@antasphere/chassis-server 1.0.0

package/dist/middleware/rate-limit.js

@@ -0,0 +1,277 @@
+import { RateLimiterMemory, RateLimiterRedis, RateLimiterRes } from 'rate-limiter-flexible';
+import { getConnInfo } from '@hono/node-server/conninfo';
+/**
+ * Auth-surface rate limits (ours, not Better Auth's built-in): login, OTP
+ * sends, invitation acceptance, setup attempts, API-key verification
+ * failures. Memory backend per replica by default; Redis when REDIS_URL is
+ * set so limits hold across replicas (Profile B).
+ */
+/** Workspace-creation attempts one person gets per hour; an address gets ten times that. */
+export const WORKSPACE_CREATE_PER_PERSON = 60;
+/**
+ * The chassis buckets plus the TOOL's own (`toolBuckets`, name → declaration),
+ * all built by the same `make`: one store (Redis when REDIS_URL is set, memory
+ * otherwise), one key-prefix scheme. A tool bucket can never take a chassis
+ * bucket's name — the type refuses it.
+ */
+export async function createRateLimiters(env, logger, toolBuckets) {
+    let make;
+    if (env.REDIS_URL) {
+        const { Redis } = await import('ioredis');
+        const client = new Redis(env.REDIS_URL, { enableOfflineQueue: false });
+        client.on('error', (err) => logger.error({ err }, 'redis rate-limit store error'));
+        make = (prefix, points, duration) => new RateLimiterRedis({
+            storeClient: client,
+            keyPrefix: `rl:${prefix}`,
+            points,
+            duration,
+            // If Redis blips, fail open to memory rather than dropping requests.
+            insuranceLimiter: new RateLimiterMemory({ points, duration })
+        });
+        logger.info('rate limiting backed by redis');
+    }
+    else {
+        make = (prefix, points, duration) => new RateLimiterMemory({ keyPrefix: `rl:${prefix}`, points, duration });
+    }
+    const chassis = {
+        login: make('login', 10, 15 * 60),
+        otp: make('otp', 5, 10 * 60),
+        invitationAccept: make('inv-accept', 10, 60 * 60),
+        setup: make('setup', 5, 60 * 60),
+        apiKeyFailures: make('key-fail', 20, 15 * 60),
+        cliConnect: make('cli-connect', Math.max(1, env.CLI_CONNECT_IP_LIMIT_PER_15_MIN ?? 300), 15 * 60),
+        oauthRegister: make('oauth-dcr', 10, 60 * 60),
+        oauthToken: make('oauth-token', 60, 60),
+        // Per ADDRESS: an event's teams' agents share one venue address (2026-10-01: ten times 120).
+        mcp: make('mcp', 1200, 60),
+        passwordReset: make('pw-reset', 5, 10 * 60),
+        workspaceExport: make('ws-export', 5, 600),
+        breakGlass: make('break-glass', 10, 60 * 60),
+        workspaceCreate: make('ws-create', WORKSPACE_CREATE_PER_PERSON, 60 * 60),
+        workspaceCreateAddress: make('ws-create-ip', WORKSPACE_CREATE_PER_PERSON * 10, 60 * 60),
+        openapiDoc: make('openapi', 60, 60),
+        demoRedeem: make('demo-redeem', 20, 15 * 60)
+    };
+    // The tool's buckets are built after the chassis ones, in declaration order.
+    const tool = {};
+    for (const [name, d] of Object.entries(toolBuckets ?? {})) {
+        tool[name] = make(d.prefix, d.points, d.durationSec);
+    }
+    return { ...chassis, ...tool, make };
+}
+/**
+ * Client identity for buckets and audit. x-forwarded-for is only believed
+ * when TRUST_PROXY says a proxy we control sets it; otherwise the socket
+ * address wins and spoofed headers are ignored. We read the RIGHTMOST hop —
+ * the one appended (or set) by the trusted proxy itself; the leftmost is
+ * client-claimed and spoofable whenever the proxy appends rather than
+ * overwrites. Note the compose caveat: without a proxy, Docker NAT can
+ * collapse external clients onto one address — per-IP limits are only as
+ * granular as what the socket sees.
+ */
+export function makeClientIp(trustProxy) {
+    return (c) => {
+        if (trustProxy) {
+            const hops = c.req.header('x-forwarded-for')?.split(',');
+            const xff = hops?.[hops.length - 1]?.trim();
+            if (xff)
+                return xff;
+        }
+        try {
+            return getConnInfo(c).remote.address ?? 'unknown';
+        }
+        catch {
+            // No socket (tests via app.request()) — one shared bucket.
