@braidhq/server 0.1.0 → 0.2.1

package/dist/infrastructure/{fs → _shared}/paths.js

@@ -3,9 +3,9 @@ import { join } from 'node:path';
 export const PROPOSAL_STATUSES = ['pending', 'applied', 'rejected'];
 export const CLARIFY_STATUSES = ['pending', 'answered', 'applied', 'skipped'];
 /**
- * Path-prefix containment check. Both inputs must be absolute. Handles
- * the `/foo/bar-evil` vs `/foo/bar/` aliasing gotcha by normalising the
- * parent with a trailing slash before `startsWith`.
+ * Path-prefix containment check. Both inputs must be absolute.
+ * Handles the `/foo/bar-evil` vs `/foo/bar/` aliasing gotcha,
+ * normalising the parent with a trailing slash before `startsWith`.
  */
 export function isUnder(candidate, parent) {
     const normalisedParent = parent.endsWith('/') ? parent : `${parent}/`;
@@ -25,33 +25,31 @@ export function workspaceArtifactsDir(workspaceRoot) {
     return join(workspaceRoot, 'artifacts');
 }
 export function graphJsonPath(workspaceRoot) {
-    return join(workspaceArtifactsDir(workspaceRoot), 'graph.json');
+    return join(workspaceArtifactsDir(workspaceRoot), 'model.json');
 }
 export function batchPlanPath(workspaceRoot) {
     return join(workspaceArtifactsDir(workspaceRoot), 'batch-plan.json');
 }
-export function sourceUnitStateDir(workspaceRoot) {
+export function sourceUnitObservationDir(workspaceRoot) {
     return join(workspaceArtifactsDir(workspaceRoot), 'source-unit-state');
 }
-export function sourceUnitStateFilePath(workspaceRoot, sourceId, relativePath) {
-    // Drop trailing slash from folder units so file name doesn't end in
-    // `/.json`. Replace path separators inside the unit name with `__`
-    // so a multi-level folder unit still maps to one file.
+export function sourceUnitObservationFilePath(workspaceRoot, sourceId, relativePath) {
+    // Drop the trailing slash from folder units,
+    // so the file name doesn't end in `/.json`.
+    // In the unit name,
+    // replace path separators with `__`, so a nested unit maps to one file.
     const trimmed = relativePath.endsWith('/') ? relativePath.slice(0, -1) : relativePath;
     const flattened = trimmed.replace(/\//g, '__');
-    return join(sourceUnitStateDir(workspaceRoot), sourceId, `${flattened}.json`);
+    return join(sourceUnitObservationDir(workspaceRoot), sourceId, `${flattened}.json`);
 }
-export function sourceUnitStateSourceDir(workspaceRoot, sourceId) {
-    return join(sourceUnitStateDir(workspaceRoot), sourceId);
+export function sourceUnitObservationSourceDir(workspaceRoot, sourceId) {
+    return join(sourceUnitObservationDir(workspaceRoot), sourceId);
 }
 export function proposalsDir(workspaceRoot, status) {
     return join(workspaceArtifactsDir(workspaceRoot), 'proposals', status);
 }
-export function clarifyDir(workspaceRoot, status) {
-    return join(workspaceArtifactsDir(workspaceRoot), 'clarify', status);
-}
-export function decisionsDir(workspaceRoot) {
-    return join(workspaceArtifactsDir(workspaceRoot), 'decisions');
+export function clarificationDir(workspaceRoot, status) {
+    return join(workspaceArtifactsDir(workspaceRoot), 'clarifications', status);
 }
 export function viewsDir(workspaceRoot, kind) {
     return join(workspaceArtifactsDir(workspaceRoot), 'views', kind);
@@ -59,6 +57,12 @@ export function viewsDir(workspaceRoot, kind) {
 export function runsDir(workspaceRoot) {
     return join(workspaceArtifactsDir(workspaceRoot), 'runs');
 }
+export function reactorCyclesDir(workspaceRoot) {
+    return join(workspaceArtifactsDir(workspaceRoot), 'reactor-cycles');
+}
+export function reactorCycleFilePath(workspaceRoot, cycleId) {
+    return join(reactorCyclesDir(workspaceRoot), `${cycleId}.json`);
+}
 export function runIndexPath(workspaceRoot) {
     return join(runsDir(workspaceRoot), 'index.jsonl');
 }
@@ -68,9 +72,12 @@ export function runEventsPath(workspaceRoot, runId) {
 export function runSessionsMetadataPath(workspaceRoot) {
     return join(runsDir(workspaceRoot), 'sessions.jsonl');
 }
-// claude stores conversation memory keyed by cwd, so resume must spawn from
-// the same dir as the first turn. Putting it inside the workspace (not /tmp)
-// keeps the path derivable from runId and lets it survive a server restart.
+/**
+ * claude stores conversation memory keyed by cwd,
+ * so resume must spawn from the same dir as the first turn.
+ * Keeping it in the workspace, not /tmp, stays derivable from runId,
+ * and survives a server restart.
+ */
 export function sessionsDir(workspaceRoot) {
     return join(workspaceRoot, '.braid-sessions');
 }

