@antasphere/chassis-server 1.0.0

package/src/identity/hub-user-client.ts

@@ -0,0 +1,554 @@
+import { workspaceRoles, type WorkspaceRole } from '@antasphere/chassis-db';
+import type { Logger } from '../logger.js';
+import type { GrantAccess, HubGrantService } from './hub-grant.js';
+import { placeholderWorkspaceName } from './hub-projection.js';
+
+/**
+ * The as-the-user hub reader (internal/federation.md, live user-scoped
+ * federation): every org/membership read between logins is `GET
+ * <hub>/api/v1/orgs` presented with the USER's OWN grant token
+ * (identity/hub-grant.ts) — the hub only ever returns what that user may
+ * see, so a cross-tenant read is structurally impossible on this path.
+ * There is deliberately NO target-user parameter anywhere.
+ *
+ * Failure posture mirrors the retired H4 client: only a definitive 200
+ * list may drive reconciliation; network/timeout/5xx/malformed answers are
+ * one loud, fail-open 'inconclusive'. A 401/403 gets exactly ONE
+ * forced-refresh retry (the presented token may be stale or wrong-audience
+ * from a pre-flip row) — a second refusal is inconclusive, never a grant
+ * kill (only the token endpoint's `invalid_grant` kills a grant, inside
+ * HubGrantService).
+ */
+
+/** The hub API resource identifier (RFC 8707 `aud`) — `<hub issuer>/mcp`. */
+export function hubApiResource(issuerUrl: string): string {
+  return issuerUrl.replace(/\/+$/, '') + '/mcp';
+}
+
+/**
+ * One validated entry of the caller-scoped org list. Forward-compatible by
+ * construction: an absent `status` reads as 'active', an absent `isDefault`
+ * as false, an unknown `role` as null (keep-alive only — an unknown role
+ * must never read as absence).
+ */
+export interface HubOrg {
+  /** The hub org id (uuid) — what `workspaces.centralAccountId` projects. */
+  id: string;
+  /** Org display name; null when absent/blank. */
+  name: string | null;
+  role: WorkspaceRole | null;
+  status: 'active' | 'suspended';
+  /** The caller's hub-level default org (at most one entry carries it). */
+  isDefault: boolean;
+  /**
+   * The CALLER's own teams in this org (never the org's whole roster: the
+   * hub answers as the person). An absent or malformed field reads as none
+   * (a hub that predates teams); an entry without a uuid id is dropped.
+   */
+  teams: HubTeam[];
+}
+
+/** One of the caller's teams in an org, as `GET /orgs` carries it. */
+export interface HubTeam {
+  /** The hub's team id — what `workspace_teams.hub_team_id` projects. */
+  id: string;
+  slug: string;
+  name: string;
+}
+
+/**
+ * One of the caller's organizations that does NOT open this tool to them
+ * (the org restricts the tool to teams the caller is not in). The hub leaves
+ * such an org out of `orgs`; `denied` names it so the refusal page can say
+ * which organization to ask. A hint for the person, never an access input.
+ */
+export interface HubDeniedOrg {
+  id: string;
+  /** Org display name; the projection's placeholder when absent/blank. */
+  name: string;
+}
+
+export type HubOrgsResult =
+  | { kind: 'ok'; orgs: HubOrg[]; denied: HubDeniedOrg[] }
+  | { kind: 'no_link' }
+  | { kind: 'grant_dead' }
+  | { kind: 'inconclusive' };
+
+/**
+ * The organization's WHOLE team list as one member reads it (`GET
+ * <hub>/api/v1/teams`, PRDCT-2813), every team of the org whether or not the
+ * reader sits in it. `complete` is false when the drain stopped at its page
+ * cap with more pages left: the list is then a prefix, good for upserting,
+ * never for deleting what it does not name.
