@cat-factory/server 0.333.0 → 0.335.0

package/dist/modules/publicApi/PublicDirectoryController.js

@@ -0,0 +1,107 @@
+import { deleteDirectoryWebhookContract, listDirectoryAccountMembershipsContract, listDirectoryChangesContract, listDirectoryReposContract, listDirectoryUsersContract, listDirectoryWorkspaceMembershipsContract, listDirectoryWebhooksContract, listDirectoryWorkspacesContract, putDirectoryWebhookContract, } from '@cat-factory/contracts';
+import { ForbiddenError } from '@cat-factory/kernel';
+import { buildHonoRoute } from '@toad-contracts/hono';
+import { Hono } from 'hono';
+import { requireCapability } from '../../http/guards.js';
+import { authorizeAccount, refuse } from './publicApiAuth.js';
+// The public DIRECTORY surface (`/api/v1/directory/*`): an account's workspaces, users,
+// memberships and linked repositories, and the change feed that keeps a mirror of them current.
+// Account-scoped, so no workspace header is read; the key's workspace reach becomes the reader's
+// filter. The rules (visibility, cursor expiry, the snapshot watermark) are `DirectoryService`'s.
+// Design: backend/docs/adr/0067-directory-sync.md.
+export function publicDirectoryController() {
+    const app = new Hono();
+    buildHonoRoute(app, listDirectoryChangesContract, async (c) => {
+        const gate = await authorizeAccount(c, listDirectoryChangesContract.minScope);
+        if ('fail' in gate)
+            return refuse(c, gate.fail);
+        const { after, limit } = c.req.valid('query');
+        const page = await c.get('container').directory.changes(reader(gate.auth), after ?? 0, limit);
+        return c.json(page, 200);
+    });
+    buildHonoRoute(app, listDirectoryWorkspacesContract, async (c) => {
+        const gate = await authorizeAccount(c, listDirectoryWorkspacesContract.minScope);
+        if ('fail' in gate)
+            return refuse(c, gate.fail);
+        const { cursor, limit } = c.req.valid('query');
+        return c.json(await c.get('container').directory.workspaces(reader(gate.auth), cursor, limit), 200);
+    });
+    buildHonoRoute(app, listDirectoryUsersContract, async (c) => {
+        const gate = await authorizeAccount(c, listDirectoryUsersContract.minScope);
+        if ('fail' in gate)
+            return refuse(c, gate.fail);
+        const { cursor, limit } = c.req.valid('query');
+        return c.json(await c.get('container').directory.users(reader(gate.auth), cursor, limit), 200);
+    });
+    buildHonoRoute(app, listDirectoryAccountMembershipsContract, async (c) => {
+        const gate = await authorizeAccount(c, listDirectoryAccountMembershipsContract.minScope);
+        if ('fail' in gate)
+            return refuse(c, gate.fail);
+        const { cursor, limit } = c.req.valid('query');
+        const page = await c
+            .get('container')
+            .directory.accountMemberships(reader(gate.auth), cursor, limit);
+        return c.json(page, 200);
+    });
+    buildHonoRoute(app, listDirectoryWorkspaceMembershipsContract, async (c) => {
+        const gate = await authorizeAccount(c, listDirectoryWorkspaceMembershipsContract.minScope);
+        if ('fail' in gate)
+            return refuse(c, gate.fail);
+        const { cursor, limit } = c.req.valid('query');
+        const page = await c
+            .get('container')
+            .directory.workspaceMemberships(reader(gate.auth), cursor, limit);
+        return c.json(page, 200);
+    });
+    buildHonoRoute(app, listDirectoryReposContract, async (c) => {
+        const gate = await authorizeAccount(c, listDirectoryReposContract.minScope);
+        if ('fail' in gate)
+            return refuse(c, gate.fail);
+        const { cursor, limit } = c.req.valid('query');
+        return c.json(await c.get('container').directory.repos(reader(gate.auth), cursor, limit), 200);
+    });
+    // ---- Directory webhooks: account-level push endpoints --------------------------------------
+    // `admin` and account-wide only: an endpoint receives every directory change in the account, so
+    // a key limited to some workspaces could otherwise read the rest through a push it registered.
+    buildHonoRoute(app, listDirectoryWebhooksContract, async (c) => {
+        const gate = await authorizeAccount(c, listDirectoryWebhooksContract.minScope);
+        if ('fail' in gate)
+            return refuse(c, gate.fail);
+        const accountId = requireAccountWide(gate.auth);
+        return c.json({ webhooks: await webhooks(c).list(accountId) }, 200);
+    });
+    buildHonoRoute(app, putDirectoryWebhookContract, async (c) => {
+        const gate = await authorizeAccount(c, putDirectoryWebhookContract.minScope);
+        if ('fail' in gate)
+            return refuse(c, gate.fail);
+        const accountId = requireAccountWide(gate.auth);
+        const { webhookId } = c.req.valid('param');
+        return c.json(await webhooks(c).put(accountId, webhookId, c.req.valid('json')), 200);
+    });
+    buildHonoRoute(app, deleteDirectoryWebhookContract, async (c) => {
+        const gate = await authorizeAccount(c, deleteDirectoryWebhookContract.minScope);
+        if ('fail' in gate)
+            return refuse(c, gate.fail);
+        const accountId = requireAccountWide(gate.auth);
+        await webhooks(c).delete(accountId, c.req.valid('param').webhookId);
+        return c.body(null, 204);
+    });
+    return app;
+}
+function webhooks(c) {
+    return requireCapability(c.get('container').directoryWebhooks, 'Directory webhooks are not served here: they need ENCRYPTION_KEY to seal signing secrets, and a mothership-mode node leaves them to the mothership');
+}
+/** The key's account, refusing a key limited to some workspaces. */
+function requireAccountWide(auth) {
+    if (auth.workspaceIds !== null) {
+        throw new ForbiddenError('Directory webhooks need a key that reaches every workspace', {
+            reason: 'account_scope_required',
+        });
+    }
+    return auth.accountId;
+}
+/** The directory reader a key is: its account, and its workspace reach as the filter. */
+function reader(auth) {
+    return { accountId: auth.accountId, workspaceIds: auth.workspaceIds };
+}
+//# sourceMappingURL=PublicDirectoryController.js.map

