command_tower 0.10.0 → 0.11.1

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: command_tower
 version: !ruby/object:Gem::Version
-  version: 0.10.0
+  version: 0.11.1
 platform: ruby
 authors:
 - matt-taylor
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-08-21 00:00:00.000000000 Z
+date: 2026-08-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: phonelib
@@ -184,22 +184,32 @@ files:
 - app/auth/command_tower/auth/auth_context.rb
 - app/auth/command_tower/auth/password_recovery_session_context.rb
 - app/auth/command_tower/auth/signup_session_context.rb
+- app/controllers/command_tower/admin/application_controller.rb
+- app/controllers/command_tower/admin/audit/events_controller.rb
 - app/controllers/command_tower/admin/messaging/announcements_controller.rb
+- app/controllers/command_tower/admin/users/identities_controller.rb
+- app/controllers/command_tower/admin/users/impersonation_sessions_controller.rb
+- app/controllers/command_tower/admin/users/roles_controller.rb
+- app/controllers/command_tower/admin/users_controller.rb
+- app/controllers/command_tower/admin/workspace_controller.rb
 - app/controllers/command_tower/application_controller.rb
 - app/controllers/command_tower/auth/email/availability_controller.rb
 - app/controllers/command_tower/auth/email_verification/send_controller.rb
 - app/controllers/command_tower/auth/email_verification/verify_controller.rb
 - app/controllers/command_tower/auth/identity_policy_controller.rb
+- app/controllers/command_tower/auth/impersonation_session_controller.rb
 - app/controllers/command_tower/auth/logout_controller.rb
 - app/controllers/command_tower/auth/password_recovery_session/create_controller.rb
 - app/controllers/command_tower/auth/password_reset/reset_controller.rb
 - app/controllers/command_tower/auth/password_reset/send_controller.rb
 - app/controllers/command_tower/auth/password_reset/validate_controller.rb
 - app/controllers/command_tower/auth/plain_text/login_controller.rb
+- app/controllers/command_tower/auth/principal_capabilities_controller.rb
 - app/controllers/command_tower/auth/register_controller.rb
 - app/controllers/command_tower/auth/session_controller.rb
 - app/controllers/command_tower/auth/signup_session/create_controller.rb
 - app/controllers/command_tower/auth/username/availability_controller.rb
+- app/controllers/command_tower/me/audit_events_controller.rb
 - app/controllers/command_tower/me/inbox_controller.rb
 - app/controllers/command_tower/me/name_controller.rb
 - app/controllers/command_tower/me/password_controller.rb
@@ -218,8 +228,12 @@ files:
 - app/controllers/concerns/command_tower/auth/invalid_credentials_deserializer_renderer.rb
 - app/controllers/concerns/command_tower/auth/password_recovery_session_boundary.rb
 - app/controllers/concerns/command_tower/auth/signup_session_boundary.rb
+- app/controllers/concerns/command_tower/execution/http_boundary.rb
 - app/deserializers/command_tower/deserializers/admin/messaging/create_announcement_deserializer.rb
+- app/deserializers/command_tower/deserializers/admin/scope_parameter.rb
+- app/deserializers/command_tower/deserializers/admin/users.rb
 - app/deserializers/command_tower/deserializers/application_deserializer.rb
+- app/deserializers/command_tower/deserializers/audit/events.rb
 - app/deserializers/command_tower/deserializers/auth/email_availability_deserializer.rb
 - app/deserializers/command_tower/deserializers/auth/email_verification/verify_deserializer.rb
 - app/deserializers/command_tower/deserializers/auth/password_reset/reset_deserializer.rb
@@ -257,11 +271,16 @@ files:
 - app/errors/command_tower/errors/account/pushover_verification_failed_error.rb
