@foldrun/core 8.0.1 → 9.1.0

package/dist/src/secrets.js

@@ -106,11 +106,43 @@ function secretsFile(tenant, workspace) {
 // every rename a re-seal racing other writers. What that leaves open — a
 // ciphertext moved between two workspaces of the same account by someone who
 // can already write the volume — is the residual, and stays inside one account.
+//
+// Rolling out (30 Oct 2026, accepted, no switch): a pod from before this
+// release cannot open a limited record (its AAD lacks the list), and one that
+// sets a new value over it writes the record back without the list — open to
+// every workspace again. So limits are set after every pod, worker and the
+// egress proxy run this version; the secrets docs say so.
+//
+// The workspaces an account secret is limited to are in the seal too (30 Oct
+// 2026), appended only when the record has the list: every record sealed
+// before keeps the AAD it was sealed with, and a list added to, widened in or
+// stripped from a sealed record on disk makes it fail to open — "not set",
+// never "every workspace". These ARE workspace names, so a rename re-seals
+// them (retargetSecretWorkspaces), under the vault lock.
 function vaultAad(tenant, workspace, name, rec) {
     if (rec.sites !== undefined && (!Array.isArray(rec.sites) || rec.sites.some((x) => typeof x !== "string"))) {
         throw new Error("malformed sites");
     }
-    return Buffer.from(JSON.stringify(["foldrun-vault/2", tenant, workspace ? "w" : "a", name, rec.kind ?? "", rec.k ?? "install", [...(rec.sites ?? [])].sort()]), "utf8");
+    if (rec.workspaces !== undefined && (!Array.isArray(rec.workspaces) || rec.workspaces.some((x) => typeof x !== "string"))) {
+        throw new Error("malformed workspaces");
+    }
+    return Buffer.from(JSON.stringify([
+        "foldrun-vault/2",
+        tenant,
+        workspace ? "w" : "a",
+        name,
+        rec.kind ?? "",
+        rec.k ?? "install",
+        [...(rec.sites ?? [])].sort(),
+        ...(rec.workspaces !== undefined ? [["workspaces", [...rec.workspaces].sort()]] : []),
+    ]), "utf8");
+}
+/** May an account record be used in this workspace? No list: everywhere. A
+ *  list that is not a list of names (rewritten on disk) allows nowhere. */
+function usableIn(rec, workspace) {
+    if (!rec || rec.workspaces === undefined)
+        return true;
+    return Array.isArray(rec.workspaces) && rec.workspaces.includes(workspace);
 }
 const writeBound = () => process.env.FOLDRUN_VAULT_WRITE_BOUND === "1";
 const requireBound = () => process.env.FOLDRUN_VAULT_REQUIRE_BOUND === "1";
@@ -126,6 +158,8 @@ function sealRecord(tenant, workspace, name, value, meta, bound = writeBound())
         ...(meta.kind ? { kind: meta.kind } : {}),
         ...(mark ? { k: mark } : {}),
         ...(meta.sites?.length ? { sites: [...meta.sites] } : {}),
+        // An empty list is a choice (no workspace may use it), kept as written.
+        ...(meta.workspaces !== undefined ? { workspaces: [...meta.workspaces] } : {}),
     };
     const iv = crypto.randomBytes(12);
     const cipher = crypto.createCipheriv("aes-256-gcm", key, iv, GCM);
@@ -237,30 +271,84 @@ export function mutateVaultFile(file, change) {
     }
 }
 export const SECRET_NAME = /^[A-Z][A-Z0-9_]{1,63}$/;
-export function setSecret(tenant, name, value, workspace, kind) {
-    if (!SECRET_NAME.test(name)) {
+/**
+ * How a `signing_secret:` is shown in an answer, a log line or a delivery
+ * record: the name it holds, and only a name (30 Oct 2026). It is meant to
+ * name a vault entry, but nothing stopped the value itself being written
+ * there, and notify's test send echoed it back to the dashboard as "signed
+ * with <it>". Anything that is not a secret name is described, never
+ * repeated (foldrun check flags it as secret/signing-secret-value).
