@antasphere/chassis-server 1.0.0

package/dist/middleware/security-headers.js

@@ -0,0 +1,96 @@
+import { createHash } from 'node:crypto';
+/**
+ * Baseline headers on every response (brief §2.6). The CSP applies to HTML
+ * we serve (the dashboard SPA) and locks it to self — with hashes for the
+ * inline bootstrap script SvelteKit bakes into index.html, computed once at
+ * boot. User-uploaded content never renders on this origin (the files
+ * module forces attachment for active types), so this CSP is the only HTML
+ * policy the origin needs. frame-ancestors 'none' replaces X-Frame-Options.
+ */
+export function inlineScriptHashes(html) {
+    const hashes = [];
+    const re = /<script(?![^>]*\bsrc=)[^>]*>([\s\S]*?)<\/script>/gi;
+    let match;
+    while ((match = re.exec(html)) !== null) {
+        const body = match[1] ?? '';
+        if (body.trim().length === 0)
+            continue;
+        hashes.push(`'sha256-${createHash('sha256').update(body).digest('base64')}'`);
+    }
+    return hashes;
+}
+export function buildCsp(scriptHashes, { frameSrc = [], imgSrc = [] } = {}) {
+    const script = ["'self'", ...scriptHashes].join(' ');
+    const frame = ["'self'", ...frameSrc].join(' ');
+    const img = ["'self'", 'data:', ...imgSrc].join(' ');
+    return [
+        "default-src 'self'",
+        `script-src ${script}`,
+        // Svelte injects component styles at runtime; hashes are impractical there.
+        // The two font CDNs the dashboard's app.html links (PRDCT-2308): the
+        // Observatory pairing rides Fontshare (Sentient, Synonym) and Google
+        // Fonts (Onest) because this repo is slated for the OSS cut and the
+        // faces may not be committed. Stylesheets from the two API hosts, the
+        // font files from their two file hosts, and nothing else — the
+        // dashboard's own origin stays the only script and connect source.
+        "style-src 'self' 'unsafe-inline' https://api.fontshare.com https://fonts.googleapis.com",
+        `img-src ${img}`,
+        "connect-src 'self'",
+        "font-src 'self' https://cdn.fontshare.com https://fonts.gstatic.com",
+        `frame-src ${frame}`,
+        "object-src 'none'",
+        "frame-ancestors 'none'",
+        "base-uri 'self'",
+        "form-action 'self'"
+    ].join('; ');
+}
+/**
+ * The HSTS header for this instance, or null when it must not be sent.
+ * Only an https PUBLIC_BASE_URL arms it: a browser MUST ignore HSTS received
+ * over plain http (RFC 6797 §7.2), and pinning an http-only self-host into
+ * https for 180 days would brick it. `HSTS_MAX_AGE=0` is the operator opt-out
+ * (e.g. a subdomain that cannot yet serve TLS).
+ */
+export function hstsValue(env) {
+    if (env.HSTS_MAX_AGE <= 0)
+        return null;
+    let isHttps = false;
+    try {
+        isHttps = new URL(env.PUBLIC_BASE_URL).protocol === 'https:';
+    }
+    catch {
+        isHttps = false;
+    }
+    if (!isHttps)
+        return null;
+    return `max-age=${env.HSTS_MAX_AGE}; includeSubDomains`;
+}
+export function securityHeaders({ csp, state, hsts }) {
+    return async (c, next) => {
+        await next();
+        c.header('x-content-type-options', 'nosniff');
+        // HSTS on EVERY response, not just HTML: the cookie this origin issues is
+        // sent with XHR too, so an http downgrade on /api/v1 is the same theft.
+        if (hsts && !c.res.headers.has('strict-transport-security')) {
+            c.header('strict-transport-security', hsts);
+        }
+        // Baseline defaults, but NEVER clobber a value a route set for itself:
+        // the public viewer (ADR 012) serves user-authored HTML under its own
+        // `Content-Security-Policy: sandbox …` + `Referrer-Policy: no-referrer`,
+        // and an unconditional overwrite here would silently replace the sandbox
+        // CSP with the dashboard CSP — re-opening the session-theft surface the
+        // sandbox exists to close (found by the ADR 012 spike; fail-dangerous
+        // class, see the ADR's residual-risk #1 and the viewer regression tests).
+        if (!c.res.headers.has('referrer-policy')) {
+            c.header('referrer-policy', 'strict-origin-when-cross-origin');
+        }
+        // Draining: ask keep-alive clients to reconnect elsewhere (rolling deploy).
+        if (state.draining)
+            c.header('connection', 'close');
+        const contentType = c.res.headers.get('content-type') ?? '';
+        if (contentType.includes('text/html') && !c.res.headers.has('content-security-policy')) {
+            c.header('content-security-policy', csp);
+        }
+    };
+}
+//# sourceMappingURL=security-headers.js.map

