@bridge4dev/runner 0.65.1 → 0.67.0

package/dist/codex-accounts.d.ts

@@ -0,0 +1,79 @@
+import { type CodexHome } from './adapters/codex-home.js';
+import type { AgentRateLimitWindow } from './adapters/types.js';
+import type { AccountCard, AccountList } from './claude-homes.js';
+/** Which row the home uses: a saved one only while its directory is there. */
+export declare function activeCodexAccountId(home?: string): string;
+/**
+ * The list of Codex logins on this machine (§8 `agent_accounts`).
+ *
+ * Repairs the home first, without forcing anything (S4 item 2), so a real file
+ * the CLI left in place of the link is back in its store before the rows are
+ * read. No subprocess anywhere in it.
+ */
+export declare function listCodexAccounts(homedir?: string): AccountList;
+/** The card of a row that just signed in – for the relay's log and the tests. */
+export declare function codexAccountCard(id: string): AccountCard;
+/**
+ * Make a row the login new Codex sessions start under (§8 `agent_account_activate`).
+ *
+ * Running sessions keep the tokens they started with; a refreshed login is
+ * returned to its own store before the link moves (S4 item 7). The machine row is
+ * refused only where the machine's owner wrote `[codex] auth = "own"`: there the
+ * host login is kept away from the runner on purpose, and the next repair would
+ * take the link out again.
+ */
+export declare function activateCodexAccount(id: string): string;
+/**
+ * Forget a saved Codex login: its file goes, its record goes (§8 `agent_account_forget`).
+ *
+ * The machine row cannot be forgotten. A row a live session runs under is
+ * refused – its process refreshes into that file until it ends. The row in use is
+ * switched to the machine login FIRST, so the link never points at nothing.
+ */
+export declare function forgetCodexAccount(id: string): {
+    active: string;
+};
+/** The account a Codex session runs under – captured at its start, kept to its end (R14). */
+export interface CodexSessionAccount {
+    id: string;
+    email?: string;
+    orgId?: string;
+    plan?: string;
+}
+/**
+ * Who the home a session is starting with belongs to: the row it is set to, and
+ * the identity of the login the link resolves to right now – read locally.
+ */
+export declare function codexSessionAccount(home: CodexHome): CodexSessionAccount;
+/**
+ * `owner` is the session object itself: a session can end twice (the boot catch
+ * calls `stop()`, and the process exit calls it again), and a bare delete by
+ * sessionId then wiped the note of the RELAUNCHED session that had taken the
+ * same id – «forget» stopped refusing the account that session was using (found
+ * by the independent check of S4).
+ */
+export declare function noteCodexSessionAccount(sessionId: string, accountId: string, owner: object): void;
+export declare function releaseCodexSessionAccount(sessionId: string, owner: object): void;
+/** Codex rows some live session process runs under right now. */
+export declare function liveCodexAccountIds(): Set<string>;
+/** Who the active row is, for `auth_status.activeAccount` (§8) – read locally, no CLI. */
+export declare function codexActiveAccountSummary(id: string, homedir?: string): {
+    id: string;
+    email?: string;
+    orgId?: string;
+};
+/** A refusal persisted on a saved row that still stands against its login file. */
+export declare function codexRowRefused(id: string): boolean;
+/** A session under this saved row was refused (D2): mark it, remove nothing. */
+export declare function markCodexLoginExpired(id: string): void;
+/** The row worked again. Writes only when there was a mark to clear. */
+export declare function clearCodexLoginExpired(id: string): void;
+/**
+ * A Codex session reported its account's windows. Codex sends these after every
+ * model request, for the account the session runs under – so for a card they
+ * are that subscription's figures, as fresh as its last working session.
+ */
+export declare function noteCodexUsage(orgId: string | undefined, windows: AgentRateLimitWindow[]): void;
+/** Forget every remembered reading – tests. */
+export declare function resetCodexUsage(): void;
+//# sourceMappingURL=codex-accounts.d.ts.map

package/dist/codex-accounts.js

@@ -0,0 +1,386 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { readAgentAuth, updateAgentAuth } from './agent-auth.js';
+import { codexAccountAuthFile, codexAccountDir, codexAccountsDir, codexHomePath, configuredCodexAuth, hostCodexAuthFile, markedCodexAccount, readCodexCredentialFile, repairCodexAuth, setCodexActiveLogin, } from './adapters/codex-home.js';
+import { AccountError, MACHINE_ACCOUNT_ID, isAccountId, refusalActive } from './login-marks.js';
+import { log } from './log.js';
+/**
+ * Several Codex logins on one machine, as rows (#422 S4, plan §8).
