@essentialai/cogent-server 3.4.2 → 3.4.3

package/dist/routes/sessions.js

@@ -1,7 +1,31 @@
 import { Hono } from "hono";
 import { zValidator } from "@hono/zod-validator";
 import { BridgeError, ErrorCode, CreateSessionRequestSchema, JoinSessionRequestSchema, generateSessionId, generateSessionLabel, isValidSessionLabel, } from "@essentialai/cogent";
-import { validationHook } from "./validation-hook.js";
+import { JoinRateLimiter } from "../services/join-rate-limiter.js";
+import { validationHook, honoSchema } from "./validation-hook.js";
+import { logOrgEvent } from "../services/obs-log.js";
+/**
+ * Best-effort client IP for the rate limiter's per-source tier.
+ *
+ * Prefer `X-Real-IP` (our edge proxy OVERWRITES it with the real peer) and the
+ * RIGHTMOST `X-Forwarded-For` entry (the hop our proxy appends) — never the
+ * leftmost XFF value, which is attacker-supplied. This is only the UX tier;
+ * the spoof-proof guarantee comes from the limiter's channel tier (keyed on the
+ * non-spoofable sessionId), so a forged header at worst evades per-IP
+ * granularity, not the lockout itself.
+ */
+export function clientIp(c) {
+    const realIp = c.req.header("x-real-ip")?.trim();
+    if (realIp)
+        return realIp;
+    const xff = c.req.header("x-forwarded-for");
+    if (xff) {
+        const parts = xff.split(",").map((s) => s.trim()).filter(Boolean);
+        if (parts.length > 0)
+            return parts[parts.length - 1];
+    }
+    return "unknown";
+}
 /**
  * Create session routes sub-router.
  *
@@ -9,8 +33,13 @@ import { validationHook } from "./validation-hook.js";
  * POST /:sessionId/join -> Join an existing session
  *
  * Both endpoints are unauthenticated (they issue tokens, not consume them).
+ *
+ * @param multiTenant   When true, Org_ID (the 3rd join credential) is enforced
+ *                      for channels created with one. When false (free relay),
+ *                      Org_ID is ignored entirely and behavior is unchanged.
+ * @param rateLimiter   Throttles repeated failed joins (brute-force lockout).
  */
-export function createSessionRoutes(sessionStore, authService) {
+export function createSessionRoutes(sessionStore, authService, multiTenant, rateLimiter) {
     const sessions = new Hono();
     /**
      * POST / - Create a new session.
@@ -18,16 +47,26 @@ export function createSessionRoutes(sessionStore, authService) {
      * Receives { secret, label? }, bcrypt-hashes the secret, generates a bearer
      * token, creates the session on disk, and returns { sessionId, token, createdAt }.
      */
-    sessions.post("/", zValidator("json", CreateSessionRequestSchema, validationHook), async (c) => {
-        const { secret, label } = c.req.valid("json");
+    sessions.post("/", zValidator("json", honoSchema(CreateSessionRequestSchema), validationHook), async (c) => {
+        const { secret, label, orgId } = c.req.valid("json");
         // Generate unique session ID
         const sessionId = generateSessionId();
-        // Auto-generate label if not provided, with collision retry
+        // On a multi-tenant relay, an Org_ID makes this an Org_ID-gated business
+        // channel: persist the bcrypt hash (auth) and a stable SHA-256 scope
+        // (label namespacing), never the plaintext. The free relay ignores Org_ID
+        // entirely (org stays undefined -> labels stay globally scoped, NFR6).
+        const org = multiTenant && orgId
+            ? {
+                idHash: await authService.hashSecret(orgId),
+                scope: authService.hashToken(orgId),
+            }
+            : undefined;
+        // Auto-generate label if not provided, with collision retry (scoped to the org)
         let sessionLabel = label;
         if (!sessionLabel) {
             for (let i = 0; i < 5; i++) {
                 const candidate = generateSessionLabel();
-                if (!sessionStore.isLabelTaken(candidate)) {
+                if (!sessionStore.isLabelTaken(candidate, org?.scope)) {
                     sessionLabel = candidate;
                     break;
                 }
@@ -49,7 +88,7 @@ export function createSessionRoutes(sessionStore, authService) {
             c.req.header("x-real-ip") ||
             undefined;
         // Persist the session
-        const session = await sessionStore.createSession(sessionId, sessionLabel, secretHash, tokenEntry, creatorIp);
+        const session = await sessionStore.createSession(sessionId, sessionLabel, secretHash, tokenEntry, creatorIp, org);
         return c.json({
             sessionId,
             token,
@@ -58,9 +97,13 @@ export function createSessionRoutes(sessionStore, authService) {
         }, 201);
     });
     /**
-     * GET /resolve/:label - Resolve a session label to its UUID.
+     * GET /resolve/:label - Resolve a PUBLIC (free) session label to its UUID.
      *
      * Unauthenticated -- a sessionId alone grants no access (token required).
+     * Resolves the public scope ONLY: business (Org_ID-gated) labels are
+     * intentionally NOT discoverable here, so a caller cannot enumerate another
+     * org's channels by label (per-org isolation, FR6). Business channels are
+     * joined by sessionId, provisioned via the control plane / admin (E3).
      * Returns { sessionId, label } or 400/404.
      */
     sessions.get("/resolve/:label", async (c) => {
@@ -68,6 +111,7 @@ export function createSessionRoutes(sessionStore, authService) {
         if (!isValidSessionLabel(label)) {
             return c.json({ error: "Invalid label format. Must be 3-32 lowercase alphanumeric characters with internal hyphens." }, 400);
         }
+        // orgScope omitted -> public scope only; business labels resolve to null.
         const sessionId = sessionStore.getSessionIdByLabel(label);
         if (!sessionId) {
             throw new BridgeError(ErrorCode.SESSION_NOT_FOUND, `No session with label "${label}"`, "Check the label or use the full session ID");
@@ -80,19 +124,61 @@ export function createSessionRoutes(sessionStore, authService) {
      * Receives { secret }, verifies against bcrypt hash, generates a new bearer
      * token, and returns { sessionId, token, peerCount }.
      */
-    sessions.post("/:sessionId/join", zValidator("json", JoinSessionRequestSchema, validationHook), async (c) => {
+    sessions.post("/:sessionId/join", zValidator("json", honoSchema(JoinSessionRequestSchema), validationHook), async (c) => {
         const sessionId = c.req.param("sessionId");
-        const { secret } = c.req.valid("json");
+        const { secret, orgId } = c.req.valid("json");
+        // Rate-limit brute-force joins. Tier 1 (source IP + channel) for UX;
+        // tier 2 (channel only, non-spoofable) is the security backstop that
+        // holds even if X-Forwarded-For / X-Real-IP are forged. The limiter is a
+        // Business Edition control: gate it behind multiTenant so the free relay
+        // path is unchanged (NFR6 — a free join failure stays 401, never 429).
+        const sourceKey = JoinRateLimiter.sourceKey(clientIp(c), sessionId);
+        const channelKey = JoinRateLimiter.channelKey(sessionId);
+        if (multiTenant)
+            rateLimiter.check(sourceKey, channelKey);
         // Look up the session
         const session = await sessionStore.getSession(sessionId);
         if (!session) {
             throw new BridgeError(ErrorCode.SESSION_NOT_FOUND, `Session ${sessionId} not found`, "Check the session ID or create a new session");
         }
-        // Verify the provided secret against the stored bcrypt hash
-        const isValid = await authService.verifySecret(secret, session.secretHash);
+        // A business channel is one that was created WITH an Org_ID (orgIdHash
+        // present). Keyed on the stored hash, NOT the live multiTenant flag, so a
+        // channel created as business stays Org_ID-gated even if the flag is later
+        // toggled off (fail-closed — never silently downgrade to secret-only).
+        const isBusiness = session.orgIdHash !== undefined;
+        // Enumeration-safe verification: ALWAYS run the same number of bcrypt
+        // comparisons regardless of which credential is wrong, so timing leaks
+        // nothing. For business channels both the secret AND Org_ID are checked
+        // (Org_ID compared even when omitted -> empty string -> false). A wrong
+        // Org_ID and a wrong password therefore produce identical work and the
+        // identical error below (no oracle).
+        const secretOk = await authService.verifySecret(secret, session.secretHash);
+        const orgOk = isBusiness
+            ? await authService.verifySecret(orgId ?? "", session.orgIdHash)
+            : true;
+        const isValid = secretOk && orgOk;
         if (!isValid) {
-            throw new BridgeError(ErrorCode.AUTH_INVALID_TOKEN, "Invalid session secret", "Verify you are using the correct shared secret for this session");
+            if (multiTenant)
+                rateLimiter.recordFailure(sourceKey, channelKey);
+            // Per-org observability (Story 2.7): org-tagged auth failure. NEVER log
+            // the secret or Org_ID — only the org_scope tag + that it was a business
+            // channel. (Does not break the enumeration-safe single error below.)
+            logOrgEvent({
+                event: "auth_failure",
+                orgScope: session.orgScope ?? null,
+                sessionId,
+                outcome: "invalid_credentials",
+                detail: { phase: "join", isBusiness },
+            });
+            // Business: ONE generic message for every failure mode (no enumeration).
+            // Free: keep the historical message verbatim (NFR6, unchanged behavior).
+            throw isBusiness
+                ? new BridgeError(ErrorCode.AUTH_INVALID_TOKEN, "Invalid credentials", "Verify the channel secret and Org_ID")
+                : new BridgeError(ErrorCode.AUTH_INVALID_TOKEN, "Invalid session secret", "Verify you are using the correct shared secret for this session");
         }
+        // Successful join clears the per-source counter for this (IP, channel).
+        if (multiTenant)
+            rateLimiter.recordSuccess(sourceKey);
         // Generate a new bearer token for this joining client
         const { token, tokenHash } = authService.generateToken();
         const tokenEntry = {

