@antseed/cli 0.1.178 → 0.1.180

package/dist/gateway/console-api/access.js

@@ -0,0 +1,171 @@
+import { clientIp } from '../auth/http.js';
+import { recordAudit } from '../services/context.js';
+import { ConsoleError } from './router.js';
+/**
+ * Role checks for console routes. Members are re-read from the store on
+ * every check so a role change or a disabled member takes effect at once,
+ * whatever the session cached. Management tokens act as org admins; the API
+ * server already refuses read-scope tokens on anything but GET.
+ */
+function unauthorized() {
+    return new ConsoleError(401, 'unauthorized', 'Sign in to continue');
+}
+function forbidden(message = 'You do not have access to this') {
+    return new ConsoleError(403, 'forbidden', message);
+}
+/** The live member behind a principal, or null for keys and tokens. Throws when the member is no longer active. */
+export function activeMember(store, p) {
+    if (!p)
+        throw unauthorized();
+    if (p.kind !== 'member')
+        return null;
+    const member = store.getMember(p.memberId);
+    if (!member || member.status !== 'active')
+        throw unauthorized();
+    return member;
+}
+export function isOrgAdmin(store, p) {
+    if (!p)
+        return false;
+    if (p.kind === 'token')
+        return true;
+    if (p.kind === 'key')
+        return false;
+    const member = store.getMember(p.memberId);
+    return Boolean(member && member.status === 'active' && (member.orgRole === 'owner' || member.orgRole === 'admin'));
+}
+/**
+ * Org owner or admin (or a management token). The store argument is
+ * optional to keep the spec'd signature; without it the principal's own
+ * claim is trusted.
+ */
+export function requireOrgAdmin(p, store) {
+    if (!p)
+        throw unauthorized();
+    if (p.kind === 'token')
+        return;
+    if (p.kind === 'key')
+        throw forbidden('API-key sessions are read-only');
+    if (store) {
+        activeMember(store, p);
+        if (!isOrgAdmin(store, p))
+            throw forbidden('Only organization admins can do this');
+        return;
+    }
+    if (p.orgRole !== 'owner' && p.orgRole !== 'admin')
+        throw forbidden('Only organization admins can do this');
+}
+/** The caller's role in a workspace: org admins and tokens count as workspace admins. */
+export function workspaceRole(store, p, workspaceId) {
+    if (!p || p.kind === 'key')
+        return null;
+    if (isOrgAdmin(store, p))
+        return 'admin';
+    if (p.kind !== 'member')
+        return null;
+    const member = store.getMember(p.memberId);
+    if (!member || member.status !== 'active')
+        return null;
+    return store.memberWorkspaceRoles(p.memberId).get(workspaceId) ?? null;
+}
+export function requireWorkspaceAccess(store, p, workspaceId, minRole = 'member') {
+    if (!p)
+        throw unauthorized();
+    if (p.kind === 'member')
+        activeMember(store, p);
+    if (!store.getWorkspace(workspaceId))
+        throw new ConsoleError(404, 'not_found', 'Workspace not found');
+    const role = workspaceRole(store, p, workspaceId);
+    if (!role)
+        throw forbidden('You are not a member of this workspace');
+    if (minRole === 'admin' && role !== 'admin')
+        throw forbidden('Only workspace admins can do this');
+}
+export function canSeeWorkspace(store, p, workspaceId) {
+    if (!store.getWorkspace(workspaceId))
+        return false;
+    return workspaceRole(store, p, workspaceId) !== null;
+}
+/** Workspaces the caller can open; null means all of them. */
+export function visibleWorkspaceIds(store, p) {
+    if (isOrgAdmin(store, p))
+        return null;
+    if (!p || p.kind !== 'member')
+        return new Set();
+    return new Set(store.memberWorkspaceRoles(p.memberId).keys());
+}
+/**
+ * Keys whose usage and request log the caller may read; null means all.
+ * A key session sees its key; a member sees every key in workspaces they
+ * administer plus their own keys elsewhere.
+ */
+export function visibleKeyIds(store, p) {
+    if (!p)
+        throw unauthorized();
+    if (p.kind === 'key')
+        return [p.keyId];
+    if (isOrgAdmin(store, p))
+        return null;
+    if (p.kind !== 'member')
+        return [];
+    activeMember(store, p);
+    const roles = store.memberWorkspaceRoles(p.memberId);
+    return store.listKeys()
+        .filter((key) => roles.get(key.workspaceId) === 'admin' || (key.ownerMemberId === p.memberId && roles.has(key.workspaceId)))
+        .map((key) => key.id);
+}
+// ── Audit helpers ─────────────────────────────────────────────────────────
+/** The audit-log actor for a principal (null → system). */
+export function auditActor(store, p) {
+    if (!p)
+        return { kind: 'system', id: null, label: null };
+    try {
+        if (p.kind === 'member')
+            return { kind: 'member', id: p.memberId, label: store.getMember(p.memberId)?.label ?? null };
+        if (p.kind === 'key')
+            return { kind: 'key', id: p.keyId, label: store.getKey(p.keyId)?.label ?? null };
+        return { kind: 'token', id: p.tokenId, label: store.getAdminToken(p.tokenId)?.label ?? null };
+    }
+    catch {
+        return { kind: p.kind, id: principalId(p), label: null };
+    }
+}
+function principalId(p) {
+    if (p.kind === 'member')
+        return p.memberId;
+    if (p.kind === 'key')
+        return p.keyId;
+    return p.tokenId;
+}
+/**
+ * Client address of a console request. `CF-Connecting-IP` is believed only
+ * when the gateway runs behind its own Cloudflare tunnel
+ * (`deps.trustCloudflareHeaders`); otherwise the last `X-Forwarded-For`
+ * hop added by a loopback proxy, else the socket peer.
+ */
+export function requestIp(request, deps) {
+    if (!request.raw?.socket)
+        return null;
+    return clientIp(request.raw, { trustCloudflare: deps?.trustCloudflareHeaders === true });
+}
+/**
+ * Records one mutating console action. Never throws: a failed write is
+ * logged loudly instead, since the action itself already happened.
+ *
+ *   audit(deps, request, 'preset.update', { kind: 'preset', id, label: name }, { before, after })
+ */
+export function audit(deps, request, action, target = null, details = {}) {
+    recordAudit(deps, requestActor(deps, request), action, target, details);
+}
+/** The audit actor and client address of a console request, for the shared services. */
+export function requestActor(deps, request) {
+    let ip = null;
+    try {
+        ip = requestIp(request, deps);
+    }
+    catch {
+        ip = null;
+    }
+    return { actor: auditActor(deps.store, request.principal), ip };
+}
+//# sourceMappingURL=access.js.map

