@antasphere/chassis-server 1.0.0

package/dist/identity/hub-projection.js

@@ -0,0 +1,130 @@
+import { and, eq, inArray, isNotNull, lt, notInArray, sql } from 'drizzle-orm';
+import { workspaceMembers, workspaceTeamMembers, workspaceTeams, workspaces } from '@antasphere/chassis-db';
+/**
+ * The name a hub org goes by when the hub sends none (an older hub, a blank
+ * name): recognizable, and self-healing wherever the next hub read carries
+ * the real one. The projection's H1 fallback and the refusal page's hint.
+ */
+export function placeholderWorkspaceName(hubOrgId) {
+    return `Antasphere workspace ${hubOrgId.slice(0, 8)}`;
+}
+export async function projectOrgMembership(db, projection) {
+    const { localUserId, hubWorkspaceId, hubWorkspaceName, role } = projection;
+    let [ws] = await db
+        .select({ id: workspaces.id, name: workspaces.name })
+        .from(workspaces)
+        .where(eq(workspaces.centralAccountId, hubWorkspaceId))
+        .limit(1);
+    if (!ws) {
+        // H1 fallback: without workspace_name (older hub), project under a
+        // recognizable placeholder — self-healing, the re-sync below renames
+        // it at the first call whose hub data carries the name.
+        const name = hubWorkspaceName ?? placeholderWorkspaceName(hubWorkspaceId);
+        const inserted = await db
+            .insert(workspaces)
+            .values({ name, centralAccountId: hubWorkspaceId })
+            .onConflictDoNothing({
+            target: workspaces.centralAccountId,
+            where: sql `${workspaces.centralAccountId} IS NOT NULL`
+        })
+            .returning({ id: workspaces.id, name: workspaces.name });
+        // Conflict = a concurrent first projection won the insert; land on its row.
+        ws =
+            inserted[0] ??
+                (await db
+                    .select({ id: workspaces.id, name: workspaces.name })
+                    .from(workspaces)
+                    .where(eq(workspaces.centralAccountId, hubWorkspaceId))
+                    .limit(1))[0];
+        if (!ws)
+            throw new Error('projection insert and re-select both returned nothing');
+    }
+    if (hubWorkspaceName && ws.name !== hubWorkspaceName) {
+        await db.update(workspaces).set({ name: hubWorkspaceName }).where(eq(workspaces.id, ws.id));
+    }
+    const [member] = await db
+        .insert(workspaceMembers)
+        .values({
+        workspaceId: ws.id,
+        userId: localUserId,
+        role,
+        origin: 'hub',
+        isActive: true
+    })
+        .onConflictDoUpdate({
+        target: [workspaceMembers.workspaceId, workspaceMembers.userId],
+        set: { role, origin: 'hub', isActive: true }
+    })
+        .returning({ id: workspaceMembers.id });
+    if (!member)
+        throw new Error('membership upsert returned nothing');
+    return { workspaceId: ws.id, memberId: member.id };
+}
+export async function projectTeamSeats(db, projection) {
+    const { workspaceId, memberId, teams } = projection;
+    const seatTeamIds = [];
+    if (teams.length > 0) {
+        await db
+            .insert(workspaceTeams)
+            .values(teams.map((team) => ({ workspaceId, hubTeamId: team.id, slug: team.slug, name: team.name })))
+            .onConflictDoUpdate({
+            target: workspaceTeams.hubTeamId,
+            set: {
+                slug: sql `excluded.slug`,
+                name: sql `excluded.name`,
+                updatedAt: sql `now()`
+            },
+            // Renamed on drift only, and never across organizations.
+            setWhere: sql `${workspaceTeams.workspaceId} = ${workspaceId}
+          AND (${workspaceTeams.slug} IS DISTINCT FROM excluded.slug
+            OR ${workspaceTeams.name} IS DISTINCT FROM excluded.name)`
+        });
+        const rows = await db
+            .select({ id: workspaceTeams.id })
+            .from(workspaceTeams)
+            .where(and(eq(workspaceTeams.workspaceId, workspaceId), inArray(workspaceTeams.hubTeamId, teams.map((team) => team.id))));
+        seatTeamIds.push(...rows.map((row) => row.id));
+        if (seatTeamIds.length > 0) {
+            await db
+                .insert(workspaceTeamMembers)
+                .values(seatTeamIds.map((teamId) => ({ teamId, memberId })))
+                .onConflictDoNothing({ target: [workspaceTeamMembers.teamId, workspaceTeamMembers.memberId] });
+        }
+    }
+    // The seats the hub no longer asserts, in THIS workspace only.