package/dist/middleware/security-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.js","sourceRoot":"","sources":["../../src/middleware/security-headers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAKzC;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,EAAE,GAAG,oDAAoD,CAAC;IAChE,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACvC,MAAM,CAAC,IAAI,CAAC,WAAW,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAqBD,MAAM,UAAU,QAAQ,CAAC,YAAsB,EAAE,EAAE,QAAQ,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,KAAiB,EAAE;IAC9F,MAAM,MAAM,GAAG,CAAC,QAAQ,EAAE,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,CAAC,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrD,OAAO;QACL,oBAAoB;QACpB,cAAc,MAAM,EAAE;QACtB,4EAA4E;QAC5E,qEAAqE;QACrE,qEAAqE;QACrE,oEAAoE;QACpE,sEAAsE;QACtE,+DAA+D;QAC/D,mEAAmE;QACnE,yFAAyF;QACzF,WAAW,GAAG,EAAE;QAChB,oBAAoB;QACpB,qEAAqE;QACrE,aAAa,KAAK,EAAE;QACpB,mBAAmB;QACnB,wBAAwB;QACxB,iBAAiB;QACjB,oBAAoB;KACrB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAeD;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,GAAkD;IAC1E,IAAI,GAAG,CAAC,YAAY,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,WAAW,GAAG,CAAC,YAAY,qBAAqB,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAyB;IACzE,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,IAAI,EAAE,CAAC;QACb,CAAC,CAAC,MAAM,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QAC9C,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,EAAE,CAAC;YAC5D,CAAC,CAAC,MAAM,CAAC,2BAA2B,EAAE,IAAI,CAAC,CAAC;QAC9C,CAAC;QACD,uEAAuE;QACvE,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,0EAA0E;QAC1E,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC1C,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;QACjE,CAAC;QACD,4EAA4E;QAC5E,IAAI,KAAK,CAAC,QAAQ;YAAE,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACpD,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC5D,IAAI,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;YACvF,CAAC,CAAC,MAAM,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/observability/index.d.ts

@@ -0,0 +1,3 @@
+export { type Otel, createOtel } from './otel.js';
+export { createMetrics } from './metrics.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/observability/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/observability/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}

package/dist/observability/index.js

@@ -0,0 +1,3 @@
+export { createOtel } from './otel.js';
+export { createMetrics } from './metrics.js';
+//# sourceMappingURL=index.js.map

package/dist/observability/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/observability/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,UAAU,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}

package/dist/observability/metrics.d.ts

@@ -0,0 +1,17 @@
+import { Registry } from 'prom-client';
+import type { MiddlewareHandler } from 'hono';
+import { Hono } from 'hono';
+import { type Db } from '@antasphere/chassis-db';
+import type PgBoss from 'pg-boss';
+/**
+ * Prometheus surface. Route labels use the MATCHED pattern (not the raw
+ * path) so label cardinality stays bounded. Queue depth and storage bytes
+ * are collected lazily at scrape time.
+ */
+export interface Metrics {
+    registry: Registry;
+    middleware: MiddlewareHandler;
+    routes: (token: string | undefined) => Hono;
+}
+export declare function createMetrics(db: Db, boss: PgBoss): Metrics;
+//# sourceMappingURL=metrics.d.ts.map

package/dist/observability/metrics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../src/observability/metrics.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2C,QAAQ,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAS,KAAK,EAAE,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,SAAS,CAAC;AAKlC;;;;GAIG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC;CAC7C;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAgF3D"}