package/dist/modules/publicApi/PublicDirectoryController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PublicDirectoryController.js","sourceRoot":"","sources":["../../../src/modules/publicApi/PublicDirectoryController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,uCAAuC,EACvC,4BAA4B,EAC5B,0BAA0B,EAC1B,0BAA0B,EAC1B,yCAAyC,EACzC,6BAA6B,EAC7B,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAE7D,wFAAwF;AACxF,gGAAgG;AAChG,iGAAiG;AACjG,kGAAkG;AAClG,mDAAmD;AAEnD,MAAM,UAAU,yBAAyB;IACvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,cAAc,CAAC,GAAG,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5D,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,CAAC,EAAE,4BAA4B,CAAC,QAAQ,CAAC,CAAA;QAC7E,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,CAAC,CAAA;QAC7F,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,+BAA+B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/D,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,CAAC,EAAE,+BAA+B,CAAC,QAAQ,CAAC,CAAA;QAChF,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC9C,OAAO,CAAC,CAAC,IAAI,CACX,MAAM,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAC/E,GAAG,CACJ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,CAAC,EAAE,0BAA0B,CAAC,QAAQ,CAAC,CAAA;QAC3E,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,CAAA;IAChG,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,uCAAuC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvE,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,CAAC,EAAE,uCAAuC,CAAC,QAAQ,CAAC,CAAA;QACxF,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC9C,MAAM,IAAI,GAAG,MAAM,CAAC;aACjB,GAAG,CAAC,WAAW,CAAC;aAChB,SAAS,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;QACjE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,yCAAyC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzE,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,CAAC,EAAE,yCAAyC,CAAC,QAAQ,CAAC,CAAA;QAC1F,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC9C,MAAM,IAAI,GAAG,MAAM,CAAC;aACjB,GAAG,CAAC,WAAW,CAAC;aAChB,SAAS,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;QACnE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,CAAC,EAAE,0BAA0B,CAAC,QAAQ,CAAC,CAAA;QAC3E,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,CAAA;IAChG,CAAC,CAAC,CAAA;IAEF,+FAA+F;IAC/F,gGAAgG;IAChG,+FAA+F;IAE/F,cAAc,CAAC,GAAG,EAAE,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7D,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,CAAC,EAAE,6BAA6B,CAAC,QAAQ,CAAC,CAAA;QAC9E,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3D,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,CAAC,EAAE,2BAA2B,CAAC,QAAQ,CAAC,CAAA;QAC5E,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACtF,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,8BAA8B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9D,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,CAAC,EAAE,8BAA8B,CAAC,QAAQ,CAAC,CAAA;QAC/E,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAA;QACnE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,QAAQ,CAAmB,CAAa;IAC/C,OAAO,iBAAiB,CACtB,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,iBAAiB,EACpC,oJAAoJ,CACrJ,CAAA;AACH,CAAC;AAED,oEAAoE;AACpE,SAAS,kBAAkB,CAAC,IAA0D;IACpF,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,cAAc,CAAC,4DAA4D,EAAE;YACrF,MAAM,EAAE,wBAAwB;SACjC,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAA;AACvB,CAAC;AAED,yFAAyF;AACzF,SAAS,MAAM,CAAC,IAA0D;IACxE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAA;AACvE,CAAC"}

package/dist/modules/publicApi/PublicDiscoveryController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PublicDiscoveryController.d.ts","sourceRoot":"","sources":["../../../src/modules/publicApi/PublicDiscoveryController.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAkB/C,wBAAgB,yBAAyB,IAAI,IAAI,CAAC,MAAM,CAAC,CAoDxD"}
+{"version":3,"file":"PublicDiscoveryController.d.ts","sourceRoot":"","sources":["../../../src/modules/publicApi/PublicDiscoveryController.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAkB/C,wBAAgB,yBAAyB,IAAI,IAAI,CAAC,MAAM,CAAC,CAgExD"}

