@antasphere/chassis-server 1.0.0

package/dist/api/audit.js

@@ -0,0 +1,75 @@
+import { count, eq, lt, desc } from 'drizzle-orm';
+import { auditListRoute } from '@antasphere/chassis-contract/routes';
+import { auditLog, user as userTable } from '@antasphere/chassis-db';
+import { requireRole } from '../middleware/auth-context.js';
+import { auditFilterConditions, auditWhere, cursorId } from '../audit/filters.js';
+export function registerAuditRoutes(api, db) {
+    api.use('/audit', requireRole('admin'));
+    api.openapi(auditListRoute, async (c) => {
+        const principal = c.get('principal');
+        const query = c.req.valid('query');
+        const { limit } = query;
+        // SECURITY: the scope is the caller's workspace and nothing in the
+        // query can widen it; every filter narrows within it, as a bound
+        // parameter (audit/filters.ts). The cursor stays the last row id, so
+        // a page is "the next `limit` rows older than the cursor that match
+        // the same filters": a client that changes a filter starts over.
+        const scope = eq(auditLog.workspaceId, principal.workspaceId);
+        const filters = auditFilterConditions(query);
+        const cursor = cursorId(query.cursor);
+        const where = auditWhere(scope, filters, cursor !== null ? lt(auditLog.id, cursor) : null);
+        const rows = await db
+            .select({
+            id: auditLog.id,
+            actorUserId: auditLog.actorUserId,
+            actorEmail: userTable.email,
+            actorVia: auditLog.actorVia,
+            apiKeyId: auditLog.apiKeyId,
+            action: auditLog.action,
+            resourceType: auditLog.resourceType,
+            resourceId: auditLog.resourceId,
+            requestId: auditLog.requestId,
+            ip: auditLog.ip,
+            metadata: auditLog.metadata,
+            createdAt: auditLog.createdAt
+        })
+            .from(auditLog)
+            .leftJoin(userTable, eq(auditLog.actorUserId, userTable.id))
+            .where(where)
+            .orderBy(desc(auditLog.id))
+            .limit(limit + 1);
+        // The total is counted once per listing, on the first page: the count
+        // walks the same join and WHERE without the cursor, and a client keeps
+        // the figure while it loads the pages after.
+        let total = null;
+        if (cursor === null) {
+            const [counted] = await db
+                .select({ n: count() })
+                .from(auditLog)
+                .leftJoin(userTable, eq(auditLog.actorUserId, userTable.id))
+                .where(auditWhere(scope, filters, null));
+            total = counted?.n ?? 0;
+        }
+        const page = rows.slice(0, limit);
+        const nextCursor = rows.length > limit ? String(page[page.length - 1]?.id ?? '') : null;
+        return c.json({
+            entries: page.map((r) => ({
+                id: r.id,
+                actorUserId: r.actorUserId,
+                actorEmail: r.actorEmail,
+                actorVia: r.actorVia,
+                apiKeyId: r.apiKeyId,
+                action: r.action,
+                resourceType: r.resourceType,
+                resourceId: r.resourceId,
+                requestId: r.requestId,
+                ip: r.ip,
+                metadata: r.metadata,
+                createdAt: r.createdAt.toISOString()
+            })),
+            nextCursor,
+            total
+        }, 200);
+    });
+}
+//# sourceMappingURL=audit.js.map

package/dist/api/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/api/audit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,IAAI,IAAI,SAAS,EAAW,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAElF,MAAM,UAAU,mBAAmB,CAAC,GAAgB,EAAE,EAAM;IAC1D,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IACxC,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QAExB,mEAAmE;QACnE,iEAAiE;QACjE,qEAAqE;QACrE,oEAAoE;QACpE,iEAAiE;QACjE,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAE3F,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC;YACN,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,UAAU,EAAE,SAAS,CAAC,KAAK;YAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;SAC9B,CAAC;aACD,IAAI,CAAC,QAAQ,CAAC;aACd,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;aAC3D,KAAK,CAAC,KAAK,CAAC;aACZ,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;aAC1B,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAEpB,sEAAsE;QACtE,uEAAuE;QACvE,6CAA6C;QAC7C,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;iBACvB,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;iBACtB,IAAI,CAAC,QAAQ,CAAC;iBACd,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;iBAC3D,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;YAC3C,KAAK,GAAG,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxF,OAAO,CAAC,CAAC,IAAI,CACX;YACE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACxB,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;aACrC,CAAC,CAAC;YACH,UAAU;YACV,KAAK;SACN,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/api/break-glass.d.ts

@@ -0,0 +1,48 @@
+import type { OpenAPIHono } from '@hono/zod-openapi';
+import { type Db } from '@antasphere/chassis-db';
+import type { Auth } from '../identity/better-auth.js';
+import type { AuditService } from '../audit/service.js';
+import type { Logger } from '../logger.js';
+/**
+ * Break-glass superadmin recovery (ADR 010) — the instance-level recovery
+ * surface for the per-tenant hosting model. Two capabilities only:
+ *
+ *  - claim-ownership: make the calling superadmin (or a named existing user)
+ *    an ACTIVE OWNER of a workspace — creating the membership when absent,
+ *    reactivating and promoting when present. It ADDS an owner and never
+ *    removes one, so the migration-0009 last-owner trigger is satisfied by
+ *    construction. The target workspace is explicit (`workspaceId`) once the
+ *    instance runs several (ADR 014); a single-workspace instance keeps the
+ *    old no-argument call.