package/dist/routes/sessions.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/routes/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EACL,WAAW,EACX,SAAS,EACT,0BAA0B,EAC1B,wBAAwB,EACxB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,YAA0B,EAC1B,WAAwB;IAExB,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAa,CAAC;IAEvC;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CACX,GAAG,EACH,UAAU,CAAC,MAAM,EAAE,0BAA0B,EAAE,cAAc,CAAC,EAC9D,KAAK,EAAE,CAAC,EAAE,EAAE;QACV,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAE9C,6BAA6B;QAC7B,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QAEtC,4DAA4D;QAC5D,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC3B,MAAM,SAAS,GAAG,oBAAoB,EAAE,CAAC;gBACzC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC1C,YAAY,GAAG,SAAS,CAAC;oBACzB,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,CAAC,YAAY;gBAAE,YAAY,GAAG,oBAAoB,EAAE,CAAC,CAAC,kCAAkC;QAC9F,CAAC;QAED,6CAA6C;QAC7C,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAExD,2DAA2D;QAC3D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,aAAa,EAAE,CAAC;QAEzD,gCAAgC;QAChC,MAAM,UAAU,GAAe;YAC7B,SAAS;YACT,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,kEAAkE;QAClE,MAAM,SAAS,GACb,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YACrD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;YACzB,SAAS,CAAC;QAEZ,sBAAsB;QACtB,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,aAAa,CAC9C,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,SAAS,CACV,CAAC;QAEF,OAAO,CAAC,CAAC,IAAI,CACX;YACE,SAAS;YACT,KAAK;YACL,KAAK,EAAE,YAAY;YACnB,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CACF,CAAC;IAEF;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEnC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,6FAA6F,EAAE,EACxG,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,YAAY,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,WAAW,CACnB,SAAS,CAAC,iBAAiB,EAC3B,0BAA0B,KAAK,GAAG,EAClC,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CACX,kBAAkB,EAClB,UAAU,CAAC,MAAM,EAAE,wBAAwB,EAAE,cAAc,CAAC,EAC5D,KAAK,EAAE,CAAC,EAAE,EAAE;QACV,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEvC,sBAAsB;QACtB,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CACnB,SAAS,CAAC,iBAAiB,EAC3B,WAAW,SAAS,YAAY,EAChC,8CAA8C,CAC/C,CAAC;QACJ,CAAC;QAED,4DAA4D;QAC5D,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,YAAY,CAC5C,MAAM,EACN,OAAO,CAAC,UAAU,CACnB,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CACnB,SAAS,CAAC,kBAAkB,EAC5B,wBAAwB,EACxB,iEAAiE,CAClE,CAAC;QACJ,CAAC;QAED,sDAAsD;QACtD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,aAAa,EAAE,CAAC;QACzD,MAAM,UAAU,GAAe;YAC7B,SAAS;YACT,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,+BAA+B;QAC/B,MAAM,YAAY,CAAC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAEnD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,SAAS;YACT,KAAK;YACL,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;YAC1B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM;SAC7C,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/routes/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EACL,WAAW,EACX,SAAS,EACT,0BAA0B,EAC1B,wBAAwB,EACxB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAEnE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CAAC,CAA4D;IACnF,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC5C,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CACjC,YAA0B,EAC1B,WAAwB,EACxB,WAAoB,EACpB,WAA4B;IAE5B,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAa,CAAC;IAEvC;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CACX,GAAG,EACH,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,0BAA0B,CAAC,EAAE,cAAc,CAAC,EAC1E,KAAK,EAAE,CAAC,EAAE,EAAE;QACV,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAErD,6BAA6B;QAC7B,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;QAEtC,yEAAyE;QACzE,qEAAqE;QACrE,0EAA0E;QAC1E,uEAAuE;QACvE,MAAM,GAAG,GACP,WAAW,IAAI,KAAK;YAClB,CAAC,CAAC;gBACE,MAAM,EAAE,MAAM,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC;gBAC3C,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC;aACpC;YACH,CAAC,CAAC,SAAS,CAAC;QAEhB,gFAAgF;QAChF,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC3B,MAAM,SAAS,GAAG,oBAAoB,EAAE,CAAC;gBACzC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;oBACtD,YAAY,GAAG,SAAS,CAAC;oBACzB,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,CAAC,YAAY;gBAAE,YAAY,GAAG,oBAAoB,EAAE,CAAC,CAAC,kCAAkC;QAC9F,CAAC;QAED,6CAA6C;QAC7C,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAExD,2DAA2D;QAC3D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,aAAa,EAAE,CAAC;QAEzD,gCAAgC;QAChC,MAAM,UAAU,GAAe;YAC7B,SAAS;YACT,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,kEAAkE;QAClE,MAAM,SAAS,GACb,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YACrD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;YACzB,SAAS,CAAC;QAEZ,sBAAsB;QACtB,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,aAAa,CAC9C,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,SAAS,EACT,GAAG,CACJ,CAAC;QAEF,OAAO,CAAC,CAAC,IAAI,CACX;YACE,SAAS;YACT,KAAK;YACL,KAAK,EAAE,YAAY;YACnB,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,EACD,GAAG,CACJ,CAAC;IACJ,CAAC,CACF,CAAC;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEnC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,6FAA6F,EAAE,EACxG,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,MAAM,SAAS,GAAG,YAAY,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,WAAW,CACnB,SAAS,CAAC,iBAAiB,EAC3B,0BAA0B,KAAK,GAAG,EAClC,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CACX,kBAAkB,EAClB,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,wBAAwB,CAAC,EAAE,cAAc,CAAC,EACxE,KAAK,EAAE,CAAC,EAAE,EAAE;QACV,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAE9C,qEAAqE;QACrE,qEAAqE;QACrE,yEAAyE;QACzE,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,WAAW;YAAE,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAE1D,sBAAsB;QACtB,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CACnB,SAAS,CAAC,iBAAiB,EAC3B,WAAW,SAAS,YAAY,EAChC,8CAA8C,CAC/C,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,0EAA0E;QAC1E,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;QAEnD,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,uEAAuE;QACvE,qCAAqC;QACrC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,UAAU;YACtB,CAAC,CAAC,MAAM,WAAW,CAAC,YAAY,CAAC,KAAK,IAAI,EAAE,EAAE,OAAO,CAAC,SAAmB,CAAC;YAC1E,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,OAAO,GAAG,QAAQ,IAAI,KAAK,CAAC;QAElC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,WAAW;gBAAE,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YAClE,wEAAwE;YACxE,yEAAyE;YACzE,qEAAqE;YACrE,WAAW,CAAC;gBACV,KAAK,EAAE,cAAc;gBACrB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;gBAClC,SAAS;gBACT,OAAO,EAAE,qBAAqB;gBAC9B,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE;aACtC,CAAC,CAAC;YACH,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,UAAU;gBACd,CAAC,CAAC,IAAI,WAAW,CACb,SAAS,CAAC,kBAAkB,EAC5B,qBAAqB,EACrB,sCAAsC,CACvC;gBACH,CAAC,CAAC,IAAI,WAAW,CACb,SAAS,CAAC,kBAAkB,EAC5B,wBAAwB,EACxB,iEAAiE,CAClE,CAAC;QACR,CAAC;QAED,wEAAwE;QACxE,IAAI,WAAW;YAAE,WAAW,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAEtD,sDAAsD;QACtD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,aAAa,EAAE,CAAC;QACzD,MAAM,UAAU,GAAe;YAC7B,SAAS;YACT,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,+BAA+B;QAC/B,MAAM,YAAY,CAAC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAEnD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,SAAS;YACT,KAAK;YACL,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE;YAC1B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM;SAC7C,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/routes/validation-hook.d.ts