+ */
+export type HubOrgTeamsResult =
+  | { kind: 'ok'; teams: HubTeam[]; complete: boolean }
+  | { kind: 'inconclusive' }
+  | { kind: 'no_link' }
+  | { kind: 'grant_dead' };
+
+/** The page size of the team-list drain (the hub's own maximum). */
+const ORG_TEAMS_PAGE_LIMIT = 100;
+/** At most this many pages per read (1,000 teams), then the drain stops. */
+const ORG_TEAMS_MAX_PAGES = 10;
+
+/**
+ * The answer of one as-the-user org creation (PRDCT-2443):
+ *  - 'created': the hub answered 201 with a well-formed org;
+ *  - 'limit_reached': the hub's own per-user organization cap refused it;
+ *  - 'reauth_required': the hub answered 403 `insufficient_scope` — THIS
+ *    grant does not carry `orgs:create` (it predates the scope, or a CLI
+ *    connect replaced it). Not a dead grant and not a policy refusal: a
+ *    fresh browser sign-in mints a grant that has it;
+ *  - 'invalid': the hub refused the NAME (its validation, not ours);
+ *  - 'refused': any other definitive refusal (the hub does not let this
+ *    grant create organizations) — `code` is the hub's, for the log only;
+ *  - 'no_link' / 'grant_dead': the grant verdicts, verbatim from
+ *    HubGrantService;
+ *  - 'inconclusive': network/timeout/5xx/malformed. The organization MAY
+ *    exist at the hub (it commits before it answers); the caller never
+ *    retries by itself, and the next reconcile pass projects it if so.
+ */
+export type HubCreateOrgResult =
+  | { kind: 'created'; org: { id: string; name: string | null; role: WorkspaceRole | null } }
+  | { kind: 'limit_reached' }
+  | { kind: 'reauth_required' }
+  | { kind: 'invalid' }
+  | { kind: 'refused'; status: number; code: string | null }
+  | { kind: 'no_link' }
+  | { kind: 'grant_dead' }
+  | { kind: 'inconclusive' };
+
+/** The one-function boundary the workspace-creation route depends on (its test seam). */
+export type HubOrgCreator = (localUserId: string, name: string) => Promise<HubCreateOrgResult>;
+
+/** The hub's cap refusal codes — today's (`org_limit_reached`) and the `*_cap_reached` spelling. */
+const HUB_ORG_LIMIT_CODES = new Set(['org_limit_reached', 'org_cap_reached']);
+
+/**
+ * THE ONE PLACE that knows the shape of the hub's `POST /api/v1/orgs` answer
+ * (hub contract `orgCreatedSchema`: 201 `{ org: { id, name, role, … } }`;
+ * refusals in the common `{ error: { code } }` envelope). Pure, so the
+ * shape is adjustable — and testable — without touching the transport.
+ */
+export function classifyHubOrgCreateAnswer(status: number, body: unknown): HubCreateOrgResult {
+  const code =
+    typeof (body as { error?: { code?: unknown } } | null)?.error?.code === 'string'
+      ? (body as { error: { code: string } }).error.code
+      : null;
+  if (status === 201 || status === 200) {
+    const raw = ((body as { org?: unknown } | null)?.org ?? null) as {
+      id?: unknown;
+      name?: unknown;
+      role?: unknown;
+    } | null;
+    // A 2xx without a valid org id is unusable AND ambiguous (something was
+    // probably created): inconclusive, never a guess at the id.
+    if (!raw || typeof raw.id !== 'string' || !UUID_RE.test(raw.id)) return { kind: 'inconclusive' };
+    return {
+      kind: 'created',
+      org: {
+        id: raw.id,
+        name: typeof raw.name === 'string' && raw.name.trim() ? raw.name : null,
+        role:
+          typeof raw.role === 'string' && (workspaceRoles as readonly string[]).includes(raw.role)
+            ? (raw.role as WorkspaceRole)
+            : null
+      }
+    };
+  }
+  if ((status === 403 || status === 409) && code !== null && HUB_ORG_LIMIT_CODES.has(code)) {
+    return { kind: 'limit_reached' };
+  }
+  // Exactly the hub's scope refusal — never any other 403 (a registry
+  // refusal, `forbidden`, stays 'refused': signing in again would not help).