 - app/errors/command_tower/errors/account/sms_capability_unavailable_error.rb
 - app/errors/command_tower/errors/application_error.rb
+- app/errors/command_tower/errors/auth/admin_unavailable_during_impersonation_error.rb
 - app/errors/command_tower/errors/auth/csrf_mismatch_error.rb
 - app/errors/command_tower/errors/auth/csrf_missing_error.rb
+- app/errors/command_tower/errors/auth/default_membership_assignment_error.rb
 - app/errors/command_tower/errors/auth/email_already_registered_error.rb
 - app/errors/command_tower/errors/auth/email_verification_required_error.rb
+- app/errors/command_tower/errors/auth/impersonation_session_expired_error.rb
+- app/errors/command_tower/errors/auth/impersonation_session_missing_error.rb
 - app/errors/command_tower/errors/auth/invalid_credentials_error.rb
+- app/errors/command_tower/errors/auth/nested_impersonation_error.rb
 - app/errors/command_tower/errors/auth/password_recovery_ip_rate_limit_error.rb
 - app/errors/command_tower/errors/auth/password_recovery_session_expired_error.rb
 - app/errors/command_tower/errors/auth/password_recovery_session_invalid_error.rb
@@ -269,6 +288,7 @@ files:
 - app/errors/command_tower/errors/auth/password_recovery_session_rate_limit_error.rb
 - app/errors/command_tower/errors/auth/password_reset_invalid_token_error.rb
 - app/errors/command_tower/errors/auth/password_reset_unavailable_error.rb
+- app/errors/command_tower/errors/auth/self_impersonation_error.rb
 - app/errors/command_tower/errors/auth/signup_ip_rate_limit_error.rb
 - app/errors/command_tower/errors/auth/signup_session_expired_error.rb
 - app/errors/command_tower/errors/auth/signup_session_invalid_error.rb
@@ -276,6 +296,7 @@ files:
 - app/errors/command_tower/errors/auth/signup_session_rate_limit_error.rb
 - app/errors/command_tower/errors/auth/verification_code_invalid_error.rb
 - app/errors/command_tower/errors/auth/verification_send_failed_error.rb
+- app/errors/command_tower/errors/continuation_exhausted_error.rb
 - app/errors/command_tower/errors/forbidden_error.rb
 - app/errors/command_tower/errors/internal_error.rb
 - app/errors/command_tower/errors/messaging/accept_rejected_error.rb
@@ -286,6 +307,7 @@ files:
 - app/errors/command_tower/errors/validation_error.rb
 - app/helpers/command_tower/application_helper.rb
 - app/jobs/command_tower/application_job.rb
+- app/jobs/command_tower/execution/job_boundary.rb
 - app/jobs/command_tower/messaging/channel_delivery_execution_job.rb
 - app/jobs/command_tower/messaging/communications/produce_recipient_job.rb
 - app/jobs/command_tower/messaging/execution_recovery_job.rb
@@ -296,6 +318,8 @@ files:
 - app/mailers/command_tower/messaging/channel_mailer.rb
 - app/mailers/command_tower/password_reset_mailer.rb
 - app/models/command_tower/application_record.rb
+- app/models/command_tower/audit/event.rb
+- app/models/command_tower/impersonation/session.rb
 - app/models/command_tower/messaging/channel_delivery.rb
 - app/models/command_tower/messaging/communication.rb
 - app/models/command_tower/messaging/delivery_attempt.rb
@@ -307,9 +331,13 @@ files:
 - app/models/user.rb
 - app/models/user_secret.rb
 - app/serializers/command_tower/serializers/admin/messaging/announcement_response_serializer.rb
+- app/serializers/command_tower/serializers/admin/users.rb
+- app/serializers/command_tower/serializers/admin/workspace/manifest_serializer.rb
 - app/serializers/command_tower/serializers/application/envelope_serializer.rb
 - app/serializers/command_tower/serializers/application/error_entry_serializer.rb
 - app/serializers/command_tower/serializers/application_serializer.rb