@@ -1,4 +1,34 @@
 import type { Context, Env } from "hono";
+import type { zValidator } from "@hono/zod-validator";
+/**
+ * Dual-zod-instance type shim for `zValidator`.
+ *
+ * The server resolves `zod@4.3.6` while `@essentialai/cogent` bundles its OWN
+ * nested `zod@4.4.3`. TypeScript compatibility is STRUCTURAL — decided by a
+ * type's inferred shape, not its name (vault:
+ * typescript-master-vault/concepts/Structural_Type_Compatibility.md). The two
+ * copies' `$ZodType`/`$ZodTypeInternals` shapes differ, so a cogent-exported
+ * schema is NOT assignable to the `ZodType` shape `@hono/zod-validator` was
+ * compiled against — passing it straight in is a `TS2345`/`TS2769` no-overload
+ * error, even though both are "zod v4" by name.
+ *
+ * A type assertion is the sanctioned escape hatch for exactly this case —
+ * "integrating with third-party libraries that may not have accurate type
+ * definitions" — to be used judiciously, only when necessary (vault:
+ * typescript-master-vault/concepts/Type_Assertion.md, Best Practices). So this is
+ * ONE narrow, documented boundary cast to the exact type `zValidator` expects
+ * (`Parameters<typeof zValidator>[1]`, NOT `any`), not scattered casts. The
+ * schemas validate correctly at runtime (covered by the route test suites); only
+ * the compile-time type is bridged. Without it `tsc` exits non-zero and
+ * `npm run build` (hence the publish gate / image build) fails.
+ *
+ * Trade-off: the cast collapses the INFERRED output type, so `c.req.valid(...)`
+ * at the call sites is `any` rather than the schema's type. Acceptable here — the
+ * handlers are small and covered by route tests. Remove once both packages
+ * resolve a single zod instance (dedupe the nested copy / align versions).
+ */
+type ZValidatorSchema = Parameters<typeof zValidator>[1];
+export declare function honoSchema(schema: unknown): ZValidatorSchema;
 /**
  * Shared validation hook for @hono/zod-validator.
  *
@@ -15,4 +45,5 @@ export declare function validationHook(result: {
     success: boolean;
     error?: unknown;
 }, c: Context<Env>): Response | void;
+export {};
 //# sourceMappingURL=validation-hook.d.ts.map

