@antasphere/chassis-server 1.0.0

package/dist/identity/index.d.ts

@@ -0,0 +1,13 @@
+export { type AccountEvent, type Auth, createAuth, mcpResourceUrl, signInOriginRefused, trustedOriginsFor } from './better-auth.js';
+export { DEMO_PASS_DEFAULT_MINUTES, DEMO_PASS_MAX_MINUTES, DEMO_PASS_MAX_PATH_LENGTH, DEMO_SESSION_REFUSED_API_ROUTES, DEMO_SESSION_REFUSED_AUTH_PATHS, type DemoSessionRefusedApiRoute, demoSessionApiRefusalMessage, demoSessionAuthRefusal, isDemoAddress, isDemoSignInHost, isSafeDemoPath, parseDemoEmailDomains, parseDemoHosts } from './demo-pass-rules.js';
+export { DEFAULT_GRANT_DIALS, type GrantAccess, HubGrantService, LOCK_WATCHDOG_HEADROOM_MS } from './hub-grant.js';
+export { HubJwtVerifier } from './hub-jwt.js';
+export { HubLogoutService, hintCookieClearHeader } from './hub-logout.js';
+export { projectOrgMembership } from './hub-projection.js';
+export { DEFAULT_FEDERATION_DIALS, type HubFederationDials, HubOrgReconciler, type ReconcilePassOutcome } from './hub-reconcile.js';
+export { HUB_SSO_PROVIDER_ID, HUB_SSO_SCOPES, type HubConnectAssertion, HubSsoLoginError, HubSsoService, ssoAuthorizationUrlParams } from './hub-sso.js';
+export { type HubCreateOrgResult, type HubOrgCreator, HubUserClient, classifyHubOrgCreateAnswer, hubApiResource } from './hub-user-client.js';
+export { OauthJwtVerifier } from './oauth-jwt.js';
+export { type OnWorkspaceMiss, resolveMembership } from './resolve-membership.js';
+export { preflightSigningKey, retireSigningKey, runSigningKeyCli } from './signing-key.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,IAAI,EACT,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,+BAA+B,EAC/B,+BAA+B,EAC/B,KAAK,0BAA0B,EAC/B,4BAA4B,EAC5B,sBAAsB,EACtB,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACrB,cAAc,EACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,mBAAmB,EACnB,KAAK,WAAW,EAChB,eAAe,EACf,yBAAyB,EAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,gBAAgB,EAChB,KAAK,oBAAoB,EAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,KAAK,mBAAmB,EACxB,gBAAgB,EAChB,aAAa,EACb,yBAAyB,EAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,aAAa,EACb,0BAA0B,EAC1B,cAAc,EACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,KAAK,eAAe,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/identity/index.js

@@ -0,0 +1,13 @@
+export { createAuth, mcpResourceUrl, signInOriginRefused, trustedOriginsFor } from './better-auth.js';
+export { DEMO_PASS_DEFAULT_MINUTES, DEMO_PASS_MAX_MINUTES, DEMO_PASS_MAX_PATH_LENGTH, DEMO_SESSION_REFUSED_API_ROUTES, DEMO_SESSION_REFUSED_AUTH_PATHS, demoSessionApiRefusalMessage, demoSessionAuthRefusal, isDemoAddress, isDemoSignInHost, isSafeDemoPath, parseDemoEmailDomains, parseDemoHosts } from './demo-pass-rules.js';
+export { DEFAULT_GRANT_DIALS, HubGrantService, LOCK_WATCHDOG_HEADROOM_MS } from './hub-grant.js';
+export { HubJwtVerifier } from './hub-jwt.js';
+export { HubLogoutService, hintCookieClearHeader } from './hub-logout.js';
+export { projectOrgMembership } from './hub-projection.js';
+export { DEFAULT_FEDERATION_DIALS, HubOrgReconciler } from './hub-reconcile.js';
+export { HUB_SSO_PROVIDER_ID, HUB_SSO_SCOPES, HubSsoLoginError, HubSsoService, ssoAuthorizationUrlParams } from './hub-sso.js';
+export { HubUserClient, classifyHubOrgCreateAnswer, hubApiResource } from './hub-user-client.js';
+export { OauthJwtVerifier } from './oauth-jwt.js';
+export { resolveMembership } from './resolve-membership.js';
+export { preflightSigningKey, retireSigningKey, runSigningKeyCli } from './signing-key.js';
+//# sourceMappingURL=index.js.map

package/dist/identity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,UAAU,EACV,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,yBAAyB,EACzB,+BAA+B,EAC/B,+BAA+B,EAE/B,4BAA4B,EAC5B,sBAAsB,EACtB,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACrB,cAAc,EACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,mBAAmB,EAEnB,eAAe,EACf,yBAAyB,EAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,wBAAwB,EAExB,gBAAgB,EAEjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,mBAAmB,EACnB,cAAc,EAEd,gBAAgB,EAChB,aAAa,EACb,yBAAyB,EAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EAGL,aAAa,EACb,0BAA0B,EAC1B,cAAc,EACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAwB,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/identity/oauth-jwt.d.ts

