@cat-factory/server 0.237.1 → 0.239.1

package/dist/auth/middleware.d.ts

@@ -8,6 +8,11 @@ export declare function bearerToken<E extends AppEnv>(c: Context<E>): string | n
  * SECRET being present, NOT on `cfg.enabled`: local mode can mint a real session (PAT /
  * password login) while running `devOpen` with auth otherwise "disabled", and that session
  * must still resolve to its user. With no secret there's nothing to verify against → null.
+ *
+ * Two gates, in this order. The HMAC + audience check proves the deployment issued this token for
+ * a user session; the GENERATION check proves the session has not since been revoked. The second
+ * is a store read (cached), which is the whole cost of making a stateless token revocable — see
+ * {@link sessionIsCurrent}.
  */
 export declare function verifySession<E extends AppEnv>(c: Context<E>): Promise<SessionPayload | null>;
 /**

package/dist/auth/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,cAAc,CAAA;AAiB7E,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,IAAI,CAK1E;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAQ7F;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,CA8BpE"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,cAAc,CAAA;AAiB7E,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,IAAI,CAK1E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CAAC,CAAC,SAAS,MAAM,EAClD,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GACZ,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAUhC;AAiCD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,CA8BpE"}

package/dist/auth/middleware.js

@@ -25,16 +25,52 @@ export function bearerToken(c) {
  * SECRET being present, NOT on `cfg.enabled`: local mode can mint a real session (PAT /
  * password login) while running `devOpen` with auth otherwise "disabled", and that session
  * must still resolve to its user. With no secret there's nothing to verify against → null.
+ *
+ * Two gates, in this order. The HMAC + audience check proves the deployment issued this token for
+ * a user session; the GENERATION check proves the session has not since been revoked. The second
+ * is a store read (cached), which is the whole cost of making a stateless token revocable — see
+ * {@link sessionIsCurrent}.
  */
-export function verifySession(c) {
+export async function verifySession(c) {
     const cfg = c.get('container').config.auth;
     if (!cfg.sessionSecret)
-        return Promise.resolve(null);
+        return null;
     // Pin the `session` audience: a container LLM-proxy token or a WS ticket — both
     // signed with the same secret — must NOT be accepted as a user session.
-    return signerFor(cfg.sessionSecret).verify(bearerToken(c), {
+    const payload = await signerFor(cfg.sessionSecret).verify(bearerToken(c), {
         aud: TOKEN_AUDIENCE.session,
     });
+    if (!payload)
+        return null;
+    return (await sessionIsCurrent(c, payload)) ? payload : null;
+}
+/**
+ * Whether a cryptographically valid session is still one the user has not revoked.
+ *
+ * The comparison is against the user's stored generation, read through the app cache
+ * (`UserService.sessionGeneration`), so "sign out all devices" and an SSO offboarding are one row
+ * write rather than a token blocklist.
+ *
+ * Three refusals, all deliberate:
+ *  - a token carrying NO `gen` claim (minted before the column existed) is refused, never treated
+ *    as current: an absent-claim-means-valid reading would be a permanent bypass, and the cost of
+ *    refusing is one re-login;
+ *  - a token whose `gen` differs from the row in EITHER direction is refused, rather than only a
+ *    lower one. A claim above the row cannot be produced by any mint this deployment performs, so
+ *    it means the row moved backwards (a restore) or the token was tampered with under a secret we
+ *    should not be trusting; admitting it would make a rolled-back database re-admit revoked
+ *    sessions;
+ *  - a user the store has no row for is refused, which is what closes the deleted-user bearer.
+ *
+ * A store FAILURE is none of those: it propagates rather than resolving false, so an outage
+ * surfaces as a 500 the operator can act on instead of a fleet-wide 401 that reads to every user
+ * as "your credentials are wrong" and sends them to a login that cannot work either.
+ */
+async function sessionIsCurrent(c, payload) {
+    if (typeof payload.gen !== 'number')
+        return false;
+    const current = await c.get('container').userService.sessionGeneration(payload.id);
+    return current !== null && current === payload.gen;
 }
 /**
  * Gate a route group. Preflight (OPTIONS) is always allowed so CORS isn't broken.

package/dist/auth/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAuB,MAAM,cAAc,CAAA;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAEvD,0EAA0E;AAC1E,uEAAuE;AACvE,mCAAmC;AACnC,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,uEAAuE;AACvE,8CAA8C;AAE9C,iFAAiF;AACjF,oFAAoF;AACpF,sFAAsF;AACtF,sCAAsC;AAEtC,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAmB,CAAa;IACzD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IACpD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAmB,CAAa;IAC3D,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,CAAA;IAC1C,IAAI,CAAC,GAAG,CAAC,aAAa;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACpD,gFAAgF;IAChF,wEAAwE;IACxE,OAAO,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAiB,WAAW,CAAC,CAAC,CAAC,EAAE;QACzE,GAAG,EAAE,cAAc,CAAC,OAAO;KAC5B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,EAAE,CAAA;QAC7C,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,CAAA;QAC1C,qFAAqF;QACrF,sFAAsF;QACtF,2DAA2D;QAC3D,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,CAAA;QACnC,IAAI,IAAI,EAAE,CAAC;YACT,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YACnB,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;QACD,oFAAoF;QACpF,oFAAoF;QACpF,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,CAAC,CAAA;QACxD,CAAC;QACD,IAAI,GAAG,CAAC,OAAO;YAAE,OAAO,IAAI,EAAE,CAAA;QAC9B,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EACL,sEAAsE;oBACtE,2EAA2E;aAC9E;SACF,EACD,GAAG,CACJ,CAAA;IACH,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAuB,MAAM,cAAc,CAAA;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAEvD,0EAA0E;AAC1E,uEAAuE;AACvE,mCAAmC;AACnC,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,uEAAuE;AACvE,8CAA8C;AAE9C,iFAAiF;AACjF,oFAAoF;AACpF,sFAAsF;AACtF,sCAAsC;AAEtC,0EAA0E;AAC1E,MAAM,UAAU,WAAW,CAAmB,CAAa;IACzD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IACpD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AACjC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,CAAa;IAEb,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,CAAA;IAC1C,IAAI,CAAC,GAAG,CAAC,aAAa;QAAE,OAAO,IAAI,CAAA;IACnC,gFAAgF;IAChF,wEAAwE;IACxE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAiB,WAAW,CAAC,CAAC,CAAC,EAAE;QACxF,GAAG,EAAE,cAAc,CAAC,OAAO;KAC5B,CAAC,CAAA;IACF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IACzB,OAAO,CAAC,MAAM,gBAAgB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,KAAK,UAAU,gBAAgB,CAC7B,CAAa,EACb,OAAuB;IAEvB,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,WAAW,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAClF,OAAO,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,OAAO,CAAC,GAAG,CAAA;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,EAAE,CAAA;QAC7C,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,CAAA;QAC1C,qFAAqF;QACrF,sFAAsF;QACtF,2DAA2D;QAC3D,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,CAAA;QACnC,IAAI,IAAI,EAAE,CAAC;YACT,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YACnB,OAAO,IAAI,EAAE,CAAA;QACf,CAAC;QACD,oFAAoF;QACpF,oFAAoF;QACpF,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,CAAC,CAAA;QACxD,CAAC;QACD,IAAI,GAAG,CAAC,OAAO;YAAE,OAAO,IAAI,EAAE,CAAA;QAC9B,OAAO,CAAC,CAAC,IAAI,CACX;YACE,KAAK,EAAE;gBACL,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EACL,sEAAsE;oBACtE,2EAA2E;aAC9E;SACF,EACD,GAAG,CACJ,CAAA;IACH,CAAC,CAAA;AACH,CAAC"}