+ *
+ * `adapters/codex-home.ts` moves the files; this module is what the wire and a
+ * session read: the list of cards, switching, forgetting, which account a
+ * session starts under, and the verdict on a saved row. The rows have the SAME
+ * shape as Claude's (`AccountCard`), so the API, the mirror and the window need
+ * nothing new to serve Codex.
+ *
+ * Differences from Claude, each on purpose:
+ *  - identity is read from the login file itself (claims of `id_token`) – there
+ *    is no public `auth status` with an e-mail in it, and reading a local file
+ *    costs no subprocess, so the list may read it every time;
+ *  - the machine row is the host's `~/.codex/auth.json`, which DevBridge never
+ *    wrote and does not start writing: no «Log in again» for it (R13), and a
+ *    missing file is `expired`, not a reason to drop the row (S4 item 6);
+ *  - limits: Codex measures nothing by itself – a session reports its account's
+ *    windows as it works, and the card shows the last ones this daemon saw.
+ */
+// ─── Rows ────────────────────────────────────────────────────────────
+function recordsOf() {
+    return readAgentAuth().codexAccounts ?? [];
+}
+function recordOf(id) {
+    return recordsOf().find((record) => record.id === id);
+}
+function dirExists(id, home) {
+    try {
+        return fs.lstatSync(codexAccountDir(id, home)).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * A saved login whose record went missing (the record file was set aside as
+ * unreadable, say) is still a login on this disk: it gets its record back,
+ * dated by its directory, instead of becoming a file nobody can list or forget.
+ */
+function adoptOrphanDirectories(home) {
+    let names;
+    try {
+        names = fs.readdirSync(codexAccountsDir(home));
+    }
+    catch {
+        return;
+    }
+    const known = new Set(recordsOf().map((record) => record.id));
+    const orphans = names.filter((name) => isAccountId(name) && !known.has(name));
+    if (orphans.length === 0)
+        return;
+    updateAgentAuth((file) => {
+        const records = file.codexAccounts ?? [];
+        for (const id of orphans) {
+            if (records.some((record) => record.id === id))
+                continue;
+            let addedAt = new Date().toISOString();
+            try {
+                addedAt = new Date(Math.floor(fs.statSync(codexAccountDir(id, home)).mtimeMs)).toISOString();
+            }
+            catch {
+                /* dated now */
+            }
+            records.push({ id, addedAt });
+        }
+        file.codexAccounts = records;
+    });
+    log.warn('codex-accounts: saved logins without a record got one back', { count: orphans.length });
+}
+/** Did a refusal persisted on the row outlive the login file? A file written after it wins. */
+function markHolds(markedAt, writtenMs) {
+    if (!markedAt)
+        return false;
+    const marked = Date.parse(markedAt);
+    if (!Number.isFinite(marked))
+        return false;
+    return writtenMs === undefined || writtenMs <= marked;
+}
+function loginOf(credential, refused) {
+    const login = credential.status === 'unknown'
+        ? 'unknown'
+        : credential.status === 'ok' && !refused
+            ? 'ok'
+            : 'expired';
+    return { login, ...(credential.expiresAt ? { loginUntil: credential.expiresAt } : {}) };
+}
+function identityFields(identity) {
+    return {
+        ...(identity?.email ? { email: identity.email } : {}),
+        ...(identity?.orgId ? { orgId: identity.orgId } : {}),
+        ...(identity?.plan ? { plan: identity.plan } : {}),
+    };
+}
+const sameIdentity = (a, b) => (a?.email ?? '') === (b.email ?? '') &&
+    (a?.orgId ?? '') === (b.orgId ?? '') &&
+    (a?.plan ?? '') === (b.plan ?? '');
+/** Which row the home uses: a saved one only while its directory is there. */
+export function activeCodexAccountId(home = codexHomePath()) {
+    const marked = markedCodexAccount(home);
+    return marked && dirExists(marked, home) ? marked : MACHINE_ACCOUNT_ID;
+}
+/**
+ * The list of Codex logins on this machine (§8 `agent_accounts`).