+ */
+export function signingSecretShown(name) {
+    return SECRET_NAME.test(name) ? name : "the signing_secret: (not a secret name — see foldrun check)";
+}
+/** A list as stored: trimmed, de-duplicated, sorted; every name a safe one
+ *  and, when the caller can say, one that exists. */
+function cleanWorkspaceList(workspaces) {
+    if (workspaces === null)
+        return null;
+    if (!Array.isArray(workspaces) || workspaces.some((w) => typeof w !== "string")) {
+        throw new Error("workspaces is a list of workspace names, or null for every workspace");
+    }
+    const clean = [...new Set(workspaces.map((w) => w.trim()).filter(Boolean))].sort();
+    for (const w of clean)
+        assertSafeName(w, "workspace");
+    return clean;
+}
+function assertWorkspacesExist(list, exists) {
+    if (!list || !exists)
+        return;
+    const missing = list.filter((w) => !exists(w));
+    if (missing.length)
+        throw Object.assign(new Error(`no workspace ${missing.join(", ")} in this account`), { status: 400 });
+}
+export function setSecret(tenant, name, value, workspace, kind, limit = {}) {
+    // A string, not anything that prints as one: RegExp.test and the vault's
+    // keys both coerce, so ["RESEND_API_KEY"] from a JSON body was stored as
+    // RESEND_API_KEY past a caller's check on the name (30 Oct 2026).
+    if (typeof name !== "string" || !SECRET_NAME.test(name)) {
         throw new Error(`secret name "${name}" must be UPPER_SNAKE_CASE`);
     }
     if (value.length > 8192)
         throw new Error("secret too long");
+    const wanted = limitFor(workspace, limit);
     mutateVaultFile(secretsFile(tenant, workspace), (all) => {
         // A new value keeps the sites the old one was bound to: binding is a
         // property of the credential's use, not of its current value, and a
         // rotation that silently unbound it would put the new value in pods.
         // Sealed here, under the lock: a bound record's AAD names those sites.
         const sites = all[name]?.sites;
+        // The workspaces it is limited to stay too, for the same reason: a new
+        // value that every workspace could suddenly read is a widening nobody
+        // asked for — unless this call says otherwise, in the same write.
+        if (wanted !== undefined)
+            assertWorkspacesExist(wanted, limit.exists);
+        const workspaces = wanted !== undefined ? (wanted ?? undefined) : all[name]?.workspaces;
         // Once bound, always bound: a re-save with the switch off must not
-        // quietly drop the record's authentication.
-        all[name] = sealRecord(tenant, workspace, name, value, { kind, sites }, all[name]?.v === 2 || writeBound());
+        // quietly drop the record's authentication. A limited record is always
+        // bound, so its list is in its seal (see setSecretWorkspaces).
+        all[name] = sealRecord(tenant, workspace, name, value, { kind, sites, workspaces }, all[name]?.v === 2 || workspaces !== undefined || writeBound());
         return all;
     });
 }
+/** The list a write was asked to store, checked: undefined when it was not
+ *  asked to change it. Only the account's store has lists. */
+function limitFor(workspace, limit) {
+    if (limit.workspaces === undefined)
+        return undefined;
+    if (workspace)
+        throw new Error("a workspace's own secret is that workspace's already — only an account secret is limited to workspaces");
+    return cleanWorkspaceList(limit.workspaces);
+}
 /**
  * Bind a secret to sites, or unbind it (an empty list). The secret must
  * exist in that scope. Sites are `api.example.com` or `*.example.com` — no
  * scheme, path or port. Returns the list as stored.
  */
 export function setSecretSites(tenant, name, sites, workspace) {
+    // all[name] would find ["NAME"] as NAME: see setSecret.
+    if (typeof name !== "string")
+        throw new Error("a secret's name is a string");
     const clean = [...new Set(sites.map((x) => x.trim().toLowerCase()).filter(Boolean))];
     for (const site of clean) {
         if (!SITE.test(site))
@@ -290,7 +378,7 @@ export function setSecretSites(tenant, name, sites, workspace) {
             const value = openRecord(tenant, workspace, name, rec);
             if (value === null)
                 throw new Error(`${name} cannot be read with this install's keys — set its value again before binding it`);
-            all[name] = sealRecord(tenant, workspace, name, value, { kind: rec.kind, sites: clean, updatedAt: rec.updatedAt }, true);
+            all[name] = sealRecord(tenant, workspace, name, value, { kind: rec.kind, sites: clean, workspaces: rec.workspaces, updatedAt: rec.updatedAt }, true);
             return all;
         }
         if (clean.length)
@@ -317,7 +405,11 @@ export function secretSites(tenant, names, workspace) {
         // when it opens, else the account's. Picking by presence paired an
         // account value with a workspace record's (unauthenticated) sites.
         const ownRec = own[name];
-        const rec = ownRec && openRecord(tenant, workspace, name, ownRec) !== null ? ownRec : account[name];
+        const ownOpens = Boolean(ownRec && openRecord(tenant, workspace, name, ownRec) !== null);
+        // An account record limited to other workspaces is not this one's.