package/dist/infrastructure/_shared/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../../src/infrastructure/_shared/paths.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,MAAM,CAAC,MAAM,iBAAiB,GAA8B,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;AAC9F,MAAM,CAAC,MAAM,gBAAgB,GAAmC,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;AAE7G;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,MAAc;IACvD,MAAM,gBAAgB,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,CAAA;IACrE,OAAO,SAAS,KAAK,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAA;AACvE,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,CAAC,CAAA;QAChB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,CAAC;QACL,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,aAA2B;IAC/D,OAAO,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;AACzC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,aAA2B;IACvD,OAAO,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE,YAAY,CAAC,CAAA;AACjE,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,aAA2B;IACvD,OAAO,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE,iBAAiB,CAAC,CAAA;AACtE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,aAA2B;IAClE,OAAO,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE,mBAAmB,CAAC,CAAA;AACxE,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,aAA2B,EAC3B,QAAgB,EAChB,YAAoB;IAEpB,6CAA6C;IAC7C,4CAA4C;IAC5C,oBAAoB;IACpB,wEAAwE;IACxE,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAA;IACrF,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IAC9C,OAAO,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,GAAG,SAAS,OAAO,CAAC,CAAA;AACrF,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,aAA2B,EAC3B,QAAgB;IAEhB,OAAO,IAAI,CAAC,wBAAwB,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,CAAA;AAChE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,aAA2B,EAAE,MAAsB;IAC9E,OAAO,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAA;AACxE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,aAA2B,EAAE,MAA2B;IACvF,OAAO,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAA;AAC7E,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,aAA2B,EAAE,IAAY;IAChE,OAAO,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;AAClE,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,aAA2B;IACjD,OAAO,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,CAAA;AAC3D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,aAA2B;IAC1D,OAAO,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAC,CAAA;AACrE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,aAA2B,EAAE,OAAe;IAC/E,OAAO,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,GAAG,OAAO,OAAO,CAAC,CAAA;AACjE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,aAA2B;IACtD,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,CAAA;AACpD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,aAA2B,EAAE,KAAa;IACtE,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAA;AACvD,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,aAA2B;IACjE,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAC,CAAA;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,aAA2B;IACrD,OAAO,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAA;AAC/C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,aAA2B,EAAE,KAAa;IACvE,OAAO,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,CAAA;AAChD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,aAA2B;IAC5D,OAAO,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,aAA2B;IACrE,OAAO,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAA;AAChD,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,aAA2B;IACtE,OAAO,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;AAC1C,CAAC"}