+ *
+ * Repairs the home first, without forcing anything (S4 item 2), so a real file
+ * the CLI left in place of the link is back in its store before the rows are
+ * read. No subprocess anywhere in it.
+ */
+export function listCodexAccounts(homedir = os.homedir()) {
+    const home = codexHomePath();
+    if (fs.existsSync(home))
+        repairCodexAuth({ homedir });
+    adoptOrphanDirectories(home);
+    const active = activeCodexAccountId(home);
+    const host = readCodexCredentialFile(hostCodexAuthFile(homedir));
+    const machineCard = {
+        id: MACHINE_ACCOUNT_ID,
+        kind: 'machine',
+        ...identityFields(host.identity),
+        active: active === MACHINE_ACCOUNT_ID,
+        ...loginOf(host, refusalActive('codex', MACHINE_ACCOUNT_ID)),
+        ...usageOf(host.identity.orgId),
+    };
+    const refreshed = new Map();
+    const saved = recordsOf()
+        .filter((record) => isAccountId(record.id) && dirExists(record.id, home))
+        .sort((a, b) => Date.parse(a.addedAt) - Date.parse(b.addedAt))
+        .map((record) => {
+        const credential = readCodexCredentialFile(codexAccountAuthFile(record.id, home));
+        const readable = Object.keys(credential.identity).length > 0;
+        if (readable && !sameIdentity(record.lastSeenIdentity, credential.identity)) {
+            refreshed.set(record.id, credential.identity);
+        }
+        // What the file says now; what it said last time when it cannot be read
+        // (a row whose login is gone keeps its name, D2).
+        const identity = readable ? credential.identity : record.lastSeenIdentity;
+        const refused = refusalActive('codex', record.id) || markHolds(record.loginExpiredAt, credential.writtenMs);
+        const same = identity?.orgId !== undefined &&
+            host.identity.orgId !== undefined &&
+            identity.orgId === host.identity.orgId;
+        return {
+            id: record.id,
+            kind: 'saved',
+            ...identityFields(identity),
+            addedAt: record.addedAt,
+            active: active === record.id,
+            ...loginOf(credential, refused),
+            ...usageOf(identity?.orgId),
+            ...(same ? { sameAsMachine: true } : {}),
+        };
+    });
+    if (refreshed.size > 0) {
+        try {
+            updateAgentAuth((file) => {
+                const at = new Date().toISOString();
+                for (const record of file.codexAccounts ?? []) {
+                    const identity = refreshed.get(record.id);
+                    if (identity)
+                        record.lastSeenIdentity = { ...identity, at };
+                }
+            });
+        }
+        catch (error) {
+            log.warn('codex-accounts: could not remember who the saved logins are', {
+                error: String(error),
+            });
+        }
+    }
+    return { accounts: [machineCard, ...saved], active };
+}
+function cardOf(id) {
+    const card = listCodexAccounts().accounts.find((row) => row.id === id);
+    if (!card)
+        throw new AccountError('the account is not on this server any more');
+    return card;
+}
+/** The card of a row that just signed in – for the relay's log and the tests. */
+export function codexAccountCard(id) {
+    return cardOf(id);
+}
+// ─── Switching and forgetting ────────────────────────────────────────
+/**
+ * Make a row the login new Codex sessions start under (§8 `agent_account_activate`).
+ *
+ * Running sessions keep the tokens they started with; a refreshed login is
+ * returned to its own store before the link moves (S4 item 7). The machine row is
+ * refused only where the machine's owner wrote `[codex] auth = "own"`: there the
+ * host login is kept away from the runner on purpose, and the next repair would
+ * take the link out again.
+ */
+export function activateCodexAccount(id) {
+    const home = codexHomePath();
+    if (id === MACHINE_ACCOUNT_ID) {
+        if (configuredCodexAuth() === 'own') {
+            throw new AccountError('this server keeps Codex away from the login of the machine ([codex] auth = "own" in the runner config) – switch to a saved login instead');
+        }
+        assertNoLiveSessionsForMachineSwitch();
+    }
+    else {
+        if (!isAccountId(id) || !recordOf(id))
+            throw new AccountError('no such account on this server');
+        if (!dirExists(id, home)) {
+            throw new AccountError('the login of this account is gone from this server – forget it');
+        }
+    }
+    fs.mkdirSync(home, { recursive: true, mode: 0o700 });
+    setCodexActiveLogin(id, home);
+    return activeCodexAccountId(home);
+}
+/**
+ * Forget a saved Codex login: its file goes, its record goes (§8 `agent_account_forget`).
