@hasna/instructions 0.4.35 → 0.4.39

package/dist/server/index.js

@@ -1258,78 +1258,6 @@ var RegExpRouter = class {
   }
 };
 
-// ../../node_modules/.bun/hono@4.13.1/node_modules/hono/dist/router/reg-exp-router/prepared-router.js
-var PreparedRegExpRouter = class {
-  name = "PreparedRegExpRouter";
-  #matchers;
-  #relocateMap;
-  constructor(matchers, relocateMap) {
-    this.#matchers = matchers;
-    this.#relocateMap = relocateMap;
-  }
-  #addWildcard(method, handlerData) {
-    const matcher = this.#matchers[method];
-    matcher[1].forEach((list) => list && list.push(handlerData));
-    Object.values(matcher[2]).forEach((list) => list[0].push(handlerData));
-  }
-  #addPath(method, path, handler, indexes, map) {
-    const matcher = this.#matchers[method];
-    if (!map) {
-      matcher[2][path][0].push([handler, {}]);
-    } else {
-      indexes.forEach((index) => {
-        if (typeof index === "number") {
-          matcher[1][index].push([handler, map]);
-        } else {
-          matcher[2][index || path][0].push([handler, map]);
-        }
-      });
-    }
-  }
-  add(method, path, handler) {
-    if (!this.#matchers[method]) {
-      const all = this.#matchers[METHOD_NAME_ALL];
-      const staticMap = {};
-      for (const key in all[2]) {
-        staticMap[key] = [all[2][key][0].slice(), emptyParam];
-      }
-      this.#matchers[method] = [
-        all[0],
-        all[1].map((list) => Array.isArray(list) ? list.slice() : 0),
-        staticMap
-      ];
-    }
-    if (path === "/*" || path === "*") {
-      const handlerData = [handler, {}];
-      if (method === METHOD_NAME_ALL) {
-        for (const m in this.#matchers) {
-          this.#addWildcard(m, handlerData);
-        }
-      } else {
-        this.#addWildcard(method, handlerData);
-      }
-      return;
-    }
-    const data = this.#relocateMap[path];
-    if (!data) {
-      throw new Error(`Path ${path} is not registered`);
-    }
-    for (const [indexes, map] of data) {
-      if (method === METHOD_NAME_ALL) {
-        for (const m in this.#matchers) {
-          this.#addPath(m, path, handler, indexes, map);
-        }
-      } else {
-        this.#addPath(method, path, handler, indexes, map);
-      }
-    }
-  }
-  buildAllMatchers() {
-    return this.#matchers;
-  }
-  match = match;
-};
-
 // ../../node_modules/.bun/hono@4.13.1/node_modules/hono/dist/router/smart-router/router.js
 var SmartRouter = class {
   name = "SmartRouter";
@@ -1744,14 +1672,90 @@ class ProfileNotFoundError extends Error {
   }
 }
 