@@ -0,0 +1,32 @@
+import { type Db } from '@antasphere/chassis-db';
+import type { Principal } from '@antasphere/chassis-contract';
+import { type Auth } from './better-auth.js';
+import { type OnWorkspaceMiss } from './resolve-membership.js';
+export declare class OauthJwtVerifier {
+    private readonly auth;
+    private readonly db;
+    /** Cloud only: one cached reconcile on a well-formed selector miss. */
+    private readonly onWorkspaceMiss?;
+    private readonly issuer;
+    private readonly audience;
+    private jwksCache;
+    constructor(auth: Auth, db: Db, publicBaseUrl: string, 
+    /** Cloud only: one cached reconcile on a well-formed selector miss. */
+    onWorkspaceMiss?: OnWorkspaceMiss | undefined);
+    private keySet;
+    private verify;
+    /**
+     * Resolve a Bearer JWT to its principal, or null when the token fails
+     * verification or no live membership answers the selection — the same
+     * fail-closed semantics as the session and API-key paths.
+     *
+     * `requested` is the request's X-Workspace-Id (or null). Resolution is
+     * verify → sub → resolveMembership(sub, requested): the LIVE membership
+     * lookup is the instant-revocation point AND the whole workspace
+     * authorization. A legacy `workspace_id` claim (minted before the
+     * user-scoped model) is deliberately ignored — claims stopped being an
+     * authorization input entirely.
+     */
+    resolve(token: string, requested: string | null): Promise<Principal | null>;
+}
+//# sourceMappingURL=oauth-jwt.d.ts.map

package/dist/identity/oauth-jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-jwt.d.ts","sourceRoot":"","sources":["../../src/identity/oauth-jwt.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAkB,KAAK,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAA0C,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAsBvG,qBAAa,gBAAgB;IAQzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,EAAE;IAEnB,uEAAuE;IACvE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAXnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAGlC,OAAO,CAAC,SAAS,CAAoF;gBAGlF,IAAI,EAAE,IAAI,EACV,EAAE,EAAE,EAAE,EACvB,aAAa,EAAE,MAAM;IACrB,uEAAuE;IACtD,eAAe,CAAC,EAAE,eAAe,GAAG,SAAS;YAMlD,MAAM;YASN,MAAM;IA0BpB;;;;;;;;;;;OAWG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;CAoClF"}

package/dist/identity/oauth-jwt.js

@@ -0,0 +1,122 @@
+import { createLocalJWKSet, jwtVerify } from 'jose';
+import {} from '@antasphere/chassis-db';
+import { mcpResourceUrl } from './better-auth.js';
+import { isWorkspaceSelector, resolveMembership } from './resolve-membership.js';
+/**
+ * OAuth Bearer-JWT resolution — the third credential path in auth-context.
+ *
+ * Access tokens are RS256 JWTs this instance minted itself (Better Auth jwt +
+ * oauthProvider plugins), so verification is fully local: JWKS straight from
+ * the jwt plugin (DB-backed, no HTTP), hard issuer / audience / algorithm /
+ * expiry pinning. On top of the signature, every request re-resolves the
+ * workspace membership LIVE — deactivating a member cuts token access on
+ * their next request, not at token expiry. Scope enforcement stays in the
+ * fail-closed allowlist gate (middleware/scopes.ts), identical to API keys.
+ *
+ * User-scoped credential model: a token identifies its USER ("act as you")
+ * and carries NO workspace authority — claims are never an authorization
+ * input. The request's target workspace comes from the X-Workspace-Id
+ * selector through the shared resolveMembership rule (explicit → fail-closed
+ * membership check; absent → the user's default, else oldest active), the
+ * same rule sessions and API keys use.
+ */
+const JWKS_TTL_MS = 10 * 60 * 1000;
+export class OauthJwtVerifier {
+    auth;
+    db;
+    onWorkspaceMiss;
+    issuer;
+    audience;
+    // Per-instance cache: the process verifies its OWN tokens, keys rotate
+    // rarely; on an unknown-signature failure we refetch once and retry.
+    jwksCache = null;
+    constructor(auth, db, publicBaseUrl, 
+    /** Cloud only: one cached reconcile on a well-formed selector miss. */
+    onWorkspaceMiss) {
+        this.auth = auth;
+        this.db = db;
+        this.onWorkspaceMiss = onWorkspaceMiss;
+        this.issuer = publicBaseUrl;
+        this.audience = mcpResourceUrl(publicBaseUrl);
+    }
+    async keySet(forceRefresh = false) {
+        if (!forceRefresh && this.jwksCache && Date.now() - this.jwksCache.fetchedAt < JWKS_TTL_MS) {
+            return this.jwksCache.keySet;
+        }
+        const jwks = (await this.auth.api.getJwks());
+        this.jwksCache = { keySet: createLocalJWKSet(jwks), fetchedAt: Date.now() };
+        return this.jwksCache.keySet;
+    }
+    async verify(token) {
+        const options = {
+            issuer: this.issuer,
+            audience: this.audience,
+            algorithms: ['RS256'], // hard allowlist — implicitly rejects none/HS256
+            clockTolerance: 5,
+            requiredClaims: ['sub']
+        };
+        try {
+            return await jwtVerify(token, await this.keySet(), options);
+        }
+        catch (err) {
+            // One retry with fresh keys covers signing-key rotation mid-cache —
+            // both directions: a token signed by a key the cache no longer trusts
+            // (JWSSignatureVerificationFailed) and a token signed by a key MINTED
+            // after the cache was warmed (JWKSNoMatchingKey — the rotate-signing-key
+            // drill would otherwise answer 401 for up to JWKS_TTL_MS, ADR 023).
+            if (err instanceof Error &&
+                (err.name === 'JWSSignatureVerificationFailed' || err.name === 'JWKSNoMatchingKey')) {
+                return await jwtVerify(token, await this.keySet(true), options);
+            }
+            throw err;
+        }
+    }
+    /**
+     * Resolve a Bearer JWT to its principal, or null when the token fails
+     * verification or no live membership answers the selection — the same
+     * fail-closed semantics as the session and API-key paths.
+     *
+     * `requested` is the request's X-Workspace-Id (or null). Resolution is
+     * verify → sub → resolveMembership(sub, requested): the LIVE membership
+     * lookup is the instant-revocation point AND the whole workspace
+     * authorization. A legacy `workspace_id` claim (minted before the
+     * user-scoped model) is deliberately ignored — claims stopped being an
+     * authorization input entirely.
+     */
+    async resolve(token, requested) {
+        let payload;
+        try {
+            ({ payload } = await this.verify(token));
+        }
+        catch {
+            return null;
+        }
+        const sub = typeof payload.sub === 'string' ? payload.sub : null;
+        if (!sub)
+            return null;
+        let member = await resolveMembership(this.db, sub, requested);
+        if (!member && requested && this.onWorkspaceMiss && isWorkspaceSelector(requested)) {
+            // Unknown-workspace retry (cloud): the JWT verified above — the miss
+            // may be a hub org granted since the last reconcile pass. One cached
+            // reconcile, one re-run of the SAME lookup — no recursion.
+            await this.onWorkspaceMiss(sub, requested);
+            member = await resolveMembership(this.db, sub, requested);
+        }
+        if (!member)
+            return null;
+        return {
+            userId: sub,
+            email: member.email,
+            name: member.name,
+            workspaceId: member.workspaceId,
+            role: member.role,
+            origin: member.origin,
+            via: 'oauth',
+            scopes: new Set(String(typeof payload.scope === 'string' ? payload.scope : '')
+                .split(' ')
+                .filter(Boolean)),
+            ...(member.accountRef ? { accountRef: member.accountRef } : {})
+        };
+    }
+}
+//# sourceMappingURL=oauth-jwt.js.map