package/dist/routes/validation-hook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation-hook.d.ts","sourceRoot":"","sources":["../../src/routes/validation-hook.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,EAC7C,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,GACd,QAAQ,GAAG,IAAI,CAejB"}
+{"version":3,"file":"validation-hook.d.ts","sourceRoot":"","sources":["../../src/routes/validation-hook.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,KAAK,gBAAgB,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACzD,wBAAgB,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,gBAAgB,CAE5D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,EAC7C,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,GACd,QAAQ,GAAG,IAAI,CAejB"}

package/dist/routes/validation-hook.js

@@ -1,4 +1,7 @@
 import { BridgeError, ErrorCode } from "@essentialai/cogent";
+export function honoSchema(schema) {
+    return schema;
+}
 /**
  * Shared validation hook for @hono/zod-validator.
  *

package/dist/routes/validation-hook.js.map

@@ -1 +1 @@
-{"version":3,"file":"validation-hook.js","sourceRoot":"","sources":["../../src/routes/validation-hook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAG7D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA6C,EAC7C,CAAe;IAEf,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC;QAC9B,MAAM,OAAO,GACX,QAAQ,YAAY,KAAK;YACvB,CAAC,CAAC,QAAQ,CAAC,OAAO;YAClB,CAAC,CAAC,sBAAsB,CAAC;QAE7B,MAAM,GAAG,GAAG,IAAI,WAAW,CACzB,SAAS,CAAC,aAAa,EACvB,sBAAsB,OAAO,EAAE,EAC/B,gDAAgD,CACjD,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;AACH,CAAC"}
+{"version":3,"file":"validation-hook.js","sourceRoot":"","sources":["../../src/routes/validation-hook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAgC7D,MAAM,UAAU,UAAU,CAAC,MAAe;IACxC,OAAO,MAA0B,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA6C,EAC7C,CAAe;IAEf,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC;QAC9B,MAAM,OAAO,GACX,QAAQ,YAAY,KAAK;YACvB,CAAC,CAAC,QAAQ,CAAC,OAAO;YAClB,CAAC,CAAC,sBAAsB,CAAC;QAE7B,MAAM,GAAG,GAAG,IAAI,WAAW,CACzB,SAAS,CAAC,aAAa,EACvB,sBAAsB,OAAO,EAAE,EAC/B,gDAAgD,CACjD,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;AACH,CAAC"}

