@antasphere/chassis-server 1.0.0

package/dist/identity/hub-jwt.js

@@ -0,0 +1,77 @@
+import { createRemoteJWKSet, jwtVerify } from 'jose';
+/** Discovery-document cache lifetime; the JWKS itself is cached by jose. */
+const DISCOVERY_TTL_MS = 10 * 60 * 1000;
+/**
+ * Verifies hub-minted RS256 JWTs against the hub's REMOTE JWKS (discovered
+ * via OIDC discovery at the issuer root) — the cloud edition's trust anchor
+ * for "Sign in with Antasphere" (internal/federation.md). Same discipline as
+ * the local OauthJwtVerifier: hard issuer pinning, per-call audience
+ * pinning, RS256 allowlist (implicitly rejects none/HS256), small clock
+ * tolerance. jose's remote key set self-refreshes on an unknown `kid`; a
+ * signature failure on a KNOWN kid (rotation racing the cache) gets exactly
+ * one retry against a freshly created key set.
+ */
+export class HubJwtVerifier {
+    issuerUrl;
+    discoveryCache = null;
+    keySet = null;
+    constructor(issuerUrl) {
+        this.issuerUrl = issuerUrl;
+    }
+    async jwksUri() {
+        if (this.discoveryCache && Date.now() - this.discoveryCache.fetchedAt < DISCOVERY_TTL_MS) {
+            return this.discoveryCache.jwksUri;
+        }
+        const url = this.issuerUrl.replace(/\/+$/, '') + '/.well-known/openid-configuration';
+        const res = await fetch(url);
+        if (!res.ok)
+            throw new Error(`hub discovery failed: ${res.status} ${url}`);
+        const doc = (await res.json());
+        // The discovery document must claim the issuer we were configured to
+        // trust — a mismatch means HUB_ISSUER_URL points at the wrong deployment
+        // (or something impersonating it); fail closed before trusting its keys.
+        if (doc.issuer !== this.issuerUrl) {
+            throw new Error(`hub discovery issuer mismatch: expected ${this.issuerUrl}, got ${doc.issuer}`);
+        }
+        if (typeof doc.jwks_uri !== 'string' || !doc.jwks_uri) {
+            throw new Error('hub discovery document carries no jwks_uri');
+        }
+        this.discoveryCache = { jwksUri: doc.jwks_uri, fetchedAt: Date.now() };
+        return this.discoveryCache.jwksUri;
+    }
+    async keys(forceRefresh = false) {
+        const jwksUri = await this.jwksUri();
+        if (!forceRefresh && this.keySet)
+            return this.keySet;
+        this.keySet = createRemoteJWKSet(new URL(jwksUri));
+        return this.keySet;
+    }
+    /** Verify a hub JWT with the given audience pin; throws on any failure. */
+    async verify(token, audience) {
+        const options = {
+            issuer: this.issuerUrl,
+            // The hub access token's `aud` is an ARRAY when openid is scoped
+            // ([<our resource>, <hub userinfo>]); jose accepts any element
+            // matching, so pinning our own value stays exact.
+            audience,
+            algorithms: ['RS256'], // hard allowlist — implicitly rejects none/HS256
+            clockTolerance: 5,
+            requiredClaims: ['sub']
+        };
+        try {
+            return (await jwtVerify(token, await this.keys(), options)).payload;
+        }
+        catch (err) {
+            // One retry with fresh keys covers signing-key rotation mid-cache.
+            // Two shapes mean "the cached keys may be stale": an unknown kid
+            // (JWKSNoMatchingKey — jose's own refetch is cooldown-throttled and
+            // may have been skipped) and a signature failure on a known kid.
+            if (err instanceof Error &&
+                (err.name === 'JWKSNoMatchingKey' || err.name === 'JWSSignatureVerificationFailed')) {
+                return (await jwtVerify(token, await this.keys(true), options)).payload;
+            }
+            throw err;
+        }
+    }
+}
+//# sourceMappingURL=hub-jwt.js.map

package/dist/identity/hub-jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-jwt.js","sourceRoot":"","sources":["../../src/identity/hub-jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAA0C,MAAM,MAAM,CAAC;AAE7F,4EAA4E;AAC5E,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAExC;;;;;;;;;GASG;AACH,MAAM,OAAO,cAAc;IAII;IAHrB,cAAc,GAAkD,IAAI,CAAC;IACrE,MAAM,GAAiD,IAAI,CAAC;IAEpE,YAA6B,SAAiB;QAAjB,cAAS,GAAT,SAAS,CAAQ;IAAG,CAAC;IAE1C,KAAK,CAAC,OAAO;QACnB,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,GAAG,gBAAgB,EAAE,CAAC;YACzF,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;QACrC,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,mCAAmC,CAAC;QACrF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2C,CAAC;QACzE,qEAAqE;QACrE,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,CAAC,SAAS,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,YAAY,GAAG,KAAK;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,QAAgB;QAC1C,MAAM,OAAO,GAAqB;YAChC,MAAM,EAAE,IAAI,CAAC,SAAS;YACtB,iEAAiE;YACjE,+DAA+D;YAC/D,kDAAkD;YAClD,QAAQ;YACR,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,iDAAiD;YACxE,cAAc,EAAE,CAAC;YACjB,cAAc,EAAE,CAAC,KAAK,CAAC;SACxB,CAAC;QACF,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,iEAAiE;YACjE,oEAAoE;YACpE,iEAAiE;YACjE,IACE,GAAG,YAAY,KAAK;gBACpB,CAAC,GAAG,CAAC,IAAI,KAAK,mBAAmB,IAAI,GAAG,CAAC,IAAI,KAAK,gCAAgC,CAAC,EACnF,CAAC;gBACD,OAAO,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1E,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF"}

