@antasphere/chassis-server 1.0.0

package/dist/middleware/auth-body.js

@@ -0,0 +1,55 @@
+import { hasNulDeep } from '@antasphere/chassis-contract';
+import { apiError } from '../api/errors.js';
+/** Matches better-call's / Hono's JSON content-type test (the json-depth regex). */
+const JSON_CONTENT_TYPE = /^application\/([a-z0-9.+-]*\+)?json/i;
+/**
+ * Pre-validates JSON bodies bound for the Better Auth mount (AF-1 + the
+ * update-user half of SL-B4, PRDCT-1358).
+ *
+ * The load-bearing half is NUL: Better Auth's free-text sinks (`/update-user`'s
+ * `name`) are outside the contract, so a NUL rode through to Postgres (SQLSTATE
+ * 22021) and surfaced as Better Auth's OWN 500 — a response `app.onError` never
+ * sees, so the app-level 22021 backstop cannot reach `/auth/*`. Refusing it
+ * here, before the mount, is the only complete place.
+ *
+ * The malformed/empty-JSON half is defence in depth and a wire-shape
+ * normalizer: on the pinned Better Auth (better-call ≥ 1.3.7) a JSON parse
+ * error already answers 400 (`BAD_REQUEST`), not a 500 — but with better-call's
+ * own error code, not this API's. Answering `invalid_json` here keeps the auth
+ * surface's parse errors in the same envelope as every other route, and guards
+ * a future dependency change that reverts to a 500.
+ *
+ * A body under a JSON content-type must parse and carry no NUL anywhere;
+ * non-JSON content types pass untouched (the OAuth token endpoint is
+ * form-encoded), as do bodyless requests. The body is read from a clone — the
+ * mount consumes the original.
+ */
+export function authBodyGuard() {
+    return async (c, next) => {
+        const raw = c.req.raw;
+        if (!raw.body)
+            return next();
+        if (!JSON_CONTENT_TYPE.test(raw.headers.get('content-type') ?? ''))
+            return next();
+        let text;
+        try {
+            text = await raw.clone().text();
+        }
+        catch {
+            // Unreadable body — let the mount produce its own error.
+            return next();
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch {
+            return apiError(c, 400, 'invalid_json', 'Request body is not valid JSON');
+        }
+        if (hasNulDeep(parsed)) {
+            return apiError(c, 400, 'invalid_characters', 'Request contains characters that cannot be stored (e.g. a NUL byte)');
+        }
+        return next();
+    };
+}
+//# sourceMappingURL=auth-body.js.map

package/dist/middleware/auth-body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-body.js","sourceRoot":"","sources":["../../src/middleware/auth-body.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,oFAAoF;AACpF,MAAM,iBAAiB,GAAG,sCAAsC,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,IAAI;YAAE,OAAO,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAClF,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;YACzD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,gCAAgC,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,QAAQ,CACb,CAAC,EACD,GAAG,EACH,oBAAoB,EACpB,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/auth-context.d.ts