package/dist/modules/publicApi/PublicDiscoveryController.js

@@ -26,10 +26,10 @@ export function publicDiscoveryController() {
         const gate = await authorize(c, getPublicIdentityContract.minScope);
         if ('fail' in gate)
             return refuse(c, gate.fail);
-        const { keyId, accountId, workspaceId, scope, label, externalIdentity, createdAt } = gate.auth;
+        const { keyId, accountId, workspaceId, workspaceIds, scope, label, externalIdentity, createdAt, } = gate.auth;
         // Straight off the auth result: `authenticate` already loaded the row, so self-description
         // costs no read of its own.
-        return c.json({ keyId, accountId, workspaceId, scope, label, externalIdentity, createdAt }, 200);
+        return c.json({ keyId, accountId, workspaceId, workspaceIds, scope, label, externalIdentity, createdAt }, 200);
     });
     buildHonoRoute(app, listPublicTaskTypesContract, async (c) => {
         // `read`, like every other discovery call: knowing what may be created is not creating it, and

package/dist/modules/publicApi/PublicDiscoveryController.js.map

@@ -1 +1 @@
-{"version":3,"file":"PublicDiscoveryController.js","sourceRoot":"","sources":["../../../src/modules/publicApi/PublicDiscoveryController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAA;AAC/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAA;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAE3D,iGAAiG;AACjG,gEAAgE;AAChE,EAAE;AACF,mGAAmG;AACnG,mGAAmG;AACnG,mGAAmG;AACnG,kGAAkG;AAClG,qFAAqF;AACrF,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,4FAA4F;AAE5F,MAAM,UAAU,yBAAyB;IACvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,8FAA8F;QAC9F,4FAA4F;QAC5F,6BAA6B;QAC7B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,yBAAyB,CAAC,QAAQ,CAAC,CAAA;QACnE,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,IAAI,CAAA;QAC9F,2FAA2F;QAC3F,4BAA4B;QAC5B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAA;IAClG,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3D,+FAA+F;QAC/F,sEAAsE;QACtE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,2BAA2B,CAAC,QAAQ,CAAC,CAAA;QACrE,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,gGAAgG;QAChG,+FAA+F;QAC/F,+FAA+F;QAC/F,uFAAuF;QACvF,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAC5C,SAAS,CAAC,oBAAoB,EAAE,OAAO,EACvC,IAAI,CAAC,IAAI,CAAC,WAAW,EACrB,SAAS,CAAC,MAAM,CACjB,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,SAAS,CAAC,gBAAgB,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAClG,CAAC,CAAC,CAAA;IAEF,iGAAiG;IACjG,kGAAkG;IAClG,2FAA2F;IAC3F,gGAAgG;IAChG,8FAA8F;IAC9F,4EAA4E;IAC5E,EAAE;IACF,iGAAiG;IACjG,8FAA8F;IAC9F,4FAA4F;IAC5F,GAAG,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,6FAA6F;QAC7F,mFAAmF;QACnF,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAA;IACzF,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"PublicDiscoveryController.js","sourceRoot":"","sources":["../../../src/modules/publicApi/PublicDiscoveryController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAA;AAC/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAA;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAE3D,iGAAiG;AACjG,gEAAgE;AAChE,EAAE;AACF,mGAAmG;AACnG,mGAAmG;AACnG,mGAAmG;AACnG,kGAAkG;AAClG,qFAAqF;AACrF,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,4FAA4F;AAE5F,MAAM,UAAU,yBAAyB;IACvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,cAAc,CAAC,GAAG,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzD,8FAA8F;QAC9F,4FAA4F;QAC5F,6BAA6B;QAC7B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,yBAAyB,CAAC,QAAQ,CAAC,CAAA;QACnE,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,EACJ,KAAK,EACL,SAAS,EACT,WAAW,EACX,YAAY,EACZ,KAAK,EACL,KAAK,EACL,gBAAgB,EAChB,SAAS,GACV,GAAG,IAAI,CAAC,IAAI,CAAA;QACb,2FAA2F;QAC3F,4BAA4B;QAC5B,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,EAC1F,GAAG,CACJ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,2BAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3D,+FAA+F;QAC/F,sEAAsE;QACtE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,2BAA2B,CAAC,QAAQ,CAAC,CAAA;QACrE,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACpC,gGAAgG;QAChG,+FAA+F;QAC/F,+FAA+F;QAC/F,uFAAuF;QACvF,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAC5C,SAAS,CAAC,oBAAoB,EAAE,OAAO,EACvC,IAAI,CAAC,IAAI,CAAC,WAAW,EACrB,SAAS,CAAC,MAAM,CACjB,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,SAAS,CAAC,gBAAgB,EAAE,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAClG,CAAC,CAAC,CAAA;IAEF,iGAAiG;IACjG,kGAAkG;IAClG,2FAA2F;IAC3F,gGAAgG;IAChG,8FAA8F;IAC9F,4EAA4E;IAC5E,EAAE;IACF,iGAAiG;IACjG,8FAA8F;IAC9F,4FAA4F;IAC5F,GAAG,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,6FAA6F;QAC7F,mFAAmF;QACnF,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAA;IACzF,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/publicApi/PublicKeyController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PublicKeyController.d.ts","sourceRoot":"","sources":["../../../src/modules/publicApi/PublicKeyController.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAiD/C,wBAAgB,mBAAmB,IAAI,IAAI,CAAC,MAAM,CAAC,CA4DlD"}
+{"version":3,"file":"PublicKeyController.d.ts","sourceRoot":"","sources":["../../../src/modules/publicApi/PublicKeyController.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAqD/C,wBAAgB,mBAAmB,IAAI,IAAI,CAAC,MAAM,CAAC,CA0ElD"}