package/dist/observability/metrics.js

@@ -0,0 +1,82 @@
+import { collectDefaultMetrics, Gauge, Histogram, Registry } from 'prom-client';
+import { Hono } from 'hono';
+import { sql } from 'drizzle-orm';
+import { files } from '@antasphere/chassis-db';
+import { constantTimeEquals } from '../constant-time.js';
+import { USAGE_QUEUE } from '../jobs/pgboss.js';
+import { routeLabel } from '../route-label.js';
+export function createMetrics(db, boss) {
+    const registry = new Registry();
+    collectDefaultMetrics({ register: registry });
+    const httpDuration = new Histogram({
+        name: 'http_request_duration_seconds',
+        help: 'HTTP request latency by route',
+        labelNames: ['method', 'route', 'status'],
+        buckets: [0.005, 0.02, 0.05, 0.1, 0.25, 0.5, 1, 2.5, 5],
+        registers: [registry]
+    });
+    new Gauge({
+        name: 'job_queue_depth',
+        help: 'Pending jobs in the usage queue',
+        registers: [registry],
+        async collect() {
+            try {
+                this.set((await boss.getQueueSize(USAGE_QUEUE)) ?? 0);
+            }
+            catch {
+                // queue may not exist yet (api-only role before first worker boot)
+            }
+        }
+    });
+    new Gauge({
+        name: 'storage_bytes_total',
+        help: 'Bytes referenced by live file rows',
+        registers: [registry],
+        async collect() {
+            const [row] = await db
+                .select({ total: sql `coalesce(sum(${files.sizeBytes}), 0)::text` })
+                .from(files)
+                .where(sql `${files.deletedAt} IS NULL`);
+            this.set(Number(row?.total ?? '0'));
+        }
+    });
+    const middleware = async (c, next) => {
+        const start = performance.now();
+        try {
+            await next();
+        }
+        finally {
+            const seconds = (performance.now() - start) / 1000;
+            httpDuration.observe({
+                method: c.req.method,
+                // routeLabel, same as the log line and the span: on the pinned
+                // Hono the previous `?? c.req.path` fallback was unreachable
+                // (routePath always answers a string here), but a raw-path
+                // expression in a label position is exactly what must not come
+                // back to life on a version bump — one shared, secret-free
+                // label instead (PRIV-1).
+                route: routeLabel(c),
+                status: String(c.error ? 500 : c.res.status)
+            }, seconds);
+        }
+    };
+    const routes = (token) => {
+        const app = new Hono();
+        app.get('/metrics', async (c) => {
+            // Default-closed: route names, queue depth, and storage totals are not
+            // for the open internet. setup.sh generates a METRICS_TOKEN.
+            if (!token) {
+                return c.text('metrics disabled: set METRICS_TOKEN', 401);
+            }
+            const auth = c.req.header('authorization') ?? '';
+            if (!constantTimeEquals(auth, `Bearer ${token}`)) {
+                return c.text('unauthorized', 401);
+            }
+            c.header('content-type', registry.contentType);
+            return c.body(await registry.metrics());
+        });
+        return app;
+    };
+    return { registry, middleware, routes };
+}
+//# sourceMappingURL=metrics.js.map

package/dist/observability/metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../../src/observability/metrics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEhF,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,KAAK,EAAW,MAAM,wBAAwB,CAAC;AAExD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAa/C,MAAM,UAAU,aAAa,CAAC,EAAM,EAAE,IAAY;IAChD,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAC;IAChC,qBAAqB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAE9C,MAAM,YAAY,GAAG,IAAI,SAAS,CAAC;QACjC,IAAI,EAAE,+BAA+B;QACrC,IAAI,EAAE,+BAA+B;QACrC,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAU;QAClD,OAAO,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACvD,SAAS,EAAE,CAAC,QAAQ,CAAC;KACtB,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC;QACR,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,iCAAiC;QACvC,SAAS,EAAE,CAAC,QAAQ,CAAC;QACrB,KAAK,CAAC,OAAO;YACX,IAAI,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;YACrE,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC;QACR,IAAI,EAAE,qBAAqB;QAC3B,IAAI,EAAE,oCAAoC;QAC1C,SAAS,EAAE,CAAC,QAAQ,CAAC;QACrB,KAAK,CAAC,OAAO;YACX,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,gBAAgB,KAAK,CAAC,SAAS,aAAa,EAAE,CAAC;iBAC1E,IAAI,CAAC,KAAK,CAAC;iBACX,KAAK,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,SAAS,UAAU,CAAC,CAAC;YAC1C,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC;QACtC,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,UAAU,GAAsB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACtD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC;YACnD,YAAY,CAAC,OAAO,CAClB;gBACE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;gBACpB,+DAA+D;gBAC/D,6DAA6D;gBAC7D,2DAA2D;gBAC3D,+DAA+D;gBAC/D,2DAA2D;gBAC3D,0BAA0B;gBAC1B,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;gBACpB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;aAC7C,EACD,OAAO,CACR,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,KAAyB,EAAQ,EAAE;QACjD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC9B,uEAAuE;YACvE,6DAA6D;YAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,CAAC,IAAI,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;YACjD,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,UAAU,KAAK,EAAE,CAAC,EAAE,CAAC;gBACjD,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YACrC,CAAC;YACD,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC/C,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAC1C,CAAC"}

package/dist/observability/otel.d.ts

@@ -0,0 +1,20 @@
+import { type Tracer } from '@opentelemetry/api';
+import type { MiddlewareHandler } from 'hono';
+import type { Env } from '../env.js';
+import type { Logger } from '../logger.js';
+/**
+ * Tracing with the zero-phone-home default: spans are recorded ONLY when an
+ * operator configures OTEL_EXPORTER_OTLP_ENDPOINT — without it no exporter
+ * is registered and nothing leaves the instance. The request id rides every
+ * span as `request.id`, which is the correlation key across log line, span,
+ * and audit row.
+ */
+export interface Otel {
+    tracer: Tracer;
+    middleware: MiddlewareHandler;
+    shutdown: () => Promise<void>;
+}
+export declare function createOtel(env: Pick<Env, 'OTEL_EXPORTER_OTLP_ENDPOINT' | 'APP_VERSION' | 'EDITION'>, logger: Logger, options: {
+    serviceName: string;
+}): Promise<Otel>;
+//# sourceMappingURL=otel.d.ts.map