package/dist/identity/oauth-jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-jwt.js","sourceRoot":"","sources":["../../src/identity/oauth-jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAmC,MAAM,MAAM,CAAC;AACrF,OAAO,EAAW,MAAM,wBAAwB,CAAC;AAEjD,OAAO,EAAE,cAAc,EAAa,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAwB,MAAM,yBAAyB,CAAC;AAEvG;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC,MAAM,OAAO,gBAAgB;IAQR;IACA;IAGA;IAXF,MAAM,CAAS;IACf,QAAQ,CAAS;IAClC,uEAAuE;IACvE,qEAAqE;IAC7D,SAAS,GAA+E,IAAI,CAAC;IAErG,YACmB,IAAU,EACV,EAAM,EACvB,aAAqB;IACrB,uEAAuE;IACtD,eAA6C;QAJ7C,SAAI,GAAJ,IAAI,CAAM;QACV,OAAE,GAAF,EAAE,CAAI;QAGN,oBAAe,GAAf,eAAe,CAA8B;QAE9D,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IAChD,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,YAAY,GAAG,KAAK;QACvC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,GAAG,WAAW,EAAE,CAAC;YAC3F,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QAC/B,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAoB,CAAC;QAChE,IAAI,CAAC,SAAS,GAAG,EAAE,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;IAC/B,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,KAAa;QAChC,MAAM,OAAO,GAAqB;YAChC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,iDAAiD;YACxE,cAAc,EAAE,CAAC;YACjB,cAAc,EAAE,CAAC,KAAK,CAAC;SACxB,CAAC;QACF,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,sEAAsE;YACtE,sEAAsE;YACtE,yEAAyE;YACzE,oEAAoE;YACpE,IACE,GAAG,YAAY,KAAK;gBACpB,CAAC,GAAG,CAAC,IAAI,KAAK,gCAAgC,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,CAAC,EACnF,CAAC;gBACD,OAAO,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YAClE,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,SAAwB;QACnD,IAAI,OAAgC,CAAC;QACrC,IAAI,CAAC;YACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACjE,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAEtB,IAAI,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,IAAI,SAAS,IAAI,IAAI,CAAC,eAAe,IAAI,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;YACnF,qEAAqE;YACrE,qEAAqE;YACrE,2DAA2D;YAC3D,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC3C,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,OAAO;YACL,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,EAAE,OAAO;YACZ,MAAM,EAAE,IAAI,GAAG,CACb,MAAM,CAAC,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3D,KAAK,CAAC,GAAG,CAAC;iBACV,MAAM,CAAC,OAAO,CAAC,CACnB;YACD,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;IACJ,CAAC;CACF"}