package/dist/infrastructure/auth/AccessPolicy.d.ts

@@ -1,61 +1,36 @@
 import { z } from 'zod';
 declare const Invite: z.ZodObject<{
-    email: z.ZodEffects<z.ZodString, string, string>;
+    email: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
     invitedAt: z.ZodString;
-    /**
-     * Initial server role to apply when the invite is redeemed. Defaults
-     * to `user` so an admin who invites someone is making a deliberate
-     * choice when they pick `admin`.
-     */
-    serverRole: z.ZodDefault<z.ZodEnum<["admin", "user"]>>;
-}, "strip", z.ZodTypeAny, {
-    email: string;
-    serverRole: "user" | "admin";
-    invitedAt: string;
-}, {
-    email: string;
-    invitedAt: string;
-    serverRole?: "user" | "admin" | undefined;
-}>;
+    serverRole: z.ZodDefault<z.ZodEnum<{
+        admin: "admin";
+        user: "user";
+    }>>;
+}, z.core.$strip>;
 export type Invite = z.infer<typeof Invite>;
 export interface AccessDecision {
     readonly allow: boolean;
-    /**
-     * Human-readable reason. Surfaced to the user when access is denied
-     * so they can self-diagnose ("not in allowlist", "no invite found").
-     * Suppressed when `allow=true`.
-     */
     readonly reason?: string;
-    /**
-     * For allowed access, whether this user's email matched an invite.
-     * When true, the caller redeems the invite via `consumeInvite` after
-     * creating the user record.
-     */
     readonly viaInvite?: Invite;
 }
 export interface AccessPolicyConfig {
-    /** Comma-separated list of allowed email domains (e.g. "kdanmobile.com,example.com"). */
     readonly allowedDomains?: readonly string[];
-    /** Comma-separated allowlist of specific emails (per-user, not domain-based). */
     readonly allowedEmails?: readonly string[];
-    /** Comma-separated list of admin email addresses. Matched users get serverRole='admin'. */
     readonly adminEmails?: readonly string[];
 }
 /**
- * Gate 1: decides whether a Google account is allowed to log in to this
- * Braid server. Composed of two layers:
+ * Gate 1 decides whether a Google account may log in to this Braid server.
+ * It composes two layers.
  *
- *   1. **Static allowlist**: `BRAID_ALLOWED_DOMAINS` / `BRAID_ALLOWED_EMAILS`
- *      env vars. Domain matches (`@kdanmobile.com`) auto-pass, email
- *      matches (`alice@example.com`) auto-pass. Free to leave both
- *      unset on a public instance; combined with an empty invite list
- *      this rejects everyone (fail closed).
+ * The static allowlist reads the `BRAID_ALLOWED_DOMAINS` and `BRAID_ALLOWED_EMAILS` env vars.
+ * Domain matches (`@kdanmobile.com`) and email matches (`alice@example.com`) auto-pass.
+ * Both may be left unset on a public instance,
+ * combined with an empty invite list this rejects everyone (fail closed).
  *
- *   2. **Invite list**: `${BRAID_HOME}/access.json` maintained by admin
- *      via `/admin/invites` (Phase B/C admin UI). One invite per email;
- *      consumed on first successful login.
+ * The invite list lives at `${BRAID_HOME}/access.json`, maintained by an admin via `/admin/invites`.
+ * One invite per email, consumed on first successful login.
  *
- * The policy is open for either path: domain pass OR invite present.
+ * The policy is open for either path, a domain pass OR an invite present.
  * That matches the "hybrid" Gate 1 the design picked.
  */
 export declare class AccessPolicy {
@@ -65,17 +40,16 @@ export declare class AccessPolicy {
     private readonly adminEmails;
     constructor(invitesPath: string, config?: AccessPolicyConfig);
     /**
-     * Evaluate against the current allowlist + invite file. Reads the
-     * invite file every call: invite mgmt is low-frequency and a stale
-     * cache would create a frustrating race (admin invites Bob, Bob
-     * logs in, server still says "no").
+     * Evaluate against the current allowlist and invite file.
+     * Reads the invite file every call, since invite management is low-frequency,
+     * and a stale cache would create a frustrating race,
+     * where an admin invites Bob, Bob logs in, and the server still says "no".
      */
     decide(email: string): Promise<AccessDecision>;
     /**
-     * Whether the email should be marked `serverRole='admin'` on the
-     * resulting user record. Independent of `decide`: invites carry
-     * their own role override, and an admin email might also be the
-     * allowlist path with no invite.
+     * Whether the email should be marked `serverRole='admin'` on the resulting user record.
+     * Independent of `decide`, since invites carry their own role override,
+     * and an admin email might take the allowlist path with no invite.
      */
     isAdmin(email: string): boolean;
     listInvites(): Promise<Invite[]>;
@@ -85,22 +59,23 @@ export declare class AccessPolicy {
     }): Promise<Invite>;
     removeInvite(email: string): Promise<void>;
     /**
-     * Consume an invite once the user record exists: remove from invites,
-     * add to approvedEmails so the user can sign in again without the
-     * admin re-inviting them. Idempotent.
+     * Consume an invite once the user record exists.
+     * Remove it from invites,
+     * add to approvedEmails so the user can sign in again without the admin re-inviting them.
+     * Idempotent.
      */
     consumeInvite(email: string): Promise<void>;
     /**
-     * Add an email to the persistent allowlist directly (without going
-     * through the invite step). Used by the bootstrap migration that
-     * back-fills approvedEmails for users who registered before this
-     * field existed.
+     * Add an email to the persistent allowlist directly, without going through the invite step.
+     * Used by the bootstrap migration that back-fills approvedEmails,
+     * for users who registered before this field existed.
      */
     approveEmail(email: string): Promise<void>;
     /**
-     * Drop an email from the persistent allowlist. Called when an admin
-     * deletes a user so the underlying email can't sneak back in without
-     * a fresh invite. Idempotent.
+     * Drop an email from the persistent allowlist.
+     * Called when an admin deletes a user,
+     * so the underlying email can't sneak back in without a fresh invite.
+     * Idempotent.
      */
     revokeApproval(email: string): Promise<void>;
     listApprovedEmails(): Promise<string[]>;

package/dist/infrastructure/auth/AccessPolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AccessPolicy.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/auth/AccessPolicy.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,QAAA,MAAM,MAAM;;;IAGV;;;;OAIG;;;;;;;;;;EAEH,CAAA;AACF,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAA;AAgB3C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,yFAAyF;IACzF,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C,iFAAiF;IACjF,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1C,2FAA2F;IAC3F,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACzC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,YAAY;IAMrB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAL9B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;IACnD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;gBAG9B,WAAW,EAAE,MAAM,EACpC,MAAM,GAAE,kBAAuB;IAOjC;;;;;OAKG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAsBpD;;;;;OAKG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIzB,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAIhC,SAAS,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAenF,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAShD;;;;OAIG;IACG,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjD;;;;;OAKG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhD;;;;OAIG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS5C,kBAAkB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAI/B,WAAW;YAIX,WAAW;YAeX,YAAY;CAI3B"}
+{"version":3,"file":"AccessPolicy.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/auth/AccessPolicy.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,QAAA,MAAM,MAAM;;;;;;;iBAMV,CAAA;AACF,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,CAAA;AAc3C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IAIvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IAGxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,kBAAkB;IAEjC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAE3C,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAE1C,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACzC;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,YAAY;IAMrB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAL9B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;IACnD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;gBAG9B,WAAW,EAAE,MAAM,EACpC,MAAM,GAAE,kBAAuB;IAOjC;;;;;OAKG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAsBpD;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAIzB,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAIhC,SAAS,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAenF,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAShD;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjD;;;;OAIG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWhD;;;;;OAKG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS5C,kBAAkB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAI/B,WAAW;YAIX,WAAW;YAeX,YAAY;CAI3B"}