+ *
+ * The machine row cannot be forgotten. A row a live session runs under is
+ * refused – its process refreshes into that file until it ends. The row in use is
+ * switched to the machine login FIRST, so the link never points at nothing.
+ */
+export function forgetCodexAccount(id) {
+    if (id === MACHINE_ACCOUNT_ID) {
+        throw new AccountError('the login of this machine cannot be forgotten');
+    }
+    const record = isAccountId(id) ? recordOf(id) : undefined;
+    if (!record)
+        throw new AccountError('no such account on this server');
+    if (liveCodexAccountIds().has(id)) {
+        throw new AccountError('a running session uses this account – stop it first, then forget it');
+    }
+    const home = codexHomePath();
+    if (markedCodexAccount(home) === id) {
+        assertNoLiveSessionsForMachineSwitch();
+        if (configuredCodexAuth() === 'own') {
+            throw new AccountError('this is the only login Codex may use on this server ([codex] auth = "own") – switch to another saved login first');
+        }
+        setCodexActiveLogin(MACHINE_ACCOUNT_ID, home);
+    }
+    fs.rmSync(codexAccountDir(id, home), { recursive: true, force: true });
+    updateAgentAuth((file) => {
+        file.codexAccounts = (file.codexAccounts ?? []).filter((entry) => entry.id !== id);
+        if (file.codexAccounts.length === 0)
+            delete file.codexAccounts;
+    });
+    if (record.lastSeenIdentity?.orgId)
+        usageByKey.delete(record.lastSeenIdentity.orgId);
+    log.info('codex-accounts: an account was forgotten', { account: id });
+    return { active: activeCodexAccountId(home) };
+}
+// ─── What a session starts under ─────────────────────────────────────
+/**
+ * Moving the link to the MACHINE login while Codex sessions run is refused.
+ *
+ * Codex writes a refreshed token through whatever `auth.json` points at when the
+ * refresh comes back, and it only compares accounts when it RE-READS the file, not
+ * when it writes. A switch in that second would put a session's tokens into the
+ * file the link points at by then – and the host user's own `~/.codex/auth.json`
+ * is the one file DevBridge must never write (R13). Between saved logins the same
+ * second costs a re-login of a saved account and is left open (the plan: a switch
+ * acts on what starts after it); over the host's file it is not ours to risk.
+ */
+function assertNoLiveSessionsForMachineSwitch() {
+    const live = liveCodexAccountIds().size;
+    if (live === 0)
+        return;
+    throw new AccountError(live === 1
+        ? 'a Codex session is running on this server – close or pause it before switching to the login of this machine'
+        : `${live} Codex sessions are running on this server – close or pause them before switching to the login of this machine`);
+}
+/**
+ * Who the home a session is starting with belongs to: the row it is set to, and
+ * the identity of the login the link resolves to right now – read locally.
+ */
+export function codexSessionAccount(home) {
+    const id = home.auth === 'linked' || !home.accountId ? MACHINE_ACCOUNT_ID : home.accountId;
+    if (home.auth === 'missing')
+        return { id };
+    const identity = readCodexCredentialFile(path.join(home.path, 'auth.json')).identity;
+    return { id, ...identity };
+}
+/** sessionId → the Codex row that session's process runs under, and which process said so. */
+const sessionAccounts = new Map();
+/**
+ * `owner` is the session object itself: a session can end twice (the boot catch
+ * calls `stop()`, and the process exit calls it again), and a bare delete by
+ * sessionId then wiped the note of the RELAUNCHED session that had taken the
+ * same id – «forget» stopped refusing the account that session was using (found
+ * by the independent check of S4).