+        if (!ownOpens && workspace && !usableIn(account[name], workspace))
+            continue;
+        const rec = ownOpens ? ownRec : account[name];
         if (rec?.sites?.length)
             out[name] = [...rec.sites];
     }
@@ -392,16 +484,141 @@ function decrypt(tenant, rec, aad) {
         return null; // key rotated or file tampered with
     }
 }
-/** Nearest wins: a workspace secret shadows an account one of the same name. */
+/** Nearest wins: a workspace secret shadows an account one of the same name.
+ *  An account secret limited to some workspaces (setSecretWorkspaces) is
+ *  absent for every other — the answer a secret that was never set gets, on
+ *  every path that resolves one for a workspace: runs, tool tests, notify,
+ *  the egress proxy, MCP servers. Without a workspace it is the account's
+ *  own use (its model key, its mail sender), which no list limits. */
 export function getSecret(tenant, name, workspace) {
     if (workspace) {
         const own = openRecord(tenant, workspace, name, read(tenant, workspace)[name]);
         if (own !== null)
             return { value: own, scope: "workspace" };
     }
-    const shared = openRecord(tenant, undefined, name, read(tenant)[name]);
+    const rec = read(tenant)[name];
+    if (workspace && !usableIn(rec, workspace))
+        return null;
+    const shared = openRecord(tenant, undefined, name, rec);
     return shared === null ? null : { value: shared, scope: "account" };
 }
+/** May the ACCOUNT's secret `name` be used for this workspace? True when it
+ *  is not limited (or not set); for callers that read the account's copy on
+ *  a workspace's behalf without getSecret's workspace-first lookup — the
+ *  account's mail sender for a workspace's notifications (notify.ts). */
+export function accountSecretUsableIn(tenant, name, workspace) {
+    return usableIn(read(tenant)[name], workspace);
+}
+/**
+ * Limit an account secret to some workspaces, or lift the limit (null).
+ * An empty list means no workspace may use it. Returns the list as stored,
+ * sorted, or null.
+ *
+ * `exists` is asked about each name under the vault lock (the API passes
+ * "is there such a workspace"), so it cannot grant a name a delete has just
+ * taken off every list. `ifWorkspaces`, when given, is the list the caller
+ * saw (null: every workspace): a list changed since is refused (409), so
+ * two admins editing it at once do not silently overwrite each other.
+ *
+ * The record is sealed (v2) whatever it was, whatever
+ * FOLDRUN_VAULT_WRITE_BOUND says: a list in the clear on an unbound record
+ * could be stripped on disk to open the secret to every workspace; sealed,
+ * a stripped list makes it unreadable. Every reader since 29 Oct 2026 reads v2.
+ */
+export function setSecretWorkspaces(tenant, name, workspaces, opts = {}) {
+    if (typeof name !== "string")
+        throw new Error("a secret's name is a string");
+    const clean = cleanWorkspaceList(workspaces);
+    const expected = opts.ifWorkspaces === undefined ? undefined : cleanWorkspaceList(opts.ifWorkspaces);
+    let found = false;
+    mutateVaultFile(secretsFile(tenant), (all) => {
+        const rec = all[name];
+        if (!rec)
+            return null;
+        found = true;
+        if (expected !== undefined) {
+            const now = Array.isArray(rec.workspaces) ? [...rec.workspaces].sort() : null;
+            if (JSON.stringify(now) !== JSON.stringify(expected)) {
+                throw Object.assign(new Error(`${name}'s workspaces changed since you loaded them (now ${now === null ? "every workspace" : now.length ? now.join(", ") : "none"}) — reload and try again`), { status: 409 });
+            }
+        }
+        assertWorkspacesExist(clean, opts.exists);
+        all[name] = withWorkspaces(tenant, name, rec, clean);
+        return all;
+    });
+    if (!found)
+        throw Object.assign(new Error(`no secret ${name} in the account`), { status: 404 });
+    return clean;
+}
+/** An account record with its workspace list replaced (null: removed),
+ *  opened and sealed again as a bound record with the new list in its seal.