package/dist/modules/publicApi/PublicKeyController.js

@@ -2,7 +2,7 @@ import { createPublicKeyContract, listPublicKeysContract, revokePublicKeyContrac
 import { buildHonoRoute } from '@toad-contracts/hono';
 import { Hono } from 'hono';
 import { requireCapability } from '../../http/guards.js';
-import { publicApiKeyToWire } from './keyProjection.js';
+import { assertReachCovers, assertWorkspacesInAccount, publicApiKeyToWire, } from './keyProjection.js';
 import { authorize, refuse } from './publicApiAuth.js';
 // HEADLESS key provisioning (`GET|POST|DELETE /api/v1/keys`): the external counterpart of the
 // session-authed `/workspaces/:ws/public-api-keys` routes, delegating to the SAME
@@ -51,20 +51,25 @@ export function publicKeyController() {
         const gate = await authorize(c, listPublicKeysContract.minScope);
         if ('fail' in gate)
             return refuse(c, gate.fail);
-        const keys = keyStore(c);
-        return c.json({ keys: (await keys.list(gate.auth.workspaceId)).map(publicApiKeyToWire) }, 200);
+        const { accountId, workspaceId } = gate.auth;
+        const keys = await keyStore(c).listReaching(accountId, workspaceId);
+        return c.json({ keys: keys.map((key) => publicApiKeyToWire(key, workspaceId)) }, 200);
     });
     buildHonoRoute(app, createPublicKeyContract, async (c) => {
         const gate = await authorize(c, createPublicKeyContract.minScope);
         if ('fail' in gate)
             return refuse(c, gate.fail);
         const keys = keyStore(c);
-        const { label, scope, externalIdentity } = c.req.valid('json');
-        // The account and workspace come from the KEY, never from the body: this surface mints into
-        // the caller's own workspace and has no vocabulary for another one.
+        const { label, scope, externalIdentity, workspaceIds } = c.req.valid('json');
+        // The account comes from the KEY, never from the body. The reach defaults to the workspace this
+        // request acts on (what every mint produced before keys could span workspaces) and can never
+        // exceed the minting key's own.
+        const reach = workspaceIds === undefined ? [gate.auth.workspaceId] : workspaceIds;
+        assertReachCovers(gate.auth.workspaceIds, reach, 'mint a key with that reach');
+        await assertWorkspacesInAccount(c.get('container').workspaceService, gate.auth.accountId, reach);
         const { record, secret } = await keys.issue({
             accountId: gate.auth.accountId,
-            workspaceId: gate.auth.workspaceId,
+            workspaceIds: reach,
             // No user minted this one. Attributing it to the human who minted the PARENT key would
             // be a guess dressed as provenance. The key is what acted, so the key is what is
             // recorded, and that is also what the revocation cascade follows.
@@ -82,21 +87,27 @@ export function publicKeyController() {
             // An integration that needs one asks the person to mint it.
             actsAsUserId: null,
         }, label, scope ?? DEFAULT_MINTED_SCOPE);
-        return c.json({ key: publicApiKeyToWire(record), secret }, 201);
+        return c.json({ key: publicApiKeyToWire(record, gate.auth.workspaceId), secret }, 201);
     });
     buildHonoRoute(app, revokePublicKeyContract, async (c) => {
         const gate = await authorize(c, revokePublicKeyContract.minScope);
         if ('fail' in gate)
             return refuse(c, gate.fail);
-        // Scoped to the caller's workspace by the service, and idempotent, so an unknown id is a 204
-        // rather than a 404: this surface must not become an oracle for which key ids exist.
+        // Scoped to the caller's account, and idempotent, so an unknown id is a 204 rather than a 404:
+        // this surface must not become an oracle for which key ids exist. A key reaching workspaces
+        // the caller cannot is refused, so a restricted admin key cannot retire a wider credential.
         //
         // Revoking the CALLING key is allowed on purpose: a provisioning credential retiring itself at
         // the end of a run is the case, and the request is already authorized by the time it lands.
         // That key is always an app-minted `admin` one, since revoking needs the rung this surface
         // cannot mint. Self-revocation is the PROVISIONER standing down (taking everything it
         // handed out with it), never a provisioned key handing itself back.
-        await keyStore(c).revoke(gate.auth.workspaceId, c.req.valid('param').keyId);
+        const keys = keyStore(c);
+        const target = await keys.getLive(gate.auth.accountId, c.req.valid('param').keyId);
+        if (target) {
+            assertReachCovers(gate.auth.workspaceIds, target.workspaceIds, 'revoke that key');
+            await keys.revoke(gate.auth.accountId, target.id);
+        }
         return c.body(null, 204);
     });
     return app;