package/dist/identity/hub-live-gate.d.ts

@@ -0,0 +1,17 @@
+import { type Db } from '@antasphere/chassis-db';
+import type { Logger } from '../logger.js';
+import type { PrincipalGate } from '../middleware/auth-context.js';
+import type { HubOrgReconciler } from './hub-reconcile.js';
+export interface HubLiveGateDeps {
+    db: Db;
+    reconciler: HubOrgReconciler;
+    logger: Logger;
+}
+export declare class HubLiveGate {
+    private readonly deps;
+    constructor(deps: HubLiveGateDeps);
+    readonly assert: PrincipalGate;
+    private memberRow;
+    private assertOrgActive;
+}
+//# sourceMappingURL=hub-live-gate.d.ts.map

package/dist/identity/hub-live-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-live-gate.d.ts","sourceRoot":"","sources":["../../src/identity/hub-live-gate.ts"],"names":[],"mappings":"AACA,OAAO,EAAgC,KAAK,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAiB,aAAa,EAAuB,MAAM,+BAA+B,CAAC;AACvG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAuD3D,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,EAAE,CAAC;IACP,UAAU,EAAE,gBAAgB,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,eAAe;IAElD,QAAQ,CAAC,MAAM,EAAE,aAAa,CAoE5B;YAEY,SAAS;YAcT,eAAe;CAc9B"}