package/dist/infrastructure/auth/AccessPolicy.js

@@ -5,40 +5,33 @@ import { z } from 'zod';
 const Invite = z.object({
     email: z.string().email().transform(s => s.toLowerCase()),
     invitedAt: z.string().datetime({ offset: true }),
-    /**
-     * Initial server role to apply when the invite is redeemed. Defaults
-     * to `user` so an admin who invites someone is making a deliberate
-     * choice when they pick `admin`.
-     */
+    // Initial server role applied when the invite is redeemed.
+    // Defaults to `user`, so an admin who picks `admin` is making a deliberate choice.
     serverRole: z.enum(['admin', 'user']).default('user'),
 });
 const Content = z.object({
     invites: z.array(Invite).default([]),
-    /**
-     * Emails that have already redeemed an invite (or been approved
-     * directly) and are persistently allowed to sign in. Without this,
-     * an invite would be a one-shot ticket: after the first login the
-     * invite is gone and the user gets locked out on the second login.
-     * Treat this as the "dynamic allowlist" that grows as invites get
-     * consumed; revoking a user removes their entry here.
-     */
+    // Emails that have already redeemed an invite (or been approved directly),
+    // and are persistently allowed to sign in.
+    // Without this, an invite would be a one-shot ticket,
+    // gone after the first login, locking the user out on the second.
+    // Treat this as the "dynamic allowlist" that grows as invites get consumed,
+    // revoking a user removes their entry here.
     approvedEmails: z.array(z.string().email().transform(s => s.toLowerCase())).default([]),
 });
 /**
- * Gate 1: decides whether a Google account is allowed to log in to this
- * Braid server. Composed of two layers:
+ * Gate 1 decides whether a Google account may log in to this Braid server.
+ * It composes two layers.
  *
- *   1. **Static allowlist**: `BRAID_ALLOWED_DOMAINS` / `BRAID_ALLOWED_EMAILS`
- *      env vars. Domain matches (`@kdanmobile.com`) auto-pass, email
- *      matches (`alice@example.com`) auto-pass. Free to leave both
- *      unset on a public instance; combined with an empty invite list
- *      this rejects everyone (fail closed).
+ * The static allowlist reads the `BRAID_ALLOWED_DOMAINS` and `BRAID_ALLOWED_EMAILS` env vars.
+ * Domain matches (`@kdanmobile.com`) and email matches (`alice@example.com`) auto-pass.
+ * Both may be left unset on a public instance,
+ * combined with an empty invite list this rejects everyone (fail closed).
  *
- *   2. **Invite list**: `${BRAID_HOME}/access.json` maintained by admin
- *      via `/admin/invites` (Phase B/C admin UI). One invite per email;
- *      consumed on first successful login.
+ * The invite list lives at `${BRAID_HOME}/access.json`, maintained by an admin via `/admin/invites`.
+ * One invite per email, consumed on first successful login.
  *
- * The policy is open for either path: domain pass OR invite present.
+ * The policy is open for either path, a domain pass OR an invite present.
  * That matches the "hybrid" Gate 1 the design picked.
  */
 export class AccessPolicy {
@@ -53,10 +46,10 @@ export class AccessPolicy {
         this.adminEmails = new Set((config.adminEmails ?? []).map(s => s.toLowerCase()));
     }
     /**
-     * Evaluate against the current allowlist + invite file. Reads the
-     * invite file every call: invite mgmt is low-frequency and a stale
-     * cache would create a frustrating race (admin invites Bob, Bob
-     * logs in, server still says "no").
+     * Evaluate against the current allowlist and invite file.
+     * Reads the invite file every call, since invite management is low-frequency,
+     * and a stale cache would create a frustrating race,
+     * where an admin invites Bob, Bob logs in, and the server still says "no".
      */
     async decide(email) {
         const lower = email.toLowerCase();
@@ -78,10 +71,9 @@ export class AccessPolicy {
         };
     }
     /**
-     * Whether the email should be marked `serverRole='admin'` on the
-     * resulting user record. Independent of `decide`: invites carry
-     * their own role override, and an admin email might also be the
-     * allowlist path with no invite.
+     * Whether the email should be marked `serverRole='admin'` on the resulting user record.
+     * Independent of `decide`, since invites carry their own role override,
+     * and an admin email might take the allowlist path with no invite.
      */
     isAdmin(email) {
         return this.adminEmails.has(email.toLowerCase());
@@ -112,9 +104,10 @@ export class AccessPolicy {
         await this.writeContent({ ...content, invites: filtered });
     }
     /**
-     * Consume an invite once the user record exists: remove from invites,
-     * add to approvedEmails so the user can sign in again without the
-     * admin re-inviting them. Idempotent.
+     * Consume an invite once the user record exists.
+     * Remove it from invites,
+     * add to approvedEmails so the user can sign in again without the admin re-inviting them.
+     * Idempotent.
      */
     async consumeInvite(email) {
         const lower = email.toLowerCase();
@@ -128,10 +121,9 @@ export class AccessPolicy {
         await this.writeContent({ invites, approvedEmails });
     }
     /**
-     * Add an email to the persistent allowlist directly (without going
-     * through the invite step). Used by the bootstrap migration that
-     * back-fills approvedEmails for users who registered before this
-     * field existed.
+     * Add an email to the persistent allowlist directly, without going through the invite step.
+     * Used by the bootstrap migration that back-fills approvedEmails,
+     * for users who registered before this field existed.
      */
     async approveEmail(email) {
         const lower = email.toLowerCase();
@@ -144,9 +136,10 @@ export class AccessPolicy {
         });
     }
     /**
-     * Drop an email from the persistent allowlist. Called when an admin
-     * deletes a user so the underlying email can't sneak back in without
-     * a fresh invite. Idempotent.
+     * Drop an email from the persistent allowlist.
+     * Called when an admin deletes a user,
+     * so the underlying email can't sneak back in without a fresh invite.
+     * Idempotent.
      */
     async revokeApproval(email) {
         const lower = email.toLowerCase();