+  if (status === 403 && code === 'insufficient_scope') return { kind: 'reauth_required' };
+  if (status === 400 || status === 422) return { kind: 'invalid' };
+  if (status >= 400 && status < 500) return { kind: 'refused', status, code };
+  return { kind: 'inconclusive' };
+}
+
+/**
+ * Strict UUID shape, the one id rule of every list this file parses (orgs,
+ * teams, denied orgs). The hub's org and team ids are uuids, and they are
+ * written to Postgres (`workspaces.central_account_id`,
+ * `workspace_teams.hub_team_id`) or shown to the person: an entry of any
+ * other shape is not a hub id, so it is dropped with a log line and never
+ * stored.
+ */
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+/**
+ * An org entry's `teams` (forward-compatible: absent or not an array reads
+ * as none). An entry without a uuid id is dropped (UUID_RE); a missing slug
+ * or name reads as the empty string rather than dropping a seat the hub
+ * asserted.
+ */
+export function parseTeams(raw: unknown, logger: Logger): HubTeam[] {
+  if (!Array.isArray(raw)) return [];
+  const teams: HubTeam[] = [];
+  const seen = new Set<string>();
+  for (const item of raw) {
+    const team = (item ?? {}) as { id?: unknown; slug?: unknown; name?: unknown };
+    if (typeof team.id !== 'string' || !UUID_RE.test(team.id)) {
+      logger.warn('hub /orgs carried a team without a valid id — entry dropped');
+      continue;
+    }
+    if (seen.has(team.id)) continue;
+    seen.add(team.id);
+    teams.push({
+      id: team.id,
+      slug: typeof team.slug === 'string' ? team.slug : '',
+      name: typeof team.name === 'string' ? team.name : ''
+    });
+  }
+  return teams;
+}
+
+/**
+ * The body's top-level `denied` (absent or malformed reads as none; an entry
+ * without a uuid id is dropped, UUID_RE). A missing or blank name reads as
+ * the projection's placeholder, so every reader gets a name to show.
+ */
+export function parseDenied(raw: unknown, logger: Logger): HubDeniedOrg[] {
+  if (!Array.isArray(raw)) return [];
+  const denied: HubDeniedOrg[] = [];
+  for (const item of raw) {
+    const org = (item ?? {}) as { id?: unknown; name?: unknown };
+    if (typeof org.id !== 'string' || !UUID_RE.test(org.id)) {
+      logger.warn('hub /orgs carried a denied org without a valid id — entry dropped');
+      continue;
+    }
+    denied.push({
+      id: org.id,
+      name: typeof org.name === 'string' && org.name.trim() ? org.name : placeholderWorkspaceName(org.id)
+    });
+  }
+  return denied;
+}
+
+/** The SSO callback's access token, handed through by the login path. */
+export interface LoginAccessToken {
+  accessToken: string;
+  expiresAt: Date | null;
+}
+
+export interface HubUserClientOptions {
+  grant: HubGrantService;
+  /** The hub origin (HUB_ISSUER_URL) — /api/v1/orgs lives under it. */
+  issuerUrl: string;
+  logger: Logger;
+  /** Per-fetch timeout — tight, because reconcile passes are awaited in the identity path. */
+  timeoutMs: number;
+  /**
+   * POST /orgs fetch timeout. A creation is a deliberate human act awaited
+   * once, not an identity-path read: it gets the token-endpoint budget
+   * rather than the tight reconcile one. Defaults to `timeoutMs`.