+    const inWorkspace = db
+        .select({ id: workspaceTeams.id })
+        .from(workspaceTeams)
+        .where(eq(workspaceTeams.workspaceId, workspaceId));
+    await db
+        .delete(workspaceTeamMembers)
+        .where(and(eq(workspaceTeamMembers.memberId, memberId), inArray(workspaceTeamMembers.teamId, inWorkspace), ...(seatTeamIds.length > 0 ? [notInArray(workspaceTeamMembers.teamId, seatTeamIds)] : [])));
+}
+export async function projectOrgTeams(db, projection) {
+    const { workspaceId, teams } = projection;
+    if (teams.length > 0) {
+        await db
+            .insert(workspaceTeams)
+            .values(teams.map((team) => ({ workspaceId, hubTeamId: team.id, slug: team.slug, name: team.name })))
+            .onConflictDoUpdate({
+            target: workspaceTeams.hubTeamId,
+            set: {
+                slug: sql `excluded.slug`,
+                name: sql `excluded.name`,
+                updatedAt: sql `now()`
+            },
+            setWhere: sql `${workspaceTeams.workspaceId} = ${workspaceId}
+          AND (${workspaceTeams.slug} IS DISTINCT FROM excluded.slug
+            OR ${workspaceTeams.name} IS DISTINCT FROM excluded.name)`
+        });
+    }
+    if (projection.complete === false)
+        return;
+    const readAt = projection.readAt ?? new Date();
+    await db.delete(workspaceTeams).where(and(eq(workspaceTeams.workspaceId, workspaceId), isNotNull(workspaceTeams.hubTeamId), lt(workspaceTeams.createdAt, readAt), ...(teams.length > 0
+        ? [
+            notInArray(workspaceTeams.hubTeamId, teams.map((team) => team.id))
+        ]
+        : [])));
+}
+//# sourceMappingURL=hub-projection.js.map

package/dist/identity/hub-projection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-projection.js","sourceRoot":"","sources":["../../src/identity/hub-projection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,UAAU,EAIX,MAAM,wBAAwB,CAAC;AA6BhC;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,OAAO,wBAAwB,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,EAAM,EACN,UAAmC;IAEnC,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;IAC3E,IAAI,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE;SAChB,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;SACpD,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;SACtD,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,mEAAmE;QACnE,qEAAqE;QACrE,wDAAwD;QACxD,MAAM,IAAI,GAAG,gBAAgB,IAAI,wBAAwB,CAAC,cAAc,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,UAAU,CAAC;aAClB,MAAM,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC;aAClD,mBAAmB,CAAC;YACnB,MAAM,EAAE,UAAU,CAAC,gBAAgB;YACnC,KAAK,EAAE,GAAG,CAAA,GAAG,UAAU,CAAC,gBAAgB,cAAc;SACvD,CAAC;aACD,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,4EAA4E;QAC5E,EAAE;YACA,QAAQ,CAAC,CAAC,CAAC;gBACX,CACE,MAAM,EAAE;qBACL,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;qBACpD,IAAI,CAAC,UAAU,CAAC;qBAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;qBACtD,KAAK,CAAC,CAAC,CAAC,CACZ,CAAC,CAAC,CAAC,CAAC;QACP,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,gBAAgB,IAAI,EAAE,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACrD,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,gBAAgB,CAAC;SACxB,MAAM,CAAC;QACN,WAAW,EAAE,EAAE,CAAC,EAAE;QAClB,MAAM,EAAE,WAAW;QACnB,IAAI;QACJ,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,IAAI;KACf,CAAC;SACD,kBAAkB,CAAC;QAClB,MAAM,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,gBAAgB,CAAC,MAAM,CAAC;QAC/D,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC7C,CAAC;SACD,SAAS,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACnE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;AACrD,CAAC;AAwBD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAU,EAAE,UAA+B;IAChF,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