package/dist/observability/otel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"otel.d.ts","sourceRoot":"","sources":["../../src/observability/otel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,KAAK,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAIxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAG3C;;;;;;GAMG;AACH,MAAM,WAAW,IAAI;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,iBAAiB,CAAC;IAC9B,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,6BAA6B,GAAG,aAAa,GAAG,SAAS,CAAC,EACzE,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,GAC/B,OAAO,CAAC,IAAI,CAAC,CAoDf"}

package/dist/observability/otel.js

@@ -0,0 +1,54 @@
+import { trace } from '@opentelemetry/api';
+import { NodeTracerProvider } from '@opentelemetry/sdk-trace-node';
+import { BatchSpanProcessor } from '@opentelemetry/sdk-trace-base';
+import { resourceFromAttributes } from '@opentelemetry/resources';
+import { routeLabel } from '../route-label.js';
+export async function createOtel(env, logger, options) {
+    const resource = resourceFromAttributes({
+        'service.name': options.serviceName,
+        'service.version': env.APP_VERSION,
+        'deployment.environment.name': env.EDITION
+    });
+    const spanProcessors = [];
+    if (env.OTEL_EXPORTER_OTLP_ENDPOINT) {
+        const { OTLPTraceExporter } = await import('@opentelemetry/exporter-trace-otlp-http');
+        spanProcessors.push(new BatchSpanProcessor(new OTLPTraceExporter({ url: `${env.OTEL_EXPORTER_OTLP_ENDPOINT}/v1/traces` })));
+        logger.info({ endpoint: env.OTEL_EXPORTER_OTLP_ENDPOINT }, 'otel export enabled');
+    }
+    const provider = new NodeTracerProvider({ resource, spanProcessors });
+    provider.register();
+    const tracer = trace.getTracer(options.serviceName);
+    const middleware = async (c, next) => {
+        // Start with a low-cardinality name (the matched route pattern isn't known
+        // until after routing); rename to the pattern in `finally` so span names
+        // stay bounded — a raw path with ids would explode span cardinality.
+        await tracer.startActiveSpan(`HTTP ${c.req.method}`, async (span) => {
+            span.setAttributes({
+                'http.request.method': c.req.method,
+                'request.id': c.get('requestId')
+            });
+            try {
+                await next();
+            }
+            finally {
+                // The MATCHED ROUTE PATTERN, never the raw path (route-label.ts): a
+                // span attribute is exported OFF-INSTANCE, so a `/v/<share secret>`
+                // there hands a working capability to the trace backend.
+                const route = routeLabel(c);
+                span.updateName(`${c.req.method} ${route}`);
+                span.setAttributes({
+                    'http.route': route,
+                    'url.path': route,
+                    'http.response.status_code': c.error ? 500 : c.res.status
+                });
+                span.end();
+            }
+        });
+    };
+    return {
+        tracer,
+        middleware,
+        shutdown: () => provider.shutdown()
+    };
+}
+//# sourceMappingURL=otel.js.map

package/dist/observability/otel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"otel.js","sourceRoot":"","sources":["../../src/observability/otel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAe,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAIlE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAe/C,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAyE,EACzE,MAAc,EACd,OAAgC;IAEhC,MAAM,QAAQ,GAAG,sBAAsB,CAAC;QACtC,cAAc,EAAE,OAAO,CAAC,WAAW;QACnC,iBAAiB,EAAE,GAAG,CAAC,WAAW;QAClC,6BAA6B,EAAE,GAAG,CAAC,OAAO;KAC3C,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,EAAE,CAAC;IAC1B,IAAI,GAAG,CAAC,2BAA2B,EAAE,CAAC;QACpC,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;QACtF,cAAc,CAAC,IAAI,CACjB,IAAI,kBAAkB,CAAC,IAAI,iBAAiB,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,2BAA2B,YAAY,EAAE,CAAC,CAAC,CACvG,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,2BAA2B,EAAE,EAAE,qBAAqB,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;IACtE,QAAQ,CAAC,QAAQ,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAEpD,MAAM,UAAU,GAAsB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACtD,2EAA2E;QAC3E,yEAAyE;QACzE,qEAAqE;QACrE,MAAM,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAClE,IAAI,CAAC,aAAa,CAAC;gBACjB,qBAAqB,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;gBACnC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC;aACjC,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,IAAI,EAAE,CAAC;YACf,CAAC;oBAAS,CAAC;gBACT,oEAAoE;gBACpE,oEAAoE;gBACpE,yDAAyD;gBACzD,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;gBAC5B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;gBAC5C,IAAI,CAAC,aAAa,CAAC;oBACjB,YAAY,EAAE,KAAK;oBACnB,UAAU,EAAE,KAAK;oBACjB,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM;iBAC1D,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO;QACL,MAAM;QACN,UAAU;QACV,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE;KACpC,CAAC;AACJ,CAAC"}