package/dist/auth/oidc/claims.d.ts

@@ -26,12 +26,36 @@ export interface SsoIdentity {
     /** Group memberships read from the configured claim, lowercased. Empty when none released. */
     groups: string[];
 }
-/** Whether a sign-in is admitted, and if not, which rule refused it. */
+/**
+ * What a refusal is EVIDENCE OF, which is a different question from which rule fired.
+ *
+ * Every admission rule here fails closed, and that part is not in dispute. But a refusal is also
+ * read as an OFFBOARDING signal — it is what ends the sessions the person is already holding —
+ * and only one of these two kinds of refusal says anything at all about the person:
+ *
+ *  - `directory` — a claim the IdP DID release positively places them outside the policy: groups
+ *    were released and none match, or a verified email was released and its domain is not
+ *    allowed. The directory has spoken, and "they no longer belong here" is what it said.
+ *  - `indeterminate` — the claim the rule needed was not released at all. This is equally
+ *    consistent with a person removed from every group, a dropped `groups` scope, a renamed
+ *    `groupsClaim`, a userinfo endpoint that stopped answering the claim, and an email the
+ *    provider stopped marking verified. Nothing here can tell those apart, and the difference
+ *    between them is the difference between one person leaving and the entire directory
+ *    integration having regressed.
+ *
+ * The distinction exists because acting on the second as if it were the first turns a login
+ * outage into a deployment-wide forced sign-out: on the release where a scope goes missing, every
+ * returning employee is refused, and every refusal would cut every one of their live sessions,
+ * including those of the admin who has to fix the configuration.
+ */
+export type SsoRefusalEvidence = 'directory' | 'indeterminate';
+/** Whether a sign-in is admitted, and if not, which rule refused it and on what evidence. */
 export type SsoAdmission = {
     allowed: true;
 } | {
     allowed: false;
     reason: SsoErrorReason;
+    evidence: SsoRefusalEvidence;
 };
 /**
  * Read a group-membership claim, tolerating every shape providers ship it in: an array of
@@ -82,6 +106,13 @@ export declare function readSsoIdentity(claims: Record<string, unknown>, cfg: Pi
  *  2. `allowedEmailDomains` — their email's domain is not listed. A configured domain gate with
  *     NO email released is refused (`email_required`) rather than admitted: admitting would void
  *     a rule the operator wrote, and the fix (release the `email` claim) belongs to them.
+ *
+ * Each refusal also carries what it is EVIDENCE of ({@link SsoRefusalEvidence}), because the
+ * caller does more with a refusal than deny the login: it ends the sessions the person already
+ * holds. Deciding that here rather than at the call site is the point — the reason code alone
+ * cannot answer it (`group_required` is the directory speaking when groups WERE released and
+ * merely a missing claim when they were not), and a caller re-deriving it from the reason string
+ * would have to know which claims this function looked at.
  */
 export declare function judgeSsoAdmission(identity: SsoIdentity, cfg: Pick<SsoConfig, 'allowedEmailDomains' | 'requiredGroups'>): SsoAdmission;
 /**

package/dist/auth/oidc/claims.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../../../src/auth/oidc/claims.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAiBtD,4EAA4E;AAC5E,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,OAAO,CAAA;IACtB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAA;IACb,8FAA8F;IAC9F,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,wEAAwE;AACxE,MAAM,MAAM,YAAY,GAAG;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,cAAc,CAAA;CAAE,CAAA;AAMzF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAyB3F;AAcD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAGT;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,GAClC,WAAW,GAAG,IAAI,CAcpB;AAUD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,WAAW,EACrB,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,qBAAqB,GAAG,gBAAgB,CAAC,GAC7D,YAAY,CAgBd;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,GAAG,gBAAgB,GAAG,qBAAqB,CAAC,GAC7E,OAAO,CAMT"}
+{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../../../src/auth/oidc/claims.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAiBtD,4EAA4E;AAC5E,MAAM,WAAW,WAAW;IAC1B,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,OAAO,CAAA;IACtB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAA;IACb,8FAA8F;IAC9F,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,eAAe,CAAA;AAE9D,6FAA6F;AAC7F,MAAM,MAAM,YAAY,GACpB;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,cAAc,CAAC;IAAC,QAAQ,EAAE,kBAAkB,CAAA;CAAE,CAAA;AAM5E;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAyB3F;AAcD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAGT;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,GAClC,WAAW,GAAG,IAAI,CAcpB;AAUD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,WAAW,EACrB,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,qBAAqB,GAAG,gBAAgB,CAAC,GAC7D,YAAY,CAyBd;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,GAAG,gBAAgB,GAAG,qBAAqB,CAAC,GAC7E,OAAO,CAMT"}

package/dist/auth/oidc/claims.js

@@ -110,21 +110,36 @@ function joinName(claims) {
  *  2. `allowedEmailDomains` — their email's domain is not listed. A configured domain gate with
  *     NO email released is refused (`email_required`) rather than admitted: admitting would void
  *     a rule the operator wrote, and the fix (release the `email` claim) belongs to them.
+ *
+ * Each refusal also carries what it is EVIDENCE of ({@link SsoRefusalEvidence}), because the
+ * caller does more with a refusal than deny the login: it ends the sessions the person already
+ * holds. Deciding that here rather than at the call site is the point — the reason code alone
+ * cannot answer it (`group_required` is the directory speaking when groups WERE released and
+ * merely a missing claim when they were not), and a caller re-deriving it from the reason string
+ * would have to know which claims this function looked at.
  */
 export function judgeSsoAdmission(identity, cfg) {
     if (cfg.requiredGroups.length > 0) {
         const member = identity.groups.some((group) => cfg.requiredGroups.includes(group));
-        if (!member)
-            return { allowed: false, reason: 'group_required' };
+        if (!member) {
+            // Released-but-not-matching is the directory excluding this person. NOTHING released is a
+            // claim we did not receive, and "removed from every group" is indistinguishable from "the
+            // groups scope stopped being granted" — the shape a whole deployment regresses in at once.
+            const evidence = identity.groups.length > 0 ? 'directory' : 'indeterminate';
+            return { allowed: false, reason: 'group_required', evidence };
+        }
     }
     if (cfg.allowedEmailDomains.length > 0) {
         if (!identity.email || !identity.emailVerified) {
-            return { allowed: false, reason: 'email_required' };
+            // Always indeterminate: an absent address and one the provider stopped marking verified
+            // both say nothing about whether this person still belongs to the organisation.
+            return { allowed: false, reason: 'email_required', evidence: 'indeterminate' };
         }
         const at = identity.email.lastIndexOf('@');
         const domain = at < 0 ? '' : identity.email.slice(at + 1);
         if (!cfg.allowedEmailDomains.includes(domain)) {
-            return { allowed: false, reason: 'domain_not_allowed' };
+            // A verified address WAS released and its domain is not one the operator admits.
+            return { allowed: false, reason: 'domain_not_allowed', evidence: 'directory' };
         }
     }
     return { allowed: true };

package/dist/auth/oidc/claims.js.map

@@ -1 +1 @@
-{"version":3,"file":"claims.js","sourceRoot":"","sources":["../../../src/auth/oidc/claims.ts"],"names":[],"mappings":"AAgDA,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,MAA+B,EAAE,SAAiB;IAC/E,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAA;IACzB,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAA;IAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,GAAG;aACP,KAAK,CAAC,KAAK,CAAC;aACZ,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;IACtC,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IACxF,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAA;YACxB,IAAI,KAAK;gBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;YACxC,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,GAAG,CACf,KAAiC,CAAC,KAAK,IAAK,KAAiC,CAAC,IAAI,CACpF,CAAA;YACD,IAAI,MAAM;gBAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,OAAO,CAAA;AAC7C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAiC,EACjC,MAA+B;IAE/B,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IACtC,OAAO,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,MAA+B,EAC/B,GAAmC;IAEnC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC3B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,CAAA;IACtD,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAChD,OAAO;QACL,GAAG;QACH,KAAK;QACL,aAAa,EAAE,KAAK,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,cAAc,CAAC;QACpE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC;QAC1C,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;QAC9B,KAAK,EAAE,SAAS,IAAI,KAAK,IAAI,GAAG;QAChC,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC;KAChD,CAAA;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,QAAQ,CAAC,MAA+B;IAC/C,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CACpE,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CACxC,CAAA;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAqB,EACrB,GAA8D;IAE9D,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QAClF,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;IAClE,CAAC;IACD,IAAI,GAAG,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;YAC/C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;QACrD,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC1C,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;QACzD,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;QACzD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,MAA+B,EAC/B,GAA8E;IAE9E,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1F,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}
+{"version":3,"file":"claims.js","sourceRoot":"","sources":["../../../src/auth/oidc/claims.ts"],"names":[],"mappings":"AA0EA,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,MAA+B,EAAE,SAAiB;IAC/E,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAA;IACzB,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAA;IAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,GAAG;aACP,KAAK,CAAC,KAAK,CAAC;aACZ,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;IACtC,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IACxF,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAA;YACxB,IAAI,KAAK;gBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAA;YACxC,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,GAAG,CACf,KAAiC,CAAC,KAAK,IAAK,KAAiC,CAAC,IAAI,CACpF,CAAA;YACD,IAAI,MAAM;gBAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,OAAO,CAAA;AAC7C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAiC,EACjC,MAA+B;IAE/B,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IACtC,OAAO,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,MAA+B,EAC/B,GAAmC;IAEnC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC3B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,CAAA;IACtD,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAChD,OAAO;QACL,GAAG;QACH,KAAK;QACL,aAAa,EAAE,KAAK,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,cAAc,CAAC;QACpE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC;QAC1C,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;QAC9B,KAAK,EAAE,SAAS,IAAI,KAAK,IAAI,GAAG;QAChC,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC;KAChD,CAAA;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,QAAQ,CAAC,MAA+B;IAC/C,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CACpE,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CACxC,CAAA;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAqB,EACrB,GAA8D;IAE9D,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QAClF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,0FAA0F;YAC1F,0FAA0F;YAC1F,2FAA2F;YAC3F,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAA;YAC3E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAA;QAC/D,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;YAC/C,wFAAwF;YACxF,gFAAgF;YAChF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAA;QAChF,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC1C,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;QACzD,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,iFAAiF;YACjF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAA;QAChF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,MAA+B,EAC/B,GAA8E;IAE9E,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1F,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/auth/signing.d.ts