package/dist/identity/hub-live-gate.js

@@ -0,0 +1,146 @@
+import { and, eq } from 'drizzle-orm';
+import { workspaceMembers, workspaces } from '@antasphere/chassis-db';
+import { resolveMembership } from './resolve-membership.js';
+/**
+ * The cloud edition's post-resolution principal gate (user-scoped
+ * federation — the replacement for the retired master-key P4 gates): on
+ * EVERY authenticated request into a PROJECTED workspace
+ * (`principal.accountRef` set), hub truth is re-read AS THE USER via the
+ * TTL'd reconciler, and the request is judged on the freshly reconciled
+ * LOCAL rows. No service key, no cross-tenant surface — a user's requests
+ * can only ever be gated by their OWN grant's view of the hub.
+ *
+ * Verdicts, in order:
+ *  - grant dead → 401 `hub_grant_expired` (immediate, no stale window —
+ *    Romain's decision 3; a browser SSO re-login heals the grant);
+ *  - reconcile stale beyond the window AND the hub failing → 403
+ *    `hub_unavailable` (fail closed after ~15 min of outage);
+ *  - hub-origin membership row now inactive (this very pass may have swept
+ *    it) → 401 `membership_revoked`;
+ *  - workspace `hub_status='suspended'` → 403 `account_suspended`, EXCEPT
+ *    `GET /api/v1/me` — suspended is VISIBLE-BUT-BLOCKED, and /me is how
+ *    the dashboard shows the suspended badge instead of stranding the user
+ *    (the reason the PrincipalGate seam carries the request);
+ *  - a role delta from the reconciled row applies to THIS request (D11);
+ *  - a request that SELECTED no workspace, on a credential that pins none,
+ *    runs in the person's default AS THE PASS LEFT IT: the resolver chose
+ *    the workspace before the pass ran, so a default moved at the hub
+ *    (`antasphere org use`) would land the very command that read it in the
+ *    old organization and only the next one in the new (PRDCT-2958, F2).
+ *    The membership is resolved again here and handed back as `workspace`.
+ *
+ * Guest and local-origin rows in a projected workspace skip hub enforcement
+ * entirely EXCEPT the org-level suspension read — and that reads the
+ * LOCALLY MATERIALIZED `workspaces.hub_status` column only, never a hub
+ * round-trip on a borrowed grant. ACCEPTED BOUND (documented): a guest's
+ * own `/orgs` never includes the resource's org, so that column refreshes only
+ * when a MEMBER's reconcile runs — a guest may keep resource access in a
+ * hub-suspended org until a member next touches the tool. Every cheap fix
+ * leaks (a public status probe = suspension oracle) or borrows credentials
+ * (acting on a grant its holder didn't present). Same accepted-bound class
+ * as ungated share-link viewing; suspension still cuts all MEMBERS within
+ * seconds.
+ */
+const SUSPENDED_MESSAGE = 'This organization is suspended on Antasphere';
+const UNAVAILABLE_MESSAGE = 'The Antasphere hub has been unreachable for too long; requests are refused until it recovers';
+const GRANT_EXPIRED_MESSAGE = 'Your Antasphere grant on this instance has expired — sign in with Antasphere again to renew it';
+/** The one suspension exemption: the dashboard's whoami read. */
+function isMeRead(request) {
+    return request.method === 'GET' && request.path === '/api/v1/me';
+}
+export class HubLiveGate {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    assert = async (principal, request) => {
+        // Unprojected workspace: zero hub surface on this request.
+        if (!principal.accountRef)
+            return { ok: true };
+        // Guest/local rows are the tool's own business (never hub truth): no
+        // reconcile, no membership re-assertion, no grant requirement. Org-level
+        // suspension still applies, read from the local column.
+        if (principal.origin !== 'hub') {
+            return this.assertOrgActive(principal.workspaceId, request);
+        }
+        const verdict = await this.deps.reconciler.reconcile(principal.userId);
+        if (verdict.kind === 'grant_dead') {
+            return { ok: false, status: 401, code: 'hub_grant_expired', message: GRANT_EXPIRED_MESSAGE };
+        }
+        if (verdict.kind === 'unavailable') {
+            return { ok: false, status: 403, code: 'hub_unavailable', message: UNAVAILABLE_MESSAGE };
+        }
+        // Judge the FRESHLY RECONCILED local rows (the pass above may have
+        // swept the membership, synced the role, or flipped hub_status).
+        const row = await this.memberRow(principal.userId, principal.workspaceId);
+        if (!row || !row.isActive) {
+            // Resolution saw an active row moments ago; the reconcile swept it —
+            // the hub no longer asserts this membership. Every later request dies
+            // at resolution itself (plain 401); THIS one carries the reason. A
+            // swept membership is never papered over by a move to another
+            // workspace below: the person learns what happened.
+            return {
+                ok: false,
+                status: 401,
+                code: 'membership_revoked',
+                message: 'Your membership of this organization was removed on Antasphere'
+            };
+        }
+        // A selector-less request on an unpinned credential runs in the default
+        // membership as the pass above left it (the resolver read it before, so
+        // a default moved at the hub would land THIS request in the old one).
+        // The moved-to workspace is judged exactly as the resolved one is.
+        if (request.selector === null && !principal.pinned) {
+            const fresh = await resolveMembership(this.deps.db, principal.userId, null);
+            if (fresh && fresh.workspaceId !== principal.workspaceId) {
+                const target = await this.memberRow(principal.userId, fresh.workspaceId);
+                if (target?.isActive) {
+                    if (target.hubStatus === 'suspended' && !isMeRead(request)) {
+                        return { ok: false, status: 403, code: 'account_suspended', message: SUSPENDED_MESSAGE };
+                    }
+                    const moved = {
+                        workspaceId: fresh.workspaceId,
+                        role: target.role,
+                        origin: fresh.origin,
+                        accountRef: fresh.accountRef
+                    };
+                    return { ok: true, workspace: moved };
+                }
+            }
+        }
+        if (row.hubStatus === 'suspended' && !isMeRead(request)) {
+            return { ok: false, status: 403, code: 'account_suspended', message: SUSPENDED_MESSAGE };
+        }
+        // A role delta from the reconciled row applies to THIS request (D11):
+        // a demoted admin loses admin surfaces now, a promotion lands now.
+        if (row.role !== principal.role) {
+            return { ok: true, role: row.role };
+        }
+        return { ok: true };
+    };
+    async memberRow(userId, workspaceId) {
+        const [row] = await this.deps.db
+            .select({
+            role: workspaceMembers.role,
+            isActive: workspaceMembers.isActive,
+            hubStatus: workspaces.hubStatus
+        })
+            .from(workspaceMembers)
+            .innerJoin(workspaces, eq(workspaceMembers.workspaceId, workspaces.id))
+            .where(and(eq(workspaceMembers.userId, userId), eq(workspaceMembers.workspaceId, workspaceId)))
+            .limit(1);
+        return row;
+    }
+    async assertOrgActive(workspaceId, request) {
+        const [ws] = await this.deps.db
+            .select({ hubStatus: workspaces.hubStatus })
+            .from(workspaces)
+            .where(eq(workspaces.id, workspaceId))
+            .limit(1);
+        if (ws?.hubStatus === 'suspended' && !isMeRead(request)) {
+            return { ok: false, status: 403, code: 'account_suspended', message: SUSPENDED_MESSAGE };
+        }
+        return { ok: true };
+    }
+}
+//# sourceMappingURL=hub-live-gate.js.map