+   */
+  createTimeoutMs?: number | undefined;
+  /** Test seam. */
+  fetchImpl?: typeof fetch;
+}
+
+export class HubUserClient {
+  private readonly base: string;
+  private readonly fetchImpl: typeof fetch;
+  /** An older hub without `GET /teams` is said once per client, never on every pass. */
+  private warnedNoTeamsRoute = false;
+
+  constructor(private readonly opts: HubUserClientOptions) {
+    this.base = opts.issuerUrl.replace(/\/+$/, '');
+    this.fetchImpl = opts.fetchImpl ?? fetch;
+  }
+
+  /**
+   * The user's own org list, as the hub sees it RIGHT NOW. `login` carries
+   * the SSO callback's access token (already hub-audienced — the code
+   * exchange sends the same `resource`): the login path needs no refresh,
+   * and the token is primed into the grant cache for the requests that
+   * follow.
+   */
+  async orgs(localUserId: string, login?: LoginAccessToken): Promise<HubOrgsResult> {
+    let token: string;
+    if (login) {
+      this.opts.grant.prime(localUserId, login.accessToken, login.expiresAt);
+      token = login.accessToken;
+    } else {
+      const access = await this.opts.grant.accessToken(localUserId);
+      if (access.kind !== 'ok') return { kind: access.kind };
+      token = access.accessToken;
+    }
+
+    let res = await this.get(token);
+    if (res.kind === 'error') return { kind: 'inconclusive' };
+    if (res.response.status === 401 || res.response.status === 403) {
+      // The hub refused the token (expired mid-window, or a pre-flip row's
+      // wrong-audience stored token): ONE forced refresh, ONE retry. The
+      // refresh itself classifies the grant (invalid_grant → dead).
+      this.opts.grant.invalidateAccess(localUserId);
+      const refreshed: GrantAccess = await this.opts.grant.refresh(localUserId);
+      if (refreshed.kind !== 'ok') return { kind: refreshed.kind };
+      res = await this.get(refreshed.accessToken);
+      if (res.kind === 'error') return { kind: 'inconclusive' };
+      if (res.response.status === 401 || res.response.status === 403) {
+        this.opts.logger.error(
+          { status: res.response.status },
+          'hub /orgs refused a FRESHLY refreshed token — the hub is rejecting this tool’s grants; failing open'
+        );
+        return { kind: 'inconclusive' };
+      }
+    }
+    const { response } = res;
+    if (!response.ok) {
+      this.opts.logger.warn({ status: response.status }, 'hub /orgs answered non-2xx — failing open');
+      return { kind: 'inconclusive' };
+    }
+    let body: unknown;
+    try {
+      body = await response.json();
+    } catch {
+      this.opts.logger.warn('hub /orgs body unparseable — failing open');
+      return { kind: 'inconclusive' };
+    }
+    const rawList = (body as { orgs?: unknown } | null)?.orgs;
+    if (!Array.isArray(rawList)) {
+      this.opts.logger.warn('hub /orgs body malformed — failing open');
+      return { kind: 'inconclusive' };
+    }
+    const orgs: HubOrg[] = [];
+    for (const raw of rawList) {
+      const entry = (raw ?? {}) as {
+        id?: unknown;
+        name?: unknown;
+        role?: unknown;
+        status?: unknown;
+        isDefault?: unknown;
+        teams?: unknown;
+      };
+      if (typeof entry.id !== 'string' || !UUID_RE.test(entry.id)) {
+        // One bad entry never poisons the list — but its org can neither be
+        // projected NOR protected by the keep-set, so say so loudly.
+        this.opts.logger.error('hub /orgs carried an entry without a valid id — entry dropped');
+        continue;
+      }
+      const role =
+        typeof entry.role === 'string' && (workspaceRoles as readonly string[]).includes(entry.role)
+          ? (entry.role as WorkspaceRole)
+          : null;
+      if (role === null) {
+        this.opts.logger.warn(
+          { hubOrgId: entry.id },
+          'hub /orgs carried an unknown role — keeping the membership alive, skipping its sync'
+        );
+      }
+      orgs.push({
+        id: entry.id,
+        name: typeof entry.name === 'string' && entry.name.trim() ? entry.name : null,
+        role,
+        // Unknown/absent status reads as 'active' (forward-compat: status
+        // only ever narrows access; enforcement reads the synced column).