@@ -41,6 +41,19 @@ export interface SessionPayload extends SessionUser {
     /** Audience pin — always `session` for a user session. */
     aud: typeof TOKEN_AUDIENCE.session;
     exp: number;
+    /**
+     * The user's session GENERATION at mint time. Verification compares it against the stored
+     * `users.session_generation` and refuses a mismatch, which is what makes a stateless token
+     * revocable: advancing the row invalidates every token minted before it, with nothing to
+     * enumerate.
+     *
+     * Declared REQUIRED, so a mint site that forgets it fails to compile rather than issuing a
+     * token nothing can revoke. A token predating the column carries no `gen` at all and is refused
+     * (see `verifySession`) rather than admitted, because the alternative — treating an absent claim
+     * as "current" — is a permanent bypass of the whole mechanism, and the one an attacker would aim
+     * at. The cost is that everyone signs in again once, which is the deliberate pre-1.0 break.
+     */
+    gen: number;
 }
 /**
  * A signed machine token for a mothership-mode local node. Minted by the mothership

package/dist/auth/signing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../src/auth/signing.ts"],"names":[],"mappings":"AA8BA,yEAAyE;AACzE,eAAO,MAAM,cAAc;IACzB,gDAAgD;aAChD,OAAO,EAAE,SAAS;IAClB,iCAAiC;aACjC,UAAU,EAAE,aAAa;IACzB;;;;;;;OAOG;aACH,QAAQ,EAAE,WAAW;IACrB,kDAAkD;aAClD,SAAS,EAAE,WAAW;IACtB,sDAAsD;aACtD,QAAQ,EAAE,IAAI;IACd;;;;OAIG;aACH,OAAO,EAAE,SAAS;CACV,CAAA;AAEV,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAA;AAEhF,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,kEAAkE;IAClE,EAAE,EAAE,MAAM,CAAA;IACV,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,0DAA0D;IAC1D,GAAG,EAAE,OAAO,cAAc,CAAC,OAAO,CAAA;IAClC,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,OAAO,cAAc,CAAC,OAAO,CAAA;IAClC,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAA;IACd,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAA;IACd,sDAAsD;IACtD,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IAC/B,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAA;CACZ;AAwBD,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAOpD;AACD,qBAAa,UAAU;IAIT,OAAO,CAAC,QAAQ,CAAC,MAAM;IAHnC,6FAA6F;IAC7F,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwC;IAEjE,YAA6B,MAAM,EAAE,MAAM,EAAI;IAEzC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG3C;IAED;;;;;;;;OAQG;IACG,MAAM,CAAC,CAAC,SAAS,MAAM,EAC3B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,aAAa,CAAA;KAAE,GAC7B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CA8BnB;YAEa,GAAG;IAKjB;;;;;;OAMG;IACH,OAAO,CAAC,MAAM;IAUd,mFAAmF;IACnF,OAAO,CAAC,aAAa;IAUrB;;;;OAIG;YACW,iBAAiB;CAoBhC"}
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../src/auth/signing.ts"],"names":[],"mappings":"AAoCA,yEAAyE;AACzE,eAAO,MAAM,cAAc;IACzB,gDAAgD;aAChD,OAAO,EAAE,SAAS;IAClB,iCAAiC;aACjC,UAAU,EAAE,aAAa;IACzB;;;;;;;OAOG;aACH,QAAQ,EAAE,WAAW;IACrB,kDAAkD;aAClD,SAAS,EAAE,WAAW;IACtB,sDAAsD;aACtD,QAAQ,EAAE,IAAI;IACd;;;;OAIG;aACH,OAAO,EAAE,SAAS;CACV,CAAA;AAEV,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAA;AAEhF,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,kEAAkE;IAClE,EAAE,EAAE,MAAM,CAAA;IACV,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,0DAA0D;IAC1D,GAAG,EAAE,OAAO,cAAc,CAAC,OAAO,CAAA;IAClC,GAAG,EAAE,MAAM,CAAA;IACX;;;;;;;;;;;OAWG;IACH,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,OAAO,cAAc,CAAC,OAAO,CAAA;IAClC,sFAAsF;IACtF,MAAM,EAAE,MAAM,CAAA;IACd,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAA;IACd,sDAAsD;IACtD,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IAC/B,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAA;CACZ;AAwBD,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAOpD;AACD,qBAAa,UAAU;IAIT,OAAO,CAAC,QAAQ,CAAC,MAAM;IAHnC,6FAA6F;IAC7F,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwC;IAEjE,YAA6B,MAAM,EAAE,MAAM,EAAI;IAEzC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG3C;IAED;;;;;;;;OAQG;IACG,MAAM,CAAC,CAAC,SAAS,MAAM,EAC3B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,aAAa,CAAA;KAAE,GAC7B,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CA8BnB;YAEa,GAAG;IAKjB;;;;;;OAMG;IACH,OAAO,CAAC,MAAM;IAUd,mFAAmF;IACnF,OAAO,CAAC,aAAa;IAUrB;;;;OAIG;YACW,iBAAiB;CAoBhC"}

package/dist/auth/signing.js

@@ -24,8 +24,14 @@ import { base64url, base64urlToBytes, timingSafeEqual } from '../crypto/encoding
 //
 // Format: `base64url(JSON payload).base64url(HMAC(base64url(JSON payload)))`.
 // The payload is base64url (no dots), so the dot split is unambiguous. Payloads
-// carrying an `exp` (epoch ms) are rejected once expired. There is no server-side
-// store: logout is a client-side drop and expiry bounds the blast radius.
+// carrying an `exp` (epoch ms) are rejected once expired.
+//
+// Signing itself remains store-free — nothing here reads a database, and every token class but
+// one is bounded purely by its expiry. The exception is the USER SESSION, which carries a `gen`
+// claim checked against the user's row by `verifySession` (see `auth/middleware.ts`), so that a
+// leaked or offboarded bearer can be revoked before it expires. That check is deliberately NOT
+// folded in here: this module is the shared primitive every audience uses, and only the session
+// audience has a principal whose row could be consulted.
 /** Distinct token audiences. Each verifier pins exactly one of these. */
 export const TOKEN_AUDIENCE = {
     /** SPA user session (Authorization: Bearer). */

