@antseed/cli 0.1.179 → 0.1.181

package/dist/gateway/accounting.js

@@ -1,6 +1,14 @@
 import { randomUUID } from 'node:crypto';
-import { findLimitBreach } from './limits.js';
+import { BUDGET_PERIODS, cappedPeriods, findLimitBreach, hasSpendLimits } from './limits.js';
 import { parseBaseUnits } from './money.js';
+/** The key's cap per period: the lower of the admins' and the owner's. */
+export function effectiveKeyLimits(key) {
+    const result = {};
+    for (const period of BUDGET_PERIODS) {
+        result[period] = lowerCap(key.limits[period] ?? null, key.ownerLimits?.[period] ?? null);
+    }
+    return result;
+}
 /** Spend can be signed after the response ends (seller-initiated auth). */
 const DEFAULT_SETTLE_GRACE_MS = 60_000;
 export function newRequestTag() {
@@ -25,21 +33,79 @@ export class GatewayAccounting {
         this._now = _options.now ?? (() => Date.now());
     }
     heldUsdc(keyId) {
+        return this._held((hold) => hold.keyId === keyId);
+    }
+    /** Holds in flight for every key a member owns. */
+    heldForMember(memberId) {
+        return this._held((hold) => hold.memberId === memberId);
+    }
+    heldForWorkspace(workspaceId) {
+        return this._held((hold) => hold.workspaceId === workspaceId);
+    }
+    _held(match) {
         let held = 0;
         for (const hold of this._holds.values())
-            if (hold.keyId === keyId)
+            if (match(hold))
                 held += hold.amountUsdc;
         return held;
     }
-    admit(key) {
+    /** Whether any level above or at the key caps spend (so admission depends on the spend feed). */
+    hasBudgets(key, context = this._context(key)) {
+        return this._budgetChecks(key, context).some(({ limits }) => hasSpendLimits(limits));
+    }
+    /** The key (the lower of its admin and owner caps), the member who owns it and its workspace. */
+    _budgetChecks(key, { member, workspace }) {
+        const checks = [
+            { level: 'key', limits: effectiveKeyLimits(key), scope: { keyId: key.id }, held: () => this.heldUsdc(key.id) },
+        ];
+        if (member)
+            checks.push({ level: 'member', limits: member.limits, scope: { memberId: member.id }, held: () => this.heldForMember(member.id) });
+        if (workspace)
+            checks.push({ level: 'workspace', limits: workspace.limits, scope: { workspaceId: workspace.id }, held: () => this.heldForWorkspace(workspace.id) });
+        return checks;
+    }
+    _context(key) {
+        return {
+            member: key.ownerMemberId ? this._store.getMember(key.ownerMemberId) : null,
+            workspace: this._store.getWorkspace(key.workspaceId),
+        };
+    }
+    /**
+     * Admits a paid request only when the key (the lower of its admin and
+     * owner caps), the member who owns it and its workspace all have room.
+     * Member and workspace spend is the ledger as attributed at request time,
+     * so a member who revokes a key and creates a new one still counts
+     * everything spent before against the member's caps. Levels and periods
+     * without a cap cost no query.
+     */
+    admit(key, context = this._context(key)) {
         const now = this._now();
-        const breach = findLimitBreach(key.limits, this._store.periodSpend(key.id, now), this.heldUsdc(key.id), now);
-        if (breach)
-            return { ok: false, breach };
+        for (const { level, limits, scope, held } of this._budgetChecks(key, context)) {
+            const periods = cappedPeriods(limits);
+            if (periods.length === 0)
+                continue;
+            const breach = findLimitBreach(limits, this._store.spendByPeriod(scope, now, periods), held(), now);
+            if (breach)
+                return { ok: false, breach: { ...breach, level } };
+        }
         const tag = newRequestTag();
-        this._holds.set(tag, { keyId: key.id, amountUsdc: this._options.holdUsdc, finished: false, timer: null });
+        this._holds.set(tag, {
+            keyId: key.id,
+            memberId: key.ownerMemberId,
+            workspaceId: key.workspaceId,
+            amountUsdc: this._options.holdUsdc,
+            finished: false,
+            timer: null,
+        });
         return { ok: true, tag };
     }
+    /** Drops a hold at once, for a request that never reached the buyer. */
+    release(tag) {
+        const hold = this._holds.get(tag);
+        if (hold?.timer)
+            clearTimeout(hold.timer);
+        this._holds.delete(tag);
+    }
     /** The response is over; keep the hold briefly for spend that is signed late. */
     finish(tag) {
         const hold = this._holds.get(tag);
@@ -71,6 +137,11 @@ export class GatewayAccounting {
                 cachedInputTokens: parseBaseUnits(event.cachedInputTokens),
                 outputTokens: parseBaseUnits(event.outputTokens),
                 createdAt: event.at,
+                // Spend counts against whoever the request was admitted for.