;IACpD,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,EAAE;aACL,MAAM,CAAC,cAAc,CAAC;aACtB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;aACpG,kBAAkB,CAAC;YAClB,MAAM,EAAE,cAAc,CAAC,SAAS;YAChC,GAAG,EAAE;gBACH,IAAI,EAAE,GAAG,CAAA,eAAe;gBACxB,IAAI,EAAE,GAAG,CAAA,eAAe;gBACxB,SAAS,EAAE,GAAG,CAAA,OAAO;aACtB;YACD,yDAAyD;YACzD,QAAQ,EAAE,GAAG,CAAA,GAAG,cAAc,CAAC,WAAW,MAAM,WAAW;iBAClD,cAAc,CAAC,IAAI;iBACnB,cAAc,CAAC,IAAI,kCAAkC;SAC/D,CAAC,CAAC;QACL,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC;aACjC,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,EAC3C,OAAO,CACL,cAAc,CAAC,SAAS,EACxB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAC7B,CACF,CACF,CAAC;QACJ,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/C,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,EAAE;iBACL,MAAM,CAAC,oBAAoB,CAAC;iBAC5B,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;iBAC3D,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IACD,+DAA+D;IAC/D,MAAM,WAAW,GAAG,EAAE;SACnB,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC;SACjC,IAAI,CAAC,cAAc,CAAC;SACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;IACtD,MAAM,EAAE;SACL,MAAM,CAAC,oBAAoB,CAAC;SAC5B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAC3C,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,WAAW,CAAC,EACjD,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAC1F,CACF,CAAC;AACN,CAAC;AAqCD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAU,EAAE,UAA8B;IAC9E,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;IAC1C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,EAAE;aACL,MAAM,CAAC,cAAc,CAAC;aACtB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;aACpG,kBAAkB,CAAC;YAClB,MAAM,EAAE,cAAc,CAAC,SAAS;YAChC,GAAG,EAAE;gBACH,IAAI,EAAE,GAAG,CAAA,eAAe;gBACxB,IAAI,EAAE,GAAG,CAAA,eAAe;gBACxB,SAAS,EAAE,GAAG,CAAA,OAAO;aACtB;YACD,QAAQ,EAAE,GAAG,CAAA,GAAG,cAAc,CAAC,WAAW,MAAM,WAAW;iBAClD,cAAc,CAAC,IAAI;iBACnB,cAAc,CAAC,IAAI,kCAAkC;SAC/D,CAAC,CAAC;IACP,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,KAAK,KAAK;QAAE,OAAO;IAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;IAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,KAAK,CACnC,GAAG,CACD,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,EAC3C,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,EACnC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,EACpC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAClB,CAAC,CAAC;YACE,UAAU,CACR,cAAc,CAAC,SAAS,EACxB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAC7B;SACF;QACH,CAAC,CAAC,EAAE,CAAC,CACR,CACF,CAAC;AACJ,CAAC"}

package/dist/identity/hub-reconcile.d.ts

@@ -0,0 +1,151 @@
+import { Counter } from 'prom-client';
+import { type Db } from '@antasphere/chassis-db';
+import type { AuditService } from '../audit/service.js';
+import type { Logger } from '../logger.js';
+import { type MembershipRemovalHook } from '../members/removal.js';
+import type { HubDeniedOrg, HubUserClient, LoginAccessToken } from './hub-user-client.js';
+/**
+ * Live org reconciliation (internal/federation.md, user-scoped federation): org
+ * and membership truth live ONLY at the hub, and the tool reflects it by
+ * reading the hub's caller-scoped `GET /orgs` AS THE USER (hub-user-client)
+ * — every SSO login runs the TTL-bypassing `forceReconcile()` (fail-CLOSED:
+ * a login whose pass fails is revoked — reconcile IS the projection), and
+ * the live gate (hub-live-gate.ts) runs the cached `reconcile()` on every
+ * request into a projected workspace. One pass fetches the user's full hub
+ * org list and makes the local projections match: project missing orgs,
+ * sync names/roles, sync `workspaces.hub_status` and the user's
+ * `workspace_members.is_default`, deactivate `origin='hub'` memberships the
+ * hub no longer asserts.