package/dist/auth/signing.js.map

@@ -1 +1 @@
-{"version":3,"file":"signing.js","sourceRoot":"","sources":["../../src/auth/signing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEpF,iFAAiF;AACjF,kFAAkF;AAClF,qFAAqF;AACrF,qEAAqE;AACrE,2EAA2E;AAC3E,mFAAmF;AACnF,6EAA6E;AAC7E,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,uDAAuD;AACvD,EAAE;AACF,kFAAkF;AAClF,kFAAkF;AAClF,oFAAoF;AACpF,gFAAgF;AAChF,oFAAoF;AACpF,uFAAuF;AACvF,yFAAyF;AACzF,mCAAmC;AACnC,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,kFAAkF;AAClF,0EAA0E;AAE1E,yEAAyE;AACzE,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,gDAAgD;IAChD,OAAO,EAAE,SAAS;IAClB,iCAAiC;IACjC,UAAU,EAAE,aAAa;IACzB;;;;;;;OAOG;IACH,QAAQ,EAAE,WAAW;IACrB,kDAAkD;IAClD,SAAS,EAAE,WAAW;IACtB,sDAAsD;IACtD,QAAQ,EAAE,IAAI;IACd;;;;OAIG;IACH,OAAO,EAAE,SAAS;CACV,CAAA;AAyCV,qEAAqE;AACrE,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,qBAAqB,GAAG,EAAE,CAAA;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAA;AAEnF;;;;GAIG;AACH,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAA;AAE7C,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;QAC/B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AACD,MAAM,OAAO,UAAU;IAIQ,MAAM;IAHnC,6FAA6F;IAC5E,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAA;IAEjE,YAA6B,MAAc;sBAAd,MAAM;IAAW,CAAC;IAE/C,KAAK,CAAC,IAAI,CAAC,OAAe;QACxB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;QAC/C,OAAO,GAAG,IAAI,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1E,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CACV,KAAgC,EAChC,IAA8B;QAE9B,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAEhC,8EAA8E;QAC9E,qFAAqF;QACrF,IAAI,QAAoB,CAAA;QACxB,IAAI,OAAU,CAAA;QACd,IAAI,CAAC;YACH,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;YACjD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAM,CAAA;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;QAED,kFAAkF;QAClF,mFAAmF;QACnF,iFAAiF;QACjF,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QAC1E,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAA;QAErD,MAAM,GAAG,GAAI,OAA6B,CAAC,GAAG,CAAA;QAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAA;QAC5D,yEAAyE;QACzE,uEAAuE;QACvE,IAAI,IAAI,EAAE,GAAG,KAAK,SAAS,IAAK,OAA6B,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QAC3F,OAAO,OAAO,CAAA;IAChB,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,GAAY;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAClC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IACzE,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,GAAY;QACzB,MAAM,QAAQ,GAAG,GAAG,KAAK,SAAS,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;QACzE,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACrC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,GAAG,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAA;YAC/E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;QAClC,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,mFAAmF;IAC3E,aAAa;QACnB,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACrC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,iBAAiB,CAAC,GAAW;QACzC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5C,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACrC,MAAM,EACN,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAA;QACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CACzC;YACE,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;YACvB,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;SAClD,EACD,QAAQ,EACR,GAAG,CACJ,CAAA;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;IACjG,CAAC;CACF;AAED,0FAA0F;AAC1F,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,GAAG,GAAI,OAA6B,CAAC,GAAG,CAAA;IAC9C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AAClD,CAAC"}
+{"version":3,"file":"signing.js","sourceRoot":"","sources":["../../src/auth/signing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEpF,iFAAiF;AACjF,kFAAkF;AAClF,qFAAqF;AACrF,qEAAqE;AACrE,2EAA2E;AAC3E,mFAAmF;AACnF,6EAA6E;AAC7E,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,uDAAuD;AACvD,EAAE;AACF,kFAAkF;AAClF,kFAAkF;AAClF,oFAAoF;AACpF,gFAAgF;AAChF,oFAAoF;AACpF,uFAAuF;AACvF,yFAAyF;AACzF,mCAAmC;AACnC,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,0DAA0D;AAC1D,EAAE;AACF,+FAA+F;AAC/F,gGAAgG;AAChG,gGAAgG;AAChG,+FAA+F;AAC/F,gGAAgG;AAChG,yDAAyD;AAEzD,yEAAyE;AACzE,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,gDAAgD;IAChD,OAAO,EAAE,SAAS;IAClB,iCAAiC;IACjC,UAAU,EAAE,aAAa;IACzB;;;;;;;OAOG;IACH,QAAQ,EAAE,WAAW;IACrB,kDAAkD;IAClD,SAAS,EAAE,WAAW;IACtB,sDAAsD;IACtD,QAAQ,EAAE,IAAI;IACd;;;;OAIG;IACH,OAAO,EAAE,SAAS;CACV,CAAA;AAsDV,qEAAqE;AACrE,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,qBAAqB,GAAG,EAAE,CAAA;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAA;AAEnF;;;;GAIG;AACH,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAA;AAE7C,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAChC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;QAC/B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AACD,MAAM,OAAO,UAAU;IAIQ,MAAM;IAHnC,6FAA6F;IAC5E,QAAQ,GAAG,IAAI,GAAG,EAA8B,CAAA;IAEjE,YAA6B,MAAc;sBAAd,MAAM;IAAW,CAAC;IAE/C,KAAK,CAAC,IAAI,CAAC,OAAe;QACxB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;QAC/C,OAAO,GAAG,IAAI,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1E,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CACV,KAAgC,EAChC,IAA8B;QAE9B,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAEhC,8EAA8E;QAC9E,qFAAqF;QACrF,IAAI,QAAoB,CAAA;QACxB,IAAI,OAAU,CAAA;QACd,IAAI,CAAC;YACH,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAA;YACjD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAM,CAAA;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;QAED,kFAAkF;QAClF,mFAAmF;QACnF,iFAAiF;QACjF,6EAA6E;QAC7E,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QAC1E,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAA;QAErD,MAAM,GAAG,GAAI,OAA6B,CAAC,GAAG,CAAA;QAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAA;QAC5D,yEAAyE;QACzE,uEAAuE;QACvE,IAAI,IAAI,EAAE,GAAG,KAAK,SAAS,IAAK,OAA6B,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QAC3F,OAAO,OAAO,CAAA;IAChB,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,GAAY;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAClC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IACzE,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,GAAY;QACzB,MAAM,QAAQ,GAAG,GAAG,KAAK,SAAS,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;QACzE,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACrC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,GAAG,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAA;YAC/E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;QAClC,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,mFAAmF;IAC3E,aAAa;QACnB,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACrC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,iBAAiB,CAAC,GAAW;QACzC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5C,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACrC,MAAM,EACN,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAA;QACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CACzC;YACE,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;YACvB,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;SAClD,EACD,QAAQ,EACR,GAAG,CACJ,CAAA;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAA;IACjG,CAAC;CACF;AAED,0FAA0F;AAC1F,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,GAAG,GAAI,OAA6B,CAAC,GAAG,CAAA;IAC9C,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AAClD,CAAC"}

package/dist/config/types.d.ts

@@ -319,8 +319,9 @@ export interface RetentionConfig {
     rateLimitMs: number;
     commitMs: number;
     /**
-     * LLM observability sink (full per-call prompt/response). Heavy, and only useful
-     * for recent debugging, so it is pruned aggressively (default 3 days).
+     * LLM observability sink (full per-call prompt/response). Heavy, so the window trades disk
+     * against how far back a post-mortem can reach; default 14 days, because most investigations
+     * start after the run they are about has stopped being recent.
      */
     llmCallMetricsMs: number;
     /**
@@ -351,6 +352,24 @@ export interface RetentionConfig {
      * 0 disables.
      */
     runDaysMs: number;
+    /**
+     * The account AUDIT LOG (`audit_events`). By far the LONGEST window here (default ~2 years),
+     * and deliberately so: every other table on this list answers an operational question about
+     * recent activity, while this one answers a compliance question about the past. An org adopting
+     * the platform is asked "who changed that, and when" about things that happened long after
+     * anyone stopped watching, and a short window would make the honest answer "we deleted it".
+     *
+     * It is nonetheless BOUNDED rather than infinite, because the log is the one table that grows
+     * monotonically with run volume and D1's ceiling is 10 GB per database (the arithmetic is in
+     * `backend/docs/storage-and-retention.md`). A deployment with a longer legal obligation raises
+     * the knob; 0 disables the prune entirely, which is the right setting for a deployment that
+     * exports the log elsewhere and wants nothing dropped locally.
+     *
+     * It has its OWN knob rather than sharing one, which is the governance half of keeping the log
+     * in its own store: audit retention cannot be shortened as a side effect of tuning something
+     * else, because no other table lives behind this name.
+     */
+    auditEventsMs: number;
 }
 export interface FragmentLibraryConfig {
     /** Opt-in flag (`PROMPT_LIBRARY_ENABLED=true`); needs no encryption key. */