+        status: entry.status === 'suspended' ? 'suspended' : 'active',
+        isDefault: entry.isDefault === true,
+        teams: parseTeams(entry.teams, this.opts.logger)
+      });
+    }
+    return { kind: 'ok', orgs, denied: parseDenied((body as { denied?: unknown }).denied, this.opts.logger) };
+  }
+
+  /**
+   * The organization's whole team list, read AS THE USER (PRDCT-2813): `GET
+   * <hub>/api/v1/teams` with the person's own grant token and the hub org in
+   * `X-Workspace-Id`, which the hub answers for any member of that org. Same
+   * posture as `orgs()`: one forced refresh and one retry on a 401/403 (once
+   * for the whole drain), `inconclusive` on any doubt (network, non-2xx,
+   * unparseable or malformed page). The pages are drained through
+   * `nextCursor`, at most ORG_TEAMS_MAX_PAGES of them; a list cut there is
+   * returned with `complete: false`.
+   */
+  async orgTeams(localUserId: string, hubOrgId: string): Promise<HubOrgTeamsResult> {
+    const access = await this.opts.grant.accessToken(localUserId);
+    if (access.kind !== 'ok') return { kind: access.kind };
+    let token = access.accessToken;
+    let retried = false;
+    const teams: HubTeam[] = [];
+    const seen = new Set<string>();
+    let cursor: string | null = null;
+
+    for (let page = 0; page < ORG_TEAMS_MAX_PAGES; page++) {
+      let res = await this.getTeamsPage(token, hubOrgId, cursor);
+      if (res.kind === 'error') return { kind: 'inconclusive' };
+      if ((res.response.status === 401 || res.response.status === 403) && !retried) {
+        retried = true;
+        this.opts.grant.invalidateAccess(localUserId);
+        const refreshed: GrantAccess = await this.opts.grant.refresh(localUserId);
+        if (refreshed.kind !== 'ok') return { kind: refreshed.kind };
+        token = refreshed.accessToken;
+        res = await this.getTeamsPage(token, hubOrgId, cursor);
+        if (res.kind === 'error') return { kind: 'inconclusive' };
+      }
+      const { response } = res;
+      if (response.status === 404) {
+        if (!this.warnedNoTeamsRoute) {
+          this.warnedNoTeamsRoute = true;
+          this.opts.logger.warn(
+            'hub /teams answered 404 — a hub without the team list; only the members’ own teams are projected'
+          );
+        }
+        return { kind: 'inconclusive' };
+      }
+      if (!response.ok) {
+        this.opts.logger.warn(
+          { status: response.status, hubOrgId },
+          'hub /teams answered non-2xx — failing open'
+        );
+        return { kind: 'inconclusive' };
+      }
+      let body: unknown;
+      try {
+        body = await response.json();
+      } catch {
+        this.opts.logger.warn({ hubOrgId }, 'hub /teams body unparseable — failing open');
+        return { kind: 'inconclusive' };
+      }
+      const raw = (body as { teams?: unknown; nextCursor?: unknown } | null) ?? {};
+      if (!Array.isArray(raw.teams)) {
+        this.opts.logger.warn({ hubOrgId }, 'hub /teams body malformed — failing open');
+        return { kind: 'inconclusive' };
+      }
+      const pageTeams = parseTeams(raw.teams, this.opts.logger);
+      // The hub pages on the id of the last row alone, and its teams are
+      // hard-deleted: a cursor whose team went between two page reads answers
+      // an EMPTY page with no cursor, which reads exactly like the end of the
+      // list. It is not: what was never read must not be deleted here
+      // (verifier round 1, F1). A page reached THROUGH a cursor that carries
+      // nothing is a cut list, upserted and deleted from nothing.