+                workspaceId: request.workspaceId,
+                memberId: request.memberId,
+                model: request.model,
+                endUser: request.endUser,
             });
             if (!inserted)
                 continue;
@@ -91,4 +162,12 @@ export class GatewayAccounting {
         this._holds.clear();
     }
 }
+/** The stricter of two caps; null is no cap. */
+function lowerCap(a, b) {
+    if (a === null)
+        return b;
+    if (b === null)
+        return a;
+    return Math.min(a, b);
+}
 //# sourceMappingURL=accounting.js.map

package/dist/gateway/accounting.js.map

@@ -1 +1 @@
-{"version":3,"file":"accounting.js","sourceRoot":"","sources":["../../src/gateway/accounting.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,OAAO,EAAE,eAAe,EAAoB,MAAM,aAAa,CAAA;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAG3C,2EAA2E;AAC3E,MAAM,uBAAuB,GAAG,MAAM,CAAA;AActC,MAAM,UAAU,aAAa;IAC3B,OAAO,MAAM,UAAU,EAAE,EAAE,CAAA;AAC7B,CAAC;AAMD;;;;;GAKG;AACH,MAAM,OAAO,iBAAiB;IAKC;IAAuC;IAJnD,MAAM,GAAG,IAAI,GAAG,EAAgB,CAAA;IAChC,cAAc,CAAQ;IACtB,IAAI,CAAc;IAEnC,YAA6B,MAAoB,EAAmB,QAAkC;QAAzE,WAAM,GAAN,MAAM,CAAc;QAAmB,aAAQ,GAAR,QAAQ,CAA0B;QACpG,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC,aAAa,IAAI,uBAAuB,CAAA;QACvE,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAChD,CAAC;IAED,QAAQ,CAAC,KAAa;QACpB,IAAI,IAAI,GAAG,CAAC,CAAA;QACZ,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK;gBAAE,IAAI,IAAI,IAAI,CAAC,UAAU,CAAA;QAC1F,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,GAAiB;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACvB,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAA;QAC5G,IAAI,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;QACxC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAA;QAC3B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACzG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;IAC1B,CAAC;IAED,iFAAiF;IACjF,MAAM,CAAC,GAAW;QAChB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAM;QAClC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;QACpB,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAA;QAC3E,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;IACtB,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,MAAc,EAAE,MAAuC;QAC5D,IAAI,QAAQ,GAAG,CAAC,CAAA;QAChB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAClD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;gBAAE,SAAQ;YACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;gBAC7C,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC;gBAC5C,WAAW,EAAE,SAAS,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE;gBAC3C,UAAU,EAAE,KAAK,CAAC,GAAG;gBACrB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,WAAW,EAAE,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC;gBAC9C,iBAAiB,EAAE,cAAc,CAAC,KAAK,CAAC,iBAAiB,CAAC;gBAC1D,YAAY,EAAE,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC;gBAChD,SAAS,EAAE,KAAK,CAAC,EAAE;aACpB,CAAC,CAAA;YACF,IAAI,CAAC,QAAQ;gBAAE,SAAQ;YACvB,QAAQ,IAAI,CAAC,CAAA;YACb,qEAAqE;YACrE,mEAAmE;YACnE,2DAA2D;YAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACvC,IAAI,IAAI;gBAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAA;QAC7F,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,OAAO;QACL,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,IAAI,CAAC,KAAK;gBAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACjF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;IACrB,CAAC;CACF"}
+{"version":3,"file":"accounting.js","sourceRoot":"","sources":["../../src/gateway/accounting.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAA2E,MAAM,aAAa,CAAA;AACrK,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAa3C,0EAA0E;AAC1E,MAAM,UAAU,kBAAkB,CAAC,GAAiD;IAClF,MAAM,MAAM,GAAG,EAAkB,CAAA;IACjC,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAA;IAC1F,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,2EAA2E;AAC3E,MAAM,uBAAuB,GAAG,MAAM,CAAA;AA6BtC,MAAM,UAAU,aAAa;IAC3B,OAAO,MAAM,UAAU,EAAE,EAAE,CAAA;AAC7B,CAAC;AAMD;;;;;GAKG;AACH,MAAM,OAAO,iBAAiB;IAKC;IAAuC;IAJnD,MAAM,GAAG,IAAI,GAAG,EAAgB,CAAA;IAChC,cAAc,CAAQ;IACtB,IAAI,CAAc;IAEnC,YAA6B,MAAoB,EAAmB,QAAkC;QAAzE,WAAM,GAAN,MAAM,CAAc;QAAmB,aAAQ,GAAR,QAAQ,CAA0B;QACpG,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC,aAAa,IAAI,uBAAuB,CAAA;QACvE,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;IAChD,CAAC;IAED,QAAQ,CAAC,KAAa;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAA;IACnD,CAAC;IAED,mDAAmD;IACnD,aAAa,CAAC,QAAgB;QAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAA;IACzD,CAAC;IAED,gBAAgB,CAAC,WAAmB;QAClC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,CAAA;IAC/D,CAAC;IAEO,KAAK,CAAC,KAA8B;QAC1C,IAAI,IAAI,GAAG,CAAC,CAAA;QACZ,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,KAAK,CAAC,IAAI,CAAC;gBAAE,IAAI,IAAI,IAAI,CAAC,UAAU,CAAA;QACjF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,iGAAiG;IACjG,UAAU,CAAC,GAAiB,EAAE,UAAsB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QACpE,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAA;IACtF,CAAC;IAED,iGAAiG;IACzF,aAAa,CAAC,GAAiB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAc;QACxE,MAAM,MAAM,GAAkB;YAC5B,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;SAC/G,CAAA;QACD,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QAC9I,IAAI,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