package/dist/identity/resolve-membership.d.ts

@@ -0,0 +1,28 @@
+import { type Db } from '@antasphere/chassis-db';
+/**
+ * Well-formed-selector check, shared with the cloud miss-retry hook: only a
+ * plausibly-real workspace id ever triggers a hub reconcile — a garbage
+ * header can never buy a hub round-trip (the reconciler's TTL/throttle
+ * bounds even well-formed ones).
+ */
+export declare function isWorkspaceSelector(value: string): boolean;
+/**
+ * The cloud edition's unknown-workspace retry hook (internal/federation.md):
+ * a verified credential naming a workspace the local join cannot see MAY be
+ * a hub org granted since the last reconcile pass — "invited at the hub,
+ * clicks a deep link". Boot wires ONE cached reconcile; the resolver then
+ * re-runs the SAME lookup once, no recursion. undefined on oss.
+ */
+export type OnWorkspaceMiss = (userId: string, requested: string) => Promise<void>;
+export interface ResolvedMembership {
+    workspaceId: string;
+    role: 'owner' | 'admin' | 'member';
+    origin: 'local' | 'hub' | 'guest';
+    /** The workspace's centralAccountId — null outside hub projections. */
+    accountRef: string | null;
+    /** Live user row fields, for the machine paths that carry no session. */
+    email: string;
+    name: string;
+}
+export declare function resolveMembership(db: Db, userId: string, requested: string | null): Promise<ResolvedMembership | null>;
+//# sourceMappingURL=resolve-membership.d.ts.map

package/dist/identity/resolve-membership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-membership.d.ts","sourceRoot":"","sources":["../../src/identity/resolve-membership.ts"],"names":[],"mappings":"AACA,OAAO,EAAmD,KAAK,EAAE,EAAE,MAAM,wBAAwB,CAAC;AA+BlG;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnF,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;IACnC,MAAM,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC;IAClC,uEAAuE;IACvE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAAG,IAAI,GACvB,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAqCpC"}

package/dist/identity/resolve-membership.js

@@ -0,0 +1,69 @@
+import { and, asc, desc, eq, or, sql } from 'drizzle-orm';
+import { user as userTable, workspaceMembers, workspaces } from '@antasphere/chassis-db';
+/**
+ * The ONE membership-selection rule of the user-scoped credential model
+ * (ADR 014 as amended): every credential — session, API key, OAuth bearer —
+ * identifies a USER, and each request resolves exactly ONE target workspace
+ * for that user:
+ *
+ *  - `requested` non-null (the X-Workspace-Id header, or an API key's pin):
+ *    an ACTIVE membership of that workspace is required, else null — fail
+ *    closed, so an unknown workspace and a workspace the user does not
+ *    belong to are indistinguishable (no oracle). The selector is the
+ *    workspace's LOCAL id, or (PRDCT-2947) the id of the hub organization
+ *    it projects (`workspaces.central_account_id`): a person names the
+ *    organization the hub's way (`--org <hub org id>`) and the tool maps
+ *    it here, in the one rule, so no credential path can fork on it. On
+ *    self-hosted the column is always empty and the second arm is inert.
+ *  - `requested` null: the user's DEFAULT membership (`is_default`, at most
+ *    one per user), else the deterministic fallback — the OLDEST active
+ *    membership (created_at, then id). While no row carries `is_default`
+ *    (nothing sets it on oss; the cloud reconcile materializes the hub-level
+ *    default), the ordering is inert and selection is byte-identical to the
+ *    pre-default behavior.
+ *
+ * All three resolvers share THIS query so the selection rule can never fork
+ * per credential path.
+ */
+/** Strict UUID shape — a malformed selector must never reach Postgres' uuid cast. */
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * Well-formed-selector check, shared with the cloud miss-retry hook: only a
+ * plausibly-real workspace id ever triggers a hub reconcile — a garbage
+ * header can never buy a hub round-trip (the reconciler's TTL/throttle
+ * bounds even well-formed ones).
+ */
+export function isWorkspaceSelector(value) {
+    return UUID_RE.test(value);
+}
+export async function resolveMembership(db, userId, requested) {
+    if (requested !== null && !UUID_RE.test(requested))
+        return null; // fail closed, no uuid-cast 500
+    const [row] = await db
+        .select({
+        workspaceId: workspaceMembers.workspaceId,
+        role: workspaceMembers.role,
+        origin: workspaceMembers.origin,
+        accountRef: workspaces.centralAccountId,
+        email: userTable.email,
+        name: userTable.name
+    })
+        .from(workspaceMembers)
+        .innerJoin(workspaces, eq(workspaceMembers.workspaceId, workspaces.id))
+        .innerJoin(userTable, eq(workspaceMembers.userId, userTable.id))
+        .where(and(eq(workspaceMembers.userId, userId), eq(workspaceMembers.isActive, true), ...(requested
+        ? [
+            or(eq(workspaceMembers.workspaceId, requested), 
+            // Case-blind like the uuid arm and the pin check (verifier
+            // round 1, F6): the column is text, the selector a uuid.
+            sql `lower(${workspaces.centralAccountId}) = lower(${requested})`)
+        ]
+        : [])))
+        // Selector-less default: the default membership first, then the
+        // deterministic oldest. With a selector the filter pins a single row and
+        // the order is inert.
+        .orderBy(desc(workspaceMembers.isDefault), asc(workspaceMembers.createdAt), asc(workspaceMembers.id))
+        .limit(1);
+    return row ?? null;
+}
+//# sourceMappingURL=resolve-membership.js.map