+ *  - reset-2fa: clear a locked-out user's second factor (the recovery ADR 009
+ *    deferred to manual DB surgery). User-level — needs no workspace; its
+ *    audit row is instance-attributed.
+ *
+ * SAFETY MODEL (a bug here = full instance compromise — keep all of it):
+ *
+ *  - Off by default: superadmin exists ONLY while SUPERADMIN_EMAILS is set.
+ *  - Session-only, twice over: these paths are deliberately UNLISTED in the
+ *    fail-closed scope allowlist (middleware/scopes.ts), so machine
+ *    principals 403 before reaching the handlers; AND the handlers resolve
+ *    the Better Auth session directly — a request without a session cookie
+ *    can never qualify, whatever headers it carries.
+ *  - Verified email required: an allowlisted address that was never proven
+ *    (invitation copyable-link accounts are unverified) does NOT match.
+ *  - Identity is re-read from the DB by session user id — never derived from
+ *    any header, body field, or client-supplied value.
+ *  - No requireAuth()/requireRole() gate: the recovering operator may hold a
+ *    session with NO membership (principal resolves to null), which is
+ *    exactly the state break-glass exists to fix. The handlers do their own
+ *    authentication and are exempted from the generic audit middleware
+ *    because they write their own richer rows (see audit/service.ts).
+ */
+export interface BreakGlassRouteDeps {
+    db: Db;
+    auth: Auth;
+    audit: AuditService;
+    logger: Logger;
+    /** Raw SUPERADMIN_EMAILS value (already validated by the env schema). */
+    superadminEmails: string | undefined;
+}
+export declare function registerBreakGlassRoutes(api: OpenAPIHono, deps: BreakGlassRouteDeps): void;
+//# sourceMappingURL=break-glass.d.ts.map

package/dist/api/break-glass.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"break-glass.d.ts","sourceRoot":"","sources":["../../src/api/break-glass.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAOrD,OAAO,EAA8D,KAAK,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAC7G,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAG3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,EAAE,CAAC;IACP,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AASD,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAsO1F"}

package/dist/api/break-glass.js

@@ -0,0 +1,217 @@
+import { and, eq } from 'drizzle-orm';
+import { breakGlassClaimOwnershipRoute, breakGlassResetTwoFactorRoute } from '@antasphere/chassis-contract/routes';
+import { twoFactor, user as userTable, workspaceMembers, workspaces } from '@antasphere/chassis-db';
+import { parseSuperadminEmails } from '../accounts/superadmin.js';
+const err = (code, message) => ({ error: { code, message } });
+export function registerBreakGlassRoutes(api, deps) {
+    const { db, auth, audit, logger } = deps;
+    const allowlist = parseSuperadminEmails(deps.superadminEmails);
+    /**
+     * Resolve the caller as a superadmin. One uniform `forbidden` for every
+     * rejection reason (dormant, not listed, unverified) so the endpoint is
+     * not an oracle for the allowlist's contents.
+     */
+    const resolveSuperadmin = async (c) => {
+        // Session-only: the verified session identity, never a header or bearer.
+        // Machine credentials died at the fail-closed scope gate already; a
+        // cookieless request has no session and stops here.
+        const session = await auth.api.getSession({ headers: c.req.raw.headers });
+        if (!session?.user)
+            return { kind: 'unauthenticated' };
+        if (allowlist.size === 0)
+            return { kind: 'forbidden' };
+        // Fresh row by session user id — email + verification state are read
+        // from the database, not trusted from session claims.