package/dist/services/auth-service.d.ts

@@ -1,48 +1,8 @@
 /**
- * Authentication service for the Cogent server.
- *
- * Responsibilities:
- * - bcrypt hashing of session secrets (one-time, during create/join)
- * - Random bearer token generation with SHA-256 hashing for storage
- * - Timing-safe comparison for token verification (every request)
- *
- * bcrypt is used for secrets (slow, salted -- appropriate for passwords).
- * SHA-256 is used for tokens (fast -- tokens are high-entropy random values).
- * Timing-safe comparison prevents timing attacks on token verification.
+ * Re-export shim. The hashing/token primitives now live in the shared core
+ * (`@essentialai/cogent/auth`) so the relay and the Business Edition control
+ * plane hash secrets identically. Behavior is byte-for-byte unchanged; every
+ * existing `import { AuthService } from ".../auth-service.js"` keeps working.
  */
-export declare class AuthService {
-    private readonly bcryptRounds;
-    constructor(bcryptRounds: number);
-    /**
-     * Hash a plaintext secret using bcrypt.
-     * Used during session creation and join operations.
-     */
-    hashSecret(plainSecret: string): Promise<string>;
-    /**
-     * Verify a plaintext secret against a bcrypt hash.
-     * Used during session join to validate the provided secret.
-     */
-    verifySecret(plainSecret: string, hash: string): Promise<boolean>;
-    /**
-     * Generate a cryptographically random bearer token.
-     * Returns both the plaintext token (to send to client) and its
-     * SHA-256 hash (to store on disk for lookup).
-     */
-    generateToken(): {
-        token: string;
-        tokenHash: string;
-    };
-    /**
-     * Compute the SHA-256 hash of a token string.
-     * Used by auth middleware to look up tokens in the session store index.
-     */
-    hashToken(token: string): string;
-    /**
-     * Timing-safe string comparison.
-     * Hashes both strings with SHA-256 to normalize length, then uses
-     * crypto.timingSafeEqual on the resulting buffers. This prevents
-     * timing attacks regardless of input string lengths.
-     */
-    timingSafeCompare(a: string, b: string): boolean;
-}
+export { AuthService } from "@essentialai/cogent/auth";
 //# sourceMappingURL=auth-service.d.ts.map

package/dist/services/auth-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-service.d.ts","sourceRoot":"","sources":["../../src/services/auth-service.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;GAWG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;gBAE1B,YAAY,EAAE,MAAM;IAIhC;;;OAGG;IACG,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAItD;;;OAGG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIvE;;;;OAIG;IACH,aAAa,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAMrD;;;OAGG;IACH,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAIhC;;;;;OAKG;IACH,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO;CAKjD"}
+{"version":3,"file":"auth-service.d.ts","sourceRoot":"","sources":["../../src/services/auth-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/services/auth-service.js

@@ -1,63 +1,8 @@
-import crypto from "node:crypto";
-import bcrypt from "bcryptjs";
 /**
- * Authentication service for the Cogent server.
- *
- * Responsibilities:
- * - bcrypt hashing of session secrets (one-time, during create/join)
- * - Random bearer token generation with SHA-256 hashing for storage
- * - Timing-safe comparison for token verification (every request)
- *
- * bcrypt is used for secrets (slow, salted -- appropriate for passwords).
- * SHA-256 is used for tokens (fast -- tokens are high-entropy random values).
- * Timing-safe comparison prevents timing attacks on token verification.
+ * Re-export shim. The hashing/token primitives now live in the shared core
+ * (`@essentialai/cogent/auth`) so the relay and the Business Edition control
+ * plane hash secrets identically. Behavior is byte-for-byte unchanged; every
+ * existing `import { AuthService } from ".../auth-service.js"` keeps working.
  */
-export class AuthService {
-    bcryptRounds;
-    constructor(bcryptRounds) {
-        this.bcryptRounds = bcryptRounds;
-    }
-    /**
-     * Hash a plaintext secret using bcrypt.
-     * Used during session creation and join operations.
-     */
-    async hashSecret(plainSecret) {
-        return bcrypt.hash(plainSecret, this.bcryptRounds);
-    }
-    /**
-     * Verify a plaintext secret against a bcrypt hash.
-     * Used during session join to validate the provided secret.
-     */
-    async verifySecret(plainSecret, hash) {
-        return bcrypt.compare(plainSecret, hash);
-    }
-    /**
-     * Generate a cryptographically random bearer token.
-     * Returns both the plaintext token (to send to client) and its
-     * SHA-256 hash (to store on disk for lookup).
-     */
-    generateToken() {
-        const token = crypto.randomBytes(32).toString("hex");
-        const tokenHash = this.hashToken(token);
-        return { token, tokenHash };
-    }
-    /**
-     * Compute the SHA-256 hash of a token string.
-     * Used by auth middleware to look up tokens in the session store index.
-     */
-    hashToken(token) {
-        return crypto.createHash("sha256").update(token).digest("hex");
-    }
-    /**
-     * Timing-safe string comparison.
-     * Hashes both strings with SHA-256 to normalize length, then uses
-     * crypto.timingSafeEqual on the resulting buffers. This prevents
-     * timing attacks regardless of input string lengths.
-     */
-    timingSafeCompare(a, b) {
-        const hashA = crypto.createHash("sha256").update(a).digest();
-        const hashB = crypto.createHash("sha256").update(b).digest();
-        return crypto.timingSafeEqual(hashA, hashB);
-    }
-}
+export { AuthService } from "@essentialai/cogent/auth";
 //# sourceMappingURL=auth-service.js.map