package/dist/identity/resolve-membership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-membership.js","sourceRoot":"","sources":["../../src/identity/resolve-membership.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,IAAI,IAAI,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAW,MAAM,wBAAwB,CAAC;AAElG;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,qFAAqF;AACrF,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAElF;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAsBD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAM,EACN,MAAc,EACd,SAAwB;IAExB,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,gCAAgC;IAEjG,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC;QACN,WAAW,EAAE,gBAAgB,CAAC,WAAW;QACzC,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,MAAM,EAAE,gBAAgB,CAAC,MAAM;QAC/B,UAAU,EAAE,UAAU,CAAC,gBAAgB;QACvC,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,IAAI,EAAE,SAAS,CAAC,IAAI;KACrB,CAAC;SACD,IAAI,CAAC,gBAAgB,CAAC;SACtB,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;SACtE,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;SAC/D,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,EACnC,GAAG,CAAC,SAAS;QACX,CAAC,CAAC;YACE,EAAE,CACA,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC;YAC3C,2DAA2D;YAC3D,yDAAyD;YACzD,GAAG,CAAA,SAAS,UAAU,CAAC,gBAAgB,aAAa,SAAS,GAAG,CACjE;SACF;QACH,CAAC,CAAC,EAAE,CAAC,CACR,CACF;QACD,gEAAgE;QAChE,yEAAyE;QACzE,sBAAsB;SACrB,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;SACpG,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC"}

package/dist/identity/signing-key.d.ts

@@ -0,0 +1,49 @@
+import { type Db } from '@antasphere/chassis-db';
+export type SigningKeyPreflight = {
+    ok: true;
+    kid: string | null;
+} | {
+    ok: false;
+    kid: string;
+    reason: string;
+};
+/**
+ * The operator-facing diagnostic — names the cause and BOTH safe remedies.
+ * Kept in one place so boot's fatal log and the tests pin the same message.
+ */
+export declare function signingKeyPreflightMessage(kid: string): string;
+/**
+ * Boot preflight: attempt one decrypt of the key the jwt plugin would sign
+ * with. Exactly the plugin's selection rule (sign.mjs): newest by createdAt;
+ * a missing table-or-row and an EXPIRED newest row are both fine — the next
+ * mint creates a fresh key under the current secret.
+ */
+export declare function preflightSigningKey(db: Db, authSecret: string): Promise<SigningKeyPreflight>;
+/**
+ * Mint a new signing key under the given secret — the manual rotation step
+ * (a compromise drill, or re-keying after an AUTH_SECRET change). Mirrors
+ * the plugin's createJwk (utils.mjs): extractable RS256 pair, JWK-exported,
+ * private half encrypted exactly as the plugin decrypts it. The new row's
+ * createdAt makes it the active signer; every older row stays published on
+ * /jwks (the overlap) until explicitly retired.
+ */
+export declare function rotateSigningKey(db: Db, authSecret: string): Promise<{
+    kid: string;
+}>;
+/**
+ * Delete ONE retired key by kid, after the overlap window. Refuses the
+ * newest row: deleting the active signer would silently re-key the instance
+ * on the next mint with zero coordination — the exact failure the preflight
+ * exists to prevent.
+ */
+export declare function retireSigningKey(db: Db, kid: string): Promise<void>;
+/**
+ * `node dist/index.js rotate-signing-key [--retire <kid>]` — the operator
+ * entry point (index.ts). Runs against the container's own env (DATABASE_URL
+ * + AUTH_SECRET/DATA_DIR), so `docker compose run --rm app …` works while
+ * the server is down — the state the preflight refusal leaves you in.
+ * Output goes to stdout on purpose: this is an interactive operator command,
+ * not the service log.
+ */
+export declare function runSigningKeyCli(db: Db, authSecret: string, args: readonly string[], out: (line: string) => void): Promise<number>;
+//# sourceMappingURL=signing-key.d.ts.map

package/dist/identity/signing-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing-key.d.ts","sourceRoot":"","sources":["../../src/identity/signing-key.ts"],"names":[],"mappings":"AAGA,OAAO,EAAQ,KAAK,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAgCvD,MAAM,MAAM,mBAAmB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhF;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAW9D;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgBlG;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAe3F;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWzE;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,EAAE,EACN,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC1B,OAAO,CAAC,MAAM,CAAC,CA2BjB"}