QACnK,OAAO,MAAM,CAAA;IACf,CAAC;IAEO,QAAQ,CAAC,GAAiB;QAChC,OAAO;YACL,MAAM,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI;YAC3E,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC;SACrD,CAAA;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,GAAiB,EAAE,UAAsB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACvB,KAAK,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;YAC9E,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAQ;YAClC,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAA;YACnG,IAAI,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,EAAE,CAAA;QAChE,CAAC;QACD,MAAM,GAAG,GAAG,aAAa,EAAE,CAAA;QAC3B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;YACnB,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,QAAQ,EAAE,GAAG,CAAC,aAAa;YAC3B,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;YAClC,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,IAAI;SACZ,CAAC,CAAA;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;IAC1B,CAAC;IAED,wEAAwE;IACxE,OAAO,CAAC,GAAW;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,IAAI,EAAE,KAAK;YAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC;IAED,iFAAiF;IACjF,MAAM,CAAC,GAAW;QAChB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAM;QAClC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;QACpB,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAA;QAC3E,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;IACtB,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,MAAc,EAAE,MAAuC;QAC5D,IAAI,QAAQ,GAAG,CAAC,CAAA;QAChB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAClD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;gBAAE,SAAQ;YACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;gBAC7C,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,UAAU,EAAE,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC;gBAC5C,WAAW,EAAE,SAAS,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE;gBAC3C,UAAU,EAAE,KAAK,CAAC,GAAG;gBACrB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,WAAW,EAAE,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC;gBAC9C,iBAAiB,EAAE,cAAc,CAAC,KAAK,CAAC,iBAAiB,CAAC;gBAC1D,YAAY,EAAE,cAAc,CAAC,KAAK,CAAC,YAAY,CAAC;gBAChD,SAAS,EAAE,KAAK,CAAC,EAAE;gBACnB,6DAA6D;gBAC7D,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC,CAAA;YACF,IAAI,CAAC,QAAQ;gBAAE,SAAQ;YACvB,QAAQ,IAAI,CAAC,CAAA;YACb,qEAAqE;YACrE,mEAAmE;YACnE,2DAA2D;YAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACvC,IAAI,IAAI;gBAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAA;QAC7F,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,OAAO;QACL,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,IAAI,CAAC,KAAK;gBAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACjF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;IACrB,CAAC;CACF;AAED,gDAAgD;AAChD,SAAS,QAAQ,CAAC,CAAgB,EAAE,CAAgB;IAClD,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,CAAA;IACxB,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,CAAA;IACxB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AACvB,CAAC"}

package/dist/gateway/admission-benchmark.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=admission-benchmark.test.d.ts.map

package/dist/gateway/admission-benchmark.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission-benchmark.test.d.ts","sourceRoot":"","sources":["../../src/gateway/admission-benchmark.test.ts"],"names":[],"mappings":""}

package/dist/gateway/admission-benchmark.test.js

@@ -0,0 +1,75 @@
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { performance } from 'node:perf_hooks';
+import { test } from 'node:test';
+import { GatewayAccounting } from './accounting.js';
+import { GatewayStore } from './store.js';
+/** 500k rows takes ~40 s to fill; `scripts/gateway-admit-benchmark.mjs` runs that size. */
+const LEDGER_ROWS = Number(process.env['ANTSEED_ADMIT_BENCH_ROWS'] ?? 50_000);
+const DAY_MS = 24 * 60 * 60 * 1000;
+/**
+ * Admission must not get slower as the ledger grows: with every period
+ * capped at the key, member and workspace level, admit() reads only the
+ * spend rollups (one row per scope for the lifetime total, at most 31 daily
+ * rows per dated period).
+ */
+test(`admit() stays under 5 ms with ${LEDGER_ROWS} ledger rows and every cap at every level`, (t) => {
+    const dir = mkdtempSync(join(tmpdir(), 'antseed-admit-bench-'));
+    const now = Date.UTC(2026, 9, 28, 12);
+    const store = new GatewayStore(dir, () => now);
+    try {
+        const caps = { daily: 1e12, weekly: 1e12, monthly: 1e12, total: 1e12 };
+        const owner = store.createOwner({ label: 'O', email: null });
+        store.updateMember(owner.id, { limits: caps });
+        const workspace = store.updateWorkspace(store.defaultWorkspace().id, { limits: caps });
+        const { key } = store.createKey({ label: 'k', workspaceId: workspace.id, ownerMemberId: owner.id, limits: caps, ownerLimits: caps, expiresAt: null });
+        // Half the rows are this key's (the hot path), spread over the last 120
+        // days; the rest belong to other keys in the same workspace.
+        const insert = store.database.prepare(`
+      INSERT INTO ledger_entries (kind, key_id, buyer_identity, amount_usdc, external_ref, created_at, workspace_id, member_id)
+      VALUES ('spend', ?, 'default', -1, ?, ?, ?, ?)