+            return 'unknown';
+        }
+    };
+}
+const RATE_LIMITED_BODY = {
+    error: { code: 'rate_limited', message: 'Too many requests, slow down' }
+};
+export function rateLimit(limiter, clientIp, extraKeys, options = {}) {
+    const consumeOn = options.consumeOn ?? 'arrival';
+    return async (c, next) => {
+        const keys = [clientIp(c), ...(extraKeys ? await extraKeys(c) : [])];
+        if (consumeOn === 'arrival') {
+            try {
+                for (const key of keys) {
+                    await limiter.consume(key);
+                }
+            }
+            catch {
+                return c.json(RATE_LIMITED_BODY, 429);
+            }
+            return next();
+        }
+        // Failure-only: read the buckets (no consume) and refuse an exhausted one
+        // BEFORE the handler, so a drained wall still costs an attacker nothing to
+        // hit and no credential check runs. Backend errors fail open, matching
+        // every other limiter here.
+        for (const key of keys) {
+            const state = await limiter.get(key).catch(() => null);
+            if (state && state.remainingPoints <= 0 && state.msBeforeNext > 0) {
+                return c.json(RATE_LIMITED_BODY, 429);
+            }
+        }
+        await next();
+        // 4xx/5xx = the credential was not accepted. Better Auth answers 401 for a
+        // bad password, 400 for a malformed attempt, 403 for a refused origin —
+        // all of them are attempts that must cost. A 429 is not: it is a wall
+        // behind this one (the library's own 3-per-10-seconds on `/sign-in*`)
+        // saying "slow down", no credential was judged. Counting it let a burst of
+        // ordinary sign-ins from one address (a room behind one public IP) spend
+        // this 15-minute wall in seconds (PRDCT-2830, PRDCT-2848).
+        if (c.res.status >= 400 && c.res.status !== 429) {
+            for (const key of keys) {
+                await limiter.consume(key).catch(() => { });
+            }
+        }
+    };
+}
+/**
+ * Per-email key for OTP sends and password login (per IP AND per email): the
+ * email key keeps per-account protection intact when NAT or a rotating
+ * attacker collapses/expands the IP dimension.
+ */
+export async function emailKeyOf(c) {
+    try {
+        const body = (await c.req.raw.clone().json());
+        if (body?.email && typeof body.email === 'string') {
+            return [`email:${body.email.toLowerCase().trim()}`];
+        }
+    }
+    catch {
+        // non-JSON body — the IP key alone applies
+    }
+    return [];
+}
+/** RateLimit draft headers + the X- legacy mirror; reset values are delta seconds. */
+export function quotaHeaderEntries(d) {
+    const remaining = String(Math.max(0, d.remaining));
+    const reset = String(Math.max(0, d.resetSeconds));
+    const limit = String(d.limit);
+    return [
+        ['RateLimit-Limit', limit],
+        ['RateLimit-Remaining', remaining],
+        ['RateLimit-Reset', reset],
+        ['X-RateLimit-Limit', limit],
+        ['X-RateLimit-Remaining', remaining],
+        ['X-RateLimit-Reset', reset]
+    ];
+}
+/**
+ * Bucket key for the general API quota, derived ONLY from the authenticated
+ * principal — never from a client-supplied header, so a caller can neither
+ * rotate its own bucket nor fill another principal's. Two API keys of the
+ * same user are separate buckets (a leaked key can be throttled/revoked
+ * without starving the owner's other integrations); the same user's session
+ * is a third.
+ */
+export function principalBucketKey(p) {
+    if (p.via === 'api_key')
+        return `key:${p.apiKeyId ?? p.userId}`;
+    if (p.via === 'oauth')
+        return `oauth:${p.userId}`;
+    return `session:${p.userId}`;
+}
+/**
+ * Per-principal request quota over the shared rate-limit backend. Two buckets
+ * per principal: a sustained per-minute window (the quota agents budget
+ * against — headers describe this one) and a 1-second spike cap that smooths
+ * thundering herds without burning sustained points on rejected spikes.
+ *
+ * Limits come from EntitlementService.getRequestQuota so a plan-aware edition
+ * varies them per principal; limiter instances are created lazily per
+ * distinct quota size (a product has a handful of plans, not thousands) and
+ * the size is part of the store prefix, so a plan change moves the principal
+ * to a fresh bucket instead of misreading the old counter.
+ *
+ * Failure posture matches the auth-surface limiters: Redis outages fall back
+ * to the per-replica insurance limiter inside `make`; any other backend or
+ * entitlement failure logs and FAILS OPEN (availability over throttling — the
+ * quota is a cost control, not an authz boundary; authz stays fail-closed).
+ */
+export function createRequestQuota({ entitlements, make, logger }) {
+    const sustained = new Map();
+    const burst = new Map();
+    const limiterFor = (cache, prefix, points, durationSec) => {
+        let limiter = cache.get(points);
+        if (!limiter) {
+            limiter = make(`${prefix}:${points}`, points, durationSec);
+            cache.set(points, limiter);
+        }
+        return limiter;
+    };
+    return {
+        async consume(principal) {
+            let perMinute;
+            let burstPerSecond;
+            try {
+                ({ perMinute, burstPerSecond } = await entitlements.getRequestQuota(principal));
+            }
+            catch (err) {
+                logger.error({ err }, 'request quota lookup failed — allowing request');
+                return null;
+            }
+            // Guard a product's custom (non-TS-checked) EntitlementService returning
+            // a non-numeric quota: a bare `undefined` would slip past `<= 0` and hand
+            // rate-limiter-flexible `points: undefined` (a surprise 4/min). Fail open.