package/dist/config/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EACV,0BAA0B,EAC1B,eAAe,EACf,WAAW,EACX,WAAW,EACX,mBAAmB,EACnB,2BAA2B,EAC5B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACpF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAA;AACzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAOtD,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,YAAY,CAAA;IACrB;;;;;;OAMG;IACH,iBAAiB,EAAE,CACjB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,kBAAkB,CAAC,EAAE,SAAS,WAAW,EAAE,KACxC,QAAQ,GAAG,SAAS,CAAA;IACzB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAA;CAC9C;AAED,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAA;IACvB,kFAAkF;IAClF,eAAe,EAAE,MAAM,CAAA;IACvB,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAA;IACnB,sFAAsF;IACtF,uBAAuB,EAAE,MAAM,CAAA;IAC/B,mFAAmF;IACnF,cAAc,EAAE,MAAM,CAAA;IACtB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,iBAAiB,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,8EAA8E;IAC9E,gBAAgB,EAAE,MAAM,CAAA;IACxB,2FAA2F;IAC3F,aAAa,EAAE,MAAM,CAAA;IACrB,gFAAgF;IAChF,aAAa,CAAC,EAAE,mBAAmB,CAAA;CACpC;AAED,wFAAwF;AACxF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAA;IACnB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,mFAAmF;IACnF,KAAK,EAAE,MAAM,CAAA;IACb,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAA;IACd,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,mBAAmB,EAAE,MAAM,EAAE,CAAA;IAC7B,wFAAwF;IACxF,WAAW,EAAE,MAAM,CAAA;IACnB,+DAA+D;IAC/D,cAAc,EAAE,MAAM,EAAE,CAAA;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,2FAA2F;IAC3F,OAAO,EAAE,OAAO,CAAA;IAChB,6EAA6E;IAC7E,OAAO,EAAE,OAAO,CAAA;IAChB;;;;;;;OAOG;IACH,aAAa,EAAE,OAAO,CAAA;IACtB,oEAAoE;IACpE,aAAa,EAAE,OAAO,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAA;IACf,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAA;IACjB,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAA;IACzB,8EAA8E;IAC9E,kBAAkB,EAAE,MAAM,CAAA;IAC1B,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAA;IACnB,2EAA2E;IAC3E,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,sFAAsF;IACtF,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,2FAA2F;IAC3F,sBAAsB,EAAE,MAAM,EAAE,CAAA;IAChC,wDAAwD;IACxD,eAAe,EAAE,OAAO,CAAA;IACxB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAA;IACnB,yDAAyD;IACzD,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,0EAA0E;IAC1E,GAAG,CAAC,EAAE,SAAS,CAAA;IACf;;;OAGG;IACH,mBAAmB,EAAE,MAAM,EAAE,CAAA;IAC7B;;;;;;;;;;OAUG;IACH,iBAAiB,EAAE,OAAO,CAAA;IAC1B;;;;;;;OAOG;IACH,gBAAgB,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;OAKG;IACH,MAAM,CAAC,EAAE;QACP,QAAQ,EAAE,UAAU,GAAG,QAAQ,CAAA;QAC/B,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAED,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,yDAAyD;IACzD,OAAO,EAAE,kBAAkB,EAAE,CAAA;IAC7B,kFAAkF;IAClF,OAAO,EAAE,KAAK,GAAG,UAAU,CAAA;IAC3B,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,CAAA;CAIvB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,sEAAsE;IACtE,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;CAC5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,8EAA8E;IAC9E,OAAO,EAAE,OAAO,CAAA;IAChB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,wFAAwF;IACxF,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,kFAAkF;IAClF,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAA;CAGvB;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAA;IACxB;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAA;IACzB;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAA;IACvB;;;;;OAKG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,4EAA4E;IAC5E,OAAO,EAAE,OAAO,CAAA;IAChB,mFAAmF;IACnF,QAAQ,EAAE,KAAK,GAAG,eAAe,CAAA;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;;OAMG;IACH,aAAa,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,wFAAwF;IACxF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,qFAAqF;IACrF,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;OAMG;IACH,eAAe,EAAE,yBAAyB,CAAA;IAC1C;;;;;OAKG;IACH,IAAI,EAAE,cAAc,CAAA;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,wFAAwF;IACxF,OAAO,EAAE,OAAO,CAAA;IAChB;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAA;IACvB;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,oGAAoG;IACpG,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,MAAM,EAAE,2BAA2B,CAAA;CACpC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAA;IAChB;;;;OAIG;IACH,MAAM,EAAE,mBAAmB,CAAA;IAC3B;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB,4EAA4E;IAC5E,UAAU,EAAE,uBAAuB,CAAA;CACpC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,qDAAqD;IACrD,OAAO,EAAE,OAAO,CAAA;IAChB;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAA;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,0FAA0F;IAC1F,OAAO,EAAE,MAAM,CAAA;IACf,2FAA2F;IAC3F,YAAY,EAAE,MAAM,CAAA;IACpB,iGAAiG;IACjG,aAAa,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,YAAY,CAAA;IACpB,wEAAwE;IACxE,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,SAAS,EAAE,eAAe,CAAA;IAC1B,gDAAgD;IAChD,KAAK,EAAE,YAAY,CAAA;IACnB,mFAAmF;IACnF,MAAM,EAAE,YAAY,CAAA;IACpB;;;OAGG;IACH,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,oFAAoF;IACpF,IAAI,EAAE,UAAU,CAAA;IAChB,wFAAwF;IACxF,SAAS,EAAE,eAAe,CAAA;IAC1B,uFAAuF;IACvF,KAAK,EAAE,WAAW,CAAA;IAClB,4FAA4F;IAC5F,YAAY,EAAE,kBAAkB,CAAA;IAChC,0EAA0E;IAC1E,OAAO,EAAE,gBAAgB,CAAA;IACzB,+EAA+E;IAC/E,KAAK,EAAE,WAAW,CAAA;IAClB,mFAAmF;IACnF,oBAAoB,EAAE,yBAAyB,CAAA;IAC/C,oFAAoF;IACpF,aAAa,EAAE,mBAAmB,CAAA;IAClC,oFAAoF;IACpF,KAAK,EAAE,WAAW,CAAA;IAClB,+EAA+E;IAC/E,SAAS,EAAE,eAAe,CAAA;IAC1B,qFAAqF;IACrF,eAAe,EAAE,qBAAqB,CAAA;IACtC,6EAA6E;IAC7E,aAAa,EAAE,mBAAmB,CAAA;IAClC,+EAA+E;IAC/E,QAAQ,EAAE,cAAc,CAAA;IACxB,gGAAgG;IAChG,IAAI,EAAE,UAAU,CAAA;IAChB,yFAAyF;IACzF,cAAc,EAAE,mBAAmB,CAAA;IACnC;;;OAGG;IACH,iBAAiB,EAAE,uBAAuB,CAAA;IAC1C;;;OAGG;IACH,SAAS,CAAC,EAAE,eAAe,CAAA;IAC3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,0BAA0B,CAAA;IAC3C;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE,WAAW,EAAE,CAAA;CAClC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,KAAK,EACV,0BAA0B,EAC1B,eAAe,EACf,WAAW,EACX,WAAW,EACX,mBAAmB,EACnB,2BAA2B,EAC5B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACpF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAA;AACzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAOtD,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,YAAY,CAAA;IACrB;;;;;;OAMG;IACH,iBAAiB,EAAE,CACjB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,kBAAkB,CAAC,EAAE,SAAS,WAAW,EAAE,KACxC,QAAQ,GAAG,SAAS,CAAA;IACzB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAA;CAC9C;AAED,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAA;IACvB,kFAAkF;IAClF,eAAe,EAAE,MAAM,CAAA;IACvB,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAA;IACnB,sFAAsF;IACtF,uBAAuB,EAAE,MAAM,CAAA;IAC/B,mFAAmF;IACnF,cAAc,EAAE,MAAM,CAAA;IACtB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,iBAAiB,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,8EAA8E;IAC9E,gBAAgB,EAAE,MAAM,CAAA;IACxB,2FAA2F;IAC3F,aAAa,EAAE,MAAM,CAAA;IACrB,gFAAgF;IAChF,aAAa,CAAC,EAAE,mBAAmB,CAAA;CACpC;AAED,wFAAwF;AACxF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAA;IACnB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,SAAS;IACxB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,mFAAmF;IACnF,KAAK,EAAE,MAAM,CAAA;IACb,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAA;IACd,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,mBAAmB,EAAE,MAAM,EAAE,CAAA;IAC7B,wFAAwF;IACxF,WAAW,EAAE,MAAM,CAAA;IACnB,+DAA+D;IAC/D,cAAc,EAAE,MAAM,EAAE,CAAA;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,2FAA2F;IAC3F,OAAO,EAAE,OAAO,CAAA;IAChB,6EAA6E;IAC7E,OAAO,EAAE,OAAO,CAAA;IAChB;;;;;;;OAOG;IACH,aAAa,EAAE,OAAO,CAAA;IACtB,oEAAoE;IACpE,aAAa,EAAE,OAAO,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAA;IACf,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAA;IACjB,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAA;IACzB,8EAA8E;IAC9E,kBAAkB,EAAE,MAAM,CAAA;IAC1B,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAA;IACnB,2EAA2E;IAC3E,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,sFAAsF;IACtF,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,2FAA2F;IAC3F,sBAAsB,EAAE,MAAM,EAAE,CAAA;IAChC,wDAAwD;IACxD,eAAe,EAAE,OAAO,CAAA;IACxB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAA;IACnB,yDAAyD;IACzD,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,0EAA0E;IAC1E,GAAG,CAAC,EAAE,SAAS,CAAA;IACf;;;OAGG;IACH,mBAAmB,EAAE,MAAM,EAAE,CAAA;IAC7B;;;;;;;;;;OAUG;IACH,iBAAiB,EAAE,OAAO,CAAA;IAC1B;;;;;;;OAOG;IACH,gBAAgB,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,qFAAqF;IACrF,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;OAKG;IACH,MAAM,CAAC,EAAE;QACP,QAAQ,EAAE,UAAU,GAAG,QAAQ,CAAA;QAC/B,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;CACF;AAED,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,yDAAyD;IACzD,OAAO,EAAE,kBAAkB,EAAE,CAAA;IAC7B,kFAAkF;IAClF,OAAO,EAAE,KAAK,GAAG,UAAU,CAAA;IAC3B,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,CAAA;CAIvB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,sEAAsE;IACtE,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;CAC5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,8EAA8E;IAC9E,OAAO,EAAE,OAAO,CAAA;IAChB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,wFAAwF;IACxF,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,kFAAkF;IAClF,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAA;CAGvB;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,CAAA;IACxB;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAA;IACzB;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAA;IACvB;;;;;OAKG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;;;;;;;;;;;;;;;OAgBG;IACH,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,4EAA4E;IAC5E,OAAO,EAAE,OAAO,CAAA;IAChB,mFAAmF;IACnF,QAAQ,EAAE,KAAK,GAAG,eAAe,CAAA;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;;OAMG;IACH,aAAa,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,UAAU;IACzB;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAA;IAChB,wFAAwF;IACxF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,qFAAqF;IACrF,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;OAMG;IACH,eAAe,EAAE,yBAAyB,CAAA;IAC1C;;;;;OAKG;IACH,IAAI,EAAE,cAAc,CAAA;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,wFAAwF;IACxF,OAAO,EAAE,OAAO,CAAA;IAChB;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAA;IACvB;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,oGAAoG;IACpG,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,MAAM,EAAE,2BAA2B,CAAA;CACpC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,4CAA4C;IAC5C,OAAO,EAAE,OAAO,CAAA;IAChB;;;;OAIG;IACH,MAAM,EAAE,mBAAmB,CAAA;IAC3B;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB,4EAA4E;IAC5E,UAAU,EAAE,uBAAuB,CAAA;CACpC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,qDAAqD;IACrD,OAAO,EAAE,OAAO,CAAA;IAChB;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAA;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,OAAO,CAAA;IAChB,0FAA0F;IAC1F,OAAO,EAAE,MAAM,CAAA;IACf,2FAA2F;IAC3F,YAAY,EAAE,MAAM,CAAA;IACpB,iGAAiG;IACjG,aAAa,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,YAAY,CAAA;IACpB,wEAAwE;IACxE,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,SAAS,EAAE,eAAe,CAAA;IAC1B,gDAAgD;IAChD,KAAK,EAAE,YAAY,CAAA;IACnB,mFAAmF;IACnF,MAAM,EAAE,YAAY,CAAA;IACpB;;;OAGG;IACH,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,oFAAoF;IACpF,IAAI,EAAE,UAAU,CAAA;IAChB,wFAAwF;IACxF,SAAS,EAAE,eAAe,CAAA;IAC1B,uFAAuF;IACvF,KAAK,EAAE,WAAW,CAAA;IAClB,4FAA4F;IAC5F,YAAY,EAAE,kBAAkB,CAAA;IAChC,0EAA0E;IAC1E,OAAO,EAAE,gBAAgB,CAAA;IACzB,+EAA+E;IAC/E,KAAK,EAAE,WAAW,CAAA;IAClB,mFAAmF;IACnF,oBAAoB,EAAE,yBAAyB,CAAA;IAC/C,oFAAoF;IACpF,aAAa,EAAE,mBAAmB,CAAA;IAClC,oFAAoF;IACpF,KAAK,EAAE,WAAW,CAAA;IAClB,+EAA+E;IAC/E,SAAS,EAAE,eAAe,CAAA;IAC1B,qFAAqF;IACrF,eAAe,EAAE,qBAAqB,CAAA;IACtC,6EAA6E;IAC7E,aAAa,EAAE,mBAAmB,CAAA;IAClC,+EAA+E;IAC/E,QAAQ,EAAE,cAAc,CAAA;IACxB,gGAAgG;IAChG,IAAI,EAAE,UAAU,CAAA;IAChB,yFAAyF;IACzF,cAAc,EAAE,mBAAmB,CAAA;IACnC;;;OAGG;IACH,iBAAiB,EAAE,uBAAuB,CAAA;IAC1C;;;OAGG;IACH,SAAS,CAAC,EAAE,eAAe,CAAA;IAC3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,0BAA0B,CAAA;IAC3C;;;;;;;;;OASG;IACH,iBAAiB,CAAC,EAAE,WAAW,EAAE,CAAA;CAClC"}