package/dist/identity/hub-live-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-live-gate.js","sourceRoot":"","sources":["../../src/identity/hub-live-gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAW,MAAM,wBAAwB,CAAC;AAI/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,MAAM,iBAAiB,GAAG,8CAA8C,CAAC;AACzE,MAAM,mBAAmB,GACvB,8FAA8F,CAAC;AACjG,MAAM,qBAAqB,GACzB,gGAAgG,CAAC;AAEnG,iEAAiE;AACjE,SAAS,QAAQ,CAAC,OAAyC;IACzD,OAAO,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,CAAC;AACnE,CAAC;AAQD,MAAM,OAAO,WAAW;IACO;IAA7B,YAA6B,IAAqB;QAArB,SAAI,GAAJ,IAAI,CAAiB;IAAG,CAAC;IAE7C,MAAM,GAAkB,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;QAC5D,2DAA2D;QAC3D,IAAI,CAAC,SAAS,CAAC,UAAU;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAE/C,qEAAqE;QACrE,yEAAyE;QACzE,wDAAwD;QACxD,IAAI,SAAS,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;QAC/F,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;QAC3F,CAAC;QAED,mEAAmE;QACnE,iEAAiE;QACjE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;QAC1E,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC1B,qEAAqE;YACrE,sEAAsE;YACtE,mEAAmE;YACnE,8DAA8D;YAC9D,oDAAoD;YACpD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,gEAAgE;aAC1E,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,wEAAwE;QACxE,sEAAsE;QACtE,mEAAmE;QACnE,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC5E,IAAI,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC;gBACzD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;gBACzE,IAAI,MAAM,EAAE,QAAQ,EAAE,CAAC;oBACrB,IAAI,MAAM,CAAC,SAAS,KAAK,WAAW,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;oBAC3F,CAAC;oBACD,MAAM,KAAK,GAAkB;wBAC3B,WAAW,EAAE,KAAK,CAAC,WAAW;wBAC9B,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;qBAC7B,CAAC;oBACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;gBACxC,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,GAAG,CAAC,SAAS,KAAK,WAAW,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAC3F,CAAC;QACD,sEAAsE;QACtE,mEAAmE;QACnE,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;YAChC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,WAAmB;QACzD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC;YACN,IAAI,EAAE,gBAAgB,CAAC,IAAI;YAC3B,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;YACnC,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC;aACD,IAAI,CAAC,gBAAgB,CAAC;aACtB,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;aACtE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;aAC9F,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,WAAmB,EACnB,OAAyC;QAEzC,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC5B,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC;aAC3C,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;aACrC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,EAAE,EAAE,SAAS,KAAK,WAAW,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAC3F,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;CACF"}