+ *  One that will not open is refused, never relabelled (setSecretSites). */
+function withWorkspaces(tenant, name, rec, workspaces) {
+    const value = openRecord(tenant, undefined, name, rec);
+    if (value === null)
+        throw new Error(`${name} cannot be read with this install's keys — set its value again before changing its workspaces`);
+    return sealRecord(tenant, undefined, name, value, { kind: rec.kind, sites: rec.sites, workspaces: workspaces ?? undefined, updatedAt: rec.updatedAt }, true);
+}
+/**
+ * A workspace is being renamed (to: its new name) or deleted (to: null):
+ * every account secret limited to it follows. Without this a rename quietly
+ * cut the workspace off its secrets, and a delete left the name on the list
+ * for the next workspace given it.
+ *
+ * `failed` names the records that hold the name but will not open with this
+ * install's keys: they are left exactly as they are, so the old name is
+ * STILL on their list — a key restored later would bring the grant back.
+ * The caller must not report the rename or delete as clean while any are
+ * left (the API refuses it, naming them: set them again, or delete them).
+ *
+ * Names, not ids: a grant naming a workspace's immutable id would survive a
+ * rename untouched and could never pass to a new workspace given an old
+ * name — the stronger design, not built yet (30 Oct 2026).
+ */
+export function retargetSecretWorkspaces(tenant, from, to) {
+    const changed = [];
+    const failed = [];
+    const file = secretsFile(tenant);
+    if (!fs.existsSync(file))
+        return { changed, failed };
+    mutateVaultFile(file, (all) => {
+        changed.length = 0;
+        failed.length = 0;
+        const staged = {};
+        for (const [name, rec] of Object.entries(all)) {
+            const list = rec.workspaces;
+            if (list === undefined)
+                continue;
+            if (!Array.isArray(list)) {
+                // A list rewritten on disk into something else allows nowhere
+                // (usableIn) — nothing for this rename to carry.
+                continue;
+            }
+            if (!list.includes(from))
+                continue;
+            const next = [...new Set(list.map((w) => (w === from ? to : w)).filter((w) => typeof w === "string"))].sort();
+            try {
+                staged[name] = withWorkspaces(tenant, name, rec, next);
+                changed.push(name);
+            }
+            catch {
+                failed.push(name);
+            }
+        }
+        // All or nothing (Codex, 30 Oct 2026): writing the readable records and
+        // refusing the rename for the unreadable ones moved grants to a name the
+        // workspace never took. One failure leaves the vault exactly as it was.
+        if (failed.length) {
+            changed.length = 0;
+            return null;
+        }
+        if (!changed.length)
+            return null;
+        Object.assign(all, staged);
+        return all;
+    });
+    return { changed, failed };
+}
 export function deleteSecret(tenant, name, workspace) {
     mutateVaultFile(secretsFile(tenant, workspace), (all) => {
         if (!(name in all))
@@ -414,12 +631,18 @@ export function deleteSecret(tenant, name, workspace) {
 // store; with one it lists what that workspace actually resolves, marking
 // which scope each name comes from.
 export function listSecrets(tenant, workspace) {
-    const account = Object.entries(read(tenant)).map(([name, rec]) => ({
+    const records = Object.entries(read(tenant));
+    const account = records
+        // What a workspace resolves leaves out an account secret limited to
+        // others: it is not set, as far as that workspace is concerned.
+        .filter(([, rec]) => !workspace || usableIn(rec, workspace))
+        .map(([name, rec]) => ({
         name,
         updatedAt: rec.updatedAt,
         scope: "account",
         ...(rec.kind ? { kind: rec.kind } : {}),
         ...(rec.sites?.length ? { sites: [...rec.sites] } : {}),
+        ...(!workspace && Array.isArray(rec.workspaces) ? { workspaces: [...rec.workspaces] } : {}),
     }));
     if (!workspace)
         return account.sort((a, b) => a.name.localeCompare(b.name));
@@ -553,6 +776,9 @@ export function rotateMasterKey(tenant, from, to) {
                     // Kept too (it was dropped until 29 Oct 2026): a rotation that
                     // unbinds every bound secret puts their values into pods.
                     ...(rec.sites?.length ? { sites: rec.sites } : {}),
+                    // And the workspaces it is limited to: dropped, it would read as
+                    // "every workspace" (and fail its seal).