@@ -0,0 +1,170 @@
+import type { Context, MiddlewareHandler } from 'hono';
+import type { RateLimiterAbstract } from 'rate-limiter-flexible';
+import { type Principal } from '@antasphere/chassis-contract';
+import type { PlatformRegistry } from '../platform/registry.js';
+import { type ClientIpFn, type RequestQuotaService } from './rate-limit.js';
+declare module 'hono' {
+    interface ContextVariableMap {
+        principal: Principal | null;
+        /** The tool's `guest_forbidden` sentence, set by `authContext` for `requireNonGuest()` to answer with. */
+        guestForbiddenMessage: string;
+        /** Demo sign-in: the pass that opened this request's session, when one did (the audit mark). */
+        demoPassId?: string;
+    }
+}
+export declare function isPublicApiPath(path: string): boolean;
+/**
+ * An edition's post-resolution verdict on an otherwise-valid principal.
+ * `ok` with a `role` means "the caller's authoritative role just changed —
+ * run THIS request under it"; `ok` with a `workspace` means "the person's
+ * DEFAULT workspace just moved (the pass this request ran read it off the
+ * hub) — run THIS request there", which the gate says only for a request
+ * that selected nothing (`request.selector` null) on a credential that pins
+ * nothing (PRDCT-2958, F2: the command that runs the pass used to land in
+ * the old default, the one after it in the new); a refusal carries the
+ * exact wire error. The seam exists for the cloud edition's hub gates (org
+ * suspension + hub membership re-assertion, internal/federation.md P4); oss
+ * never wires one. The gate also sees WHAT is being asked (`request`), so a
+ * policy can exempt specific surfaces (e.g. suspension keeping GET /me
+ * readable — the visible-but-blocked posture); implementations may ignore
+ * it.
+ */
+export type PrincipalGateResult = {
+    ok: true;
+    role?: Principal['role'];
+    workspace?: GateWorkspace;
+} | {
+    ok: false;
+    status: 401 | 403;
+    code: string;
+    message: string;
+};
+/** The membership a gate re-resolved for the request: the fields of the principal it replaces. */
+export interface GateWorkspace {
+    workspaceId: string;
+    role: Principal['role'];
+    origin: Principal['origin'];
+    accountRef: string | null;
+}
+export interface PrincipalGateRequest {
+    path: string;
+    method: string;
+    /** The request's own workspace selector (the X-Workspace-Id header), null when it named none. */
+    selector: string | null;
+}
+export type PrincipalGate = (principal: Principal, request: PrincipalGateRequest) => Promise<PrincipalGateResult>;
+/** The gate's verdict applied: the principal to run the request as, or the exact wire refusal. */
+export type AdmitResult = {
+    ok: true;
+    principal: Principal;
+} | {
+    ok: false;
+    status: 401 | 403;
+    code: string;
+    message: string;
+};
+/**
+ * The session half of the credential resolver: the identity provider's live
+ * resolve of the request's cookie (membership re-checked, the selection rule
+ * applied). One home for the call, shared by `authContext` and the
+ * zero-state re-admission of `GET /me`.
+ */
+export declare function resolveSessionPrincipal(c: Context, registry: PlatformRegistry): Promise<Principal | null>;
+/**
+ * The edition gate on a resolved principal, with a freshly synced hub role
+ * applied to THIS request (D11): a demoted admin loses admin surfaces now, a
+ * promoted member gains them now. No gate (oss) admits the principal as it
+ * is. One home for the step, shared by `authContext` and the zero-state
+ * re-admission of `GET /me`.
+ */
+export declare function admitPrincipal(c: Context, principal: Principal, principalGate: PrincipalGate | undefined): Promise<AdmitResult>;
+export interface AuthContextDeps {
+    registry: PlatformRegistry;
+    /**
+     * Resolves `Bearer <prefix>_...` API keys under the user-scoped selection
+     * rule — `requested` is the request's X-Workspace-Id (or null). May throw
+     * WorkspaceMismatchError for a valid PINNED key whose pin differs from the
+     * header. Absent = keys rejected.
+     */
+    resolveApiKey?: (token: string, requested: string | null) => Promise<Principal | null>;
+    /** Resolves OAuth Bearer JWTs (local JWKS verify + live membership selection). */