package/dist/gateway/console-api/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../../src/gateway/console-api/access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC1C,OAAO,EAAE,WAAW,EAAc,MAAM,wBAAwB,CAAA;AAEhE,OAAO,EAAE,YAAY,EAAuC,MAAM,aAAa,CAAA;AAG/E;;;;;GAKG;AAEH,SAAS,YAAY;IACnB,OAAO,IAAI,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,qBAAqB,CAAC,CAAA;AACrE,CAAC;AAED,SAAS,SAAS,CAAC,OAAO,GAAG,gCAAgC;IAC3D,OAAO,IAAI,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;AACpD,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,YAAY,CAAC,KAAmB,EAAE,CAAmB;IACnE,IAAI,CAAC,CAAC;QAAE,MAAM,YAAY,EAAE,CAAA;IAC5B,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,YAAY,EAAE,CAAA;IAC/D,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAmB,EAAE,CAAmB;IACjE,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IACpB,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,KAAK,CAAA;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC1C,OAAO,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAA;AACpH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,CAAmB,EAAE,KAAoB;IACvE,IAAI,CAAC,CAAC;QAAE,MAAM,YAAY,EAAE,CAAA;IAC5B,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;QAAE,OAAM;IAC9B,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;QAAE,MAAM,SAAS,CAAC,gCAAgC,CAAC,CAAA;IACvE,IAAI,KAAK,EAAE,CAAC;QACV,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;QACtB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;YAAE,MAAM,SAAS,CAAC,sCAAsC,CAAC,CAAA;QAClF,OAAM;IACR,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO;QAAE,MAAM,SAAS,CAAC,sCAAsC,CAAC,CAAA;AAC7G,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,aAAa,CAAC,KAAmB,EAAE,CAAmB,EAAE,WAAmB;IACzF,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IACvC,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QAAE,OAAO,OAAO,CAAA;IACxC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACtD,OAAO,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAA;AACxE,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAmB,EAAE,CAAmB,EAAE,WAAmB,EAAE,UAA8B,QAAQ;IAC1I,IAAI,CAAC,CAAC;QAAE,MAAM,YAAY,EAAE,CAAA;IAC5B,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IAC/C,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,qBAAqB,CAAC,CAAA;IACrG,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,EAAE,CAAC,EAAE,WAAW,CAAC,CAAA;IACjD,IAAI,CAAC,IAAI;QAAE,MAAM,SAAS,CAAC,wCAAwC,CAAC,CAAA;IACpE,IAAI,OAAO,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;QAAE,MAAM,SAAS,CAAC,mCAAmC,CAAC,CAAA;AACnG,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAmB,EAAE,CAAmB,EAAE,WAAmB;IAC3F,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAA;IAClD,OAAO,aAAa,CAAC,KAAK,EAAE,CAAC,EAAE,WAAW,CAAC,KAAK,IAAI,CAAA;AACtD,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,mBAAmB,CAAC,KAAmB,EAAE,CAAmB;IAC1E,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACrC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,GAAG,EAAE,CAAA;IAC/C,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;AAC/D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAmB,EAAE,CAAmB;IACpE,IAAI,CAAC,CAAC;QAAE,MAAM,YAAY,EAAE,CAAA;IAC5B,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACtC,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACrC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAA;IAClC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACtB,MAAM,KAAK,GAAG,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IACpD,OAAO,KAAK,CAAC,QAAQ,EAAE;SACpB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;SAC3H,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;AACzB,CAAC;AAED,6EAA6E;AAE7E,2DAA2D;AAC3D,MAAM,UAAU,UAAU,CAAC,KAAmE,EAAE,CAAmB;IACjH,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IACxD,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,IAAI,IAAI,EAAE,CAAA;QACrH,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,IAAI,EAAE,CAAA;QACtG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,IAAI,IAAI,EAAE,CAAA;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,CAAY;IAC/B,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAA;IAC1C,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,CAAC,CAAC,KAAK,CAAA;IACpC,OAAO,CAAC,CAAC,OAAO,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,OAAoC,EAAE,IAA2C;IACzG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM;QAAE,OAAO,IAAI,CAAA;IACrC,OAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,sBAAsB,KAAK,IAAI,EAAE,CAAC,CAAA;AAC1F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CACnB,IAA6D,EAC7D,OAAkD,EAClD,MAAc,EACd,SAA+B,IAAI,EACnC,UAAmC,EAAE;IAErC,WAAW,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;AACzE,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,IAA+D,EAAE,OAAkD;IAC9I,IAAI,EAAE,GAAkB,IAAI,CAAA;IAC5B,IAAI,CAAC;QACH,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,EAAE,GAAG,IAAI,CAAA;IACX,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAA;AACjE,CAAC"}