package/dist/http/workspaceAccess.d.ts

@@ -1,4 +1,4 @@
-import { type BlockEditActor } from '@cat-factory/contracts';
+import { type BlockEditAuthority } from '@cat-factory/contracts';
 import { type WorkspaceAccess, type WorkspacePermission } from '@cat-factory/kernel';
 import type { Context, Hono } from 'hono';
 import type { AppEnv, ServerContainer } from './env.js';
@@ -27,18 +27,33 @@ export declare function loadWorkspaceAccess(container: ServerContainer, workspac
  */
 export declare function requirePermission<E extends AppEnv>(c: Context<E>, permission: WorkspacePermission): void;
 /**
- * The authority a BOARD EDIT is made under, as the auth gate already resolved it (ADR 0037).
+ * The authority a BOARD EDIT is made under, resolvable in whichever workspace the write actually
+ * decides in (ADR 0037).
  *
- * A total accessor for the same reason `runInitiatorRole` is one: a task's `riskPolicyId` decides
+ * A total accessor for the same reason `runInitiatorRole` is one: a block's `riskPolicyId` decides
  * which roles its runs sandbox and how their auto-merge is narrowed, so re-pointing it is judged
- * against the editor rather than waved through as a preference, and a route that read the two
- * facts itself would be a second place to get the dev-open `null` wrong.
+ * against the editor rather than waved through as a preference, and a route that read the facts
+ * itself would be a second place to get the dev-open `null` wrong.
  *
- * With auth disabled the gate resolves no access object, and this returns the unattributed editor
- * rather than inventing one: there is no tier whose restrictions could be dropped, which is the
- * same reading a run started under dev-open gets when it pins no `initiatedByRole`.
+ * It resolves PER WORKSPACE rather than handing back the acting board's answer, because a board
+ * write does not always decide on the board it was addressed to. A board mounts services homed in
+ * other workspaces, and every write on one lands at that home: the row is written there, its
+ * preset resolves against that library, and a run on it is admitted through that board under the
+ * role the editor holds there. A single pre-resolved actor made the guard read one workspace's
+ * policies against another's roles, which refuses and admits by turns for reasons neither
+ * workspace states.
+ *
+ * The acting board costs nothing (the gate already published its resolution); any other workspace
+ * goes through the SAME `loadWorkspaceAccess` the gate uses, memoised per request so a subtree
+ * spanning two homes reads each once. A workspace the caller cannot see resolves to the
+ * unattributed editor: no tier there means no run of theirs is ever admitted under its policies,
+ * so none of its restrictions is theirs to drop.
+ *
+ * With auth disabled the gate resolves no access object, and every workspace returns the
+ * unattributed editor rather than an invented tier, the same reading a run started under dev-open
+ * gets when it pins no `initiatedByRole`.
  */
-export declare function blockEditActor<E extends AppEnv>(c: Context<E>): BlockEditActor;
+export declare function blockEditAuthority<E extends AppEnv>(c: Context<E>): BlockEditAuthority;
 /**
  * The controller-level admin-tier gate (workspace-rbac, slice 6): every WRITE served under one of
  * `prefixes` requires `permission`, with ZERO per-handler code. Reads (GET/HEAD) pass straight