+ */
+export function noteCodexSessionAccount(sessionId, accountId, owner) {
+    sessionAccounts.set(sessionId, { accountId, owner });
+}
+export function releaseCodexSessionAccount(sessionId, owner) {
+    if (sessionAccounts.get(sessionId)?.owner === owner)
+        sessionAccounts.delete(sessionId);
+}
+/** Codex rows some live session process runs under right now. */
+export function liveCodexAccountIds() {
+    return new Set([...sessionAccounts.values()].map((entry) => entry.accountId));
+}
+// ─── The verdict on a saved row ──────────────────────────────────────
+/** Who the active row is, for `auth_status.activeAccount` (§8) – read locally, no CLI. */
+export function codexActiveAccountSummary(id, homedir = os.homedir()) {
+    const file = id === MACHINE_ACCOUNT_ID ? hostCodexAuthFile(homedir) : codexAccountAuthFile(id);
+    const identity = readCodexCredentialFile(file).identity;
+    const known = identity.orgId || identity.email ? identity : recordOf(id)?.lastSeenIdentity;
+    return {
+        id,
+        ...(known?.email ? { email: known.email } : {}),
+        ...(known?.orgId ? { orgId: known.orgId } : {}),
+    };
+}
+/** A refusal persisted on a saved row that still stands against its login file. */
+export function codexRowRefused(id) {
+    if (id === MACHINE_ACCOUNT_ID || !isAccountId(id))
+        return false;
+    const record = recordOf(id);
+    if (!record?.loginExpiredAt)
+        return false;
+    return markHolds(record.loginExpiredAt, readCodexCredentialFile(codexAccountAuthFile(id)).writtenMs);
+}
+/** A session under this saved row was refused (D2): mark it, remove nothing. */
+export function markCodexLoginExpired(id) {
+    if (!isAccountId(id))
+        return;
+    try {
+        updateAgentAuth((file) => {
+            const record = file.codexAccounts?.find((entry) => entry.id === id);
+            if (record)
+                record.loginExpiredAt = new Date().toISOString();
+        });
+    }
+    catch (error) {
+        log.warn('codex-accounts: could not record the refusal', { account: id, error: String(error) });
+    }
+}
+/** The row worked again. Writes only when there was a mark to clear. */
+export function clearCodexLoginExpired(id) {
+    if (!isAccountId(id) || !recordOf(id)?.loginExpiredAt)
+        return;
+    try {
+        updateAgentAuth((file) => {
+            const record = file.codexAccounts?.find((entry) => entry.id === id);
+            if (record)
+                delete record.loginExpiredAt;
+        });
+    }
+    catch (error) {
+        log.warn('codex-accounts: could not clear the refusal', { account: id, error: String(error) });
+    }
+}
+// ─── Limits a session saw ────────────────────────────────────────────
+/** subscription key → the windows a Codex session of it last reported, in this daemon. */
+const usageByKey = new Map();
+/**
+ * A Codex session reported its account's windows. Codex sends these after every
+ * model request, for the account the session runs under – so for a card they
+ * are that subscription's figures, as fresh as its last working session.
+ */
+export function noteCodexUsage(orgId, windows) {
+    if (!orgId)
+        return;
+    // The two windows a card has words for; a window Codex names otherwise stays in
+    // the session's own panel.
+    const rows = windows.flatMap((window) => (window.key === 'five_hour' || window.key === 'seven_day') &&
+        typeof window.usedPercent === 'number'
+        ? [{ key: window.key, label: null, percent: window.usedPercent, resetsAt: window.resetsAt }]
+        : []);
+    if (rows.length === 0)
+        return;
+    usageByKey.set(orgId, { rows, measuredAtMs: Date.now() });
+}
+function usageOf(orgId) {
+    const reading = orgId ? usageByKey.get(orgId) : undefined;
+    if (!reading)
+        return {};
+    return { usage: reading.rows, usageMeasuredAt: new Date(reading.measuredAtMs).toISOString() };
+}
+/** Forget every remembered reading – tests. */
+export function resetCodexUsage() {
+    usageByKey.clear();
+}
+//# sourceMappingURL=codex-accounts.js.map

package/dist/commit-message.js

@@ -1,6 +1,7 @@
 import { query } from '@anthropic-ai/claude-agent-sdk';
 import { assertClaudeInstalled, claudeExecutableOption } from './agent-binary.js';
 import { scrubbedEnv } from './adapters/claude.js';
+import { activeAccountHome, withAccountHome } from './claude-homes.js';
 import { gitBranchDiff } from './gitops.js';
 import { isSecretPath, maskString } from './policy.js';
 /**
@@ -160,7 +161,9 @@ export async function proposeCommitMessage(input, queryFn = query) {
             prompt: buildPrompt(input, diff),
             options: {
                 cwd: input.worktreePath,
-                env: scrubbedEnv(),
+                // The machine's active account (#422), with the same rule as a session:
+                // its home, and no operator token above it.