+    `);
+        const fill = performance.now();
+        store.database.pragma('cache_size = -262144');
+        store.database.transaction(() => {
+            for (let index = 0; index < LEDGER_ROWS; index += 1) {
+                const mine = index % 2 === 0;
+                insert.run(mine ? key.id : `key_other_${index % 97}`, `bench:${index}`, now - (index % 120) * DAY_MS - (index % 1000), workspace.id, mine ? owner.id : null);
+            }
+        })();
+        t.diagnostic(`filled ${LEDGER_ROWS} ledger rows in ${Math.round(performance.now() - fill)} ms`);
+        const accounting = new GatewayAccounting(store, { holdUsdc: 1, now: () => now });
+        const fresh = store.getKey(key.id);
+        const context = { member: store.getMember(owner.id), workspace: store.getWorkspace(workspace.id) };
+        for (let index = 0; index < 20; index += 1) {
+            const warm = accounting.admit(fresh, context);
+            if (warm.ok)
+                accounting.release(warm.tag);
+        }
+        const runs = 500;
+        const timings = [];
+        for (let index = 0; index < runs; index += 1) {
+            const started = performance.now();
+            const admission = accounting.admit(fresh, context);
+            timings.push(performance.now() - started);
+            assert.ok(admission.ok);
+            if (admission.ok)
+                accounting.release(admission.tag);
+        }
+        timings.sort((a, b) => a - b);
+        const mean = timings.reduce((sum, value) => sum + value, 0) / runs;
+        const p99 = timings[Math.floor(runs * 0.99)];
+        t.diagnostic(`admit(): mean ${mean.toFixed(3)} ms, p50 ${timings[runs / 2].toFixed(3)} ms, p99 ${p99.toFixed(3)} ms`);
+        assert.ok(mean < 5, `mean admit() ${mean.toFixed(3)} ms`);
+        const spent = store.spendByPeriod({ keyId: key.id }, now);
+        assert.equal(spent.total, LEDGER_ROWS / 2);
+        accounting.dispose();
+    }
+    finally {
+        store.close();
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+//# sourceMappingURL=admission-benchmark.test.js.map

package/dist/gateway/admission-benchmark.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission-benchmark.test.js","sourceRoot":"","sources":["../../src/gateway/admission-benchmark.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAEzC,2FAA2F;AAC3F,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,MAAM,CAAC,CAAA;AAC7E,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAElC;;;;;GAKG;AACH,IAAI,CAAC,iCAAiC,WAAW,2CAA2C,EAAE,CAAC,CAAC,EAAE,EAAE;IAClG,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAA;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IACrC,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAA;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QACtE,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5D,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QACtF,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,aAAa,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAErJ,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;;;KAGrC,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QAC9B,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAA;QAC7C,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE;YAC9B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,WAAW,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,KAAK,CAAC,CAAA;gBAC5B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,GAAG,EAAE,EAAE,EAAE,SAAS,KAAK,EAAE,EAAE,GAAG,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,EACnH,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YACzC,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QACJ,CAAC,CAAC,UAAU,CAAC,UAAU,WAAW,mBAAmB,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QAE/F,MAAM,UAAU,GAAG,IAAI,iBAAiB,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAA;QAChF,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAE,CAAA;QACnC,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAA;QAClG,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;YAC7C,IAAI,IAAI,CAAC,EAAE;gBAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC3C,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAA;QAChB,MAAM,OAAO,GAAa,EAAE,CAAA;QAC5B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;YACjC,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;YAClD,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAA;YACzC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;YACvB,IAAI,SAAS,CAAC,EAAE;gBAAE,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QACrD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC,GAAG,IAAI,CAAA;QAClE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAE,CAAA;QAC7C,CAAC,CAAC,UAAU,CAAC,iBAAiB,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,OAAO,CAAC,IAAI,GAAG,CAAC,CAAE,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QACtH,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,EAAE,gBAAgB,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QAEzD,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QACzD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,CAAC,CAAC,CAAA;QAC1C,UAAU,CAAC,OAAO,EAAE,CAAA;IACtB,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,KAAK,EAAE,CAAA;QACb,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,CAAC;AACH,CAAC,CAAC,CAAA"}

package/dist/gateway/auth/auth.test.d.ts

@@ -0,0 +1,4 @@
+import type { ConsoleDeps } from '../console-api/deps.js';
+import type { AuthDeps } from './types.js';
+export declare const consoleDepsSatisfyAuth: (deps: ConsoleDeps) => AuthDeps;
+//# sourceMappingURL=auth.test.d.ts.map

package/dist/gateway/auth/auth.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.test.d.ts","sourceRoot":"","sources":["../../../src/gateway/auth/auth.test.ts"],"names":[],"mappings":"AAiYA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAC1C,eAAO,MAAM,sBAAsB,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,QAAyB,CAAA"}

package/dist/gateway/auth/auth.test.js

@@ -0,0 +1,337 @@