package/dist/identity/hub-logout.d.ts

@@ -0,0 +1,88 @@
+import { symmetricDecrypt } from 'better-auth/crypto';
+import { type Db } from '@antasphere/chassis-db';
+import type { Logger } from '../logger.js';
+/**
+ * RP-initiated logout against the hub (SL-2, internal/federation.md): "one
+ * concept of being logged in" needs logout-anywhere to end the HUB session,
+ * not just the local one. The hub's oauth-provider plugin exposes
+ * `GET /oauth2/end-session` (RP-initiated logout); this module builds the
+ * URL the browser must VISIT to end the anchor session — the local revoke
+ * itself happens in api/sso-logout.ts regardless of whether a URL could be
+ * built.
+ *
+ * Everything here FAILS SOFT to `null` ("no hub leg — local signout only"):
+ * a logout must never be blocked by a missing id_token, a hub outage, or a
+ * malformed discovery document. Pinned 1.6.15 plugin facts this leans on
+ * (re-verify on ANY Better Auth / oauth-provider bump):
+ *
+ *  - the id_token is stored PLAINTEXT on the `account` row —
+ *    `encryptOAuthTokens` wraps only access/refresh tokens (setTokenUtil,
+ *    dist/oauth2/utils.mjs; idToken is written raw in
+ *    generic-oauth/routes.mjs + oauth2/link-account.mjs). The read below is
+ *    still encrypted-TOLERANT (the hub-grant isLikelyEncrypted mirror) so a
+ *    future bump that starts encrypting it cannot break logout;
+ *  - the end-session endpoint HARD-FAILS on an id_token_hint without a
+ *    `sid` claim ("id token missing session") — pre-flip id_tokens (minted
+ *    before the hub client's enableEndSession flip) carry none, so a
+ *    sid-less token degrades HERE to null instead of bouncing the user
+ *    through a hub error;
+ *  - verification there is signature-only (jose compactVerify against the
+ *    hub JWKS) — an EXPIRED id_token is still a usable hint, so no expiry
+ *    check happens here either;
+ *  - `post_logout_redirect_uri` must EXACT-match the client's registered
+ *    postLogoutRedirectUris — the cross-repo contract pins
+ *    `<PUBLIC_BASE_URL>/login?signed_out=1`, seeded in the hub registry.
+ */
+/** The pinned post-logout landing (cross-repo contract — match EXACTLY). */
+export declare function postLogoutRedirectUri(publicBaseUrl: string): string;
+export interface HubLogoutOptions {
+    db: Db;
+    /** Hub OIDC issuer (HUB_ISSUER_URL) — discovery derives from it. */
+    issuerUrl: string;
+    /** This instance's public origin — the post-logout landing derives from it. */
+    publicBaseUrl: string;
+    /**
+     * Better Auth's token-encryption key material (`(await
+     * auth.$context).secretConfig`) — only ever consulted when a stored
+     * id_token LOOKS encrypted (future-bump insurance; today's are plaintext).
+     */
+    key: () => Promise<Parameters<typeof symmetricDecrypt>[0]['key']>;
+    logger: Logger;
+    /** Discovery fetch timeout — a slow hub must never hang a logout. */
+    discoveryTimeoutMs?: number;
+    /** Test seam. */
+    fetchImpl?: typeof fetch;
+}
+export declare class HubLogoutService {
+    private readonly opts;
+    private readonly fetchImpl;
+    private readonly timeoutMs;
+    /** Discovery-cached end-session endpoint; failures are retried per call. */
+    private endpointCache;
+    constructor(opts: HubLogoutOptions);
+    /**
+     * The hub end-session URL for this user's CURRENT hub session, or null
+     * when no usable hub leg exists (no `antasphere` account row, no stored
+     * id_token, a sid-less pre-flip id_token, or an unreachable/endpoint-less
+     * discovery document). The caller revokes the local session and clears
+     * the hint EITHER WAY — null only means the browser skips the hub bounce.
+     */
+    endSessionUrl(userId: string): Promise<string | null>;
+    /** The user's stored hub id_token, plaintext/encrypted-tolerant. */
+    private readIdToken;
+    /** Discovery read, cached on success; a failed fetch retries next call. */
+    private endSessionEndpoint;
+}
+/**
+ * The Set-Cookie header value that CLEARS the shared SSO hint cookie —
+ * mirroring the hub-set attributes exactly (cross-repo contract: Domain on
+ * the shared parent, Path=/, SameSite=Lax, Secure on https, NOT HttpOnly)
+ * so the browser matches and expires the hub's cookie rather than minting a
+ * host-only shadow. Max-Age=0 is the deletion.
+ */
+export declare function hintCookieClearHeader(opts: {
+    name: string;
+    domain: string;
+    secure: boolean;
+}): string;
+//# sourceMappingURL=hub-logout.d.ts.map

package/dist/identity/hub-logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-logout.d.ts","sourceRoot":"","sources":["../../src/identity/hub-logout.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAW,KAAK,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAI3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,4EAA4E;AAC5E,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,EAAE,CAAC;IACP,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,aAAa,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,GAAG,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAClE,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iBAAiB;IACjB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,qBAAa,gBAAgB;IAMf,OAAO,CAAC,QAAQ,CAAC,IAAI;IALjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,4EAA4E;IAC5E,OAAO,CAAC,aAAa,CAAuB;gBAEf,IAAI,EAAE,gBAAgB;IAKnD;;;;;;OAMG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA+B3D,oEAAoE;YACtD,WAAW;IAoBzB,2EAA2E;YAC7D,kBAAkB;CA0BjC;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAErG"}