+    resolveOauthJwt?: (token: string, requested: string | null) => Promise<Principal | null>;
+    /** Distinguishes an API-key credential from other bearers. */
+    isApiKeyToken: (token: string) => boolean;
+    /** Failed key verifications consume from this bucket (per IP) — brute-force wall. */
+    keyFailureLimiter?: RateLimiterAbstract;
+    /** Client identity (socket address unless TRUST_PROXY opts into XFF). */
+    clientIp: ClientIpFn;
+    /** General per-principal request quota (I3). Absent = no general limit. */
+    requestQuota?: RequestQuotaService;
+    /**
+     * Post-resolution principal veto (cloud edition only). Runs here — in the
+     * single credential resolver — rather than inside any one identity path,
+     * so sessions, API keys, AND OAuth bearers all pass the same gate
+     * (internal/decisions/016). Absent (oss) = zero overhead, zero hub surface.
+     */
+    principalGate?: PrincipalGate | undefined;
+    /**
+     * Demo sign-in (present only while DEMO_SIGN_IN is on, self-hosted): judges
+     * a resolved SESSION against the demo pass that opened it, if one did.
+     * `ended` = the pass has expired or was revoked and the session is gone:
+     * the request goes on signed out. Here, in the single credential resolver,
+     * so no route can be reached with a session its pass no longer backs.
+     */
+    demoSession?: ((headers: Headers) => Promise<{
+        passId: string;
+        sessionId: string;
+    } | 'ended' | null>) | undefined;
+    /**
+     * The composed fail-closed scope allowlist (`createScopeAllowlist` in
+     * scopes.ts: the chassis rules, then the tool's). `null` = the endpoint is
+     * not open to machine principals. Required: a tool must state its list.
+     */
+    requiredScopeFor: (path: string, method: string) => string | null;
+    /**
+     * The tool's `guest_forbidden` sentence (`copy.guestForbidden`). Carried on
+     * the request so `requireNonGuest()` keeps its argument-less call sites, in
+     * the chassis and in the tool alike. Required: the chassis has no wording.
+     */
+    guestForbiddenMessage: string;
+}
+/**
+ * The single credential resolver: every /api/v1 request passes through here
+ * and comes out with c.get('principal') set (or a 401/403 for bad machine
+ * credentials). Three paths, one output shape:
+ *
+ *  - session cookie → IdentityProvider.resolve (live membership re-check)
+ *  - Bearer API key → O(1) key lookup (M2)
+ *  - Bearer JWT → OAuth access token this instance minted: local JWKS
+ *    verification + live membership re-check (M6)
+ *
+ * Machine principals additionally pass the fail-closed scope allowlist:
+ * endpoints not consciously listed in scopes.ts are unreachable with a key
+ * or token, whatever the underlying user's role is.
+ */
+export declare function authContext({ registry, resolveApiKey, resolveOauthJwt, isApiKeyToken, keyFailureLimiter, clientIp, requestQuota, principalGate, demoSession, requiredScopeFor, guestForbiddenMessage }: AuthContextDeps): MiddlewareHandler;
+/** Route guard: 401 when unauthenticated. */
+export declare function requireAuth(): MiddlewareHandler;
+/**
+ * Route guard (D2, internal/federation.md P6): an `origin='guest'` membership
+ * belongs to an EXTERNAL per-resource collaborator — it exists so the platform
+ * can resolve them to a principal at all, not to make them a workspace
+ * actor. Guests keep every ADR 013 per-resource surface their grant opens
+ * (read, version push, share tokens, annotations on THAT resource) but are
+ * refused resource creation and workspace-level surfaces on BOTH editions.
+ * Judges the resolved principal, so sessions, API keys, and OAuth bearers
+ * all pass the same gate. 403 — the surfaces this guards are flat,
+ * documented workspace surfaces, not probeable per-grant resources, so the
+ * ADR 013 hide-existence 404 posture does not apply here (same stance as
+ * requireRole).
+ */
+export declare function requireNonGuest(): MiddlewareHandler;
+declare const ROLE_RANK: {
+    readonly member: 0;
+    readonly admin: 1;
+    readonly owner: 2;
+};
+/** Route guard: 403 below the required role. */
+export declare function requireRole(min: keyof typeof ROLE_RANK): MiddlewareHandler;
+export {};
+//# sourceMappingURL=auth-context.d.ts.map