+        const [u] = await db
+            .select({
+            id: userTable.id,
+            email: userTable.email,
+            emailVerified: userTable.emailVerified,
+            name: userTable.name
+        })
+            .from(userTable)
+            .where(eq(userTable.id, session.user.id))
+            .limit(1);
+        if (!u)
+            return { kind: 'forbidden' };
+        if (!allowlist.has(u.email.toLowerCase()))
+            return { kind: 'forbidden' };
+        if (!u.emailVerified)
+            return { kind: 'forbidden' };
+        return { kind: 'ok', caller: { userId: u.id, email: u.email, name: u.name } };
+    };
+    /**
+     * The workspace an owner-claim targets (ADR 014). Explicit `workspaceId`
+     * wins; omitted, it resolves ONLY while the instance runs a single
+     * workspace — with several, recovery must name its target (400
+     * workspace_required), never guess one.
+     */
+    const resolveTargetWorkspace = async (explicit) => {
+        if (explicit) {
+            const [ws] = await db
+                .select({ id: workspaces.id })
+                .from(workspaces)
+                .where(eq(workspaces.id, explicit))
+                .limit(1);
+            return ws ? { kind: 'ok', id: ws.id } : { kind: 'not_found' };
+        }
+        const rows = await db.select({ id: workspaces.id }).from(workspaces).limit(2);
+        const [only] = rows;
+        if (!only)
+            return { kind: 'not_setup' };
+        if (rows.length > 1)
+            return { kind: 'ambiguous' };
+        return { kind: 'ok', id: only.id };
+    };
+    api.openapi(breakGlassClaimOwnershipRoute, async (c) => {
+        const resolved = await resolveSuperadmin(c);
+        if (resolved.kind === 'unauthenticated') {
+            return c.json(err('unauthenticated', 'Authentication required'), 401);
+        }
+        if (resolved.kind === 'forbidden') {
+            return c.json(err('forbidden', 'Break-glass is not available to this caller'), 403);
+        }
+        const caller = resolved.caller;
+        const body = c.req.valid('json');
+        const targetWs = await resolveTargetWorkspace(body.workspaceId);
+        if (targetWs.kind === 'not_setup') {
+            return c.json(err('not_setup', 'This instance has not completed setup'), 409);
+        }
+        if (targetWs.kind === 'not_found') {
+            return c.json(err('not_found', 'Target workspace not found'), 404);
+        }
+        if (targetWs.kind === 'ambiguous') {
+            return c.json(err('workspace_required', 'This instance has several workspaces — pass workspaceId explicitly'), 400);
+        }
+        const ws = { id: targetWs.id };
+        // Target: a named existing user, or the calling superadmin.
+        let target = { userId: caller.userId, email: caller.email };
+        if (body.userId) {
+            const [t] = await db
+                .select({ id: userTable.id, email: userTable.email })
+                .from(userTable)
+                .where(eq(userTable.id, body.userId))
+                .limit(1);
+            if (!t)
+                return c.json(err('not_found', 'Target user not found'), 404);
+            target = { userId: t.id, email: t.email };
+        }
+        const [before] = await db
+            .select({
+            id: workspaceMembers.id,
+            role: workspaceMembers.role,
+            isActive: workspaceMembers.isActive
+        })
+            .from(workspaceMembers)
+            .where(and(eq(workspaceMembers.workspaceId, ws.id), eq(workspaceMembers.userId, target.userId)))
+            .limit(1);
+        // Additive by construction: create-or-promote to an ACTIVE OWNER. The
+        // 0009 last-owner trigger only rejects operations that REMOVE the last
+        // active owner — adding one is always legal, including the first owner
+        // of an ownerless workspace.
+        const [after] = await db
+            .insert(workspaceMembers)
+            // origin='local' on BOTH paths (BG-1, PRDCT-1356): a break-glass owner
+            // is the tool's own business, never hub truth. Left at 'hub' (the
+            // conflict path once kept the row's old origin), the cloud reconciler's
+            // deactivation sweep — which targets origin='hub' rows the hub no
+            // longer asserts — undid the recovery ~12 s later.