+      if (page > 0 && pageTeams.length === 0) {
+        this.opts.logger.warn(
+          { hubOrgId, teams: teams.length },
+          'hub /teams answered an empty page behind a cursor (the cursor’s team went) — upserting what was read, deleting nothing'
+        );
+        return { kind: 'ok', teams, complete: false };
+      }
+      for (const team of pageTeams) {
+        if (seen.has(team.id)) continue;
+        seen.add(team.id);
+        teams.push(team);
+      }
+      cursor = typeof raw.nextCursor === 'string' && raw.nextCursor !== '' ? raw.nextCursor : null;
+      if (cursor === null) return { kind: 'ok', teams, complete: true };
+    }
+    this.opts.logger.warn(
+      { hubOrgId, teams: teams.length },
+      'hub /teams has more pages than one read drains — upserting what was read, deleting nothing'
+    );
+    return { kind: 'ok', teams, complete: false };
+  }
+
+  /**
+   * Create an organization at the hub AS THE USER (PRDCT-2443): `POST
+   * <hub>/api/v1/orgs` `{ name }` presented with the user's OWN grant token,
+   * obtained through the SAME HubGrantService path `orgs()` uses (cache →
+   * single-flighted refresh; the PRDCT-1370 presentation record and probe
+   * live inside it). No service key, no target-user parameter: the hub makes
+   * the BEARER the owner, so the only organization this can ever create is
+   * the caller's own.
+   *
+   * Retry posture, deliberately narrower than the read's: ONLY a 401 earns
+   * the one forced-refresh retry (the hub refused the token before doing
+   * anything, so nothing was created). A 403 is a definitive policy answer
+   * (the cap, or a hub that does not open creation to grants) and a
+   * network/timeout/5xx answer is NEVER retried — the hub commits before it
+   * answers, so a blind second POST could create a second organization.
+   */
+  async createOrg(localUserId: string, name: string): Promise<HubCreateOrgResult> {
+    const access = await this.opts.grant.accessToken(localUserId);
+    if (access.kind !== 'ok') return { kind: access.kind };
+
+    let res = await this.post(access.accessToken, name);
+    if (res.kind === 'error') return { kind: 'inconclusive' };
+    if (res.response.status === 401) {
+      this.opts.grant.invalidateAccess(localUserId);
+      const refreshed: GrantAccess = await this.opts.grant.refresh(localUserId);
+      if (refreshed.kind !== 'ok') return { kind: refreshed.kind };
+      res = await this.post(refreshed.accessToken, name);
+      if (res.kind === 'error') return { kind: 'inconclusive' };
+      if (res.response.status === 401) {
+        this.opts.logger.error(
+          'hub POST /orgs refused a FRESHLY refreshed token — the hub is rejecting this tool’s grants'
+        );
+        return { kind: 'refused', status: 401, code: null };
+      }
+    }
+    let body: unknown = null;
+    try {
+      body = await res.response.json();
+    } catch {
+      body = null;
+    }
+    const result = classifyHubOrgCreateAnswer(res.response.status, body);
+    if (result.kind === 'inconclusive' || result.kind === 'refused') {
+      this.opts.logger.warn(
+        { status: res.response.status, code: result.kind === 'refused' ? result.code : undefined },
+        'hub POST /orgs did not create the organization'
+      );
+    }
+    return result;
+  }
+
+  private async post(
+    token: string,
+    name: string
+  ): Promise<{ kind: 'ok'; response: Response } | { kind: 'error' }> {
+    try {
+      const response = await this.fetchImpl(`${this.base}/api/v1/orgs`, {