package/dist/middleware/auth-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-context.d.ts","sourceRoot":"","sources":["../../src/middleware/auth-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAA2B,KAAK,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,OAAO,EAEL,KAAK,UAAU,EAEf,KAAK,mBAAmB,EACzB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,QAAQ,MAAM,CAAC;IACpB,UAAU,kBAAkB;QAC1B,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;QAC5B,0GAA0G;QAC1G,qBAAqB,EAAE,MAAM,CAAC;QAC9B,gGAAgG;QAChG,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB;CACF;AAmBD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,aAAa,CAAA;CAAE,GACjE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpE,kGAAkG;AAClG,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,MAAM,aAAa,GAAG,CAC1B,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,oBAAoB,KAC1B,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAElC,kGAAkG;AAClG,MAAM,MAAM,WAAW,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvG;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAOzG;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,CAAC,EAAE,OAAO,EACV,SAAS,EAAE,SAAS,EACpB,aAAa,EAAE,aAAa,GAAG,SAAS,GACvC,OAAO,CAAC,WAAW,CAAC,CAkBtB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACvF,kFAAkF;IAClF,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzF,8DAA8D;IAC9D,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IAC1C,qFAAqF;IACrF,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;IACxC,yEAAyE;IACzE,QAAQ,EAAE,UAAU,CAAC;IACrB,2EAA2E;IAC3E,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAC1C;;;;;;OAMG;IACH,WAAW,CAAC,EACV,CAAC,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;IACtG;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAClE;;;;OAIG;IACH,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,EAC1B,QAAQ,EACR,aAAa,EACb,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACtB,EAAE,eAAe,GAAG,iBAAiB,CAwHrC;AAED,6CAA6C;AAC7C,wBAAgB,WAAW,IAAI,iBAAiB,CAO/C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,IAAI,iBAAiB,CAYnD;AAED,QAAA,MAAM,SAAS;;;;CAA6C,CAAC;AAE7D,gDAAgD;AAChD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,OAAO,SAAS,GAAG,iBAAiB,CAW1E"}