package/dist/pagination.d.ts

@@ -0,0 +1,57 @@
+import { type SQL } from 'drizzle-orm';
+import type { PgColumn, PgTable } from 'drizzle-orm/pg-core';
+/**
+ * Shared UUID shape check — cursors here, and the id params of the
+ * plain-Hono routes that have no contract schema (files content/HEAD): a
+ * non-UUID string must be rejected before it reaches Postgres' uuid cast.
+ */
+export declare function isUuid(value: string): boolean;
+/**
+ * The cursor row id, or null when absent/malformed. A malformed cursor is
+ * silently ignored — the caller serves page 1 (the audit route's
+ * `Number('banana')` tolerance).
+ */
+export declare function cursorRowId(cursor: string | undefined): string | null;
+/**
+ * Row-value keyset predicate: everything strictly older than the cursor row,
+ * with the cursor row's (created_at, id) resolved by a SQL-side subquery.
+ * The subquery is workspace-scoped so a foreign workspace's cursor can never
+ * position inside this workspace's ordering. A well-formed-but-unknown id
+ * makes the subquery empty → NULL predicate → empty page + nextCursor null;
+ * harmless, since cursors are server-issued and these tables never
+ * hard-delete rows.
+ */
+export declare function keysetBefore(opts: {
+    table: PgTable;
+    id: PgColumn;
+    createdAt: PgColumn;
+    workspaceId: PgColumn;
+    cursorId: string;
+    workspace: string;
+}): SQL;
+/** Slice a limit+1 fetch into the page + the audit-style nextCursor (last id of the page). */
+export declare function pageOf<T extends {
+    id: string;
+}>(rows: T[], limit: number): {
+    page: T[];
+    nextCursor: string | null;
+};
+export interface KeysetValueCursor {
+    /** `created_at::text`, exactly as Postgres rendered it. */
+    createdAt: string;
+    id: string;
+}
+export declare function encodeKeysetCursor(row: {
+    id: string;
+    createdAtText: string;
+}): string;
+export declare function decodeKeysetCursor(cursor: string | undefined): KeysetValueCursor | null;
+/** The `created_at::text` column to select beside a row that will mint a value cursor. */
+export declare function createdAtText(createdAt: PgColumn): SQL<string>;
+/** `(created_at, id) < (cursor)` with the cursor's own values; `keysetBefore`'s twin for hard-deleting tables. */
+export declare function keysetBeforeValue(opts: {
+    id: PgColumn;
+    createdAt: PgColumn;
+    cursor: KeysetValueCursor;
+}): SQL;
+//# sourceMappingURL=pagination.d.ts.map

package/dist/pagination.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pagination.d.ts","sourceRoot":"","sources":["../src/pagination.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,KAAK,GAAG,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAsB7D;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE7C;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAGrE;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,EAAE,EAAE,QAAQ,CAAC;IACb,SAAS,EAAE,QAAQ,CAAC;IACpB,WAAW,EAAE,QAAQ,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,GAAG,CAEN;AAED,8FAA8F;AAC9F,wBAAgB,MAAM,CAAC,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,EAC7C,IAAI,EAAE,CAAC,EAAE,EACT,KAAK,EAAE,MAAM,GACZ;IAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAI1C;AAUD,MAAM,WAAW,iBAAiB;IAChC,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAErF;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,GAAG,IAAI,CAavF;AAED,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,SAAS,EAAE,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAE9D;AAED,kHAAkH;AAClH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,EAAE,EAAE,QAAQ,CAAC;IACb,SAAS,EAAE,QAAQ,CAAC;IACpB,MAAM,EAAE,iBAAiB,CAAC;CAC3B,GAAG,GAAG,CAEN"}