package/dist/modules/publicApi/PublicKeyController.js.map

@@ -1 +1 @@
-{"version":3,"file":"PublicKeyController.js","sourceRoot":"","sources":["../../../src/modules/publicApi/PublicKeyController.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEtD,8FAA8F;AAC9F,kFAAkF;AAClF,6FAA6F;AAC7F,oCAAoC;AACpC,EAAE;AACF,wDAAwD;AACxD,gGAAgG;AAChG,yBAAyB;AACzB,4FAA4F;AAC5F,qFAAqF;AACrF,EAAE;AACF,uEAAuE;AACvE,EAAE;AACF,8EAA8E;AAC9E,gGAAgG;AAChG,8FAA8F;AAC9F,+FAA+F;AAC/F,iEAAiE;AACjE,8FAA8F;AAC9F,gGAAgG;AAChG,6FAA6F;AAC7F,oBAAoB;AACpB,EAAE;AACF,2FAA2F;AAC3F,4FAA4F;AAC5F,2CAA2C;AAE3C;;;;;GAKG;AACH,SAAS,QAAQ,CAAmB,CAAa;IAC/C,OAAO,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,aAAa,EAAE,8BAA8B,CAAC,CAAA;AAC5F,CAAC;AAED;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,OAAgB,CAAA;AAE7C,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,cAAc,CAAC,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAA;QAChE,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;QACxB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IAChG,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAA;QACjE,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;QACxB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC9D,4FAA4F;QAC5F,oEAAoE;QACpE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CACzC;YACE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;YAC9B,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;YAClC,uFAAuF;YACvF,iFAAiF;YACjF,kEAAkE;YAClE,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;YAC/B,uFAAuF;YACvF,uFAAuF;YACvF,uFAAuF;YACvF,uFAAuF;YACvF,gBAAgB,EAAE,gBAAgB,IAAI,IAAI;YAC1C,uFAAuF;YACvF,wFAAwF;YACxF,uFAAuF;YACvF,yFAAyF;YACzF,4DAA4D;YAC5D,YAAY,EAAE,IAAI;SACnB,EACD,KAAK,EACL,KAAK,IAAI,oBAAoB,CAC9B,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAA;QACjE,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,6FAA6F;QAC7F,qFAAqF;QACrF,EAAE;QACF,+FAA+F;QAC/F,4FAA4F;QAC5F,2FAA2F;QAC3F,sFAAsF;QACtF,oEAAoE;QACpE,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAA;QAC3E,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"PublicKeyController.js","sourceRoot":"","sources":["../../../src/modules/publicApi/PublicKeyController.ts"],"names":[],"mappings":"AACA,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEtD,8FAA8F;AAC9F,kFAAkF;AAClF,6FAA6F;AAC7F,oCAAoC;AACpC,EAAE;AACF,wDAAwD;AACxD,gGAAgG;AAChG,yBAAyB;AACzB,4FAA4F;AAC5F,qFAAqF;AACrF,EAAE;AACF,uEAAuE;AACvE,EAAE;AACF,8EAA8E;AAC9E,gGAAgG;AAChG,8FAA8F;AAC9F,+FAA+F;AAC/F,iEAAiE;AACjE,8FAA8F;AAC9F,gGAAgG;AAChG,6FAA6F;AAC7F,oBAAoB;AACpB,EAAE;AACF,2FAA2F;AAC3F,4FAA4F;AAC5F,2CAA2C;AAE3C;;;;;GAKG;AACH,SAAS,QAAQ,CAAmB,CAAa;IAC/C,OAAO,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,aAAa,EAAE,8BAA8B,CAAC,CAAA;AAC5F,CAAC;AAED;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,OAAgB,CAAA;AAE7C,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,cAAc,CAAC,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAA;QAChE,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,IAAI,CAAA;QAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;QACnE,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAuB,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,EAAE,EACrF,GAAG,CACJ,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAA;QACjE,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;QACxB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC5E,gGAAgG;QAChG,6FAA6F;QAC7F,gCAAgC;QAChC,MAAM,KAAK,GAAG,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,YAAY,CAAA;QACjF,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,4BAA4B,CAAC,CAAA;QAC9E,MAAM,yBAAyB,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QAChG,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CACzC;YACE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;YAC9B,YAAY,EAAE,KAAK;YACnB,uFAAuF;YACvF,iFAAiF;YACjF,kEAAkE;YAClE,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;YAC/B,uFAAuF;YACvF,uFAAuF;YACvF,uFAAuF;YACvF,uFAAuF;YACvF,gBAAgB,EAAE,gBAAgB,IAAI,IAAI;YAC1C,uFAAuF;YACvF,wFAAwF;YACxF,uFAAuF;YACvF,yFAAyF;YACzF,4DAA4D;YAC5D,YAAY,EAAE,IAAI;SACnB,EACD,KAAK,EACL,KAAK,IAAI,oBAAoB,CAC9B,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAA;IACxF,CAAC,CAAC,CAAA;IAEF,cAAc,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAA;QACjE,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,+FAA+F;QAC/F,4FAA4F;QAC5F,4FAA4F;QAC5F,EAAE;QACF,+FAA+F;QAC/F,4FAA4F;QAC5F,2FAA2F;QAC3F,sFAAsF;QACtF,oEAAoE;QACpE,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAA;QAClF,IAAI,MAAM,EAAE,CAAC;YACX,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAA;YACjF,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QACnD,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/publicApi/PublicPrAssessmentController.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from 'hono';
+import type { AppEnv } from '../../http/env.js';
+export declare function publicPrAssessmentController(): Hono<AppEnv>;
+//# sourceMappingURL=PublicPrAssessmentController.d.ts.map