+- app/serializers/command_tower/serializers/audit/events.rb
+- app/serializers/command_tower/serializers/audit/events/filter_options_serializer.rb
 - app/serializers/command_tower/serializers/auth/email_availability_serializer.rb
 - app/serializers/command_tower/serializers/auth/email_verification/message_response_serializer.rb
 - app/serializers/command_tower/serializers/auth/identity_policy_serializer.rb
@@ -318,11 +346,13 @@ files:
 - app/serializers/command_tower/serializers/auth/password_recovery_session_response_serializer.rb
 - app/serializers/command_tower/serializers/auth/password_reset/message_response_serializer.rb
 - app/serializers/command_tower/serializers/auth/password_reset/validate_response_serializer.rb
+- app/serializers/command_tower/serializers/auth/principal_capabilities_serializer.rb
 - app/serializers/command_tower/serializers/auth/register_response_serializer.rb
 - app/serializers/command_tower/serializers/auth/session_response_serializer.rb
 - app/serializers/command_tower/serializers/auth/signup_session_response_serializer.rb
 - app/serializers/command_tower/serializers/auth/user_serializer.rb
 - app/serializers/command_tower/serializers/auth/username_availability_serializer.rb
+- app/serializers/command_tower/serializers/impersonation/session_serializer.rb
 - app/serializers/command_tower/serializers/me/account_serializer.rb
 - app/serializers/command_tower/serializers/me/change_password_response_serializer.rb
 - app/serializers/command_tower/serializers/me/pushover_serializer.rb
@@ -406,7 +436,7 @@ files:
 - app/services/command_tower/messaging/contract/not_found_error.rb
 - app/services/command_tower/messaging/contract/observability/correlation.rb
 - app/services/command_tower/messaging/contract/observability/operation_logger.rb
-- app/services/command_tower/messaging/contract/observability/structured_logger.rb
+- app/services/command_tower/messaging/contract/observability/publisher.rb
 - app/services/command_tower/messaging/contract/requests/find_communication.rb
 - app/services/command_tower/messaging/contract/results/channel_delivery_result.rb
 - app/services/command_tower/messaging/contract/results/communication_result.rb
@@ -559,7 +589,12 @@ files:
 - app/services/command_tower/services/account/pushover/show.rb
 - app/services/command_tower/services/account/pushover/verify.rb
 - app/services/command_tower/services/account/update_phone.rb
+- app/services/command_tower/services/admin/users.rb
+- app/services/command_tower/services/admin/workspace/manifest.rb
 - app/services/command_tower/services/application_service.rb
+- app/services/command_tower/services/audit/events.rb
+- app/services/command_tower/services/audit/events/filter_options.rb
+- app/services/command_tower/services/auth/assign_default_membership_role.rb
 - app/services/command_tower/services/auth/authenticate_session.rb
 - app/services/command_tower/services/auth/authorize_request.rb
 - app/services/command_tower/services/auth/client_ip_resolver.rb
@@ -579,6 +614,7 @@ files:
 - app/services/command_tower/services/auth/password_reset/token_verification.rb
 - app/services/command_tower/services/auth/password_reset/validate.rb
 - app/services/command_tower/services/auth/plain_text/login.rb
+- app/services/command_tower/services/auth/principal_capabilities/project.rb
 - app/services/command_tower/services/auth/register.rb
 - app/services/command_tower/services/auth/signup_rate_limits/check_availability.rb
 - app/services/command_tower/services/auth/signup_rate_limits/check_register.rb
@@ -589,6 +625,10 @@ files:
 - app/services/command_tower/services/auth/signup_session/encode.rb