package/dist/gateway/console-api/deps.d.ts

@@ -0,0 +1,52 @@
+import type { BuyerAddressBook } from '../services/wallet-address.js';
+import type { HostFacts } from '../exposure.js';
+import type { GatewayStore } from '../store.js';
+import type { AuthConfig, Member } from './types.js';
+/** What every console route module gets. */
+export interface ConsoleDeps {
+    store: GatewayStore;
+    dataDir: string;
+    configPath: string;
+    buyerPort: number;
+    controlSecret: string;
+    publicUrl: string | null;
+    version: string;
+    now: () => number;
+    log: (m: string) => void;
+    /**
+     * The running buyer's identity → wallet address (null when unreachable),
+     * the source of truth for workspace wallets. `createConsoleApi` fills it
+     * from `buyerPort` when not set.
+     */
+    buyerAddresses?: BuyerAddressBook;
+    /**
+     * Session revocation. `createConsoleApi` fills this from its ConsoleAuth
+     * before calling the registrars, so route modules never need the auth
+     * object itself.
+     */
+    sessions?: {
+        revokeMemberSessions(memberId: string): void;
+        revokeKeySessions(keyId: string): void;
+    };
+    /** A member's sign-in credentials (auth owns that table); empty when not wired. */
+    memberCredentials?: (memberId: string) => Member['credentials'];
+    /** Auth configuration for `GET /settings`; a conservative default when not wired. */
+    authConfig?: () => Promise<AuthConfig> | AuthConfig;
+    /** Spend feed state of the running gateway, for `GET /status`. */
+    spendFeedState?: () => string;
+    /** Whether x402 top-ups are enabled, for `GET /status`. */
+    x402Enabled?: boolean;
+    /**
+     * The gateway is published through its own Cloudflare tunnel, so a
+     * `CF-Connecting-IP` header arriving over loopback was set by Cloudflare.
+     */
+    trustCloudflareHeaders?: boolean;
+    /**
+     * Address the gateway listens on, for `GET /status` exposure checks. When
+     * absent the saved console location is used.
+     */
+    listenHost?: string;
+    /** Host facts for exposure checks; inspected at startup when absent (tests inject them). */
+    hostFacts?: HostFacts;
+}
+//# sourceMappingURL=deps.d.ts.map

package/dist/gateway/console-api/deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps.d.ts","sourceRoot":"","sources":["../../../src/gateway/console-api/deps.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AAEpD,4CAA4C;AAC5C,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,YAAY,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,MAAM,CAAA;IACjB,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;IACxB;;;;OAIG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAA;IACjC;;;;OAIG;IACH,QAAQ,CAAC,EAAE;QAAE,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;IACnG,mFAAmF;IACnF,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC,aAAa,CAAC,CAAA;IAC/D,qFAAqF;IACrF,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,UAAU,CAAA;IACnD,kEAAkE;IAClE,cAAc,CAAC,EAAE,MAAM,MAAM,CAAA;IAC7B,2DAA2D;IAC3D,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,4FAA4F;IAC5F,SAAS,CAAC,EAAE,SAAS,CAAA;CACtB"}

package/dist/gateway/console-api/deps.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=deps.js.map

package/dist/gateway/console-api/deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps.js","sourceRoot":"","sources":["../../../src/gateway/console-api/deps.ts"],"names":[],"mappings":""}