package/dist/services/auth-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-service.js","sourceRoot":"","sources":["../../src/services/auth-service.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,MAAM,MAAM,UAAU,CAAC;AAE9B;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,WAAW;IACL,YAAY,CAAS;IAEtC,YAAY,YAAoB;QAC9B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,WAAmB;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACrD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,WAAmB,EAAE,IAAY;QAClD,OAAO,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED;;;;OAIG;IACH,aAAa;QACX,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACxC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,KAAa;QACrB,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,CAAS,EAAE,CAAS;QACpC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC7D,OAAO,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;CACF"}
+{"version":3,"file":"auth-service.js","sourceRoot":"","sources":["../../src/services/auth-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/services/connection-manager.d.ts

@@ -68,6 +68,21 @@ export declare class ConnectionManager {
      * Get all connections in a session (flat array across all peers).
      */
     getAllSessionConnections(sessionId: string): PeerConnection[];
+    /**
+     * Force-close every WebSocket connection in a session (all peers), returning
+     * the number closed. Used when the control plane deletes a channel or rotates
+     * an Org_ID: connected agents are dropped so they must rejoin with current
+     * credentials. Best-effort — already-closed sockets are ignored. Does not
+     * mutate the session store; the caller owns that.
+     *
+     * Map cleanup is deferred: this does NOT call `removeConnection`. The socket's
+     * async `onClose` handler (ws/handler.ts) runs the normal teardown — pruning
+     * the connection map, starting the grace timer, and firing `onPeerOffline`.
+     * Calling `removeConnection` here as well would double-fire that teardown. So
+     * for a brief window after this returns, `getAllSessionConnections` may still
+     * list the now-closing sockets (mirrors the existing `closeAll` shutdown path).
+     */
+    closeSessionConnections(sessionId: string, code: number, reason: string): number;
     /**
      * Get the list of peer IDs with active connections in a session.
      */

package/dist/services/connection-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection-manager.d.ts","sourceRoot":"","sources":["../../src/services/connection-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,SAAS,MAAM,IAAI,CAAC;AAEhC;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,EAAE,EAAE,SAAS,CAAC;IACd,qEAAqE;IACrE,KAAK,EAAE,SAAS,CAAC;IACjB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,iBAAiB,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC;CACnD;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAC5B;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAGxB;IAEJ;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAGxB;IAEJ,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IAExC,uEAAuE;IACvE,OAAO,CAAC,aAAa,CAAC,CAA8C;gBAExD,cAAc,GAAE,MAAe;IAI3C;;;OAGG;IACH,gBAAgB,CACd,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,GACpD,IAAI;IAIP;;;OAGG;IACH,aAAa,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI;IA4BzC;;;;OAIG;IACH,gBAAgB,CACd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,SAAS,GACZ,IAAI;IA4BP;;;OAGG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,EAAE;IAMnE;;OAEG;IACH,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,EAAE;IAW7D;;OAEG;IACH,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE;IAMhD;;;;OAIG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM;IAYnE;;;OAGG;IACH,kBAAkB,CAChB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,aAAa,CAAC,EAAE,MAAM,GACrB,IAAI;IAcP;;;;;;;;OAQG;IACH,4BAA4B,CAC1B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,GACpC,IAAI;IAcP;;OAEG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAOvD;;;OAGG;IACH,sBAAsB,IAAI,MAAM;IAQhC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAwB5C;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;CAUzB"}
+{"version":3,"file":"connection-manager.d.ts","sourceRoot":"","sources":["../../src/services/connection-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,SAAS,MAAM,IAAI,CAAC;AAEhC;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,EAAE,EAAE,SAAS,CAAC;IACd,qEAAqE;IACrE,KAAK,EAAE,SAAS,CAAC;IACjB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,iBAAiB,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC;CACnD;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAC5B;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAGxB;IAEJ;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAGxB;IAEJ,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IAExC,uEAAuE;IACvE,OAAO,CAAC,aAAa,CAAC,CAA8C;gBAExD,cAAc,GAAE,MAAe;IAI3C;;;OAGG;IACH,gBAAgB,CACd,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,GACpD,IAAI;IAIP;;;OAGG;IACH,aAAa,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI;IA4BzC;;;;OAIG;IACH,gBAAgB,CACd,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,SAAS,GACZ,IAAI;IA4BP;;;OAGG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,EAAE;IAMnE;;OAEG;IACH,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,EAAE;IAW7D;;;;;;;;;;;;;OAaG;IACH,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM;IAehF;;OAEG;IACH,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE;IAMhD;;;;OAIG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM;IAYnE;;;OAGG;IACH,kBAAkB,CAChB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,aAAa,CAAC,EAAE,MAAM,GACrB,IAAI;IAcP;;;;;;;;OAQG;IACH,4BAA4B,CAC1B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,GACpC,IAAI;IAcP;;OAEG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAOvD;;;OAGG;IACH,sBAAsB,IAAI,MAAM;IAQhC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAwB5C;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;CAUzB"}