package/dist/modules/publicApi/PublicPrAssessmentController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PublicPrAssessmentController.d.ts","sourceRoot":"","sources":["../../../src/modules/publicApi/PublicPrAssessmentController.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAQ/C,wBAAgB,4BAA4B,IAAI,IAAI,CAAC,MAAM,CAAC,CAyB3D"}

package/dist/modules/publicApi/PublicPrAssessmentController.js

@@ -0,0 +1,26 @@
+import { assessPublicPullRequestContract } from '@cat-factory/contracts';
+import { buildHonoRoute } from '@toad-contracts/hono';
+import { Hono } from 'hono';
+import { requireCapability } from '../../http/guards.js';
+import { keyInitiatorRole } from '../../http/runAdmission.js';
+import { authorize, refuse } from './publicApiAuth.js';
+// The public PR assessment (`POST /api/v1/pr-assessments`): one synchronous model call that scores
+// a pull request and says whether a risk policy would land it. Every rule lives in the service.
+export function publicPrAssessmentController() {
+    const app = new Hono();
+    buildHonoRoute(app, assessPublicPullRequestContract, async (c) => {
+        const gate = await authorize(c, assessPublicPullRequestContract.minScope);
+        if ('fail' in gate)
+            return refuse(c, gate.fail);
+        // Same reason the risk-policy list answers with: the verdict is judged against that library.
+        const { service } = requireCapability(c.get('container').prAssessment, 'Risk policies are not configured', 'risk_policies_unwired');
+        // A key bound to a person reads the PR and calls the model as them, and is judged under their
+        // role as a run it starts would be; an unbound key runs on the workspace's credentials.
+        const { workspaceId, actsAsUserId } = gate.auth;
+        const role = await keyInitiatorRole(c.get('container'), workspaceId, actsAsUserId);
+        const assessment = await service.assess(workspaceId, { userId: actsAsUserId, role }, c.req.valid('json'));
+        return c.json(assessment, 200);
+    });
+    return app;
+}
+//# sourceMappingURL=PublicPrAssessmentController.js.map

package/dist/modules/publicApi/PublicPrAssessmentController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PublicPrAssessmentController.js","sourceRoot":"","sources":["../../../src/modules/publicApi/PublicPrAssessmentController.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAA;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEtD,mGAAmG;AACnG,gGAAgG;AAEhG,MAAM,UAAU,4BAA4B;IAC1C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,cAAc,CAAC,GAAG,EAAE,+BAA+B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,+BAA+B,CAAC,QAAQ,CAAC,CAAA;QACzE,IAAI,MAAM,IAAI,IAAI;YAAE,OAAO,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/C,6FAA6F;QAC7F,MAAM,EAAE,OAAO,EAAE,GAAG,iBAAiB,CACnC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,YAAY,EAC/B,kCAAkC,EAClC,uBAAuB,CACxB,CAAA;QACD,8FAA8F;QAC9F,wFAAwF;QACxF,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,IAAI,CAAA;QAC/C,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,YAAY,CAAC,CAAA;QAClF,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,MAAM,CACrC,WAAW,EACX,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,EAC9B,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CACpB,CAAA;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/modules/publicApi/decisions/scope.d.ts

@@ -55,7 +55,7 @@ export declare function requireScopedRun<E extends AppEnv>(c: Context<E>, worksp
 /** The error a gate rejected with, kept as DATA so each handler emits its own typed `c.json`. */
 export type GateFailure = {
     fail: {
-        status: 401 | 403 | 404 | 428 | 503;
+        status: 401 | 403 | 404 | 422 | 428 | 503;
         code: string;
         message: string;
         /**