package/dist/gateway/console-api/handlers/admin-tokens.d.ts

@@ -0,0 +1,8 @@
+import type { ConsoleDeps } from '../deps.js';
+import { type ConsoleRouter } from '../router.js';
+/**
+ * Management tokens: org admins (signed in, not via another token) mint and
+ * revoke them (rules in `services/tokens.ts`).
+ */
+export declare function registerAdminTokenRoutes(router: ConsoleRouter, deps: ConsoleDeps): void;
+//# sourceMappingURL=admin-tokens.d.ts.map

package/dist/gateway/console-api/handlers/admin-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-tokens.d.ts","sourceRoot":"","sources":["../../../../src/gateway/console-api/handlers/admin-tokens.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,EAAW,KAAK,aAAa,EAAE,MAAM,cAAc,CAAA;AAiB1D;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA2BvF"}

package/dist/gateway/console-api/handlers/admin-tokens.js

@@ -0,0 +1,48 @@
+import { createAdminToken, revokeAdminToken, tokenExpiry } from '../../services/tokens.js';
+import { requestActor, requireOrgAdmin } from '../access.js';
+import { respond } from '../router.js';
+import { asObject, badRequest, notFound, requiredString } from '../serialize.js';
+function tokenDto(token) {
+    return {
+        id: token.id,
+        label: token.label,
+        hint: token.hint,
+        scope: token.scope,
+        createdByMemberId: token.createdBy,
+        expiresAt: token.expiresAt,
+        createdAt: token.createdAt,
+        lastUsedAt: token.lastUsedAt,
+    };
+}
+/**
+ * Management tokens: org admins (signed in, not via another token) mint and
+ * revoke them (rules in `services/tokens.ts`).
+ */
+export function registerAdminTokenRoutes(router, deps) {
+    const { store } = deps;
+    router.add('GET', '/admin-tokens', async ({ principal }) => {
+        requireOrgAdmin(principal, store);
+        return store.listAdminTokens().map(tokenDto);
+    }, { allow: ['member'] });
+    router.add('POST', '/admin-tokens', async (request) => {
+        const { principal, body } = request;
+        requireOrgAdmin(principal, store);
+        const input = asObject(body);
+        const label = requiredString(input, 'label');
+        const scope = input['scope'] ?? 'read';
+        if (scope !== 'admin' && scope !== 'read')
+            throw badRequest('scope must be admin or read');
+        const caller = principal?.kind === 'member' ? store.getMember(principal.memberId) : null;
+        const expiresAt = tokenExpiry(input['expiresInDays'], deps.now(), caller?.orgRole === 'owner');
+        const { token, secret } = createAdminToken(deps, requestActor(deps, request), { label, scope, expiresAt, createdBy: caller?.id ?? null });
+        return respond(201, { token: tokenDto(token), secret });
+    }, { allow: ['member'] });
+    router.add('DELETE', '/admin-tokens/:id', async (request) => {
+        requireOrgAdmin(request.principal, store);
+        const { revoked } = revokeAdminToken(deps, requestActor(deps, request), request.params['id']);
+        if (!revoked)
+            throw notFound('Token');
+        return respond(204);
+    }, { allow: ['member'] });
+}
+//# sourceMappingURL=admin-tokens.js.map

package/dist/gateway/console-api/handlers/admin-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-tokens.js","sourceRoot":"","sources":["../../../../src/gateway/console-api/handlers/admin-tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAE1F,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAE5D,OAAO,EAAE,OAAO,EAAsB,MAAM,cAAc,CAAA;AAC1D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAGhF,SAAS,QAAQ,CAAC,KAAuB;IACvC,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,iBAAiB,EAAE,KAAK,CAAC,SAAS;QAClC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAqB,EAAE,IAAiB;IAC/E,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;IAEtB,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;QACzD,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QACjC,OAAO,KAAK,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC9C,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAEzB,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACpD,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;QACnC,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC5B,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,MAAM,CAAA;QACtC,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,MAAM;YAAE,MAAM,UAAU,CAAC,6BAA6B,CAAC,CAAA;QAC1F,MAAM,MAAM,GAAG,SAAS,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACxF,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC,CAAA;QAC9F,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;QACzI,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;IACzD,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAEzB,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,mBAAmB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC1D,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QACzC,MAAM,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAE,CAAC,CAAA;QAC9F,IAAI,CAAC,OAAO;YAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;QACrC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAA;IACrB,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;AAC3B,CAAC"}

package/dist/gateway/console-api/handlers/audit.d.ts

@@ -0,0 +1,8 @@
+import type { ConsoleDeps } from '../deps.js';
+import type { ConsoleRouter } from '../router.js';
+/**
+ * `GET /audit?before=&limit=&actor=&action=` (org admins and tokens): the
+ * audit log, newest first (see `services/audit.ts`).
+ */
+export declare function registerAuditRoutes(router: ConsoleRouter, deps: ConsoleDeps): void;
+//# sourceMappingURL=audit.d.ts.map

package/dist/gateway/console-api/handlers/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../../src/gateway/console-api/handlers/audit.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAGjD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAWlF"}