package/dist/services/connection-manager.js

@@ -111,6 +111,35 @@ export class ConnectionManager {
         }
         return result;
     }
+    /**
+     * Force-close every WebSocket connection in a session (all peers), returning
+     * the number closed. Used when the control plane deletes a channel or rotates
+     * an Org_ID: connected agents are dropped so they must rejoin with current
+     * credentials. Best-effort — already-closed sockets are ignored. Does not
+     * mutate the session store; the caller owns that.
+     *
+     * Map cleanup is deferred: this does NOT call `removeConnection`. The socket's
+     * async `onClose` handler (ws/handler.ts) runs the normal teardown — pruning
+     * the connection map, starting the grace timer, and firing `onPeerOffline`.
+     * Calling `removeConnection` here as well would double-fire that teardown. So
+     * for a brief window after this returns, `getAllSessionConnections` may still
+     * list the now-closing sockets (mirrors the existing `closeAll` shutdown path).
+     */
+    closeSessionConnections(sessionId, code, reason) {
+        const conns = this.getAllSessionConnections(sessionId);
+        let closed = 0;
+        for (const conn of conns) {
+            try {
+                clearInterval(conn.heartbeatInterval);
+                conn.ws.close(code, reason);
+                closed++;
+            }
+            catch {
+                // Already closed / closing -- nothing to do.
+            }
+        }
+        return closed;
+    }
     /**
      * Get the list of peer IDs with active connections in a session.
      */

package/dist/services/connection-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"connection-manager.js","sourceRoot":"","sources":["../../src/services/connection-manager.ts"],"names":[],"mappings":"AAsBA;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IAC5B;;;OAGG;IACc,WAAW,GAAG,IAAI,GAAG,EAGnC,CAAC;IAEJ;;;;OAIG;IACc,WAAW,GAAG,IAAI,GAAG,EAGnC,CAAC;IAEJ,iFAAiF;IAChE,cAAc,CAAS;IAExC,uEAAuE;IAC/D,aAAa,CAA+C;IAEpE,YAAY,iBAAyB,MAAM;QACzC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,gBAAgB,CACd,QAAqD;QAErD,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,IAAoB;QAChC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAEnC,yDAAyD;QACzD,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC;QAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,YAAY,CAAC,aAAa,CAAC,CAAC;YAC5B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;QAED,gCAAgC;QAChC,IAAI,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,UAAU,GAAG,IAAI,GAAG,EAA4B,CAAC;YACjD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC9C,CAAC;QAED,oDAAoD;QACpD,IAAI,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS,GAAG,EAAE,CAAC;YACf,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,gBAAgB,CACd,SAAiB,EACjB,MAAc,EACd,EAAa;QAEb,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU;YAAE,OAAO;QAExB,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,0DAA0D;QAC1D,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO;QAEvB,mDAAmD;QACnD,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAChD,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAEzB,+CAA+C;QAC/C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAE1B,6BAA6B;YAC7B,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACrC,CAAC;YAED,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,cAAc,CAAC,SAAiB,EAAE,MAAc;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,CAAC;QAC3B,OAAO,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,wBAAwB,CAAC,SAAiB;QACxC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,CAAC;QAE3B,MAAM,MAAM,GAAqB,EAAE,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,SAAiB;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACH,UAAU,CAAC,SAAiB,EAAE,MAAc,EAAE,IAAY;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;gBAC7B,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,IAAI,EAAE,CAAC;YACT,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAChB,SAAiB,EACjB,IAAY,EACZ,aAAsB;QAEtB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU;YAAE,OAAO;QAExB,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;YACzC,IAAI,MAAM,KAAK,aAAa;gBAAE,SAAS;YACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;oBAC7B,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,4BAA4B,CAC1B,SAAiB,EACjB,IAAY,EACZ,QAAqC;QAErC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU;YAAE,OAAO;QAExB,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;YACzC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,SAAS;YAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;oBAC7B,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,SAAiB,EAAE,MAAc;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QAC9B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IACjD,CAAC;IAED;;;OAGG;IACH,sBAAsB;QACpB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC;QAC3B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,IAAY,EAAE,MAAc;QACnC,+BAA+B;QAC/B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QAEzB,wBAAwB;QACxB,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;gBACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;oBACtC,IAAI,CAAC;wBACH,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBAC9B,CAAC;oBAAC,MAAM,CAAC;wBACP,4DAA4D;oBAC9D,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CAAC,SAAiB,EAAE,MAAc;QACxD,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC;QAE1C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,CAAC,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAExB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;CACF"}
+{"version":3,"file":"connection-manager.js","sourceRoot":"","sources":["../../src/services/connection-manager.ts"],"names":[],"mappings":"AAsBA;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IAC5B;;;OAGG;IACc,WAAW,GAAG,IAAI,GAAG,EAGnC,CAAC;IAEJ;;;;OAIG;IACc,WAAW,GAAG,IAAI,GAAG,EAGnC,CAAC;IAEJ,iFAAiF;IAChE,cAAc,CAAS;IAExC,uEAAuE;IAC/D,aAAa,CAA+C;IAEpE,YAAY,iBAAyB,MAAM;QACzC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,gBAAgB,CACd,QAAqD;QAErD,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,IAAoB;QAChC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAEnC,yDAAyD;QACzD,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC;QAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,YAAY,CAAC,aAAa,CAAC,CAAC;YAC5B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;QAED,gCAAgC;QAChC,IAAI,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,UAAU,GAAG,IAAI,GAAG,EAA4B,CAAC;YACjD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC9C,CAAC;QAED,oDAAoD;QACpD,IAAI,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS,GAAG,EAAE,CAAC;YACf,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACpC,CAAC;QAED,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,gBAAgB,CACd,SAAiB,EACjB,MAAc,EACd,EAAa;QAEb,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU;YAAE,OAAO;QAExB,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,0DAA0D;QAC1D,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO;QAEvB,mDAAmD;QACnD,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAChD,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAEzB,+CAA+C;QAC/C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAE1B,6BAA6B;YAC7B,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACrC,CAAC;YAED,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,cAAc,CAAC,SAAiB,EAAE,MAAc;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,CAAC;QAC3B,OAAO,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,wBAAwB,CAAC,SAAiB;QACxC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,CAAC;QAE3B,MAAM,MAAM,GAAqB,EAAE,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,uBAAuB,CAAC,SAAiB,EAAE,IAAY,EAAE,MAAc;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBACtC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC5B,MAAM,EAAE,CAAC;YACX,CAAC;YAAC,MAAM,CAAC;gBACP,6CAA6C;YAC/C,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,mBAAmB,CAAC,SAAiB;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACH,UAAU,CAAC,SAAiB,EAAE,MAAc,EAAE,IAAY;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;gBAC7B,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,IAAI,EAAE,CAAC;YACT,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAChB,SAAiB,EACjB,IAAY,EACZ,aAAsB;QAEtB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU;YAAE,OAAO;QAExB,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;YACzC,IAAI,MAAM,KAAK,aAAa;gBAAE,SAAS;YACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;oBAC7B,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,4BAA4B,CAC1B,SAAiB,EACjB,IAAY,EACZ,QAAqC;QAErC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU;YAAE,OAAO;QAExB,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;YACzC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,SAAS;YAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;oBAC7B,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,SAAiB,EAAE,MAAc;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QAC9B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IACjD,CAAC;IAED;;;OAGG;IACH,sBAAsB;QACpB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC;QAC3B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,IAAY,EAAE,MAAc;QACnC,+BAA+B;QAC/B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QAEzB,wBAAwB;QACxB,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;gBACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,aAAa,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;oBACtC,IAAI,CAAC;wBACH,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBAC9B,CAAC;oBAAC,MAAM,CAAC;wBACP,4DAA4D;oBAC9D,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CAAC,SAAiB,EAAE,MAAc;QACxD,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC;QAE1C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,CAAC,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QAExB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;CACF"}