package/dist/infrastructure/auth/AccessPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"AccessPolicy.js","sourceRoot":"","sources":["../../../src/infrastructure/auth/AccessPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAChD;;;;OAIG;IACH,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACtD,CAAC,CAAA;AAGF,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpC;;;;;;;OAOG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACxF,CAAC,CAAA;AA4BF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,YAAY;IAMJ;IALF,cAAc,CAAqB;IACnC,aAAa,CAAqB;IAClC,WAAW,CAAqB;IAEjD,YACmB,WAAmB,EACpC,SAA6B,EAAE;QADd,gBAAW,GAAX,WAAW,CAAQ;QAGpC,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;QACtF,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;QACpF,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IAClF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;QACjC,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC;YAC/B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QACxB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACxC,IAAI,MAAM,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;YAC3C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QAExB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxC,+DAA+D;QAC/D,IAAI,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;YACxC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QACxB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAA;QAC3D,IAAI,MAAM;YACR,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;QAE3C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,+EAA+E;SACxF,CAAA;IACH,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,KAAa;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAC,WAAW,EAAE,CAAA;IAC3B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAuD;QACrE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAA;QACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC;YAC9C,MAAM,IAAI,eAAe,CAAC,eAAe,KAAK,kBAAkB,CAAC,CAAA;QACnE,MAAM,MAAM,GAAW;YACrB,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,MAAM;SACvC,CAAA;QACD,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5B,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;QAChC,OAAO,MAAM,CAAA;IACf,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAA;QAC/D,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM;YAC5C,OAAM;QACR,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAA;QAC9D,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC3D,CAAC,CAAC,OAAO,CAAC,cAAc;YACxB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;QACtC,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,cAAc,KAAK,OAAO,CAAC,cAAc;YACxF,OAAM;QACR,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAA;IACtD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxC,IAAI,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;YACxC,OAAM;QACR,MAAM,IAAI,CAAC,YAAY,CAAC;YACtB,GAAG,OAAO;YACV,cAAc,EAAE,CAAC,GAAG,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC;SACnD,CAAC,CAAA;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,KAAa;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAA;QAChE,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,MAAM;YACnD,OAAM;QACR,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAA;IACnE,CAAC;IAED,KAAK,CAAC,kBAAkB;QACtB,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,cAAc,CAAA;IAClD,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAA;IAC3C,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;YACrD,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;YACjD,IAAI,CAAC,MAAM,CAAC,OAAO;gBACjB,MAAM,IAAI,eAAe,CAAC,2BAA2B,IAAI,CAAC,WAAW,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;YACpG,OAAO,MAAM,CAAC,IAAI,CAAA;QACpB,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBACpD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CAAA;YAC5C,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,OAAgB;QACzC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3D,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACrF,CAAC;CACF"}
+{"version":3,"file":"AccessPolicy.js","sourceRoot":"","sources":["../../../src/infrastructure/auth/AccessPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAChD,2DAA2D;IAC3D,mFAAmF;IACnF,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACtD,CAAC,CAAA;AAGF,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpC,2EAA2E;IAC3E,2CAA2C;IAC3C,sDAAsD;IACtD,kEAAkE;IAClE,4EAA4E;IAC5E,4CAA4C;IAC5C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACxF,CAAC,CAAA;AAuBF;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,YAAY;IAMJ;IALF,cAAc,CAAqB;IACnC,aAAa,CAAqB;IAClC,WAAW,CAAqB;IAEjD,YACmB,WAAmB,EACpC,SAA6B,EAAE;QADd,gBAAW,GAAX,WAAW,CAAQ;QAGpC,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;QACtF,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;QACpF,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;IAClF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;QACjC,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC;YAC/B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QACxB,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACxC,IAAI,MAAM,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;YAC3C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QAExB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxC,+DAA+D;QAC/D,IAAI,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;YACxC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;QACxB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAA;QAC3D,IAAI,MAAM;YACR,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;QAE3C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,+EAA+E;SACxF,CAAA;IACH,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,KAAa;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;IAClD,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAC,WAAW,EAAE,CAAA;IAC3B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAuD;QACrE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAA;QACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC;YAC9C,MAAM,IAAI,eAAe,CAAC,eAAe,KAAK,kBAAkB,CAAC,CAAA;QACnE,MAAM,MAAM,GAAW;YACrB,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,MAAM;SACvC,CAAA;QACD,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5B,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;QAChC,OAAO,MAAM,CAAA;IACf,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAA;QAC/D,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM;YAC5C,OAAM;QACR,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAA;QAC9D,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC3D,CAAC,CAAC,OAAO,CAAC,cAAc;YACxB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;QACtC,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,cAAc,KAAK,OAAO,CAAC,cAAc;YACxF,OAAM;QACR,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAA;IACtD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxC,IAAI,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;YACxC,OAAM;QACR,MAAM,IAAI,CAAC,YAAY,CAAC;YACtB,GAAG,OAAO;YACV,cAAc,EAAE,CAAC,GAAG,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC;SACnD,CAAC,CAAA;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,KAAa;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAA;QAChE,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,MAAM;YACnD,OAAM;QACR,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,CAAA;IACnE,CAAC;IAED,KAAK,CAAC,kBAAkB;QACtB,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,cAAc,CAAA;IAClD,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAA;IAC3C,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;YACrD,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;YACjD,IAAI,CAAC,MAAM,CAAC,OAAO;gBACjB,MAAM,IAAI,eAAe,CAAC,2BAA2B,IAAI,CAAC,WAAW,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;YACpG,OAAO,MAAM,CAAC,IAAI,CAAA;QACpB,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBACpD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,CAAA;YAC5C,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,OAAgB;QACzC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3D,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACrF,CAAC;CACF"}