package/dist/identity/hub-logout.js

@@ -0,0 +1,158 @@
+import { and, eq } from 'drizzle-orm';
+import { decodeJwt } from 'jose';
+import { symmetricDecrypt } from 'better-auth/crypto';
+import { account } from '@antasphere/chassis-db';
+import { isLikelyEncrypted } from './hub-grant.js';
+import { HUB_SSO_PROVIDER_ID } from './hub-sso.js';
+/**
+ * RP-initiated logout against the hub (SL-2, internal/federation.md): "one
+ * concept of being logged in" needs logout-anywhere to end the HUB session,
+ * not just the local one. The hub's oauth-provider plugin exposes
+ * `GET /oauth2/end-session` (RP-initiated logout); this module builds the
+ * URL the browser must VISIT to end the anchor session — the local revoke
+ * itself happens in api/sso-logout.ts regardless of whether a URL could be
+ * built.
+ *
+ * Everything here FAILS SOFT to `null` ("no hub leg — local signout only"):
+ * a logout must never be blocked by a missing id_token, a hub outage, or a
+ * malformed discovery document. Pinned 1.6.15 plugin facts this leans on
+ * (re-verify on ANY Better Auth / oauth-provider bump):
+ *
+ *  - the id_token is stored PLAINTEXT on the `account` row —
+ *    `encryptOAuthTokens` wraps only access/refresh tokens (setTokenUtil,
+ *    dist/oauth2/utils.mjs; idToken is written raw in
+ *    generic-oauth/routes.mjs + oauth2/link-account.mjs). The read below is
+ *    still encrypted-TOLERANT (the hub-grant isLikelyEncrypted mirror) so a
+ *    future bump that starts encrypting it cannot break logout;
+ *  - the end-session endpoint HARD-FAILS on an id_token_hint without a
+ *    `sid` claim ("id token missing session") — pre-flip id_tokens (minted
+ *    before the hub client's enableEndSession flip) carry none, so a
+ *    sid-less token degrades HERE to null instead of bouncing the user
+ *    through a hub error;
+ *  - verification there is signature-only (jose compactVerify against the
+ *    hub JWKS) — an EXPIRED id_token is still a usable hint, so no expiry
+ *    check happens here either;
+ *  - `post_logout_redirect_uri` must EXACT-match the client's registered
+ *    postLogoutRedirectUris — the cross-repo contract pins
+ *    `<PUBLIC_BASE_URL>/login?signed_out=1`, seeded in the hub registry.
+ */
+/** The pinned post-logout landing (cross-repo contract — match EXACTLY). */
+export function postLogoutRedirectUri(publicBaseUrl) {
+    return publicBaseUrl.replace(/\/+$/, '') + '/login?signed_out=1';
+}
+export class HubLogoutService {
+    opts;
+    fetchImpl;
+    timeoutMs;
+    /** Discovery-cached end-session endpoint; failures are retried per call. */
+    endpointCache = null;
+    constructor(opts) {
+        this.opts = opts;
+        this.fetchImpl = opts.fetchImpl ?? fetch;
+        this.timeoutMs = opts.discoveryTimeoutMs ?? 3_000;
+    }
+    /**
+     * The hub end-session URL for this user's CURRENT hub session, or null
+     * when no usable hub leg exists (no `antasphere` account row, no stored
+     * id_token, a sid-less pre-flip id_token, or an unreachable/endpoint-less
+     * discovery document). The caller revokes the local session and clears
+     * the hint EITHER WAY — null only means the browser skips the hub bounce.
+     */
+    async endSessionUrl(userId) {
+        try {
+            const idToken = await this.readIdToken(userId);
+            if (!idToken)
+                return null;
+            // decode (NOT verify) — we only need the sid presence check; the hub
+            // verifies the hint's signature itself on presentation.
+            let sid;
+            try {
+                sid = decodeJwt(idToken).sid;
+            }
+            catch {
+                return null; // not a JWT — nothing presentable
+            }
+            if (typeof sid !== 'string' || !sid) {
+                // Pre-flip id_token (rollout caveat): the hub would hard-fail the
+                // hint, so degrade to a local-only signout until the next login
+                // stores a sid-carrying token.
+                this.opts.logger.info({ userId }, 'hub logout: stored id_token carries no sid — local signout only');
+                return null;
+            }
+            const endpoint = await this.endSessionEndpoint();
+            if (!endpoint)
+                return null;
+            const url = new URL(endpoint);
+            url.searchParams.set('id_token_hint', idToken);
+            url.searchParams.set('post_logout_redirect_uri', postLogoutRedirectUri(this.opts.publicBaseUrl));
+            return url.toString();
+        }
+        catch (err) {
+            this.opts.logger.warn({ err, userId }, 'hub logout: end-session URL build failed — local signout only');
+            return null;
+        }
+    }
+    /** The user's stored hub id_token, plaintext/encrypted-tolerant. */
+    async readIdToken(userId) {
+        const [row] = await this.opts.db
+            .select({ idToken: account.idToken })
+            .from(account)
+            .where(and(eq(account.userId, userId), eq(account.providerId, HUB_SSO_PROVIDER_ID)))
+            .limit(1);
+        const stored = row?.idToken;
+        if (!stored)
+            return null;
+        // A JWT (dots, base64url) never matches isLikelyEncrypted, so today's
+        // plaintext tokens pass straight through; a future encrypted value gets
+        // one decrypt attempt and fails soft.
+        if (!isLikelyEncrypted(stored))
+            return stored;
+        try {
+            return await symmetricDecrypt({ key: await this.opts.key(), data: stored });
+        }
+        catch (err) {
+            this.opts.logger.warn({ err, userId }, 'hub logout: stored id_token failed to decrypt');
+            return null;
+        }
+    }
+    /** Discovery read, cached on success; a failed fetch retries next call. */
+    async endSessionEndpoint() {
+        if (this.endpointCache)
+            return this.endpointCache;
+        const discoveryUrl = this.opts.issuerUrl.replace(/\/+$/, '') + '/.well-known/openid-configuration';
+        try {
+            const res = await this.fetchImpl(discoveryUrl, {
+                headers: { accept: 'application/json' },
+                signal: AbortSignal.timeout(this.timeoutMs)
+            });
+            if (!res.ok) {
+                this.opts.logger.warn({ status: res.status }, 'hub logout: discovery answered non-2xx');
+                return null;
+            }
+            const doc = (await res.json());
+            const endpoint = doc.end_session_endpoint;
+            if (typeof endpoint !== 'string' || !endpoint) {
+                // A hub predating the end-session flip advertises none — degrade.
+                this.opts.logger.info('hub logout: discovery carries no end_session_endpoint — local signout only');
+                return null;
+            }
+            this.endpointCache = endpoint;
+            return endpoint;
+        }
+        catch (err) {
+            this.opts.logger.warn({ err }, 'hub logout: discovery unreachable — local signout only');
+            return null;
+        }
+    }
+}
+/**
+ * The Set-Cookie header value that CLEARS the shared SSO hint cookie —
+ * mirroring the hub-set attributes exactly (cross-repo contract: Domain on
+ * the shared parent, Path=/, SameSite=Lax, Secure on https, NOT HttpOnly)
+ * so the browser matches and expires the hub's cookie rather than minting a
+ * host-only shadow. Max-Age=0 is the deletion.
+ */
+export function hintCookieClearHeader(opts) {
+    return `${opts.name}=; Max-Age=0; Domain=${opts.domain}; Path=/; SameSite=Lax${opts.secure ? '; Secure' : ''}`;
+}
+//# sourceMappingURL=hub-logout.js.map