+            if (!Number.isFinite(perMinute) || !Number.isFinite(burstPerSecond)) {
+                logger.error({ perMinute, burstPerSecond }, 'request quota returned a non-numeric value — allowing request');
+                return null;
+            }
+            if (perMinute <= 0)
+                return null; // 0 = unlimited, a conscious operator opt-out
+            const key = principalBucketKey(principal);
+            const sustainedLimiter = limiterFor(sustained, 'apiq', perMinute, 60);
+            // Spike cap first: a rejected burst must not burn sustained points —
+            // the 1 s bucket self-heals and the minute budget stays intact.
+            if (burstPerSecond > 0) {
+                try {
+                    await limiterFor(burst, 'apiq-burst', burstPerSecond, 1).consume(key);
+                }
+                catch (rejection) {
+                    if (!(rejection instanceof RateLimiterRes)) {
+                        logger.error({ err: rejection }, 'rate-limit backend failure — allowing request');
+                        return null;
+                    }
+                    // Report the sustained bucket's state (read-only) so headers stay
+                    // meaningful; the retry hint comes from the 1 s burst window.
+                    const state = await sustainedLimiter.get(key).catch(() => null);
+                    return {
+                        ok: false,
+                        limit: perMinute,
+                        remaining: state ? Math.max(0, state.remainingPoints) : perMinute,
+                        resetSeconds: Math.ceil((state?.msBeforeNext ?? 0) / 1000),
+                        retryAfterSeconds: Math.max(1, Math.ceil(rejection.msBeforeNext / 1000))
+                    };
+                }
+            }
+            try {
+                const res = await sustainedLimiter.consume(key);
+                return {
+                    ok: true,
+                    limit: perMinute,
+                    remaining: res.remainingPoints,
+                    resetSeconds: Math.ceil(res.msBeforeNext / 1000)
+                };
+            }
+            catch (rejection) {
+                if (!(rejection instanceof RateLimiterRes)) {
+                    logger.error({ err: rejection }, 'rate-limit backend failure — allowing request');
+                    return null;
+                }
+                const retry = Math.max(1, Math.ceil(rejection.msBeforeNext / 1000));
+                return {
+                    ok: false,
+                    limit: perMinute,
+                    remaining: 0,
+                    resetSeconds: retry,
+                    retryAfterSeconds: retry
+                };
+            }
+        }
+    };
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/middleware/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/middleware/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EAEf,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAKzD;;;;;GAKG;AACH,4FAA4F;AAC5F,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAyE9C;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAmF,EACnF,MAAc,EACd,WAA0F;IAE1F,IAAI,IAAkF,CAAC;IAEvF,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QAClB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAC,CAAC;QAC1F,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAClC,IAAI,gBAAgB,CAAC;YACnB,WAAW,EAAE,MAAM;YACnB,SAAS,EAAE,MAAM,MAAM,EAAE;YACzB,MAAM;YACN,QAAQ;YACR,qEAAqE;YACrE,gBAAgB,EAAE,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;SAC9D,CAAC,CAAC;QACL,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAClC,IAAI,iBAAiB,CAAC,EAAE,SAAS,EAAE,MAAM,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,OAAO,GAAG;QACd,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;QACjC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;QAC5B,gBAAgB,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;QACjD,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;QAChC,cAAc,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;QAC7C,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,+BAA+B,IAAI,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;QACjG,aAAa,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;QAC7C,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,CAAC;QACvC,6FAA6F;QAC7F,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QAC1B,aAAa,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;QAC3C,eAAe,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,GAAG,CAAC;QAC1C,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;QAC5C,eAAe,EAAE,IAAI,CAAC,WAAW,EAAE,2BAA2B,EAAE,EAAE,GAAG,EAAE,CAAC;QACxE,sBAAsB,EAAE,IAAI,CAAC,cAAc,EAAE,2BAA2B,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;QACvF,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC;QACnC,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;KACR,CAAC;IACvC,6EAA6E;IAC7E,MAAM,IAAI,GAAG,EAA0C,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAwC,EAAE,CAAC;QACjG,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC;AAKD;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,UAAmB;IAC9C,OAAO,CAAC,CAAC,EAAE,EAAE;QACX,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YACzD,MAAM,GAAG,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YAC5C,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;QACtB,CAAC;QACD,IAAI,CAAC;YACH,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;YAC3D,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAuBD,MAAM,iBAAiB,GAAG;IACxB,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,8BAA8B,EAAE;CAChE,CAAC;AAEX,MAAM,UAAU,SAAS,CACvB,OAA4B,EAC5B,QAAoB,EACpB,SAA6C,EAC7C,UAA4B,EAAE;IAE9B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,SAAS,CAAC;IACjD,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAErE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;YACxC,CAAC;YACD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,0EAA0E;QAC1E,2EAA2E;QAC3E,uEAAuE;QACvE,4BAA4B;QAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACvD,IAAI,KAAK,IAAI,KAAK,CAAC,eAAe,IAAI,CAAC,IAAI,KAAK,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;gBAClE,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;QACb,2EAA2E;QAC3E,wEAAwE;QACxE,sEAAsE;QACtE,sEAAsE;QACtE,2EAA2E;QAC3E,yEAAyE;QACzE,2DAA2D;QAC3D,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAChD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,CAAU;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAuB,CAAC;QACpE,IAAI,IAAI,EAAE,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAClD,OAAO,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAqBD,sFAAsF;AACtF,MAAM,UAAU,kBAAkB,CAAC,CAAgB;IACjD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO;QACL,CAAC,iBAAiB,EAAE,KAAK,CAAC;QAC1B,CAAC,qBAAqB,EAAE,SAAS,CAAC;QAClC,CAAC,iBAAiB,EAAE,KAAK,CAAC;QAC1B,CAAC,mBAAmB,EAAE,KAAK,CAAC;QAC5B,CAAC,uBAAuB,EAAE,SAAS,CAAC;QACpC,CAAC,mBAAmB,EAAE,KAAK,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAY;IAC7C,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IAChE,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;IAClD,OAAO,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC;AAC/B,CAAC;AASD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAoB;IACjF,MAAM,SAAS,GAAG,IAAI,GAAG,EAA+B,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA+B,CAAC;IACrD,MAAM,UAAU,GAAG,CACjB,KAAuC,EACvC,MAAc,EACd,MAAc,EACd,WAAmB,EACE,EAAE;QACvB,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,CAAC,GAAG,MAAM,IAAI,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;YAC3D,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,SAAS;YACrB,IAAI,SAAiB,CAAC;YACtB,IAAI,cAAsB,CAAC;YAC3B,IAAI,CAAC;gBACH,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,MAAM,YAAY,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;YAClF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,gDAAgD,CAAC,CAAC;gBACxE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,yEAAyE;YACzE,0EAA0E;YAC1E,2EAA2E;YAC3E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBACpE,MAAM,CAAC,KAAK,CACV,EAAE,SAAS,EAAE,cAAc,EAAE,EAC7B,+DAA+D,CAChE,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,SAAS,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC,CAAC,8CAA8C;YAE/E,MAAM,GAAG,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;YAC1C,MAAM,gBAAgB,GAAG,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YAEtE,qEAAqE;YACrE,gEAAgE;YAChE,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACxE,CAAC;gBAAC,OAAO,SAAS,EAAE,CAAC;oBACnB,IAAI,CAAC,CAAC,SAAS,YAAY,cAAc,CAAC,EAAE,CAAC;wBAC3C,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,+CAA+C,CAAC,CAAC;wBAClF,OAAO,IAAI,CAAC;oBACd,CAAC;oBACD,kEAAkE;oBAClE,8DAA8D;oBAC9D,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;oBAChE,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE,SAAS;wBAChB,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS;wBACjE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,YAAY,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;wBAC1D,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;qBACzE,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAChD,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,KAAK,EAAE,SAAS;oBAChB,SAAS,EAAE,GAAG,CAAC,eAAe;oBAC9B,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC;iBACjD,CAAC;YACJ,CAAC;YAAC,OAAO,SAAS,EAAE,CAAC;gBACnB,IAAI,CAAC,CAAC,SAAS,YAAY,cAAc,CAAC,EAAE,CAAC;oBAC3C,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,+CAA+C,CAAC,CAAC;oBAClF,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC;gBACpE,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,SAAS;oBAChB,SAAS,EAAE,CAAC;oBACZ,YAAY,EAAE,KAAK;oBACnB,iBAAiB,EAAE,KAAK;iBACzB,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/middleware/request-id.d.ts

@@ -0,0 +1,10 @@
+import type { MiddlewareHandler } from 'hono';
+import type { Logger } from '../logger.js';
+declare module 'hono' {
+    interface ContextVariableMap {
+        requestId: string;
+        logger: Logger;
+    }
+}
+export declare function requestId(base: Logger): MiddlewareHandler;
+//# sourceMappingURL=request-id.d.ts.map

package/dist/middleware/request-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-id.d.ts","sourceRoot":"","sources":["../../src/middleware/request-id.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,QAAQ,MAAM,CAAC;IACpB,UAAU,kBAAkB;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;KAChB;CACF;AAYD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CA+BzD"}

package/dist/middleware/request-id.js

@@ -0,0 +1,42 @@
+import { randomUUID } from 'node:crypto';
+import { routeLabel } from '../route-label.js';
+/**
+ * First middleware in the chain: binds a request id (propagated from
+ * x-request-id when a proxy already assigned one) and a child logger carrying
+ * it, and writes the completion log line with latency. Everything downstream
+ * (traces, audit entries) reuses this id, which is what makes one request
+ * followable across log, trace, and audit.