+                    ...(rec.workspaces !== undefined ? { workspaces: rec.workspaces } : {}),
                     ...(aad ? { v: 2 } : {}),
                 };
                 count++;
@@ -572,7 +798,7 @@ export function oauthRetryDelayMs(n) {
     const base = Number(process.env.FOLDRUN_OAUTH_RETRY_MS ?? 1000);
     return base * (n === 1 ? 1 : 3);
 }
-export function setOAuth2Secret(tenant, name, config, workspace) {
+export function setOAuth2Secret(tenant, name, config, workspace, limit = {}) {
     for (const field of ["token_url", "client_id"]) {
         if (!config[field]?.trim())
             throw new Error(`oauth2 secret needs ${field}`);
@@ -590,7 +816,7 @@ export function setOAuth2Secret(tenant, name, config, workspace) {
     if (!/^https:\/\//.test(config.token_url) && !/^http:\/\/(127\.0\.0\.1|localhost)[:/]/.test(config.token_url)) {
         throw new Error("token_url must be https — a refresh token over http is a leaked one");
     }
-    setSecret(tenant, name, OAUTH2_PREFIX + JSON.stringify(config), workspace, "oauth2");
+    setSecret(tenant, name, OAUTH2_PREFIX + JSON.stringify(config), workspace, "oauth2", limit);
 }
 export function isOAuth2Value(value) {
     return value.startsWith(OAUTH2_PREFIX);
@@ -632,7 +858,7 @@ export function replaceOAuth2RefreshToken(tenant, name, workspace, usedValue, re
                 // Built whole, not spread over the old record: a spread kept a stale
                 // `k: "tenant"` when this seal fell back to the install key, and the
                 // record then opened with neither.
-                all[name] = sealRecord(tenant, scope, name, next, { kind: rec.kind, sites: rec.sites }, rec.v === 2 || writeBound());
+                all[name] = sealRecord(tenant, scope, name, next, { kind: rec.kind, sites: rec.sites, workspaces: rec.workspaces }, rec.v === 2 || writeBound());
                 replaced = true;
             }
             return all;
@@ -802,7 +1028,7 @@ ctx) {
 // Stored as the JSON key, encrypted. Materialised the same way oauth2 is: a
 // live access token appears at the last host-side moment, cached until expiry.
 const SERVICE_ACCOUNT_PREFIX = "@service-account ";
-export function setServiceAccountSecret(tenant, name, config, workspace) {
+export function setServiceAccountSecret(tenant, name, config, workspace, limit = {}) {
     for (const field of ["token_url", "issuer", "private_key", "scope"]) {
         if (!config[field]?.trim())
             throw new Error(`service account secret needs ${field}`);
@@ -817,7 +1043,7 @@ export function setServiceAccountSecret(tenant, name, config, workspace) {
             throw new Error("subject is one identifier, no spaces or control characters");
     }
     const stored = { ...config, ...(config.subject !== undefined ? { subject: config.subject.trim() } : {}) };
-    setSecret(tenant, name, SERVICE_ACCOUNT_PREFIX + JSON.stringify(stored), workspace, "service-account");
+    setSecret(tenant, name, SERVICE_ACCOUNT_PREFIX + JSON.stringify(stored), workspace, "service-account", limit);
 }
 function base64url(input) {
     return Buffer.from(input).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
@@ -880,10 +1106,10 @@ async function exchangeServiceAccount(config, cacheKey) {
 // the only place that knows where a run's writable scratch is; here we only
 // mark the kind and carry the content.
 const FILE_PREFIX = "@file ";
-export function setFileSecret(tenant, name, content, workspace) {
+export function setFileSecret(tenant, name, content, workspace, limit = {}) {
     if (!content)
         throw new Error("a file secret needs content");
-    setSecret(tenant, name, FILE_PREFIX + content, workspace, "file");
+    setSecret(tenant, name, FILE_PREFIX + content, workspace, "file", limit);
 }
 export function isFileValue(value) {
     return value.startsWith(FILE_PREFIX);
@@ -899,7 +1125,7 @@ export function fileContent(value) {
 // config into an executable wrapper, so the agent runs `"$NAME" 'uptime'`
 // and never learns which auth flavour it is.