package/dist/http/workspaceAccess.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspaceAccess.d.ts","sourceRoot":"","sources":["../../src/http/workspaceAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAA;AACvF,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACzB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAqB,MAAM,MAAM,CAAA;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAiBvD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,eAAe,EAC1B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAKjC;AA6BD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,EAChD,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EACb,UAAU,EAAE,mBAAmB,GAC9B,IAAI,CASN;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,cAAc,CAI9E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,SAAS,MAAM,EACvD,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EACZ,UAAU,EAAE,mBAAmB,EAC/B,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,IAAI,CAQN;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sCAAsC,CAAC,CAAC,SAAS,MAAM,EACrE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EACZ,UAAU,EAAE,mBAAmB,EAC/B,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,IAAI,CAKN;AAID,2FAA2F;AAC3F,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,mBAAmB,CAAA;IAC/B,gGAAgG;IAChG,UAAU,EAAE,OAAO,CAAA;CACpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,CAI1E"}
+{"version":3,"file":"workspaceAccess.d.ts","sourceRoot":"","sources":["../../src/http/workspaceAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,kBAAkB,EACxB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACzB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAqB,MAAM,MAAM,CAAA;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAiBvD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,eAAe,EAC1B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAKjC;AA6BD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,EAChD,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EACb,UAAU,EAAE,mBAAmB,GAC9B,IAAI,CASN;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,kBAAkB,CA2BtF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,SAAS,MAAM,EACvD,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EACZ,UAAU,EAAE,mBAAmB,EAC/B,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,IAAI,CAQN;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,sCAAsC,CAAC,CAAC,SAAS,MAAM,EACrE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EACZ,UAAU,EAAE,mBAAmB,EAC/B,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,IAAI,CAKN;AAID,2FAA2F;AAC3F,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,mBAAmB,CAAA;IAC/B,gGAAgG;IAChG,UAAU,EAAE,OAAO,CAAA;CACpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,CAI1E"}

package/dist/http/workspaceAccess.js

@@ -1,4 +1,4 @@
-import { UNATTRIBUTED_BLOCK_EDITOR } from '@cat-factory/contracts';
+import { UNATTRIBUTED_BLOCK_EDIT_AUTHORITY, UNATTRIBUTED_BLOCK_EDITOR, } from '@cat-factory/contracts';
 import { ForbiddenError, resolveWorkspaceAccess, } from '@cat-factory/kernel';
 // ---------------------------------------------------------------------------
 // The single workspace-RBAC resolution point (workspace-rbac initiative). The auth gate
@@ -75,22 +75,58 @@ export function requirePermission(c, permission) {
     }
 }
 /**
- * The authority a BOARD EDIT is made under, as the auth gate already resolved it (ADR 0037).
+ * The authority a BOARD EDIT is made under, resolvable in whichever workspace the write actually
+ * decides in (ADR 0037).
  *
- * A total accessor for the same reason `runInitiatorRole` is one: a task's `riskPolicyId` decides
+ * A total accessor for the same reason `runInitiatorRole` is one: a block's `riskPolicyId` decides
  * which roles its runs sandbox and how their auto-merge is narrowed, so re-pointing it is judged
- * against the editor rather than waved through as a preference, and a route that read the two
- * facts itself would be a second place to get the dev-open `null` wrong.
+ * against the editor rather than waved through as a preference, and a route that read the facts
+ * itself would be a second place to get the dev-open `null` wrong.
  *
- * With auth disabled the gate resolves no access object, and this returns the unattributed editor
- * rather than inventing one: there is no tier whose restrictions could be dropped, which is the
- * same reading a run started under dev-open gets when it pins no `initiatedByRole`.
+ * It resolves PER WORKSPACE rather than handing back the acting board's answer, because a board
+ * write does not always decide on the board it was addressed to. A board mounts services homed in
+ * other workspaces, and every write on one lands at that home: the row is written there, its
+ * preset resolves against that library, and a run on it is admitted through that board under the
+ * role the editor holds there. A single pre-resolved actor made the guard read one workspace's
+ * policies against another's roles, which refuses and admits by turns for reasons neither
+ * workspace states.
+ *
+ * The acting board costs nothing (the gate already published its resolution); any other workspace
+ * goes through the SAME `loadWorkspaceAccess` the gate uses, memoised per request so a subtree
+ * spanning two homes reads each once. A workspace the caller cannot see resolves to the
+ * unattributed editor: no tier there means no run of theirs is ever admitted under its policies,
+ * so none of its restrictions is theirs to drop.
+ *
+ * With auth disabled the gate resolves no access object, and every workspace returns the
+ * unattributed editor rather than an invented tier, the same reading a run started under dev-open
+ * gets when it pins no `initiatedByRole`.
  */
-export function blockEditActor(c) {
-    const access = c.get('workspaceAccess');
-    if (!access)
-        return UNATTRIBUTED_BLOCK_EDITOR;
-    return { role: access.role, managesPolicy: access.permissions.has('settings.manage') };
+export function blockEditAuthority(c) {
+    const acting = c.get('workspaceAccess');
+    const user = c.get('user');
+    if (!acting || !user)
+        return UNATTRIBUTED_BLOCK_EDIT_AUTHORITY;
+    const container = c.get('container');
+    const userId = user.id;
+    const resolved = new Map();
+    return {
+        in(workspaceId) {
+            if (workspaceId === acting.workspaceId) {
+                return Promise.resolve({
+                    role: acting.role,
+                    managesPolicy: acting.permissions.has('settings.manage'),
+                });
+            }
+            let pending = resolved.get(workspaceId);
+            if (!pending) {
+                pending = loadWorkspaceAccess(container, workspaceId, userId).then((access) => access?.allowed
+                    ? { role: access.role, managesPolicy: access.permissions.has('settings.manage') }
+                    : UNATTRIBUTED_BLOCK_EDITOR);
+                resolved.set(workspaceId, pending);
+            }
+            return pending;
+        },
+    };
 }
 /**
  * The controller-level admin-tier gate (workspace-rbac, slice 6): every WRITE served under one of