+            .values({ workspaceId: ws.id, userId: target.userId, role: 'owner', isActive: true, origin: 'local' })
+            .onConflictDoUpdate({
+            target: [workspaceMembers.workspaceId, workspaceMembers.userId],
+            set: { role: 'owner', isActive: true, origin: 'local' }
+        })
+            .returning({ id: workspaceMembers.id });
+        if (!after)
+            throw new Error('break-glass ownership upsert returned no row');
+        logger.warn({
+            superadminUserId: caller.userId,
+            superadminEmail: caller.email,
+            targetUserId: target.userId,
+            targetEmail: target.email,
+            workspaceId: ws.id
+        }, 'BREAK-GLASS: workspace ownership claimed');
+        await audit.write({
+            workspaceId: ws.id,
+            principal: { userId: caller.userId, via: 'session' },
+            action: 'break_glass.claim_ownership',
+            resourceType: 'member',
+            resourceId: after.id,
+            requestId: c.get('requestId'),
+            metadata: {
+                superadminUserId: caller.userId,
+                superadminEmail: caller.email,
+                targetUserId: target.userId,
+                targetEmail: target.email,
+                before: before ? { role: before.role, isActive: before.isActive } : null,
+                after: { role: 'owner', isActive: true },
+                created: !before
+            }
+        });
+        return c.json({
+            memberId: after.id,
+            userId: target.userId,
+            email: target.email,
+            workspaceId: ws.id,
+            role: 'owner',
+            isActive: true,
+            created: !before
+        }, 200);
+    });
+    api.openapi(breakGlassResetTwoFactorRoute, async (c) => {
+        const resolved = await resolveSuperadmin(c);
+        if (resolved.kind === 'unauthenticated') {
+            return c.json(err('unauthenticated', 'Authentication required'), 401);
+        }
+        if (resolved.kind === 'forbidden') {
+            return c.json(err('forbidden', 'Break-glass is not available to this caller'), 403);
+        }
+        const caller = resolved.caller;
+        const { userId } = c.req.valid('json');
+        const [target] = await db
+            .select({
+            id: userTable.id,
+            email: userTable.email,
+            twoFactorEnabled: userTable.twoFactorEnabled
+        })
+            .from(userTable)
+            .where(eq(userTable.id, userId))
+            .limit(1);
+        if (!target)
+            return c.json(err('not_found', 'Target user not found'), 404);
+        // Clear the factor: the two_factor row (secret + backup codes) and the
+        // user flag. Idempotent — resetting an unenrolled user is a no-op 200.
+        const removed = await db
+            .delete(twoFactor)
+            .where(eq(twoFactor.userId, target.id))
+            .returning({ id: twoFactor.id });
+        await db.update(userTable).set({ twoFactorEnabled: false }).where(eq(userTable.id, target.id));
+        const hadTwoFactor = removed.length > 0 || target.twoFactorEnabled === true;
+        logger.warn({
+            superadminUserId: caller.userId,
+            superadminEmail: caller.email,
+            targetUserId: target.id,
+            targetEmail: target.email,
+            hadTwoFactor
+        }, 'BREAK-GLASS: two-factor reset');
+        // INSTANCE-attributed (workspace_id NULL, ADR 014): a second factor is a
+        // user property, not any workspace's — the row needs no workspace home.
+        await audit.write({
+            workspaceId: null,
+            principal: { userId: caller.userId, via: 'session' },
+            action: 'break_glass.reset_two_factor',
+            resourceType: 'user',
+            resourceId: target.id,
+            requestId: c.get('requestId'),
+            metadata: {
+                superadminUserId: caller.userId,
+                superadminEmail: caller.email,
+                targetUserId: target.id,
+                targetEmail: target.email,
+                hadTwoFactor
+            }
+        });
+        return c.json({ userId: target.id, hadTwoFactor }, 200);
+    });
+}
+//# sourceMappingURL=break-glass.js.map

package/dist/api/break-glass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"break-glass.js","sourceRoot":"","sources":["../../src/api/break-glass.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC9B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAW,MAAM,wBAAwB,CAAC;AAI7G,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AA6ClE,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AAO9E,MAAM,UAAU,wBAAwB,CAAC,GAAgB,EAAE,IAAyB;IAClF,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACzC,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAE/D;;;;OAIG;IACH,MAAM,iBAAiB,GAAG,KAAK,EAAE,CAAU,EAAiC,EAAE;QAC5E,yEAAyE;QACzE,oEAAoE;QACpE,oDAAoD;QACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,OAAO,EAAE,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;QACvD,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACvD,qEAAqE;QACrE,sDAAsD;QACtD,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE;aACjB,MAAM,CAAC;YACN,EAAE,EAAE,SAAS,CAAC,EAAE;YAChB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,aAAa,EAAE,SAAS,CAAC,aAAa;YACtC,IAAI,EAAE,SAAS,CAAC,IAAI;SACrB,CAAC;aACD,IAAI,CAAC,SAAS,CAAC;aACf,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;aACxC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACxE,IAAI,CAAC,CAAC,CAAC,aAAa;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACnD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAChF,CAAC,CAAC;IAEF;;;;;OAKG;IACH,MAAM,sBAAsB,GAAG,KAAK,EAClC,QAA4B,EAG5B,EAAE;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE;iBAClB,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;iBAC7B,IAAI,CAAC,UAAU,CAAC;iBAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;iBAClC,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAChE,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAClD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;IACrC,CAAC,CAAC;IAEF,GAAG,CAAC,OAAO,CAAC,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACxC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,6CAA6C,CAAC,EAAE,GAAG,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEjC,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,uCAAuC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,4BAA4B,CAAC,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CACX,GAAG,CAAC,oBAAoB,EAAE,oEAAoE,CAAC,EAC/F,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QAE/B,4DAA4D;QAC5D,IAAI,MAAM,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC5D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE;iBACjB,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;iBACpD,IAAI,CAAC,SAAS,CAAC;iBACf,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;iBACpC,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,GAAG,CAAC,CAAC;YACtE,MAAM,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAC5C,CAAC;QAED,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC;YACN,EAAE,EAAE,gBAAgB,CAAC,EAAE;YACvB,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;SACpC,CAAC;aACD,IAAI,CAAC,gBAAgB,CAAC;aACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;aAC/F,KAAK,CAAC,CAAC,CAAC,CAAC;QAEZ,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,6BAA6B;QAC7B,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,gBAAgB,CAAC;YACzB,uEAAuE;YACvE,kEAAkE;YAClE,wEAAwE;YACxE,kEAAkE;YAClE,mDAAmD;aAClD,MAAM,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;aACrG,kBAAkB,CAAC;YAClB,MAAM,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,gBAAgB,CAAC,MAAM,CAAC;YAC/D,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;SACxD,CAAC;aACD,SAAS,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAE5E,MAAM,CAAC,IAAI,CACT;YACE,gBAAgB,EAAE,MAAM,CAAC,MAAM;YAC/B,eAAe,EAAE,MAAM,CAAC,KAAK;YAC7B,YAAY,EAAE,MAAM,CAAC,MAAM;YAC3B,WAAW,EAAE,MAAM,CAAC,KAAK;YACzB,WAAW,EAAE,EAAE,CAAC,EAAE;SACnB,EACD,0CAA0C,CAC3C,CAAC;QACF,MAAM,KAAK,CAAC,KAAK,CAAC;YAChB,WAAW,EAAE,EAAE,CAAC,EAAE;YAClB,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE;YACpD,MAAM,EAAE,6BAA6B;YACrC,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,KAAK,CAAC,EAAE;YACpB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;YAC7B,QAAQ,EAAE;gBACR,gBAAgB,EAAE,MAAM,CAAC,MAAM;gBAC/B,eAAe,EAAE,MAAM,CAAC,KAAK;gBAC7B,YAAY,EAAE,MAAM,CAAC,MAAM;gBAC3B,WAAW,EAAE,MAAM,CAAC,KAAK;gBACzB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI;gBACxE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACxC,OAAO,EAAE,CAAC,MAAM;aACjB;SACF,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CACX;YACE,QAAQ,EAAE,KAAK,CAAC,EAAE;YAClB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,EAAE,CAAC,EAAE;YAClB,IAAI,EAAE,OAAgB;YACtB,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,CAAC,MAAM;SACjB,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,OAAO,CAAC,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACxC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,6CAA6C,CAAC,EAAE,GAAG,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC/B,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEvC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC;YACN,EAAE,EAAE,SAAS,CAAC,EAAE;YAChB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;SAC7C,CAAC;aACD,IAAI,CAAC,SAAS,CAAC;aACf,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC/B,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,GAAG,CAAC,CAAC;QAE3E,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,OAAO,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,SAAS,CAAC;aACjB,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;aACtC,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/F,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,gBAAgB,KAAK,IAAI,CAAC;QAE5E,MAAM,CAAC,IAAI,CACT;YACE,gBAAgB,EAAE,MAAM,CAAC,MAAM;YAC/B,eAAe,EAAE,MAAM,CAAC,KAAK;YAC7B,YAAY,EAAE,MAAM,CAAC,EAAE;YACvB,WAAW,EAAE,MAAM,CAAC,KAAK;YACzB,YAAY;SACb,EACD,+BAA+B,CAChC,CAAC;QACF,yEAAyE;QACzE,wEAAwE;QACxE,MAAM,KAAK,CAAC,KAAK,CAAC;YAChB,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE;YACpD,MAAM,EAAE,8BAA8B;YACtC,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,MAAM,CAAC,EAAE;YACrB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;YAC7B,QAAQ,EAAE;gBACR,gBAAgB,EAAE,MAAM,CAAC,MAAM;gBAC/B,eAAe,EAAE,MAAM,CAAC,KAAK;gBAC7B,YAAY,EAAE,MAAM,CAAC,EAAE;gBACvB,WAAW,EAAE,MAAM,CAAC,KAAK;gBACzB,YAAY;aACb;SACF,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/api/cli-auth.d.ts

@@ -0,0 +1,84 @@
+import type { OpenAPIHono } from '@hono/zod-openapi';
+import type { ScopeRoutes } from './scope-routes.js';
+import { type Db } from '@antasphere/chassis-db';
+import type { Auth } from '../identity/better-auth.js';
+import type { HubSsoService } from '../identity/hub-sso.js';
+import type { ApiKeyService } from '../apikeys/service.js';
+import type { AuditService } from '../audit/service.js';
+import type { EmailDriver } from '../email/driver.js';
+import type { Logger } from '../logger.js';
+/**
+ * Browserless CLI/agent auth (the tool CLI's `auth login-*` flow):
+ *
+ *   POST /cli/auth/request  → email a 6-digit sign-in OTP
+ *   POST /cli/auth/complete → verify the OTP, mint an API key
+ *
+ * Built ENTIRELY on the existing email-OTP primitive — no new credential
+ * machinery. `request` delegates to the emailOTP plugin's
+ * send-verification-otp (type "sign-in"); with the instance's
+ * `disableSignUp: true` an unknown email gets a generic success and NO mail
+ * (the plugin deletes the pending code — no enumeration oracle, no user
+ * minted). `complete` delegates to the plugin's sign-in endpoint, whose
+ * verification is atomic and attempt-limited (3 per code); with
+ * `disableSignUp` an unknown email fails exactly like a wrong code. So the
+ * closed-signup invariant (the three switches) is untouched: this surface
+ * can only ever sign in accounts that already exist (setup owner, workspace
+ * invitation, collaborator claim).