 const SSH_PREFIX = "@ssh ";
-export function setSshSecret(tenant, name, config, workspace) {
+export function setSshSecret(tenant, name, config, workspace, limit = {}) {
     const host = config.host?.trim();
     const user = config.user?.trim();
     if (!host || /[\s'"`$\\]/.test(host))
@@ -922,7 +1148,7 @@ export function setSshSecret(tenant, name, config, workspace) {
         host, user, port,
         ...(hasKey ? { private_key: config.private_key } : { password: config.password }),
     };
-    setSecret(tenant, name, SSH_PREFIX + JSON.stringify(stored), workspace, "ssh");
+    setSecret(tenant, name, SSH_PREFIX + JSON.stringify(stored), workspace, "ssh", limit);
 }
 export function isSshValue(value) {
     return value.startsWith(SSH_PREFIX);
@@ -938,7 +1164,7 @@ export function sshConfigOf(value) {
 // never appears in the bash command at all.
 const API_PREFIX = "@api ";
 const CLIENT_CERT_PREFIX = "@client-cert ";
-export function setClientCertSecret(tenant, name, config, workspace) {
+export function setClientCertSecret(tenant, name, config, workspace, limit = {}) {
     if (!/-----BEGIN CERTIFICATE-----/.test(config.cert ?? ""))
         throw new Error("cert must be a PEM certificate");
     if (!/-----BEGIN [A-Z ]{0,40}PRIVATE KEY-----/.test(config.key ?? ""))
@@ -961,29 +1187,33 @@ export function setClientCertSecret(tenant, name, config, workspace) {
         ...(config.passphrase ? { passphrase: config.passphrase } : {}),
         ...(config.export ? { export: true } : {}),
     };
-    if (!SECRET_NAME.test(name))
+    if (typeof name !== "string" || !SECRET_NAME.test(name))
         throw new Error(`secret name "${name}" must be UPPER_SNAKE_CASE`);
     const plainCert = CLIENT_CERT_PREFIX + JSON.stringify(stored);
     // Written under the vault's own lock, with the binding checked in the same
     // step: a value set over a secret keeps its site binding, and a wildcard
     // one would present the certificate to a whole domain.
+    const wanted = limitFor(workspace, limit);
     mutateVaultFile(secretsFile(tenant, workspace), (all) => {
         const sites = all[name]?.sites;
+        if (wanted !== undefined)
+            assertWorkspacesExist(wanted, limit.exists);
+        const workspaces = wanted !== undefined ? (wanted ?? undefined) : all[name]?.workspaces;
         if (sites?.some((site) => site.startsWith("*."))) {
             throw new Error(`${name} is bound to ${sites.join(", ")} — a client certificate is bound to exact hosts; unbind the wildcard first`);
         }
-        all[name] = sealRecord(tenant, workspace, name, plainCert, { kind: "client-cert", sites }, all[name]?.v === 2 || writeBound());
+        all[name] = sealRecord(tenant, workspace, name, plainCert, { kind: "client-cert", sites, workspaces }, all[name]?.v === 2 || workspaces !== undefined || writeBound());
         return all;
     });
 }
 const IDENTITY_PREFIX = "@identity ";
-export function setIdentitySecret(tenant, name, config, workspace) {
+export function setIdentitySecret(tenant, name, config, workspace, limit = {}) {
     const audience = typeof config.audience === "string" ? config.audience.trim() : "";
     if (!audience)
         throw new Error("an identity needs an audience — the value your cloud's trust expects in aud");
     if (audience.length > 600 || /[\u0000-\u001f\u007f]/.test(audience))
         throw new Error("audience is one value, at most 600 characters, no control characters");
-    setSecret(tenant, name, IDENTITY_PREFIX + JSON.stringify({ audience }), workspace, "identity");
+    setSecret(tenant, name, IDENTITY_PREFIX + JSON.stringify({ audience }), workspace, "identity", limit);
 }
 export function isIdentityValue(value) {
     return value.startsWith(IDENTITY_PREFIX);
@@ -1015,7 +1245,7 @@ export function basicAuthorization(username, password) {
         throw new Error("Basic credentials cannot contain control characters");
     return `Basic ${Buffer.from(`${username}:${password}`, "utf8").toString("base64")}`;
 }
-export function setApiSecret(tenant, name, config, workspace) {
+export function setApiSecret(tenant, name, config, workspace, limit = {}) {
     let all = { ...(config.headers ?? {}) };
     if (config.basic) {
         if (Object.keys(all).some((h) => h.toLowerCase() === "authorization")) {
@@ -1050,7 +1280,7 @@ export function setApiSecret(tenant, name, config, workspace) {
     const base = config.base_url?.trim();
     if (base && !/^https?:\/\//.test(base))
         throw new Error("base_url must be http(s)");
-    setSecret(tenant, name, API_PREFIX + JSON.stringify({ ...(base ? { base_url: trimSlashes(base) } : {}), headers: config.headers }), workspace, "api");