package/dist/identity/signing-key.js

@@ -0,0 +1,144 @@
+import { desc, eq } from 'drizzle-orm';
+import { exportJWK, generateKeyPair } from 'jose';
+import { generateRandomString, symmetricDecrypt, symmetricEncrypt } from 'better-auth/crypto';
+import { jwks } from '@antasphere/chassis-db';
+/**
+ * OAuth signing-key durability across AUTH_SECRET rotation (ADR 023).
+ *
+ * The jwt plugin stores its RS256 private key in the `jwks` table encrypted
+ * under the auth secret (bare xchacha20 ciphertext — createAuth passes a
+ * plain string `secret`, so no versioned envelope). Signing decrypts the
+ * NEWEST row on every mint; with no `rotationInterval` the row never
+ * expires, so a rotated AUTH_SECRET turns every token mint into a 500 —
+ * forever. The three exports here close that:
+ *
+ *  - `preflightSigningKey` mirrors the plugin's signing path (newest
+ *    non-expired row → decrypt) at boot and reports failure BEFORE the
+ *    instance serves an authorize endpoint it cannot follow with a token.
+ *  - `rotateSigningKey` mints a fresh RS256 key under the CURRENT secret —
+ *    the same row shape the plugin's own createJwk writes, so the plugin
+ *    signs with it immediately (newest createdAt wins). Retired rows stay in
+ *    the table, and /jwks publishes every row without an expiresAt, so
+ *    already-issued tokens keep verifying for as long as the old row stays —
+ *    the publish-overlap window.
+ *  - `retireSigningKey` deletes ONE named retired row after the overlap
+ *    window; the newest (active signer) is refused.
+ *
+ * Everything here mirrors the pinned better-auth 1.6.15 jwt plugin
+ * (plugins/jwt/{sign,utils,adapter}.mjs) — re-verify the row shape, the
+ * newest-key selection, and the /jwks publish filter on ANY bump.
+ */
+/** The alg the chassis pins in `jwks.keyPairConfig` (identity/better-auth.ts). */
+const SIGNING_ALG = 'RS256';
+/**
+ * The operator-facing diagnostic — names the cause and BOTH safe remedies.
+ * Kept in one place so boot's fatal log and the tests pin the same message.
+ */
+export function signingKeyPreflightMessage(kid) {
+    return (`OAuth signing-key preflight failed: the stored JWKS private key (kid ${kid}) ` +
+        'cannot be decrypted with the current AUTH_SECRET. This happens when AUTH_SECRET ' +
+        'was rotated without re-keying token signing; booting anyway would serve an ' +
+        'authorize endpoint whose every token mint (POST /oauth2/token) answers 500. ' +
+        'Remedies: restore the previous AUTH_SECRET, or mint a fresh signing key under ' +
+        'the current secret with `node dist/index.js rotate-signing-key` — the retired ' +
+        'key stays published on /jwks so already-issued tokens keep verifying ' +
+        '(internal/security-runbooks.md).');
+}
+/**
+ * Boot preflight: attempt one decrypt of the key the jwt plugin would sign
+ * with. Exactly the plugin's selection rule (sign.mjs): newest by createdAt;
+ * a missing table-or-row and an EXPIRED newest row are both fine — the next
+ * mint creates a fresh key under the current secret.
+ */
+export async function preflightSigningKey(db, authSecret) {
+    const [latest] = await db
+        .select({ id: jwks.id, privateKey: jwks.privateKey, expiresAt: jwks.expiresAt })
+        .from(jwks)
+        .orderBy(desc(jwks.createdAt))
+        .limit(1);
+    if (!latest)
+        return { ok: true, kid: null };
+    if (latest.expiresAt && latest.expiresAt < new Date())
+        return { ok: true, kid: null };
+    try {
+        // The plugin stores JSON.stringify(symmetricEncrypt(...)) — decrypt takes
+        // the JSON.parse'd string (sign.mjs).
+        await symmetricDecrypt({ key: authSecret, data: JSON.parse(latest.privateKey) });
+        return { ok: true, kid: latest.id };
+    }
+    catch {
+        return { ok: false, kid: latest.id, reason: signingKeyPreflightMessage(latest.id) };
+    }
+}
+/**
+ * Mint a new signing key under the given secret — the manual rotation step
+ * (a compromise drill, or re-keying after an AUTH_SECRET change). Mirrors
+ * the plugin's createJwk (utils.mjs): extractable RS256 pair, JWK-exported,
+ * private half encrypted exactly as the plugin decrypts it. The new row's
+ * createdAt makes it the active signer; every older row stays published on
+ * /jwks (the overlap) until explicitly retired.
+ */
+export async function rotateSigningKey(db, authSecret) {
+    const { publicKey, privateKey } = await generateKeyPair(SIGNING_ALG, { extractable: true });
+    const publicWebKey = await exportJWK(publicKey);
+    const privateWebKey = await exportJWK(privateKey);
+    const kid = generateRandomString(32, 'a-z', 'A-Z', '0-9');
+    await db.insert(jwks).values({
+        id: kid,
+        publicKey: JSON.stringify(publicWebKey),
+        privateKey: JSON.stringify(await symmetricEncrypt({ key: authSecret, data: JSON.stringify(privateWebKey) })),
+        createdAt: new Date(),
+        expiresAt: null
+    });
+    return { kid };
+}
+/**
+ * Delete ONE retired key by kid, after the overlap window. Refuses the
+ * newest row: deleting the active signer would silently re-key the instance
+ * on the next mint with zero coordination — the exact failure the preflight
+ * exists to prevent.
+ */
+export async function retireSigningKey(db, kid) {
+    const [latest] = await db.select({ id: jwks.id }).from(jwks).orderBy(desc(jwks.createdAt)).limit(1);
+    if (!latest)
+        throw new Error('no signing keys exist');
+    if (latest.id === kid) {
+        throw new Error(`refusing to retire ${kid}: it is the ACTIVE signing key (newest row). ` +
+            'Mint a replacement first with rotate-signing-key, wait out the overlap window, then retire.');
+    }
+    const deleted = await db.delete(jwks).where(eq(jwks.id, kid)).returning({ id: jwks.id });
+    if (deleted.length === 0)
+        throw new Error(`no signing key with kid ${kid}`);
+}
+/**
+ * `node dist/index.js rotate-signing-key [--retire <kid>]` — the operator
+ * entry point (index.ts). Runs against the container's own env (DATABASE_URL
+ * + AUTH_SECRET/DATA_DIR), so `docker compose run --rm app …` works while
+ * the server is down — the state the preflight refusal leaves you in.
+ * Output goes to stdout on purpose: this is an interactive operator command,
+ * not the service log.
+ */
+export async function runSigningKeyCli(db, authSecret, args, out) {
+    const retireAt = args.indexOf('--retire');
+    if (retireAt !== -1) {
+        const kid = args[retireAt + 1];
+        if (!kid) {
+            out('usage: rotate-signing-key --retire <kid>');
+            return 1;
+        }
+        await retireSigningKey(db, kid);
+        out(`retired signing key ${kid} — it is no longer published on /jwks; tokens it signed no longer verify`);
+        return 0;
+    }
+    const before = await db.select({ id: jwks.id }).from(jwks).orderBy(desc(jwks.createdAt));
+    const { kid } = await rotateSigningKey(db, authSecret);
+    out(`minted new signing key ${kid} under the current AUTH_SECRET — it signs from the next mint on`);
+    if (before.length > 0) {
+        out(`retired key(s) still published for the overlap window (already-issued tokens keep verifying): ` +
+            before.map((k) => k.id).join(', '));
+        out('after the overlap window (outstanding access tokens live 15 min; allow for external JWKS caches), ' +
+            'retire each with: rotate-signing-key --retire <kid>');
+    }
+    return 0;
+}
+//# sourceMappingURL=signing-key.js.map