+ *
+ * On success the sign-in's throwaway session is used server-side only: mint
+ * the key (the tool's read + write scopes — the agent surface, never its
+ * export scope), DELETE the session, and return the key once. The
+ * "sessions only mint keys" rule holds in spirit: the mint is bound to a
+ * fresh, fully verified interactive sign-in, not to a machine credential
+ * (machine principals can't even reach these paths — they are unlisted in
+ * the scope allowlist and 403 fail-closed).
+ *
+ * 2FA-enrolled users are REJECTED (403 two_factor_required): the config
+ * hooks.after in identity/better-auth.ts parks their OTP sign-in behind the
+ * TOTP step, which a browserless flow cannot complete — they mint keys in
+ * the dashboard instead. Never bypass that hook here.
+ *
+ * Without a delivering email driver both endpoints answer 400
+ * otp_unavailable (the emailOTP plugin is not even registered then) —
+ * self-hosters without SMTP paste a dashboard-minted key (the CLI's `login`).
+ *
+ * On EDITION=cloud (hubSso present) BOTH mint endpoints refuse outright —
+ * 403 cli_otp_disabled, checked BEFORE the mailer/plugin checks so a
+ * mailerless cloud instance steers to `antasphere login` too. This is the
+ * CLI half of the D1 hub-only entrance closure (the human half is the
+ * emailOTP sign-in refusal in identity/better-auth.ts): every cloud
+ * credential — human session AND machine key — must trace through the hub
+ * so its audit log is the complete access record. Cloud CLI keys are minted
+ * by `antasphere login` + /sso/cli-connect (api/sso-connect.ts) instead.
+ * oss keeps this flow unchanged.
+ *
+ * DELETE /cli/auth/key (the CLI's `logout`) stays OPEN on both editions: it
+ * revokes exactly the PRESENTING key — revocation narrows access and is the
+ * cleanup path every mint above needs.
+ *
+ * Rate limits (api/index.ts): request rides the OTP wall (per IP + email),
+ * complete rides the login wall (per IP + email).
+ */
+export interface CliAuthRouteDeps {
+    db: Db;
+    auth: Auth;
+    email: EmailDriver;
+    apiKeys: ApiKeyService;
+    audit: AuditService;
+    logger: Logger;
+    /**
+     * Cloud presence switch (internal/federation.md, D1 hub-only login): when set
+     * (EDITION=cloud boots only), the OTP mint pair refuses 403
+     * cli_otp_disabled. Only the boolean presence is consulted — the service
+     * itself is never called from this module. The self-revoke is unaffected.