package/dist/middleware/auth-context.js

@@ -0,0 +1,251 @@
+import { ACTIVE_WORKSPACE_HEADER } from '@antasphere/chassis-contract';
+import { WorkspaceMismatchError } from '../apikeys/service.js';
+import { apiError } from '../api/errors.js';
+import { quotaHeaderEntries } from './rate-limit.js';
+import { looksLikeJwt } from './scopes.js';
+/** Paths under /api/v1 that are reachable without any credential. */
+const PUBLIC_API_PATHS = new Set([
+    '/api/v1/instance',
+    '/api/v1/setup',
+    '/api/v1/openapi.json',
+    // CLI email-OTP sign-in (api/cli-auth.ts): pre-auth by definition — the
+    // flow exists to OBTAIN a credential. Both are rate-limited in api/index.ts.
+    '/api/v1/cli/auth/request',
+    '/api/v1/cli/auth/complete',
+    // CLI cross-tool connect (api/sso-connect.ts, cloud edition): pre-auth by
+    // the same definition — the hub-minted exchange JWT in the body IS the
+    // credential, verified hard by the handler. Rate-limited in api/index.ts.
+    // The entry is inert on oss: the route is never registered there, so the
+    // path falls through to the JSON 404 terminator for every caller.
+    '/api/v1/sso/cli-connect'
+]);
+export function isPublicApiPath(path) {
+    return PUBLIC_API_PATHS.has(path) || path.startsWith('/api/v1/auth/');
+}
+/**
+ * The session half of the credential resolver: the identity provider's live
+ * resolve of the request's cookie (membership re-checked, the selection rule
+ * applied). One home for the call, shared by `authContext` and the
+ * zero-state re-admission of `GET /me`.
+ */
+export function resolveSessionPrincipal(c, registry) {
+    return registry.identity.resolve({
+        headers: c.req.raw.headers,
+        path: c.req.path,
+        method: c.req.method,
+        requestId: c.get('requestId')
+    });
+}
+/**
+ * The edition gate on a resolved principal, with a freshly synced hub role
+ * applied to THIS request (D11): a demoted admin loses admin surfaces now, a
+ * promoted member gains them now. No gate (oss) admits the principal as it
+ * is. One home for the step, shared by `authContext` and the zero-state
+ * re-admission of `GET /me`.
+ */
+export async function admitPrincipal(c, principal, principalGate) {
+    if (!principalGate)
+        return { ok: true, principal };
+    const verdict = await principalGate(principal, {
+        path: c.req.path,
+        method: c.req.method,
+        selector: c.req.header(ACTIVE_WORKSPACE_HEADER)?.trim() || null
+    });
+    if (!verdict.ok)
+        return verdict;
+    let admitted = principal;
+    if (verdict.workspace && verdict.workspace.workspaceId !== principal.workspaceId) {
+        const { accountRef, ...rest } = verdict.workspace;
+        const { accountRef: _previous, ...withoutRef } = admitted;
+        admitted = { ...withoutRef, ...rest, ...(accountRef ? { accountRef } : {}) };
+    }
+    if (verdict.role !== undefined && verdict.role !== admitted.role) {
+        admitted = { ...admitted, role: verdict.role };
+    }
+    return { ok: true, principal: admitted };
+}
+/**
+ * The single credential resolver: every /api/v1 request passes through here
+ * and comes out with c.get('principal') set (or a 401/403 for bad machine
+ * credentials). Three paths, one output shape:
+ *
+ *  - session cookie → IdentityProvider.resolve (live membership re-check)
+ *  - Bearer API key → O(1) key lookup (M2)
+ *  - Bearer JWT → OAuth access token this instance minted: local JWKS
+ *    verification + live membership re-check (M6)
+ *
+ * Machine principals additionally pass the fail-closed scope allowlist:
+ * endpoints not consciously listed in scopes.ts are unreachable with a key
+ * or token, whatever the underlying user's role is.
+ */
+export function authContext({ registry, resolveApiKey, resolveOauthJwt, isApiKeyToken, keyFailureLimiter, clientIp, requestQuota, principalGate, demoSession, requiredScopeFor, guestForbiddenMessage }) {
+    return async (c, next) => {
+        c.set('principal', null);
+        c.set('guestForbiddenMessage', guestForbiddenMessage);
+        if (isPublicApiPath(c.req.path)) {
+            return next();
+        }
+        const authHeader = c.req.header('authorization')?.trim() ?? '';
+        const bearer = /^Bearer\s+(.+)$/i.exec(authHeader)?.[1]?.trim() ?? null;
+        // The universal per-request workspace selector (user-scoped credential
+        // model): EVERY credential kind resolves it through the shared
+        // resolveMembership rule — sessions inside the identity provider,
+        // machine credentials via the threaded `requested` below. A PINNED API
+        // key is the one exception: it always resolves its pin, and a header
+        // naming a different workspace is rejected loudly (403 below) instead of
+        // being silently served the pinned one.
+        const requested = c.req.header(ACTIVE_WORKSPACE_HEADER)?.trim() || null;
+        let principal = null;
+        if (bearer && looksLikeJwt(bearer)) {
+            if (!resolveOauthJwt) {
+                return apiError(c, 401, 'oauth_not_enabled', 'OAuth bearer tokens are not enabled on this instance');
+            }
+            principal = await resolveOauthJwt(bearer, requested);
+            if (!principal) {
+                return apiError(c, 401, 'invalid_token', 'OAuth bearer token is invalid, expired, or revoked');
+            }
+        }
+        else if (bearer && isApiKeyToken(bearer)) {
+            if (!resolveApiKey) {
+                return apiError(c, 401, 'invalid_api_key', 'API key not recognized');
+            }
+            const ip = clientIp(c);
+            if (keyFailureLimiter) {
+                const bucket = await keyFailureLimiter.get(ip).catch(() => null);
+                if (bucket && bucket.remainingPoints <= 0 && bucket.msBeforeNext > 0) {
+                    return apiError(c, 429, 'rate_limited', 'Too many failed API key attempts');
+                }
+            }
+            try {
+                principal = await resolveApiKey(bearer, requested);
+            }
+            catch (cause) {
+                // A VALID pinned key + a mismatching selector: a client bug or a