+import assert from 'node:assert/strict';
+import { afterEach, describe, it } from 'node:test';
+import { Wallet } from 'ethers';
+import { SESSION_ABSOLUTE_MS, SESSION_IDLE_MS } from './db.js';
+import { SoftwarePasskey, startHarness } from './test-helpers.js';
+let harness;
+afterEach(async () => {
+    await harness?.close();
+});
+function setupToken(link) {
+    return link.slice(link.indexOf('#') + 1);
+}
+async function registerPasskey(browser, enrollment, passkey, overrides = {}) {
+    const options = await browser.request('POST', '/auth/passkey/register/options', enrollment ? { enrollment } : {});
+    assert.equal(options.status, 200, JSON.stringify(options.body));
+    const origin = `http://${browser.host}`;
+    return browser.request('POST', '/auth/passkey/register/verify', { enrollment, response: passkey.register(options.body, origin, overrides), label: 'Laptop' });
+}
+async function loginPasskey(browser, passkey, overrides = {}) {
+    const options = await browser.request('POST', '/auth/passkey/login/options', {});
+    assert.equal(options.status, 200, JSON.stringify(options.body));
+    return browser.request('POST', '/auth/passkey/login/verify', { response: passkey.login(options.body, `http://${browser.host}`, overrides) });
+}
+async function claimOwner(h, browser, passkey = new SoftwarePasskey()) {
+    const setup = await browser.request('POST', '/auth/setup', { token: setupToken(h.auth.createSetupLink()), email: 'owner@example.com' });
+    assert.equal(setup.status, 200, JSON.stringify(setup.body));
+    const registered = await registerPasskey(browser, setup.body.enrollment, passkey);
+    assert.equal(registered.status, 200, JSON.stringify(registered.body));
+    return { passkey, me: registered.body };
+}
+describe('console auth: setup and passkeys', () => {
+    it('claims the console with a setup link, registers a passkey and signs in with it', async () => {
+        harness = await startHarness();
+        const browser = harness.browser();
+        assert.equal((await browser.request('GET', '/auth/config')).body.setupRequired, true);
+        assert.equal((await browser.request('GET', '/auth/config')).body.passkey, true);
+        const link = harness.auth.createSetupLink();
+        assert.match(link, new RegExp(`^http://localhost:${harness.port}/console/setup#[A-Za-z0-9_-]{40,}$`));
+        const token = setupToken(link);
+        const setup = await browser.request('POST', '/auth/setup', { token });
+        assert.equal(setup.status, 200);
+        assert.equal(setup.body.orgRole, 'owner');
+        // Single use.
+        const again = await harness.browser().request('POST', '/auth/setup', { token });
+        assert.equal(again.status, 400);
+        const passkey = new SoftwarePasskey();
+        const registered = await registerPasskey(browser, setup.body.enrollment, passkey);
+        assert.equal(registered.status, 200, JSON.stringify(registered.body));
+        assert.equal(registered.body.kind, 'member');
+        assert.equal(registered.body.me.member.orgRole, 'owner');
+        assert.equal(registered.body.me.member.credentials.length, 1);
+        assert.equal(registered.body.me.member.credentials[0].kind, 'passkey');
+        assert.deepEqual(registered.body.me.member.limits, { daily: '5.000000', weekly: null, monthly: null, total: null });
+        assert.equal(registered.body.me.workspaces.length, 2, 'org owners see every workspace');
+        // Loopback http: no Secure flag, but HttpOnly + Strict + /console.
+        const cookie = browser.lastSetCookies.find((line) => line.startsWith('antseed_console='));
+        assert.match(cookie, /HttpOnly/);
+        assert.match(cookie, /SameSite=Strict/);
+        assert.match(cookie, /Path=\/console/);
+        assert.doesNotMatch(cookie, /Secure/);
+        assert.equal((await browser.request('GET', '/auth/me')).status, 200);
+        assert.equal((await browser.request('GET', '/auth/config')).body.setupRequired, false);
+        assert.throws(() => harness.auth.createSetupLink(), /already been claimed/);
+        assert.equal((await harness.browser().request('POST', '/auth/setup', { token: 'x'.repeat(43) })).status, 409);
+        // Fresh browser signs in with the discoverable passkey.
+        const other = harness.browser();
+        const login = await loginPasskey(other, passkey);
+        assert.equal(login.status, 200, JSON.stringify(login.body));
+        assert.equal(login.body.me.member.id, registered.body.me.member.id);
+        assert.equal((await other.request('GET', '/auth/me')).status, 200);
+        // A replayed (non-increasing) counter is refused.
+        const replay = await loginPasskey(harness.browser(), passkey, { counter: 1 });
+        assert.equal(replay.status, 401);
+        assert.equal(replay.body.error.code, 'passkey_invalid');
+    });
+    it('requires user verification for passkey registration and sign-in', async () => {
+        harness = await startHarness();
+        const browser = harness.browser();
+        const setup = await browser.request('POST', '/auth/setup', { token: setupToken(harness.auth.createSetupLink()), email: 'owner@example.com' });
+        assert.equal(setup.status, 200, JSON.stringify(setup.body));
+        const registerOptions = await browser.request('POST', '/auth/passkey/register/options', { enrollment: setup.body.enrollment });
+        assert.equal(registerOptions.body.authenticatorSelection.userVerification, 'required');
+        const loginOptions = await harness.browser().request('POST', '/auth/passkey/login/options', {});
+        assert.equal(loginOptions.body.userVerification, 'required');
+        // Presence alone (no PIN or biometric) does not register a passkey...
+        const unverified = await registerPasskey(browser, setup.body.enrollment, new SoftwarePasskey(), { userVerified: false });
+        assert.equal(unverified.status, 400);
+        assert.equal(unverified.body.error.code, 'passkey_invalid');
+        // ...nor sign in with one.