package/dist/gateway/console-api/handlers/audit.js

@@ -0,0 +1,19 @@
+import { listAuditEntries } from '../../services/audit.js';
+import { requireOrgAdmin } from '../access.js';
+/**
+ * `GET /audit?before=&limit=&actor=&action=` (org admins and tokens): the
+ * audit log, newest first (see `services/audit.ts`).
+ */
+export function registerAuditRoutes(router, deps) {
+    router.add('GET', '/audit', async ({ principal, query }) => {
+        requireOrgAdmin(principal, deps.store);
+        const rawLimit = query.get('limit');
+        return listAuditEntries(deps.store, {
+            before: query.get('before'),
+            ...(rawLimit === null ? {} : { limit: Number(rawLimit) }),
+            actorId: query.get('actor'),
+            action: query.get('action'),
+        });
+    });
+}
+//# sourceMappingURL=audit.js.map

package/dist/gateway/console-api/handlers/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../../src/gateway/console-api/handlers/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAK9C;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAqB,EAAE,IAAiB;IAC1E,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAiE,EAAE;QACxH,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACnC,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE;YAClC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC3B,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;YAC3B,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;SAC5B,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/gateway/console-api/handlers/audit.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=audit.test.d.ts.map

package/dist/gateway/console-api/handlers/audit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.test.d.ts","sourceRoot":"","sources":["../../../../src/gateway/console-api/handlers/audit.test.ts"],"names":[],"mappings":""}