+                env: withAccountHome(scrubbedEnv(), activeAccountHome()),
                 // The second place Claude `Options` are built. It must follow the same
                 // constant, or after C3 commit messages would still be written by the
                 // bundled binary while sessions had moved to the system one.

package/dist/config.d.ts

@@ -15,12 +15,12 @@ declare const ConfigSchema: z.ZodObject<{
         name: z.ZodString;
         token: z.ZodString;
     }, "strip", z.ZodTypeAny, {
-        name: string;
         id: string;
+        name: string;
         token: string;
     }, {
-        name: string;
         id: string;
+        name: string;
         token: string;
     }>;
     mcp: z.ZodOptional<z.ZodObject<{
@@ -34,9 +34,9 @@ declare const ConfigSchema: z.ZodObject<{
         token: string;
     }>>;
     codex: z.ZodOptional<z.ZodObject<{
-        auth: z.ZodDefault<z.ZodEnum<["link", "own"]>>;
+        auth: z.ZodOptional<z.ZodEnum<["link", "own"]>>;
     }, "strip", z.ZodTypeAny, {
-        auth: "link" | "own";
+        auth?: "link" | "own" | undefined;
     }, {
         auth?: "link" | "own" | undefined;
     }>>;
@@ -179,10 +179,13 @@ declare const ConfigSchema: z.ZodObject<{
         ws_url: string;
     };
     server: {
-        name: string;
         id: string;
+        name: string;
         token: string;
     };
+    codex?: {
+        auth?: "link" | "own" | undefined;
+    } | undefined;
     checkpoints?: {
         enabled: boolean;
     } | undefined;
@@ -190,8 +193,8 @@ declare const ConfigSchema: z.ZodObject<{
         url: string;
         token: string;
     } | undefined;
-    codex?: {
-        auth: "link" | "own";
+    agents?: {
+        install_enabled: boolean;
     } | undefined;
     limits?: {
         max_sessions?: number | undefined;
@@ -204,19 +207,19 @@ declare const ConfigSchema: z.ZodObject<{
     verify?: {
         enabled: boolean;
     } | undefined;
-    agents?: {
-        install_enabled: boolean;
-    } | undefined;
 }, {
     api: {
         url: string;
         ws_url: string;
     };
     server: {
-        name: string;
         id: string;
+        name: string;
         token: string;
     };
+    codex?: {
+        auth?: "link" | "own" | undefined;
+    } | undefined;
     checkpoints?: {
         enabled?: boolean | undefined;
     } | undefined;
@@ -224,8 +227,8 @@ declare const ConfigSchema: z.ZodObject<{
         url: string;
         token: string;
     } | undefined;
-    codex?: {
-        auth?: "link" | "own" | undefined;
+    agents?: {
+        install_enabled?: boolean | undefined;
     } | undefined;
     limits?: {
         max_sessions?: number | undefined;
@@ -238,9 +241,6 @@ declare const ConfigSchema: z.ZodObject<{
     verify?: {
         enabled?: boolean | undefined;
     } | undefined;
-    agents?: {
-        install_enabled?: boolean | undefined;
-    } | undefined;
 }>;
 export type RunnerConfig = z.infer<typeof ConfigSchema>;
 export declare function loadConfig(): RunnerConfig | null;

package/dist/config.js

@@ -30,9 +30,12 @@ const ConfigSchema = z.object({
     //                    the owner also uses codex interactively on this machine:
     //                    OpenAI rotates refresh tokens, and two processes sharing
     //                    one credential store can invalidate each other.
+    // No schema default (#422 S4 item 2): «absent» and «written as link» are two
+    // different facts. Only a written mode is forced, and neither is forced over a
+    // saved login the dashboard switched to – the home's own mark decides then.
     codex: z
         .object({
-        auth: z.enum(['link', 'own']).default('link'),
+        auth: z.enum(['link', 'own']).optional(),
     })
         .optional(),
     // Layer-1 resource guard (plan §8.6): a ceiling the dashboard cannot raise.