package/dist/modules/publicApi/decisions/scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../../../src/modules/publicApi/decisions/scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAA2B,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC5E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AACjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,OAAO,KAAK,EACV,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,kBAAkB,EACnB,MAAM,4BAA4B,CAAA;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAgBlD,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,iBAAiB,CAAA;IAC5B,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,aAAa,CAAC,CAAC,SAAS,MAAM,EAClD,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EACb,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAQ3B;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW,UAAW,MAAM,KAAG,aACkB,CAAA;AAE9D;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,SAAS,MAAM,EACrD,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EACb,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,SAAS,CAAC,CAIpB;AAED,iGAAiG;AACjG,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE;QACJ,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;QACnC,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf;;;;;;WAMG;QACH,OAAO,CAAC,EAAE,OAAO,CAAA;KAClB,CAAA;CACF,CAAA;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG;IACtD,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAC5D,CAUA;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,SAAS,MAAM,EACvD,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAAG,WAAW,CAAC,CAgB3F;AAwDD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,GAAG,SAAS,CAEpE;AAED,kFAAkF;AAClF,UAAU,YAAY,CAAC,OAAO;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,SAAS,CAAA;IACjB,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,wDAAwD;AACxD,MAAM,WAAW,kBAAmB,SAAQ,YAAY,CAAC,iBAAiB,CAAC;IACzE,YAAY,EAAE,kBAAkB,CAAA;CACjC;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,SAAS,MAAM,EAC3D,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,kBAAkB,GAAG,WAAW,CAAC,CAa3C;AAED,mDAAmD;AACnD,MAAM,WAAW,aAAc,SAAQ,YAAY,CAAC,aAAa,CAAC;IAChE,OAAO,EAAE,aAAa,CAAA;CACvB;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,SAAS,MAAM,EACtD,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,GAAG,WAAW,CAAC,CAatC;AAED,qEAAqE;AACrE,MAAM,WAAW,gBAAiB,SAAQ,YAAY,CAAC,iBAAiB,CAAC;IACvE,UAAU,EAAE,gBAAgB,CAAA;IAC5B,KAAK,EAAE,eAAe,CAAA;CACvB;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,SAAS,MAAM,EACzD,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EACb,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,gBAAgB,GAAG,WAAW,CAAC,CAazC;AAED,+FAA+F;AAC/F,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,SAAS,CAAA;IACjB,IAAI,EAAE,aAAa,CAAA;IACnB,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,SAAS,MAAM,EACxD,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,eAAe,GAAG,WAAW,CAAC,CAiBxC"}
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../../../src/modules/publicApi/decisions/scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAA2B,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC5E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AACjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,OAAO,KAAK,EACV,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,kBAAkB,EACnB,MAAM,4BAA4B,CAAA;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAgBlD,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,iBAAiB,CAAA;IAC5B,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,aAAa,CAAC,CAAC,SAAS,MAAM,EAClD,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EACb,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAQ3B;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW,UAAW,MAAM,KAAG,aACkB,CAAA;AAE9D;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,SAAS,MAAM,EACrD,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EACb,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,SAAS,CAAC,CAIpB;AAED,iGAAiG;AACjG,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE;QACJ,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;QACzC,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf;;;;;;WAMG;QACH,OAAO,CAAC,EAAE,OAAO,CAAA;KAClB,CAAA;CACF,CAAA;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG;IACtD,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAC5D,CAUA;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,SAAS,MAAM,EACvD,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAAG,WAAW,CAAC,CAgB3F;AAwDD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,GAAG,SAAS,CAEpE;AAED,kFAAkF;AAClF,UAAU,YAAY,CAAC,OAAO;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,SAAS,CAAA;IACjB,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,wDAAwD;AACxD,MAAM,WAAW,kBAAmB,SAAQ,YAAY,CAAC,iBAAiB,CAAC;IACzE,YAAY,EAAE,kBAAkB,CAAA;CACjC;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,SAAS,MAAM,EAC3D,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,kBAAkB,GAAG,WAAW,CAAC,CAa3C;AAED,mDAAmD;AACnD,MAAM,WAAW,aAAc,SAAQ,YAAY,CAAC,aAAa,CAAC;IAChE,OAAO,EAAE,aAAa,CAAA;CACvB;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,SAAS,MAAM,EACtD,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,GAAG,WAAW,CAAC,CAatC;AAED,qEAAqE;AACrE,MAAM,WAAW,gBAAiB,SAAQ,YAAY,CAAC,iBAAiB,CAAC;IACvE,UAAU,EAAE,gBAAgB,CAAA;IAC5B,KAAK,EAAE,eAAe,CAAA;CACvB;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,SAAS,MAAM,EACzD,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EACb,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,gBAAgB,GAAG,WAAW,CAAC,CAazC;AAED,+FAA+F;AAC/F,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,SAAS,CAAA;IACjB,IAAI,EAAE,aAAa,CAAA;IACnB,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,SAAS,MAAM,EACxD,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,eAAe,GAAG,WAAW,CAAC,CAiBxC"}

package/dist/modules/publicApi/keyProjection.d.ts

@@ -1,17 +1,19 @@
-import type { PublicApiKey } from '@cat-factory/contracts';
-import type { PublicApiKeyRecord } from '@cat-factory/kernel';
+import { type PublicApiKey } from '@cat-factory/contracts';
+import { type PublicApiKeyRecord } from '@cat-factory/kernel';
 /**
- * Project a stored public-API key onto the secret-free wire resource.
+ * A key on the wire. `workspaceId` is the workspace the listing or mint was made for.
  *
- * ONE projection for both surfaces that expose a key: the session-authed management routes
- * (`PublicApiKeyController`) and the headless provisioning routes (`PublicKeyController`). They
- * had a copy each, which is how a field comes to be echoed on one and silently absent on the
- * other: `externalIdentity` is set by the headless mint and read on both, so a caller listing its
- * keys in the app would have seen every one of them claim to act for nobody.
- *
- * `secretHash` is the field this exists to leave behind. It is the only member of the record the
- * wire type has no place for, so an explicit projection (never a spread of the row) is what keeps
- * a future column from arriving on the wire by default.
+ * `secretHash` is the field this exists to leave behind, so it is an explicit projection and never
+ * a spread of the row: a future column must not arrive on the wire by default.
+ */
+export declare function publicApiKeyToWire(record: PublicApiKeyRecord, workspaceId: string): PublicApiKey;
+/**
+ * Refuse a requested reach naming any workspace outside `accountId`, in one batched read. A
+ * foreign board and a missing one answer the same 404, so the check cannot be used as a probe.
  */
-export declare function publicApiKeyToWire(record: PublicApiKeyRecord): PublicApiKey;
+export declare function assertWorkspacesInAccount(workspaces: {
+    accountIdsOf(ids: string[]): Promise<Record<string, string | null>>;
+}, accountId: string, workspaceIds: string[] | null): Promise<void>;
+/** Refuse an operation on a reach the caller's own reach does not cover. */
+export declare function assertReachCovers(holder: string[] | null, requested: string[] | null, action: string): void;
 //# sourceMappingURL=keyProjection.d.ts.map