+        const passkey = new SoftwarePasskey();
+        assert.equal((await registerPasskey(browser, setup.body.enrollment, passkey)).status, 200);
+        const login = await loginPasskey(harness.browser(), passkey, { userVerified: false });
+        assert.equal(login.status, 401);
+        assert.equal(login.body.error.code, 'passkey_invalid');
+        assert.equal((await loginPasskey(harness.browser(), passkey)).status, 200);
+    });
+    it('only the newest setup link works, and an owner who never registered can re-claim', async () => {
+        harness = await startHarness();
+        const first = setupToken(harness.auth.createSetupLink());
+        const second = setupToken(harness.auth.createSetupLink());
+        assert.equal((await harness.browser().request('POST', '/auth/setup', { token: first })).status, 400);
+        const claimed = await harness.browser().request('POST', '/auth/setup', { token: second });
+        assert.equal(claimed.status, 200);
+        // The enrollment was never used, so setup is still open, for the same owner.
+        assert.equal((await harness.browser().request('GET', '/auth/config')).body.setupRequired, true);
+        const reclaim = await harness.browser().request('POST', '/auth/setup', { token: setupToken(harness.auth.createSetupLink()) });
+        assert.equal(reclaim.status, 200);
+        const owners = [...harness.store.members.values()].filter((member) => member.orgRole === 'owner');
+        assert.equal(owners.length, 1);
+    });
+    it('uses publicUrl for the setup link', async () => {
+        harness = await startHarness({ publicUrl: 'https://gateway.example.test/' });
+        assert.match(harness.auth.createSetupLink(), /^https:\/\/gateway\.example\.test\/console\/setup#/);
+    });
+    it('lets a signed-in member add a second passkey', async () => {
+        harness = await startHarness();
+        const browser = harness.browser();
+        await claimOwner(harness, browser);
+        const second = await registerPasskey(browser, undefined, new SoftwarePasskey());
+        assert.equal(second.status, 200, JSON.stringify(second.body));
+        assert.equal(second.body.me.member.credentials.length, 2);
+        // Without a session or enrollment there is nobody to register for.
+        assert.equal((await harness.browser().request('POST', '/auth/passkey/register/options', {})).status, 401);
+    });
+    it('reports passkeys unavailable on a bare IP host', async () => {
+        harness = await startHarness();
+        const browser = harness.browser(`127.0.0.1:${harness.port}`);
+        assert.equal((await browser.request('GET', '/auth/config')).body.passkey, false);
+        assert.equal((await browser.request('POST', '/auth/passkey/login/options', {})).status, 400);
+    });
+});
+describe('console auth: invites and wallets', () => {
+    it('adds no sign-in method when the invite lapsed during sign-up', async () => {
+        harness = await startHarness();
+        const wallet = Wallet.createRandom();
+        const { member, token } = harness.store.invite({ label: 'Lee' });
+        const browser = harness.browser();
+        const enrollment = (await browser.request('POST', '/auth/invite', { token })).body.enrollment;
+        for (const invite of harness.store.invites.values())
+            invite.expiresAt = harness.clock.now - 1;
+        const message = (await browser.request('POST', '/auth/wallet/nonce', { address: wallet.address })).body.message;
+        const refused = await browser.request('POST', '/auth/wallet/verify', { message, signature: await wallet.signMessage(message), enrollment });
+        assert.equal(refused.status, 400);
+        assert.equal(refused.body.error.code, 'invite_expired');
+        assert.equal(harness.auth.credentialsFor(member.id).length, 0);
+        assert.equal(harness.store.getMember(member.id).status, 'invited');
+    });
+    it('consumes an invite once and signs in with a wallet', async () => {
+        harness = await startHarness();
+        const wallet = Wallet.createRandom();
+        const { member, token } = harness.store.invite({ label: 'Dana', email: 'dana@example.com' }, [['ws_research', 'member']]);
+        const browser = harness.browser();
+        const invited = await browser.request('POST', '/auth/invite', { token });
+        assert.equal(invited.status, 200);
+        assert.equal(invited.body.label, 'Dana');
+        // Until a sign-in method is registered the invite stays open: opening it again (a refresh) still works.
+        const reopened = await harness.browser().request('POST', '/auth/invite', { token });
+        assert.equal(reopened.status, 200);
+        assert.equal(harness.store.getMember(member.id).status, 'invited');
+        const nonce = await browser.request('POST', '/auth/wallet/nonce', { address: wallet.address });
+        const message = nonce.body.message;
+        assert.match(message, new RegExp(`^localhost:${harness.port} wants you to sign in with your Ethereum account:\n${wallet.address}\n`));
+        assert.match(message, /Chain ID: 8453/);
+        assert.match(message, /Expiration Time: /);
+        const verified = await browser.request('POST', '/auth/wallet/verify', { message, signature: await wallet.signMessage(message), enrollment: invited.body.enrollment });
+        assert.equal(verified.status, 200, JSON.stringify(verified.body));
+        assert.equal(verified.body.me.member.id, member.id);
+        assert.deepEqual(verified.body.me.workspaces.map((entry) => [entry.workspace.id, entry.role]), [['ws_research', 'member']]);
+        assert.equal(harness.store.getMember(member.id).status, 'active');
+        const used = await harness.browser().request('POST', '/auth/invite', { token });
+        assert.equal(used.body.error.code, 'invite_used');
+        // The nonce is single use.