+ *
+ * Failure posture: a pass mutates state ONLY on a definitive 200 list.
+ * Transient hub errors keep local state serving (nothing deactivated) —
+ * the ENFORCEMENT of prolonged staleness is the gate's, via the windowed
+ * `reconcile()` verdict (fresh ≤ staleMaxMs → serve; beyond it, failing →
+ * `hub_unavailable`). A definitive `grant_dead` is its own verdict — the
+ * gate answers 401 `hub_grant_expired` immediately, no stale window.
+ *
+ * Cost discipline: per-user TTL cache (~10 s) + single-flight, so N
+ * concurrent requests cost one hub fetch; a pass on an expired cache IS
+ * awaited (freshness at request time is the whole point) but is bounded by
+ * the client's tight fetch timeout; failures re-probe at most once per
+ * `retryMs`. An oss boot never constructs this class.
+ */
+/** Every dial of the live federation loop — one override surface for tests. */
+export interface HubFederationDials {
+    /** Per-user reconcile TTL (the identity-path freshness bound). */
+    reconcileTtlMs: number;
+    /** Definitive-pass staleness bound; beyond it a failing hub gates fail-closed. */
+    reconcileStaleMaxMs: number;
+    /** Failed-pass re-probe throttle: at most one hub attempt per user per interval. */
+    retryMs: number;
+    /** GET /orgs fetch timeout (awaited in the identity path — keep tight). */
+    orgsTimeoutMs: number;
+    /** Token-endpoint fetch timeout (hub-grant.ts). */
+    tokenTimeoutMs: number;
+    /** Serve cached access tokens only to exp − this (hub-grant.ts). */
+    accessSkewMs: number;
+    /** Watchdog cutting a wedged refresh's dedicated lock connection (hub-grant.ts). */
+    lockWatchdogMs: number;
+    /**
+     * How old an organization's whole team list (`GET /teams`, PRDCT-2813) may
+     * grow before a pass reads it again, per org per replica. A failed read is
+     * re-tried at most once per `retryMs`.
+     */
+    orgTeamsTtlMs: number;
+}
+export declare const DEFAULT_FEDERATION_DIALS: HubFederationDials;
+/**
+ * One pass's own outcome (what the metric labels count):
+ *  - 'ok': definitive list applied;
+ *  - 'no_link': the user holds no hub identity — nothing to reconcile,
+ *    cached like a success;
+ *  - 'grant_dead': the user's hub grant is definitively dead (cached like a
+ *    success — the answer is real; a browser login heals it);
+ *  - 'inconclusive': transient hub error, fail open;
+ *  - 'error': unexpected local failure, fail open.
+ */
+export type ReconcilePassOutcome = 'ok' | 'no_link' | 'grant_dead' | 'inconclusive' | 'error';
+/**
+ * The gate's windowed verdict:
+ *  - 'ok': definitive data within the stale window — serve on local rows;
+ *  - 'grant_dead': the grant is dead — the gate refuses immediately;
+ *  - 'unavailable': no definitive pass within the window and the hub keeps
+ *    failing — the gate fails closed.
+ */
+export type ReconcileVerdict = {
+    kind: 'ok';
+} | {
+    kind: 'grant_dead';
+} | {
+    kind: 'unavailable';
+};
+export interface HubOrgReconcilerDeps {
+    db: Db;
+    client: HubUserClient;
+    audit: AuditService;
+    logger: Logger;
+    dials: HubFederationDials;
+    /** The tool's half of a removal (the `membershipRemoval` slot), run in the sweep's transaction. */
+    onMembershipRemoval?: MembershipRemovalHook | undefined;
+    /** Test seam. */
+    now?: () => number;
+}
+export declare class HubOrgReconciler {
+    private readonly deps;
+    /** local userId → pass freshness. */
+    private readonly cache;
+    private readonly inFlight;
+    /** hub org id → its whole team list's freshness (bounded like the user cache). */
+    private readonly orgTeams;
+    private readonly now;
+    readonly dials: HubFederationDials;
+    /** Registered into the Prometheus registry by boot (cloud only). */
+    readonly promMetrics: Counter[];
+    private readonly passes;
+    private readonly orgTeamsRefreshes;
+    constructor(deps: HubOrgReconcilerDeps);
+    /**
+     * The identity-path read-through: cached per user (~10 s), single-flight,
+     * retry-throttled after failures. Awaits one pass on expiry — the request
+     * that triggered it observes the reconciled state — and NEVER throws.
