@aexol/spectral 0.9.229 → 0.9.230

package/dist/relay/registration.d.ts

@@ -3,12 +3,14 @@
  *
  * Contract (Batch 1 backend):
  *   POST <backend>/api/machines/register
- *     Headers: Authorization: Bearer <teamApiKey|userJwt>
+ *     Headers: Authorization: Bearer <userJwt|userApiKey|teamApiKey>
  *     Body:    { name?: string, hostname: string, version: string, pid: number }
- *     200:     { machineId: string, jwt: string, name: string, ownerId?: string }
+ *     200:     { machineId: string, jwt: string, name: string, teamId?, ownerId?, visibility? }
  *
  * Auth priority:
  *   - If `userJwt` is set → used as Bearer token (machine gets ownerId)
+ *   - Else if `userApiKey` is set → used as Bearer token (machine is PRIVATE
+ *     with ownerId derived from the key by the backend)
  *   - Else → `apiKey` (team API key, machine gets no owner)
  *
  * Why this lives in its own module:
@@ -30,6 +32,12 @@ export interface RegistrationDeps {
     backendUrl: string;
     /** Team API key — used when `userJwt` is not set. */
     apiKey: string;
+    /**
+     * Optional user API key ("sk-aexol-user-"), pinned to a team but owned by a
+     * single user. Used when `userJwt` is not set; takes priority over `apiKey`.
+     * The backend registers the machine as PRIVATE with ownerId from the key.
+     */
+    userApiKey?: string;
     /** Optional user JWT from OAuth login. When set, used instead of `apiKey` for registration. */
     userJwt?: string;
     /** Display name override (from `--machine-name`). Falls back to hostname. */

package/dist/relay/registration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registration.d.ts","sourceRoot":"","sources":["../../src/relay/registration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,EAA4B,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAElF,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,MAAM,EAAE,OAAO,CAAC;IAChB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWvD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAUvD;AAED,mFAAmF;AACnF,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,SAAK,GAAG,OAAO,CAI/D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,gBAAgB,CAAC,CA+G3B"}
+{"version":3,"file":"registration.d.ts","sourceRoot":"","sources":["../../src/relay/registration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,OAAO,EAA4B,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAElF,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,MAAM,EAAE,OAAO,CAAC;IAChB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWvD;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAUvD;AAED,mFAAmF;AACnF,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,SAAK,GAAG,OAAO,CAI/D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,gBAAgB,CAAC,CA2I3B"}

package/dist/relay/registration.js

@@ -3,12 +3,14 @@
  *
  * Contract (Batch 1 backend):
  *   POST <backend>/api/machines/register
- *     Headers: Authorization: Bearer <teamApiKey|userJwt>
+ *     Headers: Authorization: Bearer <userJwt|userApiKey|teamApiKey>
  *     Body:    { name?: string, hostname: string, version: string, pid: number }
- *     200:     { machineId: string, jwt: string, name: string, ownerId?: string }
+ *     200:     { machineId: string, jwt: string, name: string, teamId?, ownerId?, visibility? }
  *
  * Auth priority:
  *   - If `userJwt` is set → used as Bearer token (machine gets ownerId)
+ *   - Else if `userApiKey` is set → used as Bearer token (machine is PRIVATE
+ *     with ownerId derived from the key by the backend)
  *   - Else → `apiKey` (team API key, machine gets no owner)
  *
  * Why this lives in its own module:
@@ -92,6 +94,7 @@ export async function ensureMachineRegistered(deps) {
     const skew = deps.expirySkewSec ?? 60;
     const existing = await loadMachine();
     const forceRefresh = deps.forceRefresh === true;
+    const usingUserApiKey = !deps.userJwt && !!deps.userApiKey;
     if (!forceRefresh && existing && !isJwtExpired(existing.machineJwt, skew)) {
         // The cached machine JWT is still valid. If the caller authenticated with a
         // user JWT (OAuth login) and the cached machine was previously owned by a
@@ -106,6 +109,21 @@ export async function ensureMachineRegistered(deps) {
                 shouldReuse = false;
             }
         }
+        else if (usingUserApiKey) {
+            // A user API key carries no `sub` claim, so identity is tracked by the
+            // key itself: `ensureMachineRegistered` records the key used for the
+            // last registration in `machine.json` extra. A different key means a
+            // different user (the backend derives `ownerId` from the key), so the
+            // machine must be re-registered to transfer ownership and flip
+            // visibility to PRIVATE. A missing marker means the cached machine was
+            // registered with a team key — re-register so the backend can make it
+            // PRIVATE for this user.
+            const previousKey = existing.extra?.userApiKey;
+            if (previousKey !== deps.userApiKey) {
+                console.log("Machine registered under a different user API key, re-registering to transfer ownership...");
+                shouldReuse = false;
+            }
+        }
         if (shouldReuse) {
             return { reused: true, record: existing };
         }
@@ -114,6 +132,8 @@ export async function ensureMachineRegistered(deps) {
         console.warn("Re-registering machine: cached JWT was rejected by the backend (forceRefresh).");
     }
     const fetchImpl = deps.fetchImpl ?? fetch;
+    // Token priority: userJwt (OAuth) > userApiKey (user-pinned key) > team key.
+    const authToken = deps.userJwt ?? deps.userApiKey ?? deps.apiKey;
     const url = `${deps.backendUrl.replace(/\/$/, "")}/api/machines/register`;
     const body = {
         // Reuse the cached display name on JWT-expiry refresh so the backend's
@@ -129,7 +149,7 @@ export async function ensureMachineRegistered(deps) {
         res = await fetchImpl(url, {
             method: "POST",
             headers: {
-                Authorization: `Bearer ${deps.userJwt ?? deps.apiKey}`,
+                Authorization: `Bearer ${authToken}`,
                 "Content-Type": "application/json",
             },
             body: JSON.stringify(body),
@@ -163,6 +183,14 @@ export async function ensureMachineRegistered(deps) {
         typeof obj.name !== "string") {
         throw new Error(`Machine registration: backend response missing required fields (machineId, jwt, name)`);
     }
+    const extra = { ...(existing?.extra ?? {}) };
+    delete extra.userApiKey;
+    if (usingUserApiKey) {
+        // Record which key was used so a later run with a different user key
+        // (a different account) forces re-registration. machine.json is 0600,
+        // same as config.json where the key already lives.
+        extra.userApiKey = deps.userApiKey;
+    }
     const record = {
         machineId: obj.machineId,
         machineName: obj.name,
@@ -173,6 +201,7 @@ export async function ensureMachineRegistered(deps) {
         registeredAt: Date.now(),
         hostname: hostname(),
         version: deps.version,
+        extra: Object.keys(extra).length > 0 ? extra : undefined,
     };
     await saveMachine(record);
     return { reused: false, forced: forceRefresh, record };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aexol/spectral",
-  "version": "0.9.229",
+  "version": "0.9.230",
   "description": "AI coding agent for Aexol with relay-based browser access.",
   "type": "module",
   "private": false,