+                // confused-deputy attempt — loud 403, and no failure-limiter charge
+                // (the credential itself verified fine).
+                if (cause instanceof WorkspaceMismatchError) {
+                    return apiError(c, 403, 'workspace_mismatch', 'This credential is pinned to a different workspace');
+                }
+                throw cause;
+            }
+            if (!principal) {
+                if (keyFailureLimiter)
+                    await keyFailureLimiter.consume(ip).catch(() => { });
+                return apiError(c, 401, 'invalid_api_key', 'API key not recognized');
+            }
+        }
+        else if (bearer) {
+            return apiError(c, 401, 'unsupported_credential', 'Unrecognized bearer credential format');
+        }
+        else {
+            principal = await resolveSessionPrincipal(c, registry);
+            // Fail-closed: a judge that throws refuses the session for this
+            // request rather than letting a dead pass's session through.
+            if (principal && demoSession) {
+                const verdict = await demoSession(c.req.raw.headers);
+                if (verdict === 'ended')
+                    principal = null;
+                else if (verdict)
+                    c.set('demoPassId', verdict.passId);
+            }
+        }
+        // General per-principal request quota (I3), consumed BEFORE the scope
+        // gate so even fail-closed 403 hammering is bounded — once a credential
+        // resolves, the quota is the outermost cost control. The bucket key is
+        // derived from the principal (see principalBucketKey), never a header.
+        // Sessions are included: the default quota is far above any dashboard's
+        // request rate, and a hijacked/scripted session is the same cost vector.
+        let quota = null;
+        if (principal && requestQuota) {
+            quota = await requestQuota.consume(principal);
+            if (quota && !quota.ok) {
+                for (const [name, value] of quotaHeaderEntries(quota))
+                    c.header(name, value);
+                c.header('Retry-After', String(quota.retryAfterSeconds ?? Math.max(1, quota.resetSeconds)));
+                return apiError(c, 429, 'rate_limited', 'API request quota exceeded, slow down');
+            }
+        }
+        // Edition principal gate (cloud: hub org-status + membership
+        // re-assertion, internal/federation.md P4). AFTER the quota — hammering a
+        // suspended org stays rate-bounded — and BEFORE the scope gate, so a
+        // definitive hub refusal wins over any per-endpoint outcome. Cache-first
+        // inside; the hub is never a hard round-trip in the hot path.
+        if (principal && principalGate) {
+            const admitted = await admitPrincipal(c, principal, principalGate);
+            if (!admitted.ok) {
+                return apiError(c, admitted.status, admitted.code, admitted.message);
+            }
+            principal = admitted.principal;
+        }
+        // Fail-closed scope gate for machine principals only.
+        if (principal?.scopes) {
+            const needed = requiredScopeFor(c.req.path, c.req.method);
+            if (!needed) {
+                return apiError(c, 403, 'endpoint_not_allowed', 'This endpoint is not available to this credential');
+            }
+            if (!principal.scopes.has(needed)) {
+                return apiError(c, 403, 'insufficient_scope', `This credential was not granted "${needed}"`);
+            }
+        }
+        c.set('principal', principal);
+        if (!quota)
+            return next();
+        // Success path: stamp the quota headers on whatever response the route
+        // produced (set on c.res so streamed/raw Response bodies get them too),
+        // letting well-behaved agents self-throttle before hitting 429s.
+        await next();
+        for (const [name, value] of quotaHeaderEntries(quota))
+            c.res.headers.set(name, value);
+        return;
+    };
+}
+/** Route guard: 401 when unauthenticated. */
+export function requireAuth() {
+    return async (c, next) => {
+        if (!c.get('principal')) {
+            return apiError(c, 401, 'unauthenticated', 'Authentication required');
+        }
+        return next();
+    };
+}
+/**
+ * Route guard (D2, internal/federation.md P6): an `origin='guest'` membership
+ * belongs to an EXTERNAL per-resource collaborator — it exists so the platform
+ * can resolve them to a principal at all, not to make them a workspace
+ * actor. Guests keep every ADR 013 per-resource surface their grant opens
+ * (read, version push, share tokens, annotations on THAT resource) but are
+ * refused resource creation and workspace-level surfaces on BOTH editions.
+ * Judges the resolved principal, so sessions, API keys, and OAuth bearers
+ * all pass the same gate. 403 — the surfaces this guards are flat,
+ * documented workspace surfaces, not probeable per-grant resources, so the
+ * ADR 013 hide-existence 404 posture does not apply here (same stance as
+ * requireRole).
+ */
+export function requireNonGuest() {
+    return async (c, next) => {
+        const principal = c.get('principal');
+        if (!principal) {
+            return apiError(c, 401, 'unauthenticated', 'Authentication required');
+        }
+        if (principal.origin === 'guest') {
+            // A principal only ever comes out of `authContext`, which set the sentence first.
+            return apiError(c, 403, 'guest_forbidden', c.get('guestForbiddenMessage'));
+        }
+        return next();
+    };
+}
+const ROLE_RANK = { member: 0, admin: 1, owner: 2 };
+/** Route guard: 403 below the required role. */
+export function requireRole(min) {
+    return async (c, next) => {
+        const principal = c.get('principal');
+        if (!principal) {
+            return apiError(c, 401, 'unauthenticated', 'Authentication required');
+        }
+        if (ROLE_RANK[principal.role] < ROLE_RANK[min]) {
+            return apiError(c, 403, 'forbidden', `Requires ${min} role`);
+        }
+        return next();
+    };
+}
+//# sourceMappingURL=auth-context.js.map