+ */
+/** Propagated ids must be sane: bounded length, log-safe charset. */
+const REQUEST_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
+export function requestId(base) {
+    return async (c, next) => {
+        const incoming = c.req.header('x-request-id');
+        const id = incoming && REQUEST_ID_RE.test(incoming) ? incoming : randomUUID();
+        const log = base.child({ requestId: id });
+        c.set('requestId', id);
+        c.set('logger', log);
+        c.header('x-request-id', id);
+        const start = performance.now();
+        try {
+            await next();
+        }
+        finally {
+            const latencyMs = Math.round((performance.now() - start) * 100) / 100;
+            log.info({
+                method: c.req.method,
+                // The MATCHED ROUTE PATTERN, never the raw URL path — see
+                // route-label.ts. On THIS repo that is not hypothetical: the public
+                // viewer is `/v/:secret`, so logging c.req.path wrote every live
+                // share-link capability into the log stream, where redaction (which
+                // keys off object properties) can do nothing about one opaque
+                // string. Read after next() so routing has resolved.
+                path: routeLabel(c),
+                status: c.error ? 500 : c.res.status,
+                latencyMs,
+                ...(c.error ? { failed: true } : {})
+            }, 'request');
+        }
+    };
+}
+//# sourceMappingURL=request-id.js.map

package/dist/middleware/request-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-id.js","sourceRoot":"","sources":["../../src/middleware/request-id.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAS/C;;;;;;GAMG;AACH,qEAAqE;AACrE,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAE9C,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC9C,MAAM,EAAE,GAAG,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;QAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACvB,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACrB,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;gBAAS,CAAC;YACT,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;YACtE,GAAG,CAAC,IAAI,CACN;gBACE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;gBACpB,0DAA0D;gBAC1D,oEAAoE;gBACpE,iEAAiE;gBACjE,oEAAoE;gBACpE,8DAA8D;gBAC9D,qDAAqD;gBACrD,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;gBACnB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM;gBACpC,SAAS;gBACT,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrC,EACD,SAAS,CACV,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/scopes.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Fail-closed endpoint allowlist for machine principals (API keys now, OAuth
+ * bearer tokens in M6). Ported from a predecessor template's oauth-scopes.ts.
+ *
+ * Machine principals are deliberately MORE restricted than the user they
+ * belong to: they can only reach endpoints listed here, each behind its
+ * scope. Anything not listed returns null and the gate 403s — new endpoints
+ * are unreachable to keys/tokens until someone consciously opens them.
+ * Session principals are role-gated instead and never pass through this.
+ *
+ * Pure logic (no I/O) so it stays unit-testable. The chassis owns the
+ * MECHANISM and the rules of its own endpoints; the scope NAMES and the rules
+ * of the tool's endpoints are the tool's (`createScopeAllowlist`).
+ */
+export declare function looksLikeJwt(token: string): boolean;
+/**
+ * One tool rule: the scope a machine principal needs for this request, or
+ * null when the rule does not speak about it (the next rule is asked; no rule
+ * speaking = denied).
+ */
+export type ScopeRule<S extends string> = (path: string, method: string, isRead: boolean) => S | null;
+export interface ScopeAllowlistOptions<S extends string> {
+    /** The tool's scope behind the chassis READ surfaces (`/me`, the files reads). */
+    read: S;
+    /** The tool's scope behind the chassis MUTATIONS (files writes, the CLI key self-revoke). */
+    write: S;
+    /** The tool's dedicated opt-in scope for the full-workspace export. */
+    dataExport: S;
+    /** The tool's own rules, asked in order AFTER the chassis rules. */
+    rules: ReadonlyArray<ScopeRule<S>>;
+}
+export declare function createScopeAllowlist<S extends string>({ read, write, dataExport, rules }: ScopeAllowlistOptions<S>): (path: string, method: string) => S | null;
+//# sourceMappingURL=scopes.d.ts.map

package/dist/middleware/scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../../src/middleware/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,CAAC,GAAG,IAAI,CAAC;AAEtG,MAAM,WAAW,qBAAqB,CAAC,CAAC,SAAS,MAAM;IACrD,kFAAkF;IAClF,IAAI,EAAE,CAAC,CAAC;IACR,6FAA6F;IAC7F,KAAK,EAAE,CAAC,CAAC;IACT,uEAAuE;IACvE,UAAU,EAAE,CAAC,CAAC;IACd,oEAAoE;IACpE,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;CACpC;AAqDD,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,MAAM,EAAE,EACrD,IAAI,EACJ,KAAK,EACL,UAAU,EACV,KAAK,EACN,EAAE,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC,GAAG,IAAI,CAyDvE"}

package/dist/middleware/scopes.js

@@ -0,0 +1,139 @@
+/**
+ * Fail-closed endpoint allowlist for machine principals (API keys now, OAuth
+ * bearer tokens in M6). Ported from a predecessor template's oauth-scopes.ts.