package/dist/identity/hub-logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-logout.js","sourceRoot":"","sources":["../../src/identity/hub-logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,OAAO,EAAW,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CAAC,aAAqB;IACzD,OAAO,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,qBAAqB,CAAC;AACnE,CAAC;AAqBD,MAAM,OAAO,gBAAgB;IAME;IALZ,SAAS,CAAe;IACxB,SAAS,CAAS;IACnC,4EAA4E;IACpE,aAAa,GAAkB,IAAI,CAAC;IAE5C,YAA6B,IAAsB;QAAtB,SAAI,GAAJ,IAAI,CAAkB;QACjD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;QACzC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,kBAAkB,IAAI,KAAK,CAAC;IACpD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CAAC,MAAc;QAChC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,qEAAqE;YACrE,wDAAwD;YACxD,IAAI,GAAY,CAAC;YACjB,IAAI,CAAC;gBACH,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,CAAC,kCAAkC;YACjD,CAAC;YACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC;gBACpC,kEAAkE;gBAClE,gEAAgE;gBAChE,+BAA+B;gBAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,iEAAiE,CAAC,CAAC;gBACrG,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACjD,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,0BAA0B,EAAE,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;YACjG,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,+DAA+D,CAAC,CAAC;YACxG,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,oEAAoE;IAC5D,KAAK,CAAC,WAAW,CAAC,MAAc;QACtC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE;aAC7B,MAAM,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;aACpC,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC,CAAC;aACnF,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,MAAM,MAAM,GAAG,GAAG,EAAE,OAAO,CAAC;QAC5B,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,sEAAsE;QACtE,wEAAwE;QACxE,sCAAsC;QACtC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QAC9C,IAAI,CAAC;YACH,OAAO,MAAM,gBAAgB,CAAC,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,+CAA+C,CAAC,CAAC;YACxF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,2EAA2E;IACnE,KAAK,CAAC,kBAAkB;QAC9B,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAClD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,mCAAmC,CAAC;QACnG,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE;gBAC7C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;aAC5C,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,wCAAwC,CAAC,CAAC;gBACxF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuC,CAAC;YACrE,MAAM,QAAQ,GAAG,GAAG,CAAC,oBAAoB,CAAC;YAC1C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9C,kEAAkE;gBAClE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;gBACpG,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC;YAC9B,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,wDAAwD,CAAC,CAAC;YACzF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAuD;IAC3F,OAAO,GAAG,IAAI,CAAC,IAAI,wBAAwB,IAAI,CAAC,MAAM,yBAAyB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACjH,CAAC"}