package/dist/infrastructure/auth/SessionStore.d.ts

@@ -8,28 +8,38 @@ export interface ResolvedSession {
     readonly userId: UserId;
     readonly expiresAt?: string;
 }
+/**
+ * The port. A hosted deployment swaps the file-backed impl for a shared store,
+ * such as Redis or Postgres, behind this interface.
+ */
+export interface SessionStore {
+    issue: (userId: UserId, options?: {
+        ttlSeconds?: number;
+    }) => Promise<IssuedSession>;
+    resolve: (token: string) => Promise<ResolvedSession | null>;
+    revoke: (token: string) => Promise<void>;
+    revokeAllForUser: (userId: UserId) => Promise<void>;
+}
 /**
  * Hashed session tokens persisted to `${BRAID_HOME}/sessions.json`.
+ * Token format is 32 random bytes encoded as `base64url` (43 chars).
+ * The plain text is returned once at issuance time, the server stores SHA-256 of it.
+ * A leaked sessions.json therefore cannot be replayed as a Bearer header.
  *
- * Token format: 32 random bytes encoded as `base64url` (43 chars). The
- * plain text is returned exactly once at issuance time; the server
- * stores SHA-256 of it. A leaked sessions.json therefore cannot be
- * replayed as a Bearer header.
- *
- * No rotation, no rolling expiry, no per-device tracking: this is the
- * minimum useful surface for v0.2. Phase D / future remote-server work
- * can revisit if needed.
+ * No rotation, no rolling expiry, no per-device tracking,
+ * this is the minimum useful surface for v0.2.
+ * Future remote-server work can revisit if needed.
  */
-export declare class SessionStore {
+export declare class FsSessionStore implements SessionStore {
     private readonly filePath;
     constructor(filePath: string);
     issue(userId: UserId, options?: {
         ttlSeconds?: number;
     }): Promise<IssuedSession>;
     /**
-     * Resolve a Bearer token to its session. Updates `lastUsedAt` as a
-     * side effect; not strictly required for correctness but useful for
-     * the future "active sessions" admin view.
+     * Resolve a Bearer token to its session.
+     * Updates `lastUsedAt` as a side effect,
+     * not required for correctness but useful for the future "active sessions" admin view.
      */
     resolve(token: string): Promise<ResolvedSession | null>;
     revoke(token: string): Promise<void>;

package/dist/infrastructure/auth/SessionStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SessionStore.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/auth/SessionStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AA4B7C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,MAAM;IAEvC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,aAAa,CAAC;IAa1F;;;;OAIG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAevD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASpC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAQvC,IAAI;YAeJ,KAAK;CAIpB"}
+{"version":3,"file":"SessionStore.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/auth/SessionStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AA2B7C,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,aAAa,CAAC,CAAA;IACpF,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAA;IAC3D,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACxC,gBAAgB,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACpD;AAED;;;;;;;;;GASG;AACH,qBAAa,cAAe,YAAW,YAAY;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,MAAM;IAEvC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,aAAa,CAAC;IAgB1F;;;;OAIG;IACG,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAevD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASpC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAQvC,IAAI;YAeJ,KAAK;CAIpB"}