+ *
+ * Machine principals are deliberately MORE restricted than the user they
+ * belong to: they can only reach endpoints listed here, each behind its
+ * scope. Anything not listed returns null and the gate 403s — new endpoints
+ * are unreachable to keys/tokens until someone consciously opens them.
+ * Session principals are role-gated instead and never pass through this.
+ *
+ * Pure logic (no I/O) so it stays unit-testable. The chassis owns the
+ * MECHANISM and the rules of its own endpoints; the scope NAMES and the rules
+ * of the tool's endpoints are the tool's (`createScopeAllowlist`).
+ */
+export function looksLikeJwt(token) {
+    return token.split('.').length === 3;
+}
+/**
+ * Builds the allowlist function: the chassis rules FIRST, then the tool's
+ * rules in order, and `null` (the gate's 403 `endpoint_not_allowed`) when
+ * nothing matched — fail-closed by construction.
+ */
+/**
+ * The chassis project routes a machine principal may reach, EXACT shapes only:
+ * reads under the read scope, writes under the write scope. Anything else
+ * under `/projects` answers null HERE, so a tool's own route on a project (its
+ * link to the project, say) is the tool's rule to open, and an unknown shape
+ * stays closed.
+ */
+const PROJECT_ID = '[0-9a-fA-F-]{36}';
+const PROJECT_RE = new RegExp(`^/api/v1/projects/${PROJECT_ID}$`);
+const PROJECT_ARCHIVE_RE = new RegExp(`^/api/v1/projects/${PROJECT_ID}/(?:archive|unarchive)$`);
+const PROJECT_MEMBERS_RE = new RegExp(`^/api/v1/projects/${PROJECT_ID}/members$`);
+const PROJECT_MEMBER_RE = new RegExp(`^/api/v1/projects/${PROJECT_ID}/members/[^/]+$`);
+const PROJECT_TEAM_RE = new RegExp(`^/api/v1/projects/${PROJECT_ID}/teams/${PROJECT_ID}$`);
+function projectAccess(path, method) {
+    if (path === '/api/v1/projects')
+        return method === 'GET' ? 'read' : method === 'POST' ? 'write' : null;
+    if (PROJECT_RE.test(path))
+        return method === 'GET' ? 'read' : method === 'PATCH' ? 'write' : null;
+    if (PROJECT_ARCHIVE_RE.test(path))
+        return method === 'POST' ? 'write' : null;
+    if (PROJECT_MEMBERS_RE.test(path))
+        return method === 'GET' ? 'read' : method === 'POST' ? 'write' : null;
+    if (PROJECT_MEMBER_RE.test(path))
+        return method === 'PATCH' || method === 'DELETE' ? 'write' : null;
+    if (PROJECT_TEAM_RE.test(path))
+        return method === 'PATCH' || method === 'DELETE' ? 'write' : null;
+    return null;
+}
+/**
+ * The chassis team routes a machine principal may reach (PRDCT-2813), EXACT
+ * shapes only, the projects' pattern: the reads under the read scope, the
+ * writes under the write scope, the handler's owner-or-admin check staying
+ * the authority (and the hub-managed gate the refusal in a hub-origin
+ * workspace). A person is named by their user id in the path, never by a
+ * membership id.
+ */
+const TEAM_RE = new RegExp(`^/api/v1/teams/${PROJECT_ID}$`);
+const TEAM_MEMBERS_RE = new RegExp(`^/api/v1/teams/${PROJECT_ID}/members$`);
+const TEAM_MEMBER_RE = new RegExp(`^/api/v1/teams/${PROJECT_ID}/members/[^/]+$`);
+function teamAccess(path, method) {
+    if (path === '/api/v1/teams')
+        return method === 'GET' ? 'read' : method === 'POST' ? 'write' : null;
+    if (TEAM_RE.test(path)) {
+        return method === 'GET' ? 'read' : method === 'PATCH' || method === 'DELETE' ? 'write' : null;
+    }
+    if (TEAM_MEMBERS_RE.test(path))
+        return method === 'GET' ? 'read' : method === 'POST' ? 'write' : null;
+    if (TEAM_MEMBER_RE.test(path))
+        return method === 'DELETE' ? 'write' : null;
+    return null;
+}
+export function createScopeAllowlist({ read, write, dataExport, rules }) {
+    return function requiredScopeFor(path, method) {
+        const isRead = method === 'GET' || method === 'HEAD';
+        if (path === '/api/v1/me' && isRead)
+            return read;
+        // Files: the substrate machine callers actually need (agents pushing and
+        // pulling artifacts). Reads → the read scope, mutations → the write scope.