package/dist/pagination.js

@@ -0,0 +1,90 @@
+import { sql } from 'drizzle-orm';
+/**
+ * Keyset (cursor) pagination over (created_at, id), newest first — the audit
+ * route's convention extended to the uuid-keyed tables. Two cursor dialects,
+ * one rule: the timestamp's precision never leaves Postgres, because a JS
+ * Date round-trip truncates its microseconds and a millisecond-equal
+ * boundary row would then be skipped or repeated.
+ *
+ *  - `keysetBefore`: the cursor is the last returned row's plain id, and the
+ *    timestamp is resolved from that row by subquery at page time. For the
+ *    tables that never hard-delete a row (members are deactivated, keys and
+ *    invitations revoked, projects archived): the cursor row is always there.
+ *  - `keysetBeforeValue`: the cursor CARRIES the timestamp, as the text
+ *    Postgres itself rendered (`created_at::text`, selected beside the row,
+ *    never a JS Date), with the id. For a table that hard-deletes rows
+ *    (project_members): a cursor naming a removed row would compare against
+ *    NULL under the subquery dialect and end the listing early.
+ */
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * Shared UUID shape check — cursors here, and the id params of the
+ * plain-Hono routes that have no contract schema (files content/HEAD): a
+ * non-UUID string must be rejected before it reaches Postgres' uuid cast.
+ */
+export function isUuid(value) {
+    return UUID_RE.test(value);
+}
+/**
+ * The cursor row id, or null when absent/malformed. A malformed cursor is
+ * silently ignored — the caller serves page 1 (the audit route's
+ * `Number('banana')` tolerance).
+ */
+export function cursorRowId(cursor) {
+    if (!cursor || !isUuid(cursor))
+        return null;
+    return cursor;
+}
+/**
+ * Row-value keyset predicate: everything strictly older than the cursor row,
+ * with the cursor row's (created_at, id) resolved by a SQL-side subquery.
+ * The subquery is workspace-scoped so a foreign workspace's cursor can never
+ * position inside this workspace's ordering. A well-formed-but-unknown id
+ * makes the subquery empty → NULL predicate → empty page + nextCursor null;
+ * harmless, since cursors are server-issued and these tables never
+ * hard-delete rows.
+ */
+export function keysetBefore(opts) {
+    return sql `(${opts.createdAt}, ${opts.id}) < (SELECT ${opts.createdAt}, ${opts.id} FROM ${opts.table} WHERE ${opts.id} = ${opts.cursorId} AND ${opts.workspaceId} = ${opts.workspace})`;
+}
+/** Slice a limit+1 fetch into the page + the audit-style nextCursor (last id of the page). */
+export function pageOf(rows, limit) {
+    const page = rows.slice(0, limit);
+    const nextCursor = rows.length > limit ? (page[page.length - 1]?.id ?? null) : null;
+    return { page, nextCursor };
+}
+/**
+ * The value-carrying cursor (`keysetBeforeValue`): the row's `created_at` as
+ * Postgres rendered it and its id, base64url of `<text>|<id>`. Opaque on the
+ * wire like the other dialect; a malformed one is ignored (page 1).
+ */
+const TIMESTAMPTZ_TEXT_RE = /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}(?:\.\d{1,6})?[+-]\d{2}(?::\d{2}(?::\d{2})?)?$/;
+export function encodeKeysetCursor(row) {
+    return Buffer.from(`${row.createdAtText}|${row.id}`, 'utf8').toString('base64url');
+}
+export function decodeKeysetCursor(cursor) {
+    if (!cursor || cursor.length > 200)
+        return null;
+    // Node's base64url decoder never throws (it drops what it cannot read):
+    // the guard is the two shape checks below, not the decode.
+    const decoded = Buffer.from(cursor, 'base64url').toString('utf8');
+    const at = decoded.lastIndexOf('|');
+    if (at < 0)
+        return null;
+    const createdAt = decoded.slice(0, at);
+    const id = decoded.slice(at + 1);
+    // Both halves are validated before they reach a Postgres cast: a shape the
+    // casts would refuse must answer page 1, never a 500.
+    if (!TIMESTAMPTZ_TEXT_RE.test(createdAt) || !isUuid(id))
+        return null;
+    return { createdAt, id };
+}
+/** The `created_at::text` column to select beside a row that will mint a value cursor. */
+export function createdAtText(createdAt) {
+    return sql `${createdAt}::text`;
+}
+/** `(created_at, id) < (cursor)` with the cursor's own values; `keysetBefore`'s twin for hard-deleting tables. */
+export function keysetBeforeValue(opts) {
+    return sql `(${opts.createdAt}, ${opts.id}) < (${opts.cursor.createdAt}::timestamptz, ${opts.cursor.id}::uuid)`;
+}
+//# sourceMappingURL=pagination.js.map

package/dist/pagination.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pagination.js","sourceRoot":"","sources":["../src/pagination.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAY,MAAM,aAAa,CAAC;AAG5C;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAElF;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAA0B;IACpD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,IAO5B;IACC,OAAO,GAAG,CAAA,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,EAAE,eAAe,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,EAAE,SAAS,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC,QAAQ,QAAQ,IAAI,CAAC,WAAW,MAAM,IAAI,CAAC,SAAS,GAAG,CAAC;AAC1L,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,MAAM,CACpB,IAAS,EACT,KAAa;IAEb,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,mBAAmB,GACvB,oFAAoF,CAAC;AAQvF,MAAM,UAAU,kBAAkB,CAAC,GAA0C;IAC3E,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAA0B;IAC3D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IAChD,wEAAwE;IACxE,2DAA2D;IAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACjC,2EAA2E;IAC3E,sDAAsD;IACtD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAC3B,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,aAAa,CAAC,SAAmB;IAC/C,OAAO,GAAG,CAAQ,GAAG,SAAS,QAAQ,CAAC;AACzC,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,iBAAiB,CAAC,IAIjC;IACC,OAAO,GAAG,CAAA,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,EAAE,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,kBAAkB,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;AACjH,CAAC"}