package/dist/infrastructure/auth/SessionStore.js

@@ -4,12 +4,11 @@ import { dirname } from 'node:path';
 import { ValidationError } from '@braidhq/core';
 import { z } from 'zod';
 const SessionRow = z.object({
-    /**
-     * SHA-256 hex of the actual token. The plaintext is shown to the
-     * client exactly once at issuance time; the server only ever sees
-     * the hash thereafter. Constant-time compare is unnecessary for a
-     * pre-image lookup on hex strings, which is what `findByToken` does.
-     */
+    // SHA-256 hex of the actual token.
+    // The plaintext is shown to the client once at issuance time,
+    // the server only ever sees the hash thereafter.
+    // Constant-time compare is unnecessary for a pre-image lookup on hex strings,
+    // which is what `findByToken` does.
     tokenHash: z.string().length(64),
     userId: z.string().min(1),
     createdAt: z.string().datetime({ offset: true }),
@@ -21,17 +20,15 @@ const StoreContent = z.object({
 });
 /**
  * Hashed session tokens persisted to `${BRAID_HOME}/sessions.json`.
+ * Token format is 32 random bytes encoded as `base64url` (43 chars).
+ * The plain text is returned once at issuance time, the server stores SHA-256 of it.
+ * A leaked sessions.json therefore cannot be replayed as a Bearer header.
  *
- * Token format: 32 random bytes encoded as `base64url` (43 chars). The
- * plain text is returned exactly once at issuance time; the server
- * stores SHA-256 of it. A leaked sessions.json therefore cannot be
- * replayed as a Bearer header.
- *
- * No rotation, no rolling expiry, no per-device tracking: this is the
- * minimum useful surface for v0.2. Phase D / future remote-server work
- * can revisit if needed.
+ * No rotation, no rolling expiry, no per-device tracking,
+ * this is the minimum useful surface for v0.2.
+ * Future remote-server work can revisit if needed.
  */
-export class SessionStore {
+export class FsSessionStore {
     filePath;
     constructor(filePath) {
         this.filePath = filePath;
@@ -40,18 +37,21 @@ export class SessionStore {
         const content = await this.read();
         const token = randomBytes(32).toString('base64url');
         const tokenHash = sha256Hex(token);
-        const createdAt = new Date().toISOString();
+        const now = Date.now();
+        const createdAt = new Date(now).toISOString();
         const expiresAt = options.ttlSeconds
-            ? new Date(Date.now() + options.ttlSeconds * 1000).toISOString()
+            ? new Date(now + options.ttlSeconds * 1000).toISOString()
             : undefined;
+        // Drop already-expired rows so short-lived service tokens do not accumulate.
+        content.sessions = content.sessions.filter(s => !s.expiresAt || Date.parse(s.expiresAt) >= now);
         content.sessions.push({ tokenHash, userId, createdAt, ...(expiresAt ? { expiresAt } : {}) });
         await this.write(content);
         return { token, userId, ...(expiresAt ? { expiresAt } : {}) };
     }
     /**
-     * Resolve a Bearer token to its session. Updates `lastUsedAt` as a
-     * side effect; not strictly required for correctness but useful for
-     * the future "active sessions" admin view.
+     * Resolve a Bearer token to its session.
+     * Updates `lastUsedAt` as a side effect,
+     * not required for correctness but useful for the future "active sessions" admin view.
      */
     async resolve(token) {
         if (!token || token.length === 0)

package/dist/infrastructure/auth/SessionStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"SessionStore.js","sourceRoot":"","sources":["../../../src/infrastructure/auth/SessionStore.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC7D,CAAC,CAAA;AAIF,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC1C,CAAC,CAAA;AAcF;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,YAAY;IACM;IAA7B,YAA6B,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;IAAG,CAAC;IAEjD,KAAK,CAAC,KAAK,CAAC,MAAc,EAAE,UAAmC,EAAE;QAC/D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACnD,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU;YAClC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YAChE,CAAC,CAAC,SAAS,CAAA;QACb,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QAC5F,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACzB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;IAC/D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAC9B,OAAO,IAAI,CAAA;QACb,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAA;QACjE,IAAI,CAAC,GAAG;YACN,OAAO,IAAI,CAAA;QACb,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE;YACzD,OAAO,IAAI,CAAA;QACb,GAAG,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACzC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACzB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAgB,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;IACjG,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAA;QACxE,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,MAAM;YAC7C,OAAM;QACR,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC1C,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAc;QACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;QAClE,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,MAAM;YAC7C,OAAM;QACR,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC1C,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YAClD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;YACtD,IAAI,CAAC,MAAM,CAAC,OAAO;gBACjB,MAAM,IAAI,eAAe,CAAC,6BAA6B,IAAI,CAAC,QAAQ,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;YACnG,OAAO,MAAM,CAAC,IAAI,CAAA;QACpB,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBACpD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;YACzB,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,OAAqB;QACvC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACxD,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAClF,CAAC;CACF;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACzD,CAAC"}
+{"version":3,"file":"SessionStore.js","sourceRoot":"","sources":["../../../src/infrastructure/auth/SessionStore.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,mCAAmC;IACnC,8DAA8D;IAC9D,iDAAiD;IACjD,8EAA8E;IAC9E,oCAAoC;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC7D,CAAC,CAAA;AAIF,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC1C,CAAC,CAAA;AAyBF;;;;;;;;;GASG;AACH,MAAM,OAAO,cAAc;IACI;IAA7B,YAA6B,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;IAAG,CAAC;IAEjD,KAAK,CAAC,KAAK,CAAC,MAAc,EAAE,UAAmC,EAAE;QAC/D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACnD,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;QAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU;YAClC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YACzD,CAAC,CAAC,SAAS,CAAA;QACb,6EAA6E;QAC7E,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,CAAA;QAC/F,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QAC5F,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACzB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;IAC/D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAC9B,OAAO,IAAI,CAAA;QACb,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAA;QACjE,IAAI,CAAC,GAAG;YACN,OAAO,IAAI,CAAA;QACb,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE;YACzD,OAAO,IAAI,CAAA;QACb,GAAG,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACzC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACzB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAgB,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;IACjG,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAA;QACxE,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,MAAM;YAC7C,OAAM;QACR,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC1C,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAc;QACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;QAClE,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,MAAM;YAC7C,OAAM;QACR,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC1C,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YAClD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;YACtD,IAAI,CAAC,MAAM,CAAC,OAAO;gBACjB,MAAM,IAAI,eAAe,CAAC,6BAA6B,IAAI,CAAC,QAAQ,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;YACnG,OAAO,MAAM,CAAC,IAAI,CAAA;QACpB,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBACpD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;YACzB,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,OAAqB;QACvC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACxD,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAClF,CAAC;CACF;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACzD,CAAC"}