package/dist/identity/signing-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing-key.js","sourceRoot":"","sources":["../../src/identity/signing-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC9F,OAAO,EAAE,IAAI,EAAW,MAAM,wBAAwB,CAAC;AAEvD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,kFAAkF;AAClF,MAAM,WAAW,GAAG,OAAO,CAAC;AAK5B;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,OAAO,CACL,wEAAwE,GAAG,IAAI;QAC/E,kFAAkF;QAClF,6EAA6E;QAC7E,8EAA8E;QAC9E,gFAAgF;QAChF,gFAAgF;QAChF,uEAAuE;QACvE,kCAAkC,CACnC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EAAM,EAAE,UAAkB;IAClE,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;SACtB,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;SAC/E,IAAI,CAAC,IAAI,CAAC;SACV,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SAC7B,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACtF,IAAI,CAAC;QACH,0EAA0E;QAC1E,sCAAsC;QACtC,MAAM,gBAAgB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAW,EAAE,CAAC,CAAC;QAC3F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,0BAA0B,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IACtF,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAM,EAAE,UAAkB;IAC/D,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5F,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,oBAAoB,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1D,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QAC3B,EAAE,EAAE,GAAG;QACP,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC;QACvC,UAAU,EAAE,IAAI,CAAC,SAAS,CACxB,MAAM,gBAAgB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC,CACjF;QACD,SAAS,EAAE,IAAI,IAAI,EAAE;QACrB,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAM,EAAE,GAAW;IACxD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpG,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,sBAAsB,GAAG,+CAA+C;YACtE,6FAA6F,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACzF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAM,EACN,UAAkB,EAClB,IAAuB,EACvB,GAA2B;IAE3B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,CAAC,0CAA0C,CAAC,CAAC;YAChD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,gBAAgB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAChC,GAAG,CAAC,uBAAuB,GAAG,0EAA0E,CAAC,CAAC;QAC1G,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACzF,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACvD,GAAG,CAAC,0BAA0B,GAAG,iEAAiE,CAAC,CAAC;IACpG,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,GAAG,CACD,gGAAgG;YAC9F,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACrC,CAAC;QACF,GAAG,CACD,oGAAoG;YAClG,qDAAqD,CACxD,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,21 @@
+import type { z } from 'zod';
+import type { BootOverrides, BootResult, ToolDefinition } from './tool-definition.js';
+export { type AppDeps, createApp, postgresErrorCode } from './app.js';
+export type { ExportEntriesFn, ExportEntry } from './api/export.js';
+export { EMPTY_TOOL_ENTITLEMENTS, HUB_USAGE_SCOPE, HubCreditCheck, HubMachineToken, HubUsagePoster, EntitlementProfiles, assertToolEntitlements, type ToolEntitlementDeclaration } from './entitlements/index.js';
+export type { ApiContext, ApiRateLimitContext, ApiRoutesContext, BodyCap, BodyLimitVerdict, BootOverrides, BootResult, FilePolicy, JobsContext, PlatformCore, ServiceCore, ToolApiSlots, ToolAppSlots, ToolBuckets, ToolCopy, ToolDefinition, ToolRateLimiters } from './tool-definition.js';
+/** A platform: one tool definition bound to the chassis' locked composition. */
+export interface Platform<TEnvShape extends z.ZodRawShape, TDomain, TEvents, TToolOverrides> {
+    /**
+     * The boot sequence, in its locked order: env → logger → db probe → secret →
+     * migrations under advisory lock → app assembly → ready.
+     */
+    boot: (source?: NodeJS.ProcessEnv, overrides?: BootOverrides<TToolOverrides>) => Promise<BootResult<TEnvShape, TDomain, TEvents>>;
+}
+/**
+ * THE composition entry. A tool fills the named slots of `ToolDefinition`;
+ * the chassis owns every ordering (boot.ts, api/create-api.ts, app.ts).
+ */
+export declare function createPlatform<TEnvShape extends z.ZodRawShape, TDomain, TBuckets extends string = never, TEvents = {}, TToolOverrides = never>(tool: ToolDefinition<TEnvShape, TDomain, TBuckets, TEvents, TToolOverrides>): Platform<TEnvShape, TDomain, TEvents, TToolOverrides>;
+export type { MembershipRemovalHook, RemovedMembership, RemovalCounts } from './members/removal.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtF,OAAO,EAAE,KAAK,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AACtE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,cAAc,EACd,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,0BAA0B,EAChC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,UAAU,EACV,mBAAmB,EACnB,gBAAgB,EAChB,OAAO,EACP,gBAAgB,EAChB,aAAa,EACb,UAAU,EACV,UAAU,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,cAAc,EACd,gBAAgB,EACjB,MAAM,sBAAsB,CAAC;AAE9B,gFAAgF;AAChF,MAAM,WAAW,QAAQ,CAAC,SAAS,SAAS,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc;IACzF;;;OAGG;IACH,IAAI,EAAE,CACJ,MAAM,CAAC,EAAE,MAAM,CAAC,UAAU,EAC1B,SAAS,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC,KACtC,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,SAAS,SAAS,CAAC,CAAC,WAAW,EAC/B,OAAO,EACP,QAAQ,SAAS,MAAM,GAAG,KAAK,EAE/B,OAAO,GAAG,EAAE,EACZ,cAAc,GAAG,KAAK,EAEtB,IAAI,EAAE,cAAc,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,GAC1E,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,CAAC,CAEvD;AACD,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -0,0 +1,11 @@
+import { bootPlatform } from './boot.js';
+export { createApp, postgresErrorCode } from './app.js';
+export { EMPTY_TOOL_ENTITLEMENTS, HUB_USAGE_SCOPE, HubCreditCheck, HubMachineToken, HubUsagePoster, EntitlementProfiles, assertToolEntitlements } from './entitlements/index.js';
+/**
+ * THE composition entry. A tool fills the named slots of `ToolDefinition`;
+ * the chassis owns every ordering (boot.ts, api/create-api.ts, app.ts).
+ */
+export function createPlatform(tool) {
+    return { boot: (source, overrides) => bootPlatform(tool, source, overrides) };
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAGzC,OAAO,EAAgB,SAAS,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAEtE,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,cAAc,EACd,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EAEvB,MAAM,yBAAyB,CAAC;AAiCjC;;;GAGG;AACH,MAAM,UAAU,cAAc,CAQ5B,IAA2E;IAE3E,OAAO,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;AAChF,CAAC"}