package/dist/modules/publicApi/keyProjection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keyProjection.d.ts","sourceRoot":"","sources":["../../../src/modules/publicApi/keyProjection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAE7D;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,YAAY,CAe3E"}
+{"version":3,"file":"keyProjection.d.ts","sourceRoot":"","sources":["../../../src/modules/publicApi/keyProjection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwC,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAEhG,OAAO,EAAiC,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAK5F;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,GAAG,YAAY,CAgBhG;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE;IAAE,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,CAAA;CAAE,EACnF,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,GAC5B,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EACvB,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,EAC1B,MAAM,EAAE,MAAM,GACb,IAAI,CAMN"}

package/dist/modules/publicApi/keyProjection.js

@@ -1,21 +1,20 @@
+import { PUBLIC_API_KEY_REACH_EXCEEDED_REASON } from '@cat-factory/contracts';
+import { reachCovers } from '@cat-factory/integrations';
+import { ForbiddenError, NotFoundError } from '@cat-factory/kernel';
+// Shared by the session-authed key panel and the headless `/api/v1/keys` surface, so the two
+// project a key and judge a requested reach identically.
 /**
- * Project a stored public-API key onto the secret-free wire resource.
+ * A key on the wire. `workspaceId` is the workspace the listing or mint was made for.
  *
- * ONE projection for both surfaces that expose a key: the session-authed management routes
- * (`PublicApiKeyController`) and the headless provisioning routes (`PublicKeyController`). They
- * had a copy each, which is how a field comes to be echoed on one and silently absent on the
- * other: `externalIdentity` is set by the headless mint and read on both, so a caller listing its
- * keys in the app would have seen every one of them claim to act for nobody.
- *
- * `secretHash` is the field this exists to leave behind. It is the only member of the record the
- * wire type has no place for, so an explicit projection (never a spread of the row) is what keeps
- * a future column from arriving on the wire by default.
+ * `secretHash` is the field this exists to leave behind, so it is an explicit projection and never
+ * a spread of the row: a future column must not arrive on the wire by default.
  */
-export function publicApiKeyToWire(record) {
+export function publicApiKeyToWire(record, workspaceId) {
     return {
         id: record.id,
         accountId: record.accountId,
-        workspaceId: record.workspaceId,
+        workspaceId,
+        workspaceIds: record.workspaceIds,
         label: record.label,
         scope: record.scope,
         createdByUserId: record.createdByUserId,
@@ -27,4 +26,25 @@ export function publicApiKeyToWire(record) {
         revokedAt: record.revokedAt,
     };
 }
+/**
+ * Refuse a requested reach naming any workspace outside `accountId`, in one batched read. A
+ * foreign board and a missing one answer the same 404, so the check cannot be used as a probe.
+ */
+export async function assertWorkspacesInAccount(workspaces, accountId, workspaceIds) {
+    if (workspaceIds === null)
+        return;
+    const owners = await workspaces.accountIdsOf(workspaceIds);
+    const foreign = workspaceIds.find((id) => owners[id] !== accountId);
+    if (foreign !== undefined) {
+        throw new NotFoundError('Workspace', foreign, { reason: 'workspace_not_found' });
+    }
+}
+/** Refuse an operation on a reach the caller's own reach does not cover. */
+export function assertReachCovers(holder, requested, action) {
+    if (!reachCovers(holder, requested)) {
+        throw new ForbiddenError(`This key cannot ${action}: it reaches workspaces this key does not`, {
+            reason: PUBLIC_API_KEY_REACH_EXCEEDED_REASON,
+        });
+    }
+}
 //# sourceMappingURL=keyProjection.js.map

package/dist/modules/publicApi/keyProjection.js.map

@@ -1 +1 @@
-{"version":3,"file":"keyProjection.js","sourceRoot":"","sources":["../../../src/modules/publicApi/keyProjection.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAA0B;IAC3D,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAA;AACH,CAAC"}
+{"version":3,"file":"keyProjection.js","sourceRoot":"","sources":["../../../src/modules/publicApi/keyProjection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oCAAoC,EAAqB,MAAM,wBAAwB,CAAA;AAChG,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,aAAa,EAA2B,MAAM,qBAAqB,CAAA;AAE5F,6FAA6F;AAC7F,yDAAyD;AAEzD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAA0B,EAAE,WAAmB;IAChF,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW;QACX,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,UAAmF,EACnF,SAAiB,EACjB,YAA6B;IAE7B,IAAI,YAAY,KAAK,IAAI;QAAE,OAAM;IACjC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;IAC1D,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,SAAS,CAAC,CAAA;IACnE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,aAAa,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAA;IAClF,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB,CAC/B,MAAuB,EACvB,SAA0B,EAC1B,MAAc;IAEd,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,cAAc,CAAC,mBAAmB,MAAM,2CAA2C,EAAE;YAC7F,MAAM,EAAE,oCAAoC;SAC7C,CAAC,CAAA;IACJ,CAAC;AACH,CAAC"}