+        method: 'POST',
+        headers: {
+          authorization: `Bearer ${token}`,
+          accept: 'application/json',
+          'content-type': 'application/json'
+        },
+        body: JSON.stringify({ name }),
+        signal: AbortSignal.timeout(this.opts.createTimeoutMs ?? this.opts.timeoutMs)
+      });
+      return { kind: 'ok', response };
+    } catch (err) {
+      this.opts.logger.warn({ err }, 'hub POST /orgs fetch failed — the organization may or may not exist');
+      return { kind: 'error' };
+    }
+  }
+
+  private async getTeamsPage(
+    token: string,
+    hubOrgId: string,
+    cursor: string | null
+  ): Promise<{ kind: 'ok'; response: Response } | { kind: 'error' }> {
+    const query = `limit=${ORG_TEAMS_PAGE_LIMIT}${cursor === null ? '' : `&cursor=${encodeURIComponent(cursor)}`}`;
+    try {
+      const response = await this.fetchImpl(`${this.base}/api/v1/teams?${query}`, {
+        headers: {
+          authorization: `Bearer ${token}`,
+          accept: 'application/json',
+          'x-workspace-id': hubOrgId
+        },
+        signal: AbortSignal.timeout(this.opts.timeoutMs)
+      });
+      return { kind: 'ok', response };
+    } catch (err) {
+      this.opts.logger.warn({ err, hubOrgId }, 'hub /teams fetch failed — failing open');
+      return { kind: 'error' };
+    }
+  }
+
+  private async get(token: string): Promise<{ kind: 'ok'; response: Response } | { kind: 'error' }> {
+    try {
+      const response = await this.fetchImpl(`${this.base}/api/v1/orgs`, {
+        headers: { authorization: `Bearer ${token}`, accept: 'application/json' },
+        signal: AbortSignal.timeout(this.opts.timeoutMs)
+      });
+      return { kind: 'ok', response };
+    } catch (err) {
+      this.opts.logger.warn({ err }, 'hub /orgs fetch failed — failing open');
+      return { kind: 'error' };
+    }
+  }
+}

package/src/identity/index.ts

@@ -0,0 +1,56 @@
+export {
+  type AccountEvent,
+  type Auth,
+  createAuth,
+  mcpResourceUrl,
+  signInOriginRefused,
+  trustedOriginsFor
+} from './better-auth.js';
+export {
+  DEMO_PASS_DEFAULT_MINUTES,
+  DEMO_PASS_MAX_MINUTES,
+  DEMO_PASS_MAX_PATH_LENGTH,
+  DEMO_SESSION_REFUSED_API_ROUTES,
+  DEMO_SESSION_REFUSED_AUTH_PATHS,
+  type DemoSessionRefusedApiRoute,
+  demoSessionApiRefusalMessage,
+  demoSessionAuthRefusal,
+  isDemoAddress,
+  isDemoSignInHost,
+  isSafeDemoPath,
+  parseDemoEmailDomains,
+  parseDemoHosts
+} from './demo-pass-rules.js';
+export {
+  DEFAULT_GRANT_DIALS,
+  type GrantAccess,
+  HubGrantService,
+  LOCK_WATCHDOG_HEADROOM_MS
+} from './hub-grant.js';
+export { HubJwtVerifier } from './hub-jwt.js';
+export { HubLogoutService, hintCookieClearHeader } from './hub-logout.js';
+export { projectOrgMembership } from './hub-projection.js';
+export {
+  DEFAULT_FEDERATION_DIALS,
+  type HubFederationDials,
+  HubOrgReconciler,
+  type ReconcilePassOutcome
+} from './hub-reconcile.js';
+export {
+  HUB_SSO_PROVIDER_ID,
+  HUB_SSO_SCOPES,
+  type HubConnectAssertion,
+  HubSsoLoginError,
+  HubSsoService,
+  ssoAuthorizationUrlParams
+} from './hub-sso.js';
+export {
+  type HubCreateOrgResult,
+  type HubOrgCreator,
+  HubUserClient,
+  classifyHubOrgCreateAnswer,
+  hubApiResource
+} from './hub-user-client.js';
+export { OauthJwtVerifier } from './oauth-jwt.js';
+export { type OnWorkspaceMiss, resolveMembership } from './resolve-membership.js';
+export { preflightSigningKey, retireSigningKey, runSigningKeyCli } from './signing-key.js';