+        const replay = await harness.browser().request('POST', '/auth/wallet/verify', { message, signature: await wallet.signMessage(message) });
+        assert.equal(replay.status, 400);
+        // Later logins need no enrollment.
+        const later = harness.browser();
+        const second = (await later.request('POST', '/auth/wallet/nonce', { address: wallet.address })).body.message;
+        const login = await later.request('POST', '/auth/wallet/verify', { message: second, signature: await wallet.signMessage(second) });
+        assert.equal(login.status, 200);
+        assert.equal(login.body.me.member.credentials[0].kind, 'wallet');
+    });
+    it('rejects a signature from another wallet and an unknown wallet without enrollment', async () => {
+        harness = await startHarness();
+        const wallet = Wallet.createRandom();
+        const browser = harness.browser();
+        const message = (await browser.request('POST', '/auth/wallet/nonce', { address: wallet.address })).body.message;
+        const forged = await browser.request('POST', '/auth/wallet/verify', { message, signature: await Wallet.createRandom().signMessage(message) });
+        assert.equal(forged.status, 401);
+        const unknown = (await browser.request('POST', '/auth/wallet/nonce', { address: wallet.address })).body.message;
+        const response = await browser.request('POST', '/auth/wallet/verify', { message: unknown, signature: await wallet.signMessage(unknown) });
+        assert.equal(response.status, 401);
+        assert.equal(response.body.error.code, 'unknown_credential');
+        // An edited message doesn't match the issued one.
+        const issued = (await browser.request('POST', '/auth/wallet/nonce', { address: wallet.address })).body.message;
+        const edited = issued.replace('Sign in to', 'Sign into');
+        assert.equal((await browser.request('POST', '/auth/wallet/verify', { message: edited, signature: await wallet.signMessage(edited) })).status, 400);
+    });
+});
+describe('console auth: API keys, tokens and sessions', () => {
+    it('opens a read-only key session and ends it when the key is revoked', async () => {
+        harness = await startHarness();
+        const key = harness.store.addKey();
+        const browser = harness.browser();
+        assert.equal((await browser.request('POST', '/auth/api-key', { key: 'antseed_wrong' })).status, 401);
+        const login = await browser.request('POST', '/auth/api-key', { key: key.secret });
+        assert.equal(login.status, 200);
+        assert.equal(login.body.kind, 'key');
+        assert.equal(login.body.me.key.id, key.id);
+        assert.equal(login.body.me.key.usage.spent, '1.250000');
+        assert.equal(login.body.me.key.limits.monthly, '10.000000');
+        assert.equal((await browser.request('GET', '/auth/me')).body.kind, 'key');
+        harness.store.keys.set(key.id, { ...key, status: 'revoked' });
+        assert.equal((await browser.request('GET', '/auth/me')).status, 401);
+        const expired = harness.store.addKey({ expiresAt: harness.clock.now - 1 });
+        assert.equal((await harness.browser().request('POST', '/auth/api-key', { key: expired.secret })).status, 401);
+        const fresh = harness.store.addKey();
+        const other = harness.browser();
+        await other.request('POST', '/auth/api-key', { key: fresh.secret });
+        harness.auth.revokeKeySessions(fresh.id);
+        assert.equal((await other.request('GET', '/auth/me')).status, 401);
+    });
+    it('authenticates management tokens through the store', async () => {
+        harness = await startHarness();
+        const browser = harness.browser();
+        const secret = 'antseed_admin_' + 'a'.repeat(43);
+        assert.equal(await harness.auth.authenticate(fakeRequest({ authorization: `Bearer ${secret}` })), null);
+        harness.store.adminTokens.set(secret, { id: 'adm_1', scope: 'read', revokedAt: null, lastUsedAt: null });
+        const principal = await harness.auth.authenticate(fakeRequest({ authorization: `Bearer ${secret}` }));
+        assert.deepEqual(principal, { kind: 'token', tokenId: 'adm_1', scope: 'read' });
+        assert.notEqual(harness.store.adminTokens.get(secret).lastUsedAt, null);
+        // Tokens have no /auth/me profile.
+        assert.equal((await browser.request('GET', '/auth/me', undefined, { authorization: `Bearer ${secret}` })).status, 403);
+        harness.store.adminTokens.get(secret).revokedAt = 2;
+        assert.equal(await harness.auth.authenticate(fakeRequest({ authorization: `Bearer ${secret}` })), null);
+    });
+    it('never falls back to the session cookie when a bearer header is sent', async () => {
+        harness = await startHarness();
+        const browser = harness.browser();
+        await claimOwner(harness, browser);
+        assert.equal((await browser.request('GET', '/auth/me')).status, 200);
+        for (const authorization of ['Bearer not-a-management-token', 'Bearer antseed_admin_unknown']) {
+            assert.equal((await browser.request('GET', '/auth/me', undefined, { authorization })).status, 401, authorization);
+        }
+    });
+    it('expires idle and old sessions, rotates on login and logs out', async () => {
+        harness = await startHarness();
+        const browser = harness.browser();
+        const { passkey } = await claimOwner(harness, browser);
+        // Idle timeout.
+        harness.clock.now += SESSION_IDLE_MS + 1;
+        assert.equal((await browser.request('GET', '/auth/me')).status, 401);
+        // Absolute lifetime, despite activity.