 - app/services/command_tower/services/auth/signup_session/validate.rb
 - app/services/command_tower/services/auth/username_availability.rb
+- app/services/command_tower/services/impersonation/create.rb
+- app/services/command_tower/services/impersonation/end.rb
+- app/services/command_tower/services/impersonation/record_activity.rb
+- app/services/command_tower/services/impersonation/terminate_open_sessions.rb
 - app/services/command_tower/services/me/capabilities.rb
 - app/services/command_tower/services/me/change_password.rb
 - app/services/command_tower/services/me/pushover_product_gate.rb
@@ -605,6 +645,7 @@ files:
 - app/services/command_tower/services/service_result.rb
 - app/services/command_tower/user_attributes/mutate.rb
 - app/services/command_tower/username/available.rb
+- app/shared_sequences/command_tower/shared_sequences/admin/users/resolve_scoped_user.rb
 - app/views/command_tower/email_verification_mailer/verify_email.html.erb
 - app/views/command_tower/messaging/rendering/email.html.erb
 - app/views/command_tower/messaging/rendering/email.text.erb
@@ -613,8 +654,28 @@ files:
 - app/views/command_tower/password_reset_mailer/reset_password.html.erb
 - app/views/layouts/mailer.html.erb
 - app/views/layouts/mailer.text.erb
+- app/workflows/command_tower/transactional.rb
 - app/workflows/command_tower/workflows/admin/messaging/create_announcement_workflow.rb
+- app/workflows/command_tower/workflows/admin/scope_resolution.rb
+- app/workflows/command_tower/workflows/admin/users/error_mapping.rb
+- app/workflows/command_tower/workflows/admin/users/identity_mutation.rb
+- app/workflows/command_tower/workflows/admin/users/list_assignable_roles_workflow.rb
+- app/workflows/command_tower/workflows/admin/users/list_workflow.rb
+- app/workflows/command_tower/workflows/admin/users/set_email_validated_workflow.rb
+- app/workflows/command_tower/workflows/admin/users/show_workflow.rb
+- app/workflows/command_tower/workflows/admin/users/update_email_workflow.rb
+- app/workflows/command_tower/workflows/admin/users/update_name_workflow.rb
+- app/workflows/command_tower/workflows/admin/users/update_roles_workflow.rb
+- app/workflows/command_tower/workflows/admin/users/update_username_workflow.rb
+- app/workflows/command_tower/workflows/admin/workspace/manifest_workflow.rb
 - app/workflows/command_tower/workflows/application_workflow.rb
+- app/workflows/command_tower/workflows/audit/error_mapping.rb
+- app/workflows/command_tower/workflows/audit/events/filter_options_for_admin_workflow.rb
+- app/workflows/command_tower/workflows/audit/events/filter_options_for_user_workflow.rb
+- app/workflows/command_tower/workflows/audit/events/list_for_admin_workflow.rb
+- app/workflows/command_tower/workflows/audit/events/list_for_user_workflow.rb
+- app/workflows/command_tower/workflows/audit/events/show_for_admin_workflow.rb
+- app/workflows/command_tower/workflows/audit/events/show_for_user_workflow.rb
 - app/workflows/command_tower/workflows/auth/authenticate_request_workflow.rb
 - app/workflows/command_tower/workflows/auth/authentication_response_effects.rb
 - app/workflows/command_tower/workflows/auth/authorize_request_workflow.rb
@@ -630,6 +691,7 @@ files:
 - app/workflows/command_tower/workflows/auth/password_reset/send_workflow.rb
 - app/workflows/command_tower/workflows/auth/password_reset/validate_workflow.rb
 - app/workflows/command_tower/workflows/auth/plain_text/login_workflow.rb
+- app/workflows/command_tower/workflows/auth/principal_capabilities/show_workflow.rb
 - app/workflows/command_tower/workflows/auth/register_workflow.rb
 - app/workflows/command_tower/workflows/auth/session/show_workflow.rb