package/dist/infrastructure/batch/FsBatchPlanRepository.d.ts

@@ -0,0 +1,14 @@
+import type { BatchPlanRepository, Workspace } from '@braidhq/core';
+import { BatchPlan } from '@braidhq/core';
+import { z } from 'zod';
+export declare const BATCH_PLAN_VERSION = 2;
+export declare const BatchPlanFile: z.ZodObject<{
+    version: z.ZodNumber;
+    plan: z.ZodUnknown;
+}, z.core.$strip>;
+export declare class FsBatchPlanRepository implements BatchPlanRepository {
+    load(workspace: Workspace): Promise<BatchPlan | null>;
+    save(workspace: Workspace, plan: BatchPlan): Promise<void>;
+    clear(workspace: Workspace): Promise<void>;
+}
+//# sourceMappingURL=FsBatchPlanRepository.d.ts.map

package/dist/infrastructure/batch/FsBatchPlanRepository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FsBatchPlanRepository.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/batch/FsBatchPlanRepository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAGnE,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAEzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,eAAO,MAAM,kBAAkB,IAAI,CAAA;AAGnC,eAAO,MAAM,aAAa;;;iBAGxB,CAAA;AAEF,qBAAa,qBAAsB,YAAW,mBAAmB;IACzD,IAAI,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAmBrD,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAU1D,KAAK,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;CAGjD"}

package/dist/infrastructure/{fs → batch}/FsBatchPlanRepository.js

@@ -3,11 +3,13 @@ import process from 'node:process';
 import { BatchPlan } from '@braidhq/core';
 import { BatchPlan as BatchPlanData } from '@braidhq/schema';
 import { z } from 'zod';
-import { batchPlanPath, workspaceArtifactsDir } from './paths.js';
-export const BATCH_PLAN_VERSION = 1;
+import { batchPlanPath, workspaceArtifactsDir } from '../_shared/paths.js';
+// On-disk envelope version. Bumped only when the plan payload shape changes.
+export const BATCH_PLAN_VERSION = 2;
+// Envelope only. The plan itself is validated by its schema below.
 export const BatchPlanFile = z.object({
     version: z.number().int(),
-    plan: BatchPlanData,
+    plan: z.unknown(),
 });
 export class FsBatchPlanRepository {
     async load(workspace) {
@@ -20,11 +22,11 @@ export class FsBatchPlanRepository {
                 return null;
             throw error;
         }
-        const parsed = BatchPlanFile.parse(JSON.parse(raw));
-        if (parsed.version !== BATCH_PLAN_VERSION) {
-            throw new Error(`batch-plan.json version mismatch in ${workspace.rootPath}: expected ${BATCH_PLAN_VERSION}, got ${parsed.version}`);
+        const file = BatchPlanFile.parse(JSON.parse(raw));
+        if (file.version > BATCH_PLAN_VERSION) {
+            throw new Error(`batch-plan.json in ${workspace.rootPath} is version ${file.version}, newer than supported ${BATCH_PLAN_VERSION}`);
         }
-        return new BatchPlan(parsed.plan);
+        return new BatchPlan(BatchPlanData.parse(file.plan));
     }
     async save(workspace, plan) {
         const path = batchPlanPath(workspace.rootPath);

package/dist/infrastructure/batch/FsBatchPlanRepository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FsBatchPlanRepository.js","sourceRoot":"","sources":["../../../src/infrastructure/batch/FsBatchPlanRepository.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACzE,OAAO,OAAO,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACzC,OAAO,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC5D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAE1E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAA;AAEnC,mEAAmE;AACnE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACzB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;CAClB,CAAC,CAAA;AAEF,MAAM,OAAO,qBAAqB;IAChC,KAAK,CAAC,IAAI,CAAC,SAAoB;QAC7B,IAAI,GAAW,CAAA;QACf,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAA;QAClE,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBACpD,OAAO,IAAI,CAAA;YACb,MAAM,KAAK,CAAA;QACb,CAAC;QACD,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;QACjD,IAAI,IAAI,CAAC,OAAO,GAAG,kBAAkB,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,sBAAsB,SAAS,CAAC,QAAQ,eAAe,IAAI,CAAC,OAAO,0BAA0B,kBAAkB,EAAE,CAClH,CAAA;QACH,CAAC;QACD,OAAO,IAAI,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IACtD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAoB,EAAE,IAAe;QAC9C,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QAC9C,MAAM,KAAK,CAAC,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3E,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAA;QACpE,oEAAoE;QACpE,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;QACtD,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACtE,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACzB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAoB;QAC9B,MAAM,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9D,CAAC;CACF"}