+     * Returns the windowed verdict the live gate enforces.
+     */
+    reconcile(localUserId: string): Promise<ReconcileVerdict>;
+    /**
+     * The login-time pass (assertLogin step 3): TTL and throttle deliberately
+     * bypassed — a login is the freshest signal there is, and `login` carries
+     * the callback access token so no refresh is needed. Returns the PASS'S
+     * OWN outcome (not the windowed verdict): the fail-CLOSED login requires
+     * this very pass to have succeeded, never a recent cached one.
+     */
+    forceReconcile(localUserId: string, login?: LoginAccessToken): Promise<ReconcilePassOutcome>;
+    private startPass;
+    private verdict;
+    private runPass;
+    /**
+     * Read the organization's WHOLE team list as this person and project it
+     * (PRDCT-2813), when the last read is older than `orgTeamsTtlMs` (or never
+     * happened) and no failed read happened within `retryMs`. The LOGIN pass
+     * reads it whatever the window says (`force`): a login is the freshest
+     * signal there is, and Romain's rule is "at login, then every five minutes". A refinement
+     * of a pass whose org list already succeeded: it never throws and never
+     * fails the pass; a failed read keeps the previous list and is logged once
+     * per throttle window.
+     *
+     * No lock: two replicas (or two passes) may both refresh the same org. The
+     * upsert is idempotent and the delete is by membership of the list each
+     * one read, so the last writer leaves the hub's list, whichever it is.
+     */
+    private refreshOrgTeams;
+    /**
+     * The organizations the person's last definitive hub list named as not
+     * opening this tool to them (`GET /me`'s `hubDenied`, the refusal page's
+     * words). Empty when unknown: never read, evicted, or cleared by a
+     * `no_link` / `grant_dead` pass. Per replica, like the rest of the cache.
+     */
+    deniedOrgs(localUserId: string): HubDeniedOrg[];
+    private remember;
+}
+/** Keep a cache under MAX_CACHE_ENTRIES: drop expired entries first, then oldest-inserted. */
+export declare function pruneOversized<V>(cache: Map<string, V>, expired: (value: V) => boolean): void;
+//# sourceMappingURL=hub-reconcile.d.ts.map

package/dist/identity/hub-reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-reconcile.d.ts","sourceRoot":"","sources":["../../src/identity/hub-reconcile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAgC,KAAK,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAC/E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAA0B,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE3F,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE1F;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IACjC,kEAAkE;IAClE,cAAc,EAAE,MAAM,CAAC;IACvB,kFAAkF;IAClF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oFAAoF;IACpF,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,aAAa,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,YAAY,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,cAAc,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,wBAAwB,EAAE,kBAWtC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,MAAM,oBAAoB,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,GAAG,cAAc,GAAG,OAAO,CAAC;AAE9F;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC;AAiCjG,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,EAAE,CAAC;IACP,MAAM,EAAE,aAAa,CAAC;IACtB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,kBAAkB,CAAC;IAC1B,mGAAmG;IACnG,mBAAmB,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACxD,iBAAiB;IACjB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,qBAAa,gBAAgB;IAcf,OAAO,CAAC,QAAQ,CAAC,IAAI;IAbjC,qCAAqC;IACrC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IACvD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoD;IAC7E,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IAEnC,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAU;gBAEf,IAAI,EAAE,oBAAoB;IAoBvD;;;;;OAKG;IACG,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAuB/D;;;;;;OAMG;IACG,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IASlG,OAAO,CAAC,SAAS;IAQjB,OAAO,CAAC,OAAO;YAcD,OAAO;IA+NrB;;;;;;;;;;;;;OAaG;YACW,eAAe;IAwD7B;;;;;OAKG;IACH,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,YAAY,EAAE;IAI/C,OAAO,CAAC,QAAQ;CAiBjB;AAED,8FAA8F;AAC9F,wBAAgB,cAAc,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,OAAO,GAAG,IAAI,CAU7F"}