package/dist/gateway/console-api/handlers/audit.test.js

@@ -0,0 +1,241 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { auditActor, requestIp } from '../access.js';
+import { FakeConsoleAuth, addActiveMember, call, memberPrincipal, startConsole, tempDataDir, testDeps } from '../test-support.js';
+import { coreConsoleRegistrars } from './index.js';
+import { narrowedOwnerLimits } from '../../services/keys.js';
+const NO_LIMITS = { daily: null, weekly: null, monthly: null, total: null };
+const DAY_MS = 24 * 60 * 60 * 1000;
+function seed(store, auth) {
+    const owner = store.createOwner({ label: 'Owner', email: 'owner@example.test' });
+    const add = (label, orgRole, workspaces) => addActiveMember(store, label, { orgRole, workspaces, createdBy: owner.id });
+    const wsA = store.createWorkspace({ name: 'Alpha', buyerIdentity: 'ws-alpha' });
+    const admin = add('Admin', 'admin', []);
+    const wsAdmin = add('Ws admin', 'member', [{ workspaceId: wsA.id, role: 'admin' }]);
+    const memberA = add('Member A', 'member', [{ workspaceId: wsA.id, role: 'member' }]);
+    const keyA = store.createKey({ label: 'A key', workspaceId: wsA.id, ownerMemberId: memberA.id, limits: NO_LIMITS, expiresAt: null });
+    for (const [name, member] of Object.entries({ owner, admin, wsAdmin, memberA }))
+        auth.as(name, memberPrincipal(store, member.id));
+    auth.as('writer', { kind: 'token', tokenId: 'tok_w', scope: 'admin' });
+    return { owner, admin, wsAdmin, memberA, wsA, keyA };
+}
+async function harness() {
+    const { dir, store, cleanup } = tempDataDir();
+    const auth = new FakeConsoleAuth();
+    const org = seed(store, auth);
+    const credentials = [{ id: 'cred_1', kind: 'passkey', label: 'Laptop', createdAt: 1, lastUsedAt: null }];
+    const server = await startConsole(testDeps(store, dir, { memberCredentials: () => credentials }), auth, coreConsoleRegistrars);
+    const as = (who, method, path, body) => call(server.port, method, `/console/api${path}`, { who, body, bearer: who === 'writer' });
+    const audit = (action) => store.listAudit({ limit: 500, ...(action ? { action } : {}) }).entries;
+    return { store, auth, org, as, audit, close: async () => { await server.close(); cleanup(); } };
+}
+test('store audit log: records, filters by verb prefix and pages newest first', () => {
+    const { store, cleanup } = tempDataDir();
+    try {
+        store.recordAudit({ actor: { kind: 'cli', id: null }, action: 'key.create', target: { kind: 'key', id: 'k1' }, details: { a: 1 } });
+        store.recordAudit({ actor: { kind: 'member', id: 'm1', label: 'M' }, action: 'key.revoke', target: { kind: 'key', id: 'k1', label: 'K' }, ip: '203.0.113.9' });
+        store.recordAudit({ actor: { kind: 'member', id: 'm1' }, action: 'keyring.weird' });
+        store.recordAudit({ actor: { kind: 'system', id: null }, action: 'auth.sign_in_failed', details: { method: 'wallet' } });
+        const first = store.listAudit({ limit: 2 });
+        assert.deepEqual(first.entries.map((entry) => entry.action), ['auth.sign_in_failed', 'keyring.weird']);
+        assert.ok(first.nextBefore);
+        const second = store.listAudit({ limit: 2, before: first.nextBefore });
+        assert.deepEqual(second.entries.map((entry) => entry.action), ['key.revoke', 'key.create']);
+        assert.equal(second.nextBefore, null);
+        assert.deepEqual(second.entries[0].target, { kind: 'key', id: 'k1', label: 'K' });
+        assert.equal(second.entries[0].ip, '203.0.113.9');
+        assert.deepEqual(second.entries[1].actor, { kind: 'cli', id: null, label: null });
+        assert.deepEqual(second.entries[1].details, { a: 1 });
+        assert.deepEqual(store.listAudit({ action: 'key' }).entries.map((entry) => entry.action), ['key.revoke', 'key.create']);
+        assert.deepEqual(store.listAudit({ actorId: 'm1' }).entries.length, 2);
+    }
+    finally {
+        cleanup();
+    }
+});
+test('GET /audit is for org admins and pages with an opaque cursor', async () => {
+    const h = await harness();
+    try {
+        for (let index = 0; index < 3; index += 1)
+            h.store.recordAudit({ actor: { kind: 'cli', id: null }, action: 'workspace.create' });
+        for (const who of ['owner', 'admin', 'writer'])
+            assert.equal((await h.as(who, 'GET', '/audit')).status, 200, who);
+        for (const who of ['wsAdmin', 'memberA'])
+            assert.equal((await h.as(who, 'GET', '/audit')).status, 403, who);
+        const page = (await h.as('owner', 'GET', '/audit?limit=2')).body;
+        assert.equal(page.entries.length, 2);
+        const rest = (await h.as('owner', 'GET', `/audit?limit=2&before=${page.nextBefore}`)).body;
+        assert.equal(rest.entries.length, 1);
+        assert.equal(rest.nextBefore, null);
+        assert.equal((await h.as('owner', 'GET', '/audit?before=abc')).status, 400);
+        assert.equal((await h.as('owner', 'GET', '/audit?limit=0')).status, 400);
+    }
+    finally {
+        await h.close();
+    }
+});
+test('key actions are audited with the actor and without the secret', async () => {
+    const h = await harness();
+    try {
+        const created = await h.as('memberA', 'POST', '/keys', { label: 'Mine', workspaceId: h.org.wsA.id });
+        assert.equal(created.status, 201);
+        const { key, secret } = created.body;
+        assert.equal((await h.as('memberA', 'PATCH', `/keys/${key.id}`, { label: 'Renamed' })).status, 200);
+        const rotated = await h.as('memberA', 'POST', `/keys/${key.id}/rotate`);