+     */
+    hubSso?: HubSsoService | undefined;
+    /** The CLI key's fixed grant — the agent surface, never the export scope. */
+    cliKeyScopes: readonly string[];
+    /** The tool's instantiation of the scope-carrying mint route. */
+    routes: Pick<ScopeRoutes, 'cliAuthCompleteRoute'>;
+    /** The tool's name in the cloud refusal sentence (`identity.displayName`). */
+    displayName: string;
+}
+export declare function registerCliAuthRoutes(api: OpenAPIHono, deps: CliAuthRouteDeps): void;
+//# sourceMappingURL=cli-auth.d.ts.map

package/dist/api/cli-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-auth.d.ts","sourceRoot":"","sources":["../../src/api/cli-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAA2B,KAAK,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAC;AAEvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAI3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,EAAE,CAAC;IACP,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,aAAa,CAAC;IACvB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,MAAM,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IACnC,6EAA6E;IAC7E,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,iEAAiE;IACjE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC;IAClD,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAC;CACrB;AAoBD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAuMpF"}

package/dist/api/cli-auth.js

@@ -0,0 +1,177 @@
+import { and, eq, isNull, sql } from 'drizzle-orm';
+import { cliAuthRequestRoute, cliAuthRevokeRoute } from '@antasphere/chassis-contract/routes';
+import { apiKeys as apiKeysTable } from '@antasphere/chassis-db';
+import { resolveMembership } from '../identity/resolve-membership.js';
+const err = (code, message) => ({ error: { code, message } });
+/** better-auth APIError carries { body: { code, message } }; match by code. */
+function betterAuthErrorCode(e) {
+    const body = e?.body;
+    return typeof body?.code === 'string' ? body.code : null;
+}
+export function registerCliAuthRoutes(api, deps) {
+    const { db, auth, email, apiKeys, audit, logger, hubSso, cliKeyScopes } = deps;
+    const { cliAuthCompleteRoute } = deps.routes;
+    const otpApi = auth.api;
+    /** The D1 cloud refusal — identical on both mint routes, checked FIRST. */
+    const cloudRefusal = () => err('cli_otp_disabled', 'This instance signs in through the Antasphere hub — run `antasphere login` once; ' +
+        `the ${deps.displayName} CLI then connects automatically`);
+    api.openapi(cliAuthRequestRoute, async (c) => {
+        if (hubSso)
+            return c.json(cloudRefusal(), 403);
+        if (!email.delivers || !otpApi.sendVerificationOTP) {
+            return c.json(err('otp_unavailable', 'This instance has no email driver — sign in to the dashboard and mint an API key instead'), 400);
+        }
+        const body = c.req.valid('json');
+        try {
+            // Generic success either way; the plugin sends only to existing
+            // accounts (disableSignUp) — deliberately not observable here.
+            await otpApi.sendVerificationOTP({ body: { email: body.email, type: 'sign-in' } });
+        }
+        catch (cause) {
+            // INVALID_EMAIL can't happen (contract-validated); anything else is internal.
+            logger.error({ err: cause }, 'cli-auth: OTP send failed');
+            return c.json(err('internal', 'Could not send the sign-in code — try again'), 500);
+        }
+        return c.json({ sent: true }, 200);
+    });
+    api.openapi(cliAuthCompleteRoute, async (c) => {
+        if (hubSso)
+            return c.json(cloudRefusal(), 403);
+        if (!email.delivers || !otpApi.signInEmailOTP) {
+            return c.json(err('otp_unavailable', 'This instance has no email driver — sign in to the dashboard and mint an API key instead'), 400);
+        }
+        const body = c.req.valid('json');
+        let signedIn;
+        try {
+            signedIn = await otpApi.signInEmailOTP({ body: { email: body.email, otp: body.otp } });
+        }
+        catch (cause) {
+            const code = betterAuthErrorCode(cause);
+            if (code === 'TOO_MANY_ATTEMPTS') {
+                return c.json(err('too_many_attempts', 'Too many wrong codes — request a fresh one'), 429);
+            }
+            // INVALID_OTP covers wrong code AND unknown account (disableSignUp);
+            // OTP_EXPIRED joins them — one uniform 401, no enumeration.
+            if (code === 'INVALID_OTP' || code === 'OTP_EXPIRED' || code === 'USER_NOT_FOUND') {
+                return c.json(err('invalid_otp', 'The code is wrong, expired, or not for this email'), 401);
+            }
+            logger.error({ err: cause }, 'cli-auth: OTP sign-in failed');
+            return c.json(err('internal', 'Sign-in failed — try again'), 500);
+        }
+        // The 2FA hook (identity/better-auth.ts) parks enrolled users behind the
+        // TOTP step and answers { twoFactorRedirect } with no session. A
+        // browserless flow cannot complete that dance — refuse, never bypass.
+        if (!('token' in signedIn)) {
+            return c.json(err('two_factor_required', 'This account has two-factor auth enabled — sign in to the dashboard and mint an API key there'), 403);
+        }
+        const { token: sessionToken, user } = signedIn;
+        const dropSession = async () => {
+            try {
+                const authCtx = await auth.$context;
+                await authCtx.internalAdapter.deleteSession(sessionToken);
+            }
+            catch (cause) {
+                // Advisory: the session was never handed out; expiry bounds the residue.
+                logger.warn({ err: cause }, 'cli-auth: throwaway session cleanup failed');
+            }
+        };
+        // Same live-membership discipline as every credential path: no active
+        // membership, no key (e.g. a deactivated member's account still signs in
+        // at the Better Auth layer but has no standing on this instance). The
+        // key is USER-SCOPED by default (user-scoped credential model): it acts
+        // as its holder and the target workspace is a per-request parameter.