 - app/workflows/command_tower/workflows/auth/session_error_status.rb
@@ -637,6 +699,9 @@ files:
 - app/workflows/command_tower/workflows/auth/signup_session/authenticate_workflow.rb
 - app/workflows/command_tower/workflows/auth/signup_session/create_workflow.rb
 - app/workflows/command_tower/workflows/auth/username_availability_workflow.rb
+- app/workflows/command_tower/workflows/impersonation/error_mapping.rb
+- app/workflows/command_tower/workflows/impersonation/start_workflow.rb
+- app/workflows/command_tower/workflows/impersonation/stop_workflow.rb
 - app/workflows/command_tower/workflows/me/change_password_workflow.rb
 - app/workflows/command_tower/workflows/me/clear_phone_workflow.rb
 - app/workflows/command_tower/workflows/me/error_mapping.rb
@@ -667,8 +732,13 @@ files:
 - db/migrate/20260805000003_create_command_tower_messaging_core.rb
 - db/migrate/20260805000004_create_messaging_notification_preferences.rb
 - db/migrate/20260805000005_create_messaging_endpoints_and_pushover_credentials.rb
+- db/migrate/20260816000001_create_command_tower_audit_events.rb
+- db/migrate/20260817000001_add_scope_columns_to_command_tower_audit_events.rb
+- db/migrate/20260817000003_create_command_tower_impersonation_sessions.rb
+- docs/admin_workspace.md
 - docs/api_reference.md
 - docs/architecture.md
+- docs/audit.md
 - docs/authentication.md
 - docs/authentication_authorization_guide.md
 - docs/authorization.md
@@ -676,6 +746,7 @@ files:
 - docs/controllers.md
 - docs/cookie_authentication_guide.md
 - docs/email_verification_workflow.md
+- docs/eventing.md
 - docs/extending.md
 - docs/host_integration_guide.md
 - docs/initializing.md
@@ -683,16 +754,37 @@ files:
 - docs/models.md
 - docs/pagination.md
 - docs/password_reset_workflow.md
+- docs/principal_capabilities.md
 - docs/sensitive_routes.md
 - docs/testing.md
 - docs/upgrades/0.10.0.md
+- docs/upgrades/0.11.0.md
+- docs/upgrades/0.11.1.md
 - docs/upgrades/README.md
 - lib/command_tower.rb
+- lib/command_tower/admin_scope.rb
+- lib/command_tower/admin_scope/apply_audit_scoping.rb
+- lib/command_tower/admin_scope/apply_users_narrowing.rb
+- lib/command_tower/admin_scope/manifest_projection.rb
+- lib/command_tower/admin_scope/resolve.rb
+- lib/command_tower/admin_scope/scope_context.rb
+- lib/command_tower/admin_scope/scope_option.rb
+- lib/command_tower/admin_workspace.rb
+- lib/command_tower/audit.rb
+- lib/command_tower/audit/attribution.rb
+- lib/command_tower/audit/emit.rb
+- lib/command_tower/audit/masking.rb
+- lib/command_tower/audit/payload.rb
+- lib/command_tower/audit/persistence/subscriber.rb
 - lib/command_tower/authorization.rb
+- lib/command_tower/authorization/assignable_roles.rb
 - lib/command_tower/authorization/default.yml
+- lib/command_tower/authorization/effective_entity_grants.rb
 - lib/command_tower/authorization/entity.rb
 - lib/command_tower/authorization/role.rb
 - lib/command_tower/configuration/admin/config.rb
+- lib/command_tower/configuration/admin_scope/config.rb
+- lib/command_tower/configuration/admin_scope/tool_registration.rb
 - lib/command_tower/configuration/application/config.rb
 - lib/command_tower/configuration/authorization/config.rb
 - lib/command_tower/configuration/base.rb
@@ -703,6 +795,7 @@ files:
 - lib/command_tower/configuration/email/config.rb
 - lib/command_tower/configuration/identity/config.rb
 - lib/command_tower/configuration/identity/phone_verification.rb
+- lib/command_tower/configuration/impersonation/config.rb
 - lib/command_tower/configuration/jwt/config.rb
 - lib/command_tower/configuration/jwt/cookie/config.rb
 - lib/command_tower/configuration/jwt/cookie/csrf/config.rb