+        assert.equal((await loginPasskey(browser, passkey)).status, 200);
+        const started = harness.clock.now;
+        while (harness.clock.now < started + SESSION_ABSOLUTE_MS - SESSION_IDLE_MS / 2) {
+            harness.clock.now += SESSION_IDLE_MS / 2;
+            assert.equal((await browser.request('GET', '/auth/me')).status, 200);
+        }
+        harness.clock.now = started + SESSION_ABSOLUTE_MS + 1;
+        assert.equal((await browser.request('GET', '/auth/me')).status, 401);
+        // Rotation: the cookie a browser held before logging in no longer works.
+        assert.equal((await loginPasskey(browser, passkey)).status, 200);
+        const before = browser.cookies.get('antseed_console');
+        assert.equal((await loginPasskey(browser, passkey)).status, 200);
+        const after = browser.cookies.get('antseed_console');
+        assert.notEqual(before, after);
+        assert.equal((await harness.raw('GET', '/auth/me', undefined, { host: browser.host, cookie: `antseed_console=${before}` })).status, 401);
+        const logout = await browser.request('POST', '/auth/logout');
+        assert.equal(logout.status, 204);
+        assert.match(browser.lastSetCookies[0], /Max-Age=0/);
+        assert.equal((await harness.raw('GET', '/auth/me', undefined, { host: browser.host, cookie: `antseed_console=${after}` })).status, 401);
+    });
+    it('locks out a disabled member immediately', async () => {
+        harness = await startHarness();
+        const browser = harness.browser();
+        const { passkey, me } = await claimOwner(harness, browser);
+        harness.store.setStatus(me.me.member.id, 'disabled');
+        assert.equal((await browser.request('GET', '/auth/me')).status, 401);
+        assert.equal((await loginPasskey(harness.browser(), passkey)).status, 403);
+        harness.store.setStatus(me.me.member.id, 'active');
+        const again = harness.browser();
+        assert.equal((await loginPasskey(again, passkey)).status, 200);
+        harness.auth.revokeMemberSessions(me.me.member.id);
+        assert.equal((await again.request('GET', '/auth/me')).status, 401);
+    });
+});
+describe('console auth: rate limits and cookies', () => {
+    it('limits attempts per account and per client IP', async () => {
+        harness = await startHarness();
+        const browser = harness.browser();
+        let last;
+        for (let attempt = 0; attempt < 11; attempt += 1)
+            last = await browser.request('POST', '/auth/api-key', { key: 'antseed_guess' });
+        assert.equal(last.status, 429);
+        assert.ok(Number(last.headers['retry-after']) > 0);
+        // Per IP: forwarded addresses are trusted because the harness peer is loopback.
+        const proxied = harness.browser(undefined, { 'x-forwarded-for': '198.51.100.7' });
+        for (let attempt = 0; attempt < 30; attempt += 1) {
+            assert.equal((await proxied.request('POST', '/auth/api-key', { key: `antseed_guess_${attempt}` })).status, 401);
+        }
+        assert.equal((await proxied.request('POST', '/auth/api-key', { key: 'antseed_guess_x' })).status, 429);
+        const elsewhere = harness.browser(undefined, { 'x-forwarded-for': '198.51.100.7, 203.0.113.9' });
+        assert.equal((await elsewhere.request('POST', '/auth/api-key', { key: 'antseed_guess_y' })).status, 401);
+        harness.clock.now += 61 * 60 * 1000;
+        assert.equal((await proxied.request('POST', '/auth/api-key', { key: 'antseed_guess_z' })).status, 401);
+    });
+    it('limits setup attempts per token, not across every client', async () => {
+        harness = await startHarness();
+        const link = harness.auth.createSetupLink();
+        const token = link.slice(link.indexOf('#') + 1);
+        const guesser = harness.browser(undefined, { 'x-forwarded-for': '198.51.100.7' });
+        let last;
+        for (let attempt = 0; attempt < 11; attempt += 1)
+            last = await guesser.request('POST', '/auth/setup', { token: 'guess' });
+        assert.equal(last.status, 429);
+        const owner = harness.browser(undefined, { 'x-forwarded-for': '203.0.113.9' });
+        assert.equal((await owner.request('POST', '/auth/setup', { token })).status, 200);
+    });
+    it('marks cookies Secure over https only, so plain-http LAN sign-in works', async () => {
+        harness = await startHarness({ publicUrl: 'https://gateway.example.test' });
+        const key = harness.store.addKey();
+        const proxied = harness.browser('gateway.example.test', { 'x-forwarded-proto': 'https' });
+        await proxied.request('POST', '/auth/api-key', { key: key.secret });
+        assert.match(proxied.lastSetCookies[0], /; Secure/);
+        const lan = harness.browser('192.168.1.20:8379');
+        await lan.request('POST', '/auth/api-key', { key: key.secret });
+        assert.doesNotMatch(lan.lastSetCookies[0], /Secure/);
+        const local = harness.browser(`127.0.0.1:${harness.port}`);
+        await local.request('POST', '/auth/api-key', { key: key.secret });
+        assert.doesNotMatch(local.lastSetCookies[0], /Secure/);
+    });
+});
+function fakeRequest(headers) {
+    return { headers, socket: { remoteAddress: '127.0.0.1' } };
+}
+export const consoleDepsSatisfyAuth = (deps) => deps;
+//# sourceMappingURL=auth.test.js.map