package/dist/platform/edition.d.ts

@@ -0,0 +1,57 @@
+import type { Db } from '@antasphere/chassis-db';
+import type { EntitlementService, IdentityProvider, UsageSink } from '@antasphere/chassis-contract';
+import type { HubOrgReconciler } from '../identity/hub-reconcile.js';
+import type { PrincipalGate } from '../middleware/auth-context.js';
+import type { HubConfig } from '../env.js';
+import type { Logger } from '../logger.js';
+/**
+ * The edition split (internal/federation.md): one codebase, one Docker image,
+ * two seam bindings selected purely by instance config. This module is the
+ * ONLY place edition decides which implementations the boot-time registry
+ * gets — `oss` binds the local defaults byte-identically; `cloud` rebinds
+ * the hub-federating variants here.
+ */
+/**
+ * The hub SSO method name the cloud edition advertises in discovery — the
+ * better-auth `genericOAuth` providerId registered by identity/hub-sso.ts
+ * (its callback lands on /api/v1/auth/oauth2/callback/antasphere, the
+ * redirect URI in the hub's TOOL_REGISTRY entry).
+ */
+export declare const HUB_SSO_METHOD = "antasphere";
+/** The three registry seams the edition owns (events/workspaces are edition-independent). */
+export interface EditionSeams {
+    identity: IdentityProvider;
+    entitlements: EntitlementService;
+    usage: UsageSink;
+}
+/** What the cloud bindings need beyond the seams themselves. */
+export interface EditionBindingDeps {
+    db: Db;
+    /**
+     * The live org reconciler (identity/hub-reconcile.ts), constructed by
+     * boot on cloud — the ONE hub data path, shared by the login pass, the
+     * live gate, and the unknown-workspace miss hook.
+     */
+    reconciler?: HubOrgReconciler | undefined;
+}
+/**
+ * The bound seams plus the cloud-only extra boot wires alongside them: the
+ * post-resolution principal gate (authContext). Absent on oss by
+ * construction.
+ */
+export interface BoundEditionSeams extends EditionSeams {
+    principalGate?: PrincipalGate;
+}
+/**
+ * Bind the registry seams for this instance's edition. `hub` is the single
+ * switch: null (EDITION=oss) returns the local defaults UNTOUCHED — the
+ * self-host edition carries zero hub surface at runtime; a HubConfig
+ * (EDITION=cloud, validated at env parse) selects the cloud bindings.
+ *
+ * Entitlements bind LOCAL on BOTH editions: the live gate refuses a
+ * suspended/revoked/unavailable principal at the door, before any handler
+ * or entitlement check runs — a hub-wrapping entitlement layer would be a
+ * second, redundant enforcement path.
+ */
+export declare function bindEditionSeams(hub: HubConfig | null, local: EditionSeams, logger: Logger, deps: EditionBindingDeps): BoundEditionSeams;
+//# sourceMappingURL=edition.d.ts.map

package/dist/platform/edition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"edition.d.ts","sourceRoot":"","sources":["../../src/platform/edition.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAIhB,SAAS,EACV,MAAM,8BAA8B,CAAC;AAGtC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C;;;;;;GAMG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,cAAc,eAAsB,CAAC;AA2ClD,6FAA6F;AAC7F,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,YAAY,EAAE,kBAAkB,CAAC;IACjC,KAAK,EAAE,SAAS,CAAC;CAClB;AAED,gEAAgE;AAChE,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,EAAE,CAAC;IACP;;;;OAIG;IACH,UAAU,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;CAC3C;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAkB,SAAQ,YAAY;IACrD,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,SAAS,GAAG,IAAI,EACrB,KAAK,EAAE,YAAY,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,kBAAkB,GACvB,iBAAiB,CAuBnB"}