package/dist/services/join-rate-limiter.d.ts

@@ -0,0 +1,50 @@
+/**
+ * In-memory, two-tier rate limiter for session-join attempts.
+ *
+ * Tier 1 (per source+channel, `${ip}::${sessionId}`): a low threshold for good
+ * UX — a single brute-forcing client trips it quickly.
+ *
+ * Tier 2 (per channel, `channel::${sessionId}`): a higher threshold that is the
+ * SECURITY backstop. The channel id comes from the URL path and cannot be
+ * spoofed, so it holds even when an attacker rotates `X-Forwarded-For` /
+ * `X-Real-IP` to evade tier 1. `check()` blocks if EITHER tier is locked.
+ *
+ * Single-node MVP: state is process-local. Multi-node (vNext) moves this to a
+ * shared store (Postgres / Redis), at which point tier 1 can key on the
+ * trusted-proxy-validated real client IP. The clock is injectable for tests.
+ *
+ * Tradeoff (accepted): tier 2 means an attacker who knows a sessionId can lock
+ * NEW joins on that channel for `lockoutMs` with `channelMaxFailures` bad
+ * attempts. Already-joined agents keep their bearer tokens (join issues, does
+ * not gate, existing sessions). The higher tier-2 threshold keeps this from
+ * tripping on the rare legitimate failure; per-org quotas (E5) bound it further.
+ */
+export declare class JoinRateLimiter {
+    private readonly perSourceMax;
+    private readonly channelMax;
+    private readonly windowMs;
+    private readonly lockoutMs;
+    private readonly now;
+    private readonly attempts;
+    constructor(perSourceMax: number, channelMax: number, windowMs: number, lockoutMs: number, now?: () => number);
+    /** Tier-1 key: source IP + channel (best-effort; IP may be spoofable). */
+    static sourceKey(ip: string, sessionId: string): string;
+    /** Tier-2 key: channel only (non-spoofable; the security backstop). */
+    static channelKey(sessionId: string): string;
+    /**
+     * Throw RATE_LIMITED if EITHER the source tier or the channel tier is locked.
+     * Call BEFORE verifying credentials.
+     */
+    check(sourceKey: string, channelKey: string): void;
+    /** Record a failed attempt against both tiers. */
+    recordFailure(sourceKey: string, channelKey: string): void;
+    /**
+     * Clear the SOURCE tier after a successful join. The channel tier is left to
+     * decay with its window — a single success must not reset a channel-wide
+     * brute-force counter.
+     */
+    recordSuccess(sourceKey: string): void;
+    /** Increment a key's failure count within its window; lock past `threshold`. */
+    private _fail;
+}
+//# sourceMappingURL=join-rate-limiter.d.ts.map

package/dist/services/join-rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"join-rate-limiter.d.ts","sourceRoot":"","sources":["../../src/services/join-rate-limiter.ts"],"names":[],"mappings":"AAYA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;gBAG3D,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAM,MAAyB;IAStC,0EAA0E;IAC1E,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAIvD,uEAAuE;IACvE,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAI5C;;;OAGG;IACH,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAiBlD,kDAAkD;IAClD,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAK1D;;;;OAIG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAItC,gFAAgF;IAChF,OAAO,CAAC,KAAK;CAed"}