package/dist/identity/hub-projection.d.ts

@@ -0,0 +1,103 @@
+import { type Db, type DbConn, type WorkspaceRole } from '@antasphere/chassis-db';
+/**
+ * The ONE hub-org projection primitive (internal/federation.md, ADR 015/018):
+ * extracted verbatim from `HubSsoService.project()` so the SSO login path
+ * and the H4 reconciler (`hub-reconcile.ts`) write byte-identical rows.
+ *
+ * Lazy projection: the hub org becomes a local workspace on first use
+ * (`centralAccountId` = the hub org id), then a membership upsert
+ * re-asserts (role, origin='hub', active) on EVERY call — reactivating a
+ * deactivated row and following hub role changes (D11). Deliberately NOT
+ * WorkspaceService.create: the projection needs ON CONFLICT semantics on
+ * the 0021 unique partial index, the hub's role (not owner), and
+ * origin='hub'.
+ *
+ * Throws raw on any database failure — each caller owns its error posture
+ * (the login path maps to the fail-closed `sso_projection_failed`; the
+ * reconciler logs and continues with the next entry).
+ */
+export interface OrgMembershipProjection {
+    localUserId: string;
+    /** The hub org id (uuid, validated upstream) — never a local workspace id. */
+    hubWorkspaceId: string;
+    /** Display name (H1); null keeps the current name (or mints the placeholder). */
+    hubWorkspaceName: string | null;
+    /** The hub org role, verbatim (D11) — validated upstream, never invented here. */
+    role: WorkspaceRole;
+}
+/**
+ * The name a hub org goes by when the hub sends none (an older hub, a blank
+ * name): recognizable, and self-healing wherever the next hub read carries
+ * the real one. The projection's H1 fallback and the refusal page's hint.
+ */
+export declare function placeholderWorkspaceName(hubOrgId: string): string;
+export declare function projectOrgMembership(db: Db, projection: OrgMembershipProjection): Promise<{
+    workspaceId: string;
+    memberId: string;
+}>;
+/**
+ * The person's team seats in ONE projected workspace, as the hub asserted
+ * them in this pass (`GET /orgs`' per-org `teams`: the caller's own, never
+ * the team's roster). Upserts each team by its hub id (slug and name follow
+ * the hub; `updated_at` moves only when one of them changed), inserts the
+ * missing seats, and deletes this membership's seats whose team the hub no
+ * longer lists. Both the login pass and the periodic pass come through here,
+ * so they write byte-identical rows.
+ *
+ * Run inside one transaction per org by the caller. Throws raw, like
+ * `projectOrgMembership`. A team id already projected into ANOTHER workspace
+ * (a hub id cannot move between organizations; only a corrupt answer could
+ * say so) is left where it is and not seated here.
+ */
+export interface TeamSeatsProjection {
+    /** The projected workspace (from `projectOrgMembership`). */
+    workspaceId: string;
+    /** The person's membership row in it — the seat rides on it. */
+    memberId: string;
+    teams: ReadonlyArray<{
+        id: string;
+        slug: string;
+        name: string;
+    }>;
+}
+export declare function projectTeamSeats(db: DbConn, projection: TeamSeatsProjection): Promise<void>;
+/**
+ * The organization's teams in ONE projected workspace, as the hub's `GET
+ * /teams` lists them (PRDCT-2813). This is the organization's DEFINITIVE
+ * list as one member reads it: every team of the org, whether anyone who
+ * signed in here sits in it or not, so a team can be added to a project
+ * before any of its members arrived. The rosters stay the seats of the
+ * people who signed in (`projectTeamSeats`); this touches no seat itself.
+ *
+ * Upserts every listed team by its hub id (slug and name follow the hub,
+ * `updated_at` moves on drift only, never across organizations: the same
+ * rule as `projectTeamSeats`), then, when `complete`, DELETES this
+ * workspace's projected teams (`hub_team_id IS NOT NULL`) the list does not
+ * name: a team deleted at the hub goes, and the foreign keys' cascade takes
+ * its seats and its project entries with it. A local team (`hub_team_id IS
+ * NULL`) is never touched. An incomplete list (the drain's page cap) only
+ * upserts.
+ *
+ * Run inside one transaction by the caller. Throws raw.
+ */
+export interface OrgTeamsProjection {
+    /** The projected workspace (from `projectOrgMembership`). */
+    workspaceId: string;
+    teams: ReadonlyArray<{
+        id: string;
+        slug: string;
+        name: string;
+    }>;
+    /** False when the list is a prefix: nothing is deleted then. Default true. */
+    complete?: boolean | undefined;
+    /**
+     * When the read of the list BEGAN. A projected team created here after that
+     * moment (another replica's pass, another person's seat) is not in this
+     * list because it is newer than the read, not because the hub dropped it:
+     * the delete leaves it alone (verifier round 1, F5). Default: now, which
+     * deletes nothing newer than the call.
+     */
+    readAt?: Date | undefined;
+}
+export declare function projectOrgTeams(db: DbConn, projection: OrgTeamsProjection): Promise<void>;
+//# sourceMappingURL=hub-projection.d.ts.map

package/dist/identity/hub-projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-projection.d.ts","sourceRoot":"","sources":["../../src/identity/hub-projection.ts"],"names":[],"mappings":"AACA,OAAO,EAKL,KAAK,EAAE,EACP,KAAK,MAAM,EACX,KAAK,aAAa,EACnB,MAAM,wBAAwB,CAAC;AAEhC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,cAAc,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,kFAAkF;IAClF,IAAI,EAAE,aAAa,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,EAAE,EACN,UAAU,EAAE,uBAAuB,GAClC,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAmDpD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,mBAAmB;IAClC,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,aAAa,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClE;AAED,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqDjG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,kBAAkB;IACjC,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,aAAa,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/B;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CAC3B;AAED,wBAAsB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmC/F"}