package/dist/platform/edition.js

@@ -0,0 +1,90 @@
+import { HUB_SSO_PROVIDER_ID } from '../identity/hub-sso.js';
+import { HubLiveGate } from '../identity/hub-live-gate.js';
+/**
+ * The edition split (internal/federation.md): one codebase, one Docker image,
+ * two seam bindings selected purely by instance config. This module is the
+ * ONLY place edition decides which implementations the boot-time registry
+ * gets — `oss` binds the local defaults byte-identically; `cloud` rebinds
+ * the hub-federating variants here.
+ */
+/**
+ * The hub SSO method name the cloud edition advertises in discovery — the
+ * better-auth `genericOAuth` providerId registered by identity/hub-sso.ts
+ * (its callback lands on /api/v1/auth/oauth2/callback/antasphere, the
+ * redirect URI in the hub's TOOL_REGISTRY entry).
+ */
+export const HUB_SSO_METHOD = HUB_SSO_PROVIDER_ID;
+/**
+ * The cloud identity binding. Request RESOLUTION stays exactly the local
+ * provider's — after the SSO callback mints an ordinary session, every
+ * request is sessions + live membership re-check (the live hub gate runs
+ * post-resolution in authContext, not here). What changes is the ADVERTISED
+ * entrance (D1, hub-only human login):
+ *
+ *  - `antasphere` replaces password/email-otp/google — the login page
+ *    renders ONLY "Sign in with Antasphere". The local password machinery
+ *    stays WIRED (hidden, not blocked): the break-glass CLI remains the
+ *    operator door, and blocking /sign-in/email would dead-end it.
+ *  - `passwordReset`/`emailChange` are off: credentials and email are the
+ *    HUB's to manage (D10 re-syncs email at every login); a local reset
+ *    surface would fight the sync. Since the P8 close (ADR 017) the reset
+ *    routes don't just report false — they REFUSE on cloud (403; the
+ *    before-hook in identity/better-auth.ts + the members reset-link mint),
+ *    so a hub-JIT user can never SET a local password and sidestep SSO.
+ *  - `twoFactor` is off: the second factor guards local password/OTP
+ *    sign-ins, which the cloud page no longer offers — MFA is the hub's
+ *    concern at its own login.
+ */
+class HubSsoIdentityProvider {
+    local;
+    constructor(local) {
+        this.local = local;
+    }
+    resolve(ctx) {
+        return this.local.resolve(ctx);
+    }
+    describe() {
+        return {
+            // Machine entrances are edition-independent; the human entrance is
+            // hub-only. 'oauth' stays: every instance is its own OAuth 2.1 AS for
+            // /mcp — the hub never appears in the MCP dance.
+            methods: [HUB_SSO_METHOD, 'api-key', 'oauth'],
+            passwordReset: false,
+            emailChange: false,
+            twoFactor: false
+        };
+    }
+}
+/**
+ * Bind the registry seams for this instance's edition. `hub` is the single
+ * switch: null (EDITION=oss) returns the local defaults UNTOUCHED — the
+ * self-host edition carries zero hub surface at runtime; a HubConfig
+ * (EDITION=cloud, validated at env parse) selects the cloud bindings.
+ *
+ * Entitlements bind LOCAL on BOTH editions: the live gate refuses a
+ * suspended/revoked/unavailable principal at the door, before any handler
+ * or entitlement check runs — a hub-wrapping entitlement layer would be a
+ * second, redundant enforcement path.
+ */
+export function bindEditionSeams(hub, local, logger, deps) {
+    if (!hub)
+        return local;
+    logger.info({ hubIssuer: hub.issuerUrl }, 'EDITION=cloud: hub SSO is the human entrance (identity resolution stays local sessions); ' +
+        'org/membership truth is reconciled live AS THE USER via each user’s own hub grant ' +
+        '(internal/federation.md).');
+    const gate = deps.reconciler
+        ? new HubLiveGate({ db: deps.db, reconciler: deps.reconciler, logger })
+        : undefined;
+    return {
+        // Hub-only entrance advertised; the SSO machinery itself (relying
+        // party, JIT, login reconcile) lives in identity/hub-sso.ts and is
+        // wired through createAuth — resolution stays local by design.
+        identity: new HubSsoIdentityProvider(local.identity),
+        entitlements: local.entitlements,
+        // D6: usage stays the local sink with a no-op downstream for v1; hub
+        // ingest is a one-class downstream swap when it ships (plan §4.3).
+        usage: local.usage,
+        ...(gate ? { principalGate: gate.assert } : {})
+    };
+}
+//# sourceMappingURL=edition.js.map

package/dist/platform/edition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"edition.js","sourceRoot":"","sources":["../../src/platform/edition.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAM3D;;;;;;GAMG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,sBAAsB;IACG;IAA7B,YAA6B,KAAuB;QAAvB,UAAK,GAAL,KAAK,CAAkB;IAAG,CAAC;IAExD,OAAO,CAAC,GAAmB;QACzB,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,QAAQ;QACN,OAAO;YACL,mEAAmE;YACnE,sEAAsE;YACtE,iDAAiD;YACjD,OAAO,EAAE,CAAC,cAAc,EAAE,SAAS,EAAE,OAAO,CAAC;YAC7C,aAAa,EAAE,KAAK;YACpB,WAAW,EAAE,KAAK;YAClB,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;CACF;AA6BD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAqB,EACrB,KAAmB,EACnB,MAAc,EACd,IAAwB;IAExB,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAEvB,MAAM,CAAC,IAAI,CACT,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,EAC5B,2FAA2F;QACzF,oFAAoF;QACpF,2BAA2B,CAC9B,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU;QAC1B,CAAC,CAAC,IAAI,WAAW,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QACvE,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,kEAAkE;QAClE,mEAAmE;QACnE,+DAA+D;QAC/D,QAAQ,EAAE,IAAI,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC;QACpD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,qEAAqE;QACrE,mEAAmE;QACnE,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;AACJ,CAAC"}