+    setSecret(tenant, name, API_PREFIX + JSON.stringify({ ...(base ? { base_url: trimSlashes(base) } : {}), headers: config.headers }), workspace, "api", limit);
 }
 export function isApiValue(value) {
     return value.startsWith(API_PREFIX);
@@ -1088,7 +1318,7 @@ export function sealVaultBindings(tenant) {
             const next = { ...all };
             for (const [name, value] of plain) {
                 const rec = all[name];
-                next[name] = sealRecord(tenant, workspace, name, value, { kind: rec.kind, sites: rec.sites, updatedAt: rec.updatedAt }, true);
+                next[name] = sealRecord(tenant, workspace, name, value, { kind: rec.kind, sites: rec.sites, workspaces: rec.workspaces, updatedAt: rec.updatedAt }, true);
             }
             sealed += plain.size;
             return next;
@@ -1136,7 +1366,7 @@ export function rewrapTenantSecrets(tenant) {
                 return null;
             const next = { ...all };
             for (const [name, value] of plain) {
-                next[name] = sealRecord(tenant, workspace, name, value, { kind: all[name].kind, sites: all[name].sites, updatedAt: all[name].updatedAt }, all[name].v === 2 || writeBound());
+                next[name] = sealRecord(tenant, workspace, name, value, { kind: all[name].kind, sites: all[name].sites, workspaces: all[name].workspaces, updatedAt: all[name].updatedAt }, all[name].v === 2 || writeBound());
             }
             moved += plain.size;
             return next;

package/dist/src/storage.d.ts

@@ -22,6 +22,15 @@ interface Index {
     version: 1;
     files: FileRecord[];
 }
+/**
+ * Refuse a workspace that is not there, as a 404 (30 Oct 2026).
+ *
+ * The store is keyed by workspace *name* and used to be created for any safe
+ * name on first write, so an editor got a fresh quota for every name they
+ * invented — stores no workspace list shows and no delete reaches. Every
+ * write here, and the routes that read, ask this first.
+ */
+export declare function requireWorkspace(tenant: string, workspace: string): void;
 /**
  * Hosted only. On a laptop `storage/` is just a folder in the user's own
  * project — they can see it, open it, and put a PDF in it with Finder — and
@@ -57,6 +66,18 @@ export interface Driver {
     put(key: string, body: Buffer, mime: string): Promise<void>;
     get(key: string): Promise<Buffer>;
     has(key: string): Promise<boolean>;
+    /** The object's real length, or null when there is none — what the store
+     *  holds, never what a browser said it sent (30 Oct 2026). */
+    size(key: string): Promise<number | null>;
+    /** The bytes as a stream, optionally one inclusive byte range — so a route
+     *  hands a file on without holding all of it in memory. */
+    open(key: string, range?: {
+        start: number;
+        end: number;
+    }): Promise<ReadableStream<Uint8Array>>;
+    /** Server-side copy to another key (s3 only — the fs driver's blobs move
+     *  with their directory). Used when a workspace is renamed. */
+    copy?(from: string, to: string): Promise<void>;
     remove(key: string): Promise<void>;
     /** A URL a browser can GET directly, or null when the driver has no such
      *  thing (fs) and the route must stream the bytes itself. */
@@ -65,7 +86,9 @@ export interface Driver {
     presignGet(key: string, filename: string, mime: string, ttlSec?: number, inlineType?: string): Promise<string | null>;
     /** A URL a browser can PUT directly to, so upload bytes never transit the
      *  dashboard process. Null on fs, where the route takes the body. */
-    presignPut(key: string, mime: string, ttlSec?: number): Promise<string | null>;
+    /** `size`: sign the length in, so the store refuses a PUT of any other
+     *  length (30 Oct 2026) — the per-file limit then holds at the bucket. */
+    presignPut(key: string, mime: string, ttlSec?: number, size?: number): Promise<string | null>;
 }
 /** Where the fs driver keeps a blob. Exported because the run mirror
  *  hardlinks straight to it rather than reading and rewriting the bytes. */
@@ -101,9 +124,33 @@ export declare function contentDisposition(type: "inline" | "attachment", filena
 export declare function driverFor(tenant: string, workspace: string): Driver;
 export declare function putFile(tenant: string, workspace: string, rel: string, body: Buffer, by: string): Promise<FileRecord>;
 /** Register bytes a browser PUT straight to the bucket. Same bookkeeping as
- *  putFile, minus the bytes — the platform never saw them. */
-export declare function registerUpload(tenant: string, workspace: string, rel: string, sha: string, size: number, by: string): Promise<FileRecord>;
+ *  putFile, minus the bytes — the platform never saw them.