package/dist/http/workspaceAccess.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspaceAccess.js","sourceRoot":"","sources":["../../src/http/workspaceAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAuB,MAAM,wBAAwB,CAAA;AACvF,OAAO,EACL,cAAc,EACd,sBAAsB,GAGvB,MAAM,qBAAqB,CAAA;AAI5B,8EAA8E;AAC9E,wFAAwF;AACxF,yFAAyF;AACzF,mFAAmF;AACnF,EAAE;AACF,yFAAyF;AACzF,sFAAsF;AACtF,wFAAwF;AACxF,2FAA2F;AAC3F,8FAA8F;AAC9F,4FAA4F;AAC5F,8FAA8F;AAC9F,uFAAuF;AACvF,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAA0B,EAC1B,WAAmB,EACnB,MAAc;IAEd,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC9F,MAAM,EAAE,MAAM,8BAA8B,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC;KAC7E,CAAC,CAAC,CAAA;IACH,OAAO,MAAM,CAAA;AACf,CAAC;AAED,qGAAqG;AACrG,KAAK,UAAU,8BAA8B,CAC3C,SAA0B,EAC1B,WAAmB,EACnB,MAAc;IAEd,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;IAC3E,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA,CAAC,4DAA4D;IAExF,uFAAuF;IACvF,uDAAuD;IACvD,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACjC,OAAO,sBAAsB,CAAC;YAC5B,MAAM;YACN,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,IAAI;SACjB,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC;QAC9D,SAAS,CAAC,gBAAgB,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC;KAC7D,CAAC,CAAA;IACF,OAAO,sBAAsB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAA;AAC3F,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,CAAa,EACb,UAA+B;IAE/B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAM,CAAC,kDAAkD;QAC7E,MAAM,IAAI,cAAc,CAAC,4BAA4B,UAAU,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/F,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,cAAc,CAAC,4BAA4B,UAAU,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/F,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAmB,CAAa;IAC5D,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,yBAAyB,CAAA;IAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAA;AACxF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAY,EACZ,UAA+B,EAC/B,QAA2B;IAE3B,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;QACtE,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAA;QAC3B,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAClE,iBAAiB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;QAClC,CAAC;QACD,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,sCAAsC,CACpD,GAAY,EACZ,UAA+B,EAC/B,QAA2B;IAE3B,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;QACrE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,iBAAiB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;QAChE,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,YAAY,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAA;AAStD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,IAAI,OAAO,OAAO,KAAK,UAAU;QAAE,OAAO,SAAS,CAAA;IACnD,MAAM,MAAM,GAAI,OAA8C,CAAC,YAAY,CAAC,CAAA;IAC5E,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,MAAsB,CAAC,CAAC,CAAC,SAAS,CAAA;AAC5F,CAAC;AAED,gGAAgG;AAChG,SAAS,SAAS,CAChB,GAAY,EACZ,QAA2B,EAC3B,OAAoB,EACpB,IAA0B;IAE1B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,4FAA4F;QAC5F,gGAAgG;QAChG,+FAA+F;QAC/F,qEAAqE;QACrE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;IACnF,CAAC;IACD,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IAC7D,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QACrB,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,EAAE,IAAI,CAAC,CAAA;IAC9B,CAAC;AACH,CAAC"}
+{"version":3,"file":"workspaceAccess.js","sourceRoot":"","sources":["../../src/http/workspaceAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iCAAiC,EACjC,yBAAyB,GAG1B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,cAAc,EACd,sBAAsB,GAGvB,MAAM,qBAAqB,CAAA;AAI5B,8EAA8E;AAC9E,wFAAwF;AACxF,yFAAyF;AACzF,mFAAmF;AACnF,EAAE;AACF,yFAAyF;AACzF,sFAAsF;AACtF,wFAAwF;AACxF,2FAA2F;AAC3F,8FAA8F;AAC9F,4FAA4F;AAC5F,8FAA8F;AAC9F,uFAAuF;AACvF,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAA0B,EAC1B,WAAmB,EACnB,MAAc;IAEd,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC9F,MAAM,EAAE,MAAM,8BAA8B,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC;KAC7E,CAAC,CAAC,CAAA;IACH,OAAO,MAAM,CAAA;AACf,CAAC;AAED,qGAAqG;AACrG,KAAK,UAAU,8BAA8B,CAC3C,SAA0B,EAC1B,WAAmB,EACnB,MAAc;IAEd,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;IAC3E,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA,CAAC,4DAA4D;IAExF,uFAAuF;IACvF,uDAAuD;IACvD,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACjC,OAAO,sBAAsB,CAAC;YAC5B,MAAM;YACN,SAAS,EAAE,SAAS;YACpB,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,IAAI;SACjB,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC;QAC9D,SAAS,CAAC,gBAAgB,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC;KAC7D,CAAC,CAAA;IACF,OAAO,sBAAsB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAA;AAC3F,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAC/B,CAAa,EACb,UAA+B;IAE/B,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAM,CAAC,kDAAkD;QAC7E,MAAM,IAAI,cAAc,CAAC,4BAA4B,UAAU,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/F,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,cAAc,CAAC,4BAA4B,UAAU,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,CAAA;IAC/F,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,kBAAkB,CAAmB,CAAa;IAChE,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IACvC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC1B,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI;QAAE,OAAO,iCAAiC,CAAA;IAC9D,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;IACtB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmC,CAAA;IAC3D,OAAO;QACL,EAAE,CAAC,WAAW;YACZ,IAAI,WAAW,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;gBACvC,OAAO,OAAO,CAAC,OAAO,CAAC;oBACrB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,iBAAiB,CAAC;iBACzD,CAAC,CAAA;YACJ,CAAC;YACD,IAAI,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YACvC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,mBAAmB,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAC5E,MAAM,EAAE,OAAO;oBACb,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE;oBACjF,CAAC,CAAC,yBAAyB,CAC9B,CAAA;gBACD,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;YACpC,CAAC;YACD,OAAO,OAAO,CAAA;QAChB,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAY,EACZ,UAA+B,EAC/B,QAA2B;IAE3B,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;QACtE,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAA;QAC3B,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAClE,iBAAiB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;QAClC,CAAC;QACD,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,sCAAsC,CACpD,GAAY,EACZ,UAA+B,EAC/B,QAA2B;IAE3B,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE;QACrE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,iBAAiB,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;QAChE,OAAO,IAAI,EAAE,CAAA;IACf,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,YAAY,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAA;AAStD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,IAAI,OAAO,OAAO,KAAK,UAAU;QAAE,OAAO,SAAS,CAAA;IACnD,MAAM,MAAM,GAAI,OAA8C,CAAC,YAAY,CAAC,CAAA;IAC5E,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,MAAsB,CAAC,CAAC,CAAC,SAAS,CAAA;AAC5F,CAAC;AAED,gGAAgG;AAChG,SAAS,SAAS,CAChB,GAAY,EACZ,QAA2B,EAC3B,OAAoB,EACpB,IAA0B;IAE1B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,4FAA4F;QAC5F,gGAAgG;QAChG,+FAA+F;QAC/F,qEAAqE;QACrE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;IACnF,CAAC;IACD,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IAC7D,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QACrB,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,EAAE,IAAI,CAAC,CAAA;IAC9B,CAAC;AACH,CAAC"}

package/dist/modules/accounts/AccountController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AccountController.d.ts","sourceRoot":"","sources":["../../../src/modules/accounts/AccountController.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAwC/C,wBAAgB,iBAAiB,IAAI,IAAI,CAAC,MAAM,CAAC,CA+NhD"}
+{"version":3,"file":"AccountController.d.ts","sourceRoot":"","sources":["../../../src/modules/accounts/AccountController.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAyC/C,wBAAgB,iBAAiB,IAAI,IAAI,CAAC,MAAM,CAAC,CAoOhD"}

package/dist/modules/accounts/AccountController.js

@@ -4,6 +4,7 @@ import { buildHonoRoute } from '@toad-contracts/hono';
 import { Hono } from 'hono';
 import { apiKeyToWire } from '../providers/ApiKeyController.js';
 import { requireCapability, requireUser } from '../../http/guards.js';
+import { registerAuditLogRoutes } from './auditLogRoutes.js';
 /**
  * The signed-in user, narrowed to what the tenancy layer needs, or a 401 — every route here
  * is account-scoped and has nothing to answer for an anonymous caller. Contrast
@@ -79,6 +80,10 @@ export function accountController() {
             .accountService.setMemberRoles(accountId, user.id, userId, c.req.valid('json').roles);
         return c.json(member, 200);
     });
+    // The audit log's read surface + the admin-forced session revocation that writes to it. Their
+    // own registrar (`auditLogRoutes.ts`) so this function stays inside the per-function budget;
+    // the paths still live under the account prefix.
+    registerAuditLogRoutes(app);
     // ---- Invitations (email-based org onboarding) ---------------------------
     // Available only when the invitation repository is wired (opt-in feature).
     buildHonoRoute(app, listInvitationsContract, async (c) => {