+        if (path === '/api/v1/files' || path.startsWith('/api/v1/files/')) {
+            return isRead ? read : write;
+        }
+        // CLI logout self-revoke (api/cli-auth.ts): the ONE /cli/auth route open
+        // to machines — DELETE revokes exactly the PRESENTING key. Safe to open
+        // because the route names no key (no id parameter): the handler acts only
+        // on principal.apiKeyId, resolved from the presented secret, and refuses
+        // every non-key principal — so the widest possible effect is a credential
+        // revoking ITSELF. The write scope because revocation is a mutation
+        // and every CLI-minted key carries it (mirrors the hub's account:write
+        // entry). Exact path + method match: any OTHER method on the path, and
+        // the PUBLIC mint routes (/cli/auth/request, /cli/auth/complete — which
+        // never reach this gate anyway), stay fail-closed.
+        if (path === '/api/v1/cli/auth/key' && method === 'DELETE')
+            return write;
+        // The person's default workspace (api/workspaces.ts, PRDCT-2815): a
+        // setting of the PERSON a credential stands for, which the CLI sets.
+        // The route names no workspace and acts on the caller's own membership
+        // rows only; a key pinned to one workspace is refused by the handler.
+        // Exact path + method: nothing else under /me opens with it.
+        if (path === '/api/v1/me/default-workspace' && method === 'PUT')
+            return write;
+        // Full-workspace export: a dedicated opt-in scope, NEVER the read scope — any
+        // admin read key would otherwise be a whole-tenant exfiltration tool.
+        // (Account deletion, DELETE /members/{id}, stays deliberately UNLISTED:
+        // machines 403 fail-closed; deleting people is a session-only act.
+        // Break-glass, /admin/break-glass/*, is likewise deliberately UNLISTED:
+        // superadmin recovery is a human session act — a key or token whose owner
+        // is on SUPERADMIN_EMAILS still 403s here, fail-closed. Never list it.)
+        if (path === '/api/v1/workspace/export' && isRead)
+            return dataExport;
+        // Projects: each route listed by its exact shape and method (above).
+        const project = projectAccess(path, method);
+        if (project !== null)
+            return project === 'read' ? read : write;
+        // Teams: the same discipline (above).
+        const team = teamAccess(path, method);
+        if (team !== null)
+            return team === 'read' ? read : write;
+        for (const rule of rules) {
+            const needed = rule(path, method, isRead);
+            if (needed !== null)
+                return needed;
+        }
+        // Deliberately UNLISTED chassis surfaces (fail-closed 403 for
+        // keys/tokens), like break-glass:
+        //  - /sso/logout (cloud) — single logout is a BROWSER act: a machine
+        //    credential must never be able to end its user's sessions. Never
+        //    list it.
+        //  - POST /workspaces — creating a workspace (on cloud: an organization at
+        //    the hub, as the user) is a HUMAN act from the dashboard. A key or a
+        //    token must never be able to mint tenants for its holder; the handler
+        //    re-checks `via === 'session'` on top (api/workspaces.ts). Never list it.
+        //  - /me/onboarding/dismiss (cloud) — the first-run welcome is a browser
+        //    concern; machines carry no banner to dismiss.
+        return null;
+    };
+}
+//# sourceMappingURL=scopes.js.map

package/dist/middleware/scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.js","sourceRoot":"","sources":["../../src/middleware/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACvC,CAAC;AAoBD;;;;GAIG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,GAAG,kBAAkB,CAAC;AACtC,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,qBAAqB,UAAU,GAAG,CAAC,CAAC;AAClE,MAAM,kBAAkB,GAAG,IAAI,MAAM,CAAC,qBAAqB,UAAU,yBAAyB,CAAC,CAAC;AAChG,MAAM,kBAAkB,GAAG,IAAI,MAAM,CAAC,qBAAqB,UAAU,WAAW,CAAC,CAAC;AAClF,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAAC,qBAAqB,UAAU,iBAAiB,CAAC,CAAC;AACvF,MAAM,eAAe,GAAG,IAAI,MAAM,CAAC,qBAAqB,UAAU,UAAU,UAAU,GAAG,CAAC,CAAC;AAE3F,SAAS,aAAa,CAAC,IAAY,EAAE,MAAc;IACjD,IAAI,IAAI,KAAK,kBAAkB;QAAE,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACvG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAClG,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACzG,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACpG,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAClG,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,kBAAkB,UAAU,GAAG,CAAC,CAAC;AAC5D,MAAM,eAAe,GAAG,IAAI,MAAM,CAAC,kBAAkB,UAAU,WAAW,CAAC,CAAC;AAC5E,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC,kBAAkB,UAAU,iBAAiB,CAAC,CAAC;AAEjF,SAAS,UAAU,CAAC,IAAY,EAAE,MAAc;IAC9C,IAAI,IAAI,KAAK,eAAe;QAAE,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACpG,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAChG,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACtG,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAmB,EACrD,IAAI,EACJ,KAAK,EACL,UAAU,EACV,KAAK,EACoB;IACzB,OAAO,SAAS,gBAAgB,CAAC,IAAY,EAAE,MAAc;QAC3D,MAAM,MAAM,GAAG,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC;QACrD,IAAI,IAAI,KAAK,YAAY,IAAI,MAAM;YAAE,OAAO,IAAI,CAAC;QACjD,yEAAyE;QACzE,2EAA2E;QAC3E,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAClE,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAC/B,CAAC;QACD,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,oEAAoE;QACpE,uEAAuE;QACvE,uEAAuE;QACvE,wEAAwE;QACxE,mDAAmD;QACnD,IAAI,IAAI,KAAK,sBAAsB,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACzE,oEAAoE;QACpE,qEAAqE;QACrE,uEAAuE;QACvE,sEAAsE;QACtE,6DAA6D;QAC7D,IAAI,IAAI,KAAK,8BAA8B,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QAC9E,8EAA8E;QAC9E,sEAAsE;QACtE,wEAAwE;QACxE,mEAAmE;QACnE,wEAAwE;QACxE,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,IAAI,KAAK,0BAA0B,IAAI,MAAM;YAAE,OAAO,UAAU,CAAC;QACrE,qEAAqE;QACrE,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAC/D,sCAAsC;QACtC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QACzD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1C,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO,MAAM,CAAC;QACrC,CAAC;QACD,8DAA8D;QAC9D,kCAAkC;QAClC,qEAAqE;QACrE,qEAAqE;QACrE,cAAc;QACd,2EAA2E;QAC3E,yEAAyE;QACzE,0EAA0E;QAC1E,8EAA8E;QAC9E,yEAAyE;QACzE,mDAAmD;QACnD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/security-headers.d.ts

@@ -0,0 +1,53 @@
+import type { MiddlewareHandler } from 'hono';
+import type { Env } from '../env.js';
+import type { RuntimeState } from '../state.js';
+/**
+ * Baseline headers on every response (brief §2.6). The CSP applies to HTML
+ * we serve (the dashboard SPA) and locks it to self — with hashes for the
+ * inline bootstrap script SvelteKit bakes into index.html, computed once at
+ * boot. User-uploaded content never renders on this origin (the files
+ * module forces attachment for active types), so this CSP is the only HTML
+ * policy the origin needs. frame-ancestors 'none' replaces X-Frame-Options.
+ */
+export declare function inlineScriptHashes(html: string): string[];
+export interface CspOptions {
+    /**
+     * Extra `frame-src` sources beyond 'self'. A dashboard may preview a resource in
+     * a sandboxed iframe whose URL honours VIEWER_BASE_URL (PRDCT-1352, DASH-4):
+     * with `default-src 'self'` and no `frame-src`, a split viewer origin made
+     * that preview a blank frame with no error anywhere but the console.
+     */
+    frameSrc?: readonly string[];
+    /**
+     * Extra `img-src` sources beyond 'self' and `data:`. A dashboard that
+     * fetches an image through its API (a request that must carry a header an
+     * `<img>` cannot send) shows it from an object URL, and `blob:` must be
+     * allowed for that or the browser refuses the picture with no error
+     * anywhere but the console. A scheme source here is a tool's declaration,
+     * never a chassis default.
+     */
+    imgSrc?: readonly string[];
+}
+export declare function buildCsp(scriptHashes: string[], { frameSrc, imgSrc }?: CspOptions): string;
+export interface SecurityHeaderOptions {
+    csp: string;
+    state: RuntimeState;
+    /**
+     * `Strict-Transport-Security` value, or null to send none. Computed once at
+     * boot from PUBLIC_BASE_URL + HSTS_MAX_AGE (see {@link hstsValue}) rather
+     * than sniffed per request: `X-Forwarded-Proto` is client-controlled unless
+     * TRUST_PROXY vouches for it, and this origin issues the session cookie —
+     * the operator's declared public scheme is the honest signal.
+     */
+    hsts?: string | null;
+}
+/**
+ * The HSTS header for this instance, or null when it must not be sent.
+ * Only an https PUBLIC_BASE_URL arms it: a browser MUST ignore HSTS received
+ * over plain http (RFC 6797 §7.2), and pinning an http-only self-host into
+ * https for 180 days would brick it. `HSTS_MAX_AGE=0` is the operator opt-out
+ * (e.g. a subdomain that cannot yet serve TLS).
+ */
+export declare function hstsValue(env: Pick<Env, 'PUBLIC_BASE_URL' | 'HSTS_MAX_AGE'>): string | null;
+export declare function securityHeaders({ csp, state, hsts }: SecurityHeaderOptions): MiddlewareHandler;
+//# sourceMappingURL=security-headers.d.ts.map

package/dist/middleware/security-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.d.ts","sourceRoot":"","sources":["../../src/middleware/security-headers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAUzD;AAED,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B;AAED,wBAAgB,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,QAAa,EAAE,MAAW,EAAE,GAAE,UAAe,GAAG,MAAM,CAwBxG;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,YAAY,CAAC;IACpB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,iBAAiB,GAAG,cAAc,CAAC,GAAG,MAAM,GAAG,IAAI,CAU3F;AAED,wBAAgB,eAAe,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,qBAAqB,GAAG,iBAAiB,CA0B9F"}