+        // `workspaceId` in the body is an optional PIN — a requested workspace
+        // the account is not an active member of answers the SAME uniform 403
+        // as having none at all (no oracle about other workspaces).
+        const membership = await resolveMembership(db, user.id, body.workspaceId ?? null);
+        if (!membership) {
+            await dropSession();
+            return c.json(err('no_membership', 'This account has no active membership on this instance'), 403);
+        }
+        const pinnedWorkspaceId = body.workspaceId ?? null;
+        const name = body.keyName ?? `CLI login ${new Date().toISOString().slice(0, 10)}`;
+        const expiresAt = body.expiresInDays ? new Date(Date.now() + body.expiresInDays * 86_400_000) : null;
+        const minted = await apiKeys.mint({
+            workspaceId: pinnedWorkspaceId,
+            createdBy: user.id,
+            name,
+            scopes: [...cliKeyScopes],
+            expiresAt
+        });
+        await dropSession();
+        const [row] = await db.select().from(apiKeysTable).where(eq(apiKeysTable.id, minted.id)).limit(1);
+        if (!row) {
+            return c.json(err('internal', 'Key mint failed — try again'), 500);
+        }
+        // This path is principal-less (public route), so the audit middleware
+        // cannot attribute it — write the row directly, like /setup does. An
+        // unpinned mint is a USER-credential event with no one workspace home:
+        // the row is instance-attributed (workspaceId null, like the orphan
+        // purge); a pinned mint lands in the pinned workspace's trail.
+        await audit.write({
+            workspaceId: pinnedWorkspaceId,
+            principal: { userId: user.id, via: 'session' },
+            action: 'apikey.create',
+            resourceType: 'api_key',
+            resourceId: minted.id,
+            requestId: c.get('requestId'),
+            metadata: {
+                name,
+                scopes: [...cliKeyScopes],
+                via: 'cli_otp',
+                workspaceId: pinnedWorkspaceId,
+                expiresAt: expiresAt?.toISOString() ?? null
+            }
+        });
+        return c.json({
+            key: minted.key,
+            apiKey: {
+                id: row.id,
+                name: row.name,
+                keyId: row.keyId,
+                scopes: row.scopes,
+                workspaceId: row.workspaceId,
+                createdBy: row.createdBy,
+                createdAt: row.createdAt.toISOString(),
+                lastUsedAt: row.lastUsedAt?.toISOString() ?? null,
+                revokedAt: row.revokedAt?.toISOString() ?? null,
+                expiresAt: row.expiresAt?.toISOString() ?? null
+            },
+            user: { id: user.id, email: user.email, name: user.name },
+            workspaceId: pinnedWorkspaceId
+        }, 201);
+    });
+    // CLI logout: revoke exactly the PRESENTING key — possession is the
+    // authority to kill itself. The ONE /cli/auth route open to machine
+    // principals (scope allowlist, the tool's write scope — every CLI-minted key
+    // carries it); there is no id parameter, so no OTHER key is nameable, and
+    // the handler acts only on principal.apiKeyId, which the credential
+    // resolver derived from the presented secret. Sessions are refused — the
+    // dashboard (DELETE /api-keys/{id}) is their key-management surface — and
+    // so are OAuth bearers (no apiKeyId). Deliberately edition-independent:
+    // on cloud, the CLI's `logout --org` must be able to kill the
+    // /sso/cli-connect-minted key server-side (revocation narrows access; the
+    // D1 closure is about MINTING).
+    api.openapi(cliAuthRevokeRoute, async (c) => {
+        const principal = c.get('principal');
+        if (!principal)
+            return c.json(err('unauthenticated', 'Authentication required'), 401);
+        if (principal.via !== 'api_key' || !principal.apiKeyId) {
+            return c.json(err('forbidden', 'Only an API key can revoke itself — use the dashboard for key management'), 403);
+        }
+        await db
+            .update(apiKeysTable)
+            .set({ revokedAt: sql `now()` })
+            .where(and(eq(apiKeysTable.id, principal.apiKeyId), isNull(apiKeysTable.revokedAt)));
+        // The generic audit middleware writes the row (machine mutation) — hand
+        // it the semantics instead of double-writing.
+        c.set('audit', {
+            action: 'apikey.revoke',
+            resourceType: 'api_key',
+            resourceId: principal.apiKeyId,
+            metadata: { via: 'cli_logout' }
+        });
+        return c.json({ revoked: true, id: principal.apiKeyId }, 200);
+    });
+}
+//# sourceMappingURL=cli-auth.js.map