package/dist/middleware/auth-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-context.js","sourceRoot":"","sources":["../../src/middleware/auth-context.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uBAAuB,EAAkB,MAAM,8BAA8B,CAAC;AAEvF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EACL,kBAAkB,EAInB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAY3C,qEAAqE;AACrE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,kBAAkB;IAClB,eAAe;IACf,sBAAsB;IACtB,wEAAwE;IACxE,6EAA6E;IAC7E,0BAA0B;IAC1B,2BAA2B;IAC3B,0EAA0E;IAC1E,uEAAuE;IACvE,0EAA0E;IAC1E,yEAAyE;IACzE,kEAAkE;IAClE,yBAAyB;CAC1B,CAAC,CAAC;AAEH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;AACxE,CAAC;AA8CD;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,CAAU,EAAE,QAA0B;IAC5E,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC/B,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO;QAC1B,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;QAChB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;QACpB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;KAC9B,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,CAAU,EACV,SAAoB,EACpB,aAAwC;IAExC,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE;QAC7C,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI;QAChB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;QACpB,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI;KAChE,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAChC,IAAI,QAAQ,GAAG,SAAS,CAAC;IACzB,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,EAAE,CAAC;QACjF,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;QAClD,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,UAAU,EAAE,GAAG,QAAQ,CAAC;QAC1D,QAAQ,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;QACjE,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AAC3C,CAAC;AAmDD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CAAC,EAC1B,QAAQ,EACR,aAAa,EACb,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACL;IAChB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACzB,CAAC,CAAC,GAAG,CAAC,uBAAuB,EAAE,qBAAqB,CAAC,CAAC;QAEtD,IAAI,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;QAExE,uEAAuE;QACvE,+DAA+D;QAC/D,kEAAkE;QAClE,uEAAuE;QACvE,qEAAqE;QACrE,yEAAyE;QACzE,wCAAwC;QACxC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;QAExE,IAAI,SAAS,GAAqB,IAAI,CAAC;QAEvC,IAAI,MAAM,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,OAAO,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,sDAAsD,CAAC,CAAC;YACvG,CAAC;YACD,SAAS,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACrD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,oDAAoD,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,OAAO,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBACjE,IAAI,MAAM,IAAI,MAAM,CAAC,eAAe,IAAI,CAAC,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;oBACrE,OAAO,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,kCAAkC,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC;YACD,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,iEAAiE;gBACjE,oEAAoE;gBACpE,yCAAyC;gBACzC,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;oBAC5C,OAAO,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,oBAAoB,EAAE,oDAAoD,CAAC,CAAC;gBACtG,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,IAAI,iBAAiB;oBAAE,MAAM,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAC3E,OAAO,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,wBAAwB,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;aAAM,IAAI,MAAM,EAAE,CAAC;YAClB,OAAO,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,wBAAwB,EAAE,uCAAuC,CAAC,CAAC;QAC7F,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,MAAM,uBAAuB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YACvD,gEAAgE;YAChE,6DAA6D;YAC7D,IAAI,SAAS,IAAI,WAAW,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACrD,IAAI,OAAO,KAAK,OAAO;oBAAE,SAAS,GAAG,IAAI,CAAC;qBACrC,IAAI,OAAO;oBAAE,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,wEAAwE;QACxE,uEAAuE;QACvE,uEAAuE;QACvE,wEAAwE;QACxE,yEAAyE;QACzE,IAAI,KAAK,GAAyB,IAAI,CAAC;QACvC,IAAI,SAAS,IAAI,YAAY,EAAE,CAAC;YAC9B,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC9C,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACvB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC;oBAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC7E,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;gBAC5F,OAAO,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,uCAAuC,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QAED,6DAA6D;QAC7D,0EAA0E;QAC1E,qEAAqE;QACrE,yEAAyE;QACzE,8DAA8D;QAC9D,IAAI,SAAS,IAAI,aAAa,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;YACnE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YACvE,CAAC;YACD,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QACjC,CAAC;QAED,sDAAsD;QACtD,IAAI,SAAS,EAAE,MAAM,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,sBAAsB,EAAE,mDAAmD,CAAC,CAAC;YACvG,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClC,OAAO,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,oBAAoB,EAAE,oCAAoC,MAAM,GAAG,CAAC,CAAC;YAC/F,CAAC;QACH,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,EAAE,CAAC;QAE1B,uEAAuE;QACvE,wEAAwE;QACxE,iEAAiE;QACjE,MAAM,IAAI,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC;YAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACtF,OAAO;IACT,CAAC,CAAC;AACJ,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,WAAW;IACzB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACxB,OAAO,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACjC,kFAAkF;YAClF,OAAO,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,SAAS,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAW,CAAC;AAE7D,gDAAgD;AAChD,MAAM,UAAU,WAAW,CAAC,GAA2B;IACrD,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,OAAO,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,GAAG,OAAO,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/body-cap.d.ts