+        assert.equal((await h.as('wsAdmin', 'POST', `/keys/${key.id}/revoke`)).status, 200);
+        const entries = h.audit('key');
+        assert.deepEqual(entries.map((entry) => entry.action), ['key.revoke', 'key.rotate', 'key.update', 'key.create']);
+        assert.deepEqual(entries[3].actor, { kind: 'member', id: h.org.memberA.id, label: 'Member A' });
+        assert.deepEqual(entries[0].actor.id, h.org.wsAdmin.id);
+        assert.deepEqual(entries[2].details, { changes: { label: { before: 'Mine', after: 'Renamed' } } });
+        assert.equal(entries[3].ip, '127.0.0.1');
+        const text = JSON.stringify(h.store.listAudit({ limit: 500 }));
+        assert.ok(!text.includes(secret) && !text.includes(rotated.body.secret), 'secrets never reach the audit log');
+    }
+    finally {
+        await h.close();
+    }
+});
+test('a key owner edits only the owner layer, which never gets past the admin layer; admins can do anything', async () => {
+    const h = await harness();
+    const id = h.org.keyA.key.id;
+    try {
+        // The admin layer is off limits to the owner.
+        assert.equal((await h.as('memberA', 'PATCH', `/keys/${id}`, { limits: { daily: '5' } })).status, 403);
+        assert.equal((await h.as('memberA', 'PATCH', `/keys/${id}`, { routingPolicy: { minTrustScore: 1 } })).status, 403);
+        // The owner layer is theirs: tighten, loosen, clear.
+        assert.equal((await h.as('memberA', 'PATCH', `/keys/${id}`, { ownerLimits: { daily: '5' } })).status, 200);
+        assert.equal((await h.as('memberA', 'PATCH', `/keys/${id}`, { ownerLimits: { daily: '4' } })).status, 200);
+        assert.equal((await h.as('memberA', 'PATCH', `/keys/${id}`, { ownerLimits: { daily: '6' } })).status, 200);
+        assert.equal((await h.as('memberA', 'PATCH', `/keys/${id}`, { ownerLimits: { daily: null } })).status, 200);
+        assert.equal(h.store.getKey(id).ownerLimits.daily, null);
+        // Under an admin cap, asking for more is answered 409 narrowed with the effective cap.
+        assert.equal((await h.as('wsAdmin', 'PATCH', `/keys/${id}`, { limits: { daily: '3' } })).status, 200);
+        const over = await h.as('memberA', 'PATCH', `/keys/${id}`, { ownerLimits: { daily: '6' } });
+        assert.equal(over.status, 409);
+        const overBody = over.body;
+        assert.equal(overBody.error.code, 'narrowed');
+        assert.deepEqual(overBody.error.fields, ['ownerLimits.daily']);
+        assert.equal(overBody.error.effectiveLimits.daily, '3.000000');
+        assert.equal(h.store.getKey(id).ownerLimits.daily, null, 'nothing stored');
+        assert.equal((await h.as('memberA', 'PATCH', `/keys/${id}`, { ownerLimits: { daily: '2' } })).status, 200);
+        // Expiry: earlier only.
+        const soon = Date.now() + DAY_MS;
+        assert.equal((await h.as('memberA', 'PATCH', `/keys/${id}`, { expiresAt: soon })).status, 200);
+        assert.equal((await h.as('memberA', 'PATCH', `/keys/${id}`, { expiresAt: soon + DAY_MS })).status, 403);
+        assert.equal((await h.as('memberA', 'PATCH', `/keys/${id}`, { expiresAt: null })).status, 403);
+        assert.equal((await h.as('memberA', 'PATCH', `/keys/${id}`, { expiresAt: soon - 1000 })).status, 200);
+        // Policy: the owner's layer narrows the admins'; asking for more is 409.
+        assert.equal((await h.as('wsAdmin', 'PATCH', `/keys/${id}`, { routingPolicy: { maxInputUsdPerMillion: 3, blockedPeerIds: ['aa'.repeat(20)] } })).status, 200);
+        const widened = await h.as('memberA', 'PATCH', `/keys/${id}`, { ownerRoutingPolicy: { maxInputUsdPerMillion: 50 } });
+        assert.equal(widened.status, 409);
+        const widenedBody = widened.body;
+        assert.deepEqual(widenedBody.error.fields, ['ownerRoutingPolicy.maxInputUsdPerMillion']);
+        assert.equal(widenedBody.error.effectiveRoutingPolicy.maxInputUsdPerMillion, 3);
+        assert.equal(h.store.getKey(id).ownerRoutingPolicy, null);
+        assert.equal((await h.as('memberA', 'PATCH', `/keys/${id}`, { ownerRoutingPolicy: { maxInputUsdPerMillion: 2 } })).status, 200);
+        assert.equal((await h.as('memberA', 'PATCH', `/keys/${id}`, { ownerRoutingPolicy: null })).status, 200);
+        assert.equal(h.store.getKey(id).routingPolicy?.maxInputUsdPerMillion, 3, 'the admin layer is untouched');
+        assert.deepEqual(h.store.getKey(id).routingPolicy?.blockedPeerIds, ['aa'.repeat(20)]);
+        // Admins raise, clear and extend freely.
+        assert.equal((await h.as('wsAdmin', 'PATCH', `/keys/${id}`, { limits: { daily: null }, expiresAt: null, routingPolicy: null })).status, 200);
+        assert.equal(h.store.getKey(id).limits.daily, null);
+        assert.equal(h.store.getKey(id).routingPolicy, null);
+    }
+    finally {
+        await h.close();
+    }
+});
+test('owner-layer caps above the admin layer are reported per period', () => {
+    const admin = { daily: 10, weekly: null, monthly: 50, total: null };
+    assert.deepEqual(narrowedOwnerLimits(admin, { daily: 5, weekly: 7 }), []);
+    assert.deepEqual(narrowedOwnerLimits(admin, { daily: 11, monthly: 51 }), ['ownerLimits.daily', 'ownerLimits.monthly']);
+    assert.deepEqual(narrowedOwnerLimits(admin, { daily: null, monthly: null }), [], 'no owner cap leaves the admin cap');
+});
+test('workspace policies: org admins set orgRoutingPolicy, workspace admins their own; changes are audited', async () => {
+    const h = await harness();
+    const path = `/workspaces/${h.org.wsA.id}`;
+    try {