package/dist/invitations/index.d.ts

@@ -0,0 +1,2 @@
+export { InvitationError, InvitationService } from './service.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/invitations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/invitations/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC"}

package/dist/invitations/index.js

@@ -0,0 +1,2 @@
+export { InvitationError, InvitationService } from './service.js';
+//# sourceMappingURL=index.js.map

package/dist/invitations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/invitations/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC"}

package/dist/invitations/service.d.ts

@@ -0,0 +1,36 @@
+import { type Db, type Invitation } from '@antasphere/chassis-db';
+/** A live invitation plus which of its two tokens the caller presented. */
+export interface InvitationMatch {
+    invitation: Invitation;
+    /** True when the presented token is the one that ONLY the email carried. */
+    viaEmailToken: boolean;
+}
+export declare class InvitationService {
+    private readonly db;
+    constructor(db: Db);
+    create(opts: {
+        workspaceId: string;
+        email: string;
+        role: 'owner' | 'admin' | 'member';
+        invitedBy: string;
+    }): Promise<{
+        invitation: Invitation;
+        token: string;
+        emailToken: string;
+    }>;
+    /**
+     * Find a live (unaccepted, unrevoked, unexpired) invitation by raw token —
+     * either the copyable-link token or the emailed one — and report which.
+     */
+    findLiveByToken(token: string): Promise<InvitationMatch | null>;
+    /**
+     * Join: create the membership and stamp acceptance atomically enough that
+     * a token cannot be redeemed twice (the accepted_at guard is the gate).
+     */
+    accept(invitation: Invitation, userId: string): Promise<boolean>;
+}
+export declare class InvitationError extends Error {
+    readonly code: 'already_member' | 'already_invited';
+    constructor(code: 'already_member' | 'already_invited', message: string);
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/invitations/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/invitations/service.ts"],"names":[],"mappings":"AAEA,OAAO,EAIL,KAAK,EAAE,EACP,KAAK,UAAU,EAChB,MAAM,wBAAwB,CAAC;AAoBhC,2EAA2E;AAC3E,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,UAAU,CAAC;IACvB,4EAA4E;IAC5E,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,qBAAa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,EAAE;IAE7B,MAAM,CAAC,IAAI,EAAE;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;QACnC,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAoD1E;;;OAGG;IACG,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAkBrE;;;OAGG;IACG,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAwCvE;AAED,qBAAa,eAAgB,SAAQ,KAAK;aAEtB,IAAI,EAAE,gBAAgB,GAAG,iBAAiB;gBAA1C,IAAI,EAAE,gBAAgB,GAAG,iBAAiB,EAC1D,OAAO,EAAE,MAAM;CAIlB"}