@@ -718,6 +811,13 @@ files:
 - lib/command_tower/configuration/pagination/config.rb
 - lib/command_tower/configuration/password_recovery_session/config.rb
 - lib/command_tower/configuration/password_recovery_session/rate_limits.rb
+- lib/command_tower/configuration/registry/admin_workspace/config.rb
+- lib/command_tower/configuration/registry/admin_workspace/tool_definition.rb
+- lib/command_tower/configuration/registry/audit/config.rb
+- lib/command_tower/configuration/registry/audit/event_definition.rb
+- lib/command_tower/configuration/registry/config.rb
+- lib/command_tower/configuration/registry/principal_capabilities/capability_definition.rb
+- lib/command_tower/configuration/registry/principal_capabilities/config.rb
 - lib/command_tower/configuration/signup_session/config.rb
 - lib/command_tower/configuration/signup_session/email_availability.rb
 - lib/command_tower/configuration/signup_session/rate_limits.rb
@@ -732,11 +832,21 @@ files:
 - lib/command_tower/current.rb
 - lib/command_tower/engine.rb
 - lib/command_tower/error.rb
+- lib/command_tower/events.rb
+- lib/command_tower/execution.rb
+- lib/command_tower/impersonation/activity_declaration.rb
+- lib/command_tower/impersonation/apply_overlay.rb
+- lib/command_tower/impersonation/clear_overlay_for_audit.rb
+- lib/command_tower/impersonation/establish_identity.rb
 - lib/command_tower/install/baseline.rb
 - lib/command_tower/install/doctor.rb
 - lib/command_tower/jwt/authorization_helper.rb
 - lib/command_tower/jwt/csrf_helper.rb
+- lib/command_tower/logging/lifecycle_declaration.rb
+- lib/command_tower/logging/projection.rb
+- lib/command_tower/logging/subscriber.rb
 - lib/command_tower/password_recovery/authorization_helper.rb
+- lib/command_tower/principal_capabilities.rb
 - lib/command_tower/redis_connection.rb
 - lib/command_tower/schema.rb
 - lib/command_tower/schema/error/base.rb
@@ -754,6 +864,7 @@ files:
 - lib/tasks/install.rake
 - lib/tasks/users.rake
 - spec/factories/entity.rb
+- spec/factories/impersonation_session.rb
 - spec/factories/messaging.rb
 - spec/factories/role.rb
 - spec/factories/user.rb

data/app/services/command_tower/messaging/contract/observability/structured_logger.rb

@@ -1,56 +0,0 @@
-# frozen_string_literal: true
-
-module CommandTower
-  module Messaging
-    module Contract
-      module Observability
-        class StructuredLogger
-          COMPONENT = "command_tower.messaging"
-          FORBIDDEN_KEYS = %w[
-            title
-            body
-            text
-            metadata
-            email
-            password
-            token
-          ].freeze
-
-          class << self
-            def info(payload)
-              emit(:info, payload)
-            end
-
-            def warn(payload)
-              emit(:warn, payload)
-            end
-
-            def error(payload)
-              emit(:error, payload)
-            end
-
-            private
-
-            def emit(level, payload)
-              envelope = build_envelope(level, payload)
-              Rails.logger.public_send(level, envelope.to_json)
-            rescue StandardError
-              nil
-            end
-
-            def build_envelope(level, payload)
-              compact = payload.to_h.transform_keys(&:to_s).except(*FORBIDDEN_KEYS)
-              compact.reject! { |_key, value| value.nil? }
-
-              {
-                "timestamp" => Time.now.utc.iso8601(3),
-                "level" => level.to_s,
-                "component" => COMPONENT,
-              }.merge(compact)
-            end
-          end
-        end
-      end
-    end
-  end
-end