@@ -0,0 +1,17 @@
+import type { Context, MiddlewareHandler } from 'hono';
+import type { BodyCap } from '../tool-definition.js';
+/**
+ * A body-size cap that DEFERS its declared-size refusal to the entitlement
+ * gate (PRDCT-2632). Built once per `BodyCap` from hono's `bodyLimit` (a
+ * declared Content-Length over the cap is refused before a byte is read; an
+ * undeclared body is counted and cut at the cap), with one difference: when
+ * the request's matched route carries a gate that judges a plan limit
+ * (`isDeferring`), a declared oversize body is not refused HERE — the
+ * refusal is parked on the context (`bodyRefusal`) for the gate to fire
+ * after the plan check, and the request is rebuilt WITHOUT a body, so
+ * nothing downstream can read a byte of it whatever the middleware order.
+ * A metered account thus meets 403 `plan_required` with its upgrade link at
+ * any size, and the cap's 413 only when the plan allows the size.
+ */
+export declare function deferrableBodyCap(cap: BodyCap, isDeferring: (c: Context) => boolean): MiddlewareHandler;
+//# sourceMappingURL=body-cap.d.ts.map

package/dist/middleware/body-cap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-cap.d.ts","sourceRoot":"","sources":["../../src/middleware/body-cap.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAEvD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAErD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,GAAG,iBAAiB,CAevG"}

package/dist/middleware/body-cap.js

@@ -0,0 +1,31 @@
+import { bodyLimit } from 'hono/body-limit';
+/**
+ * A body-size cap that DEFERS its declared-size refusal to the entitlement
+ * gate (PRDCT-2632). Built once per `BodyCap` from hono's `bodyLimit` (a
+ * declared Content-Length over the cap is refused before a byte is read; an
+ * undeclared body is counted and cut at the cap), with one difference: when
+ * the request's matched route carries a gate that judges a plan limit
+ * (`isDeferring`), a declared oversize body is not refused HERE — the
+ * refusal is parked on the context (`bodyRefusal`) for the gate to fire
+ * after the plan check, and the request is rebuilt WITHOUT a body, so
+ * nothing downstream can read a byte of it whatever the middleware order.
+ * A metered account thus meets 403 `plan_required` with its upgrade link at
+ * any size, and the cap's 413 only when the plan allows the size.
+ */
+export function deferrableBodyCap(cap, isDeferring) {
+    const streamCap = bodyLimit({ maxSize: cap.maxBytes, onError: cap.onError });
+    return (c, next) => {
+        const declared = Number(c.req.header('content-length') ?? '');
+        if (Number.isFinite(declared) && declared > cap.maxBytes && isDeferring(c)) {
+            c.set('bodyRefusal', () => cap.onError(c));
+            // Rebuilt from the URL, the method and the headers: a `body: null`
+            // in a Request init keeps the input's body (the Fetch spec), so the
+            // drop must be a request that never had one.
+            const raw = c.req.raw;
+            c.req.raw = new Request(raw.url, { method: raw.method, headers: raw.headers, signal: raw.signal });
+            return next();
+        }
+        return streamCap(c, next);
+    };
+}
+//# sourceMappingURL=body-cap.js.map

package/dist/middleware/body-cap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-cap.js","sourceRoot":"","sources":["../../src/middleware/body-cap.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAG5C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAY,EAAE,WAAoC;IAClF,MAAM,SAAS,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;QACjB,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,mEAAmE;YACnE,oEAAoE;YACpE,6CAA6C;YAC7C,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;YACtB,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACnG,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,OAAO,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/body-refusal.d.ts

@@ -0,0 +1,20 @@
+import type { Context } from 'hono';
+declare module 'hono' {
+    interface ContextVariableMap {
+        /**
+         * A body-size refusal the size cap DEFERRED (PRDCT-2632): the request
+         * declared a Content-Length over the tool's cap on a route whose gate
+         * judges a plan limit, so the gate must see the declared size first (a
+         * metered account meets 403 `plan_required` with the upgrade link at any
+         * size, never the instance-cap 413 in its place). The cap DROPS the
+         * request's body when it defers (`c.req.raw` is rebuilt without one), so
+         * nothing downstream can read a byte of it by construction; the gate
+         * fires the refusal right after the plan check, or before anything else
+         * when no plan applies. Undefined otherwise.
+         */
+        bodyRefusal: (() => Response) | undefined;
+    }
+}
+/** The pending deferred refusal of this request, if any. */
+export declare function pendingBodyRefusal(c: Context): (() => Response) | undefined;
+//# sourceMappingURL=body-refusal.d.ts.map

package/dist/middleware/body-refusal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-refusal.d.ts","sourceRoot":"","sources":["../../src/middleware/body-refusal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,QAAQ,MAAM,CAAC;IACpB,UAAU,kBAAkB;QAC1B;;;;;;;;;;WAUG;QACH,WAAW,EAAE,CAAC,MAAM,QAAQ,CAAC,GAAG,SAAS,CAAC;KAC3C;CACF;AAED,4DAA4D;AAC5D,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,SAAS,CAE3E"}

package/dist/middleware/body-refusal.js

@@ -0,0 +1,5 @@
+/** The pending deferred refusal of this request, if any. */
+export function pendingBodyRefusal(c) {
+    return c.get('bodyRefusal');
+}
+//# sourceMappingURL=body-refusal.js.map

package/dist/middleware/body-refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-refusal.js","sourceRoot":"","sources":["../../src/middleware/body-refusal.ts"],"names":[],"mappings":"AAmBA,4DAA4D;AAC5D,MAAM,UAAU,kBAAkB,CAAC,CAAU;IAC3C,OAAO,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;AAC9B,CAAC"}