender: identifier(h.sender),
+        recipient: identifier(h.recipient),
+        id: identifier(h.id),
+        expiresAt: h.expiresAt,
+    };
+}
+function headerBytes(h) {
+    return new TextEncoder().encode(JSON.stringify([h.version, h.workspaceId, h.sender, h.recipient, h.id, h.expiresAt]));
+}
+//# sourceMappingURL=types.js.map