+        assert.equal((await h.as('wsAdmin', 'PATCH', path, { orgRoutingPolicy: { requireTee: true } })).status, 403);
+        const set = await h.as('admin', 'PATCH', path, { orgRoutingPolicy: { requireTee: true } });
+        assert.equal(set.status, 200);
+        assert.deepEqual(set.body.orgRoutingPolicy, { requireTee: true });
+        const own = await h.as('wsAdmin', 'PATCH', path, { routingPolicy: { minTrustScore: 10 } });
+        assert.equal(own.status, 200);
+        assert.deepEqual(own.body.orgRoutingPolicy, { requireTee: true });
+        const entries = h.audit('workspace.policy');
+        assert.equal(entries.length, 2);
+        assert.deepEqual(entries[1].details, { orgRoutingPolicy: { before: null, after: { requireTee: true } } });
+        assert.deepEqual(entries[0].details, { routingPolicy: { before: null, after: { minTrustScore: 10 } } });
+        assert.equal((await h.as('wsAdmin', 'PATCH', path, { name: 'Alpha 2' })).status, 200);
+        assert.deepEqual(h.audit('workspace.update')[0].details, { changes: { name: { before: 'Alpha', after: 'Alpha 2' } } });
+    }
+    finally {
+        await h.close();
+    }
+});
+test('workspace member list shows emails, budgets, policies and sign-in methods to workspace admins only', async () => {
+    const h = await harness();
+    try {
+        const asMember = (await h.as('memberA', 'GET', `/workspaces/${h.org.wsA.id}/members`)).body;
+        assert.ok(asMember.length >= 2);
+        for (const row of asMember)
+            assert.deepEqual(Object.keys(row.member).sort(), ['id', 'label', 'orgRole', 'status']);
+        const asAdmin = (await h.as('wsAdmin', 'GET', `/workspaces/${h.org.wsA.id}/members`)).body;
+        assert.ok(asAdmin.every((row) => row.member.credentials.length === 1));
+    }
+    finally {
+        await h.close();
+    }
+});
+test('management tokens expire by default, remember their creator and die with the creator\'s role', async () => {
+    const h = await harness();
+    try {
+        const before = Date.now();
+        const created = await h.as('admin', 'POST', '/admin-tokens', { label: 'CI', scope: 'admin' });
+        assert.equal(created.status, 201);
+        const token = created.body.token;
+        assert.equal(token.createdByMemberId, h.org.admin.id);
+        assert.ok(token.expiresAt >= before + 90 * DAY_MS && token.expiresAt <= Date.now() + 90 * DAY_MS);
+        assert.equal((await h.as('admin', 'POST', '/admin-tokens', { label: 'x', expiresInDays: 366 })).status, 400);
+        assert.equal((await h.as('admin', 'POST', '/admin-tokens', { label: 'x', expiresInDays: 0 })).status, 400);
+        assert.equal((await h.as('admin', 'POST', '/admin-tokens', { label: 'x', expiresInDays: null })).status, 403);
+        const forever = await h.as('owner', 'POST', '/admin-tokens', { label: 'forever', expiresInDays: null });
+        assert.equal(forever.status, 201);
+        assert.equal(forever.body.token.expiresAt, null);
+        const short = (await h.as('admin', 'POST', '/admin-tokens', { label: 'short', expiresInDays: 7 })).body;
+        assert.ok(short.token.expiresAt <= Date.now() + 7 * DAY_MS);
+        // Demoting the admin revokes the tokens they created.
+        assert.equal((await h.as('owner', 'PATCH', `/members/${h.org.admin.id}`, { orgRole: 'member' })).status, 200);
+        assert.deepEqual(h.store.listAdminTokens().map((entry) => entry.label), ['forever']);
+        const demotion = h.audit('member.update')[0];
+        assert.equal(demotion.details['revokedTokens'].length, 2);
+        // Disabling a member revokes the tokens they created.
+        const ownerToken = h.store.createAdminToken({ label: 'by admin2', scope: 'read', createdBy: h.org.wsAdmin.id });
+        assert.equal((await h.as('owner', 'POST', `/members/${h.org.wsAdmin.id}/disable`)).status, 200);
+        assert.equal(h.store.getAdminToken(ownerToken.token.id).revokedAt !== null, true);
+        assert.deepEqual(h.audit('token').map((entry) => entry.action), ['token.create', 'token.create', 'token.create']);
+    }
+    finally {
+        await h.close();
+    }
+});
+test('auditActor and requestIp', () => {
+    const { store, cleanup } = tempDataDir();
+    try {
+        const owner = store.createOwner({ label: 'Owner', email: null });
+        assert.deepEqual(auditActor(store, null), { kind: 'system', id: null, label: null });
+        assert.deepEqual(auditActor(store, { kind: 'member', memberId: owner.id, orgRole: 'owner', workspaceRoles: new Map(), sessionId: 's' }), { kind: 'member', id: owner.id, label: 'Owner' });
+        assert.deepEqual(auditActor(store, { kind: 'token', tokenId: 'tok_x', scope: 'read' }), { kind: 'token', id: 'tok_x', label: null });
+        const raw = (headers, remoteAddress = '127.0.0.1') => ({ raw: { headers, socket: { remoteAddress } } });
+        assert.equal(requestIp(raw({ 'cf-connecting-ip': '198.51.100.7' })), '127.0.0.1', 'CF-Connecting-IP is ignored outside tunnel mode');
+        assert.equal(requestIp(raw({ 'cf-connecting-ip': '198.51.100.7' }), { trustCloudflareHeaders: true }), '198.51.100.7');
+        assert.equal(requestIp(raw({ 'x-forwarded-for': '10.0.0.1, 198.51.100.8' })), '198.51.100.8');
+        assert.equal(requestIp(raw({ 'x-forwarded-for': '198.51.100.8' }, '203.0.113.5')), '203.0.113.5', 'forwarding headers only from a loopback proxy');
+        assert.equal(requestIp({ raw: {} }), null);
+    }
+    finally {
+        cleanup();
+    }
+});
+//# sourceMappingURL=audit.test.js.map