+ *
+ *  `_claimed` is the size the browser says it sent, kept for the callers that
+ *  pass it and never believed (30 Oct 2026): the record, the per-file limit
+ *  and the quota all use the length the store reports. It used to store the
+ *  claim, so an object registered as 0 bytes (or -1e12) sat outside every
+ *  limit and lowered the quota line for everything after it. */
+export declare function registerUpload(tenant: string, workspace: string, rel: string, sha: string, _claimed: number, by: string): Promise<FileRecord>;
 export declare function readFileBytes(tenant: string, workspace: string, rel: string): Promise<Buffer | null>;
+/** A stored file's real length, from the store — a stat or a HEAD, never a
+ *  read. Null when there is no such record or no object behind it. */
+export declare function storedSize(tenant: string, workspace: string, rel: string): Promise<number | null>;
+/**
+ * A stored file as a stream, with its real length — for a route that passes
+ * the bytes on (a download, a public link) rather than reading them whole
+ * into memory. Null when there is no such record or no object behind it.
+ * `range` is inclusive and must lie inside the file (storedSize first, then
+ * byteRange, when the caller honours a Range header).
+ */
+export declare function openFile(tenant: string, workspace: string, rel: string, range?: {
+    start: number;
+    end: number;
+} | null): Promise<{
+    record: FileRecord;
+    size: number;
+    body: ReadableStream<Uint8Array>;
+} | null>;
 export declare function deleteFile(tenant: string, workspace: string, rel: string): Promise<boolean>;
 /** A link the browser can follow, or null when the route must stream it. */
 export declare function downloadUrl(tenant: string, workspace: string, record: FileRecord, opts?: {
@@ -111,7 +158,32 @@ export declare function downloadUrl(tenant: string, workspace: string, record: F
 }): Promise<string | null>;
 export declare function previewType(rel: string): string | null;
 /** A link the browser can PUT to, plus the key it will land at. Null on fs. */
-export declare function uploadUrl(tenant: string, workspace: string, rel: string, sha: string): Promise<string | null>;
+export declare function uploadUrl(tenant: string, workspace: string, rel: string, sha: string, size?: number): Promise<string | null>;
+/**
+ * Drop everything a workspace stored: every object its index names, then the
+ * index (30 Oct 2026). Called when a workspace is deleted — the store is kept
+ * by name beside the folder, so it used to outlive it: the files stayed
+ * downloadable under the old name, public links kept serving them, and a new
+ * workspace given the same name inherited them. Best effort per object (a
+ * leaked object costs storage; the index going is what makes them
+ * unreachable), and a no-op when there is no store.
+ */
+export declare function purgeWorkspaceStorage(tenant: string, workspace: string): Promise<void>;
+/**
+ * Move a workspace's stored files to its new name (30 Oct 2026). A rename
+ * used to move the folder only: the renamed workspace lost its files, and
+ * the old name kept them for whoever took it next.
+ *
+ * On fs the blobs live under the store's directory, so moving the directory
+ * is the whole move. On s3 an object's key carries the workspace name, so
+ * every object is copied first; only once all copies landed does the index
+ * move and the old objects go. A copy that fails leaves the store under the
+ * old name, whole, and throws — the caller can put the folder back.
+ *
+ * Whatever a store under the new name held is dropped first: it belonged to a
+ * workspace of that name that no longer exists, never to this one.
+ */
+export declare function moveWorkspaceStorage(tenant: string, from: string, to: string): Promise<void>;
 /**
  * Put the workspace's files on disk under `<workspace>/storage/`, where a run
  * copies them into its container like any other directory.