-// ../../node_modules/.bun/@hasna+contracts@0.4.2/node_modules/@hasna/contracts/dist/auth/index.js
+// ../contracts/dist/auth/index.js
 import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
+var MAX_TENANT_ID_LENGTH = 64;
+var TENANT_ID_PATTERN = new RegExp(`^[A-Za-z0-9][A-Za-z0-9._-]{0,${MAX_TENANT_ID_LENGTH - 1}}$`);
+var UUID_HEX = "[0-9a-fA-F]";
+var UUID_PATTERN = new RegExp(`^\\{?(?:${UUID_HEX}{8}-${UUID_HEX}{4}-${UUID_HEX}{4}-${UUID_HEX}{4}-${UUID_HEX}{12}|${UUID_HEX}{32})\\}?$`);
+function isValidTenantId(value) {
+  return typeof value === "string" && TENANT_ID_PATTERN.test(value);
+}
+function isUuidTenantId(value) {
+  return typeof value === "string" && UUID_PATTERN.test(value);
+}
+function canonicalizeTenantId(value) {
+  if (!isUuidTenantId(value))
+    return value;
+  const hex = value.replace(/[{}-]/g, "").toLowerCase();
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function normalizeTenantId(value) {
+  const trimmed = typeof value === "string" ? value.trim() : "";
+  const canonical = canonicalizeTenantId(trimmed);
+  if (!isValidTenantId(canonical)) {
+    throw new Error(`Invalid tenant id '${value}'. Expected 1-${MAX_TENANT_ID_LENGTH} characters matching ${TENANT_ID_PATTERN} (a UUID, ULID, slug, or prefixed id).`);
+  }
+  return canonical;
+}
+function tenantIdsEqual(left, right) {
+  const canonical = (value) => {
+    if (typeof value !== "string")
+      return null;
+    const folded = canonicalizeTenantId(value.trim());
+    return isValidTenantId(folded) ? folded : null;
+  };
+  const a = canonical(left);
+  const b = canonical(right);
+  return a !== null && b !== null && a === b;
+}
+function ownTenantId(source) {
+  return Object.hasOwn(source, "tid") ? source.tid : undefined;
+}
 var API_KEY_TOKEN_VERSION = 1;
 var API_KEY_NAMESPACE = "hasna";
-var TOKEN_PATTERN = /^hasna_([a-z][a-z0-9-]*)_([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]+)$/;
+var API_KEY_TOKEN_PATTERN = /^hasna_([a-z][a-z0-9-]*)_([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]+)$/;
+var TOKEN_PATTERN = API_KEY_TOKEN_PATTERN;
 var DEFAULT_API_KEY_TTL_SECONDS = 90 * 24 * 60 * 60;
+function ownAgentClaim(source) {
+  return Object.hasOwn(source, "agent") && typeof source.agent === "string" ? source.agent : null;
+}
+function ownScopesClaim(source) {
+  return Object.hasOwn(source, "scopes") && Array.isArray(source.scopes) ? source.scopes : null;
+}
+function ownOption(options, name) {
+  return Object.hasOwn(options, name) ? options[name] : undefined;
+}
+var typedArrayPrototype = Object.getPrototypeOf(Uint8Array.prototype);
+var intrinsicViewBuffer = Object.getOwnPropertyDescriptor(typedArrayPrototype, "buffer").get;
+var intrinsicViewByteOffset = Object.getOwnPropertyDescriptor(typedArrayPrototype, "byteOffset").get;
+var intrinsicViewByteLength = Object.getOwnPropertyDescriptor(typedArrayPrototype, "byteLength").get;
+var intrinsicDataViewBuffer = Object.getOwnPropertyDescriptor(DataView.prototype, "buffer").get;
+var intrinsicDataViewByteOffset = Object.getOwnPropertyDescriptor(DataView.prototype, "byteOffset").get;
+var intrinsicDataViewByteLength = Object.getOwnPropertyDescriptor(DataView.prototype, "byteLength").get;
+function viewWindow(view) {
+  try {
+    return [
+      intrinsicViewBuffer.call(view),
+      intrinsicViewByteOffset.call(view),
+      intrinsicViewByteLength.call(view)
+    ];
+  } catch {
+    return [
+      intrinsicDataViewBuffer.call(view),
+      intrinsicDataViewByteOffset.call(view),
+      intrinsicDataViewByteLength.call(view)
+    ];
+  }
+}
 function toBuffer(secret) {
-  return typeof secret === "string" ? Buffer.from(secret, "utf8") : secret;
+  if (typeof secret === "string")
+    return Buffer.from(secret, "utf8");
+  if (ArrayBuffer.isView(secret)) {
+    const [store, byteOffset, byteLength] = viewWindow(secret);
+    return Buffer.from(store, byteOffset, byteLength);
+  }
+  return Buffer.from(secret);
 }
 function hmac(signingSecret, message) {
   return createHmac("sha256", toBuffer(signingSecret)).update(message, "utf8").digest();
@@ -1774,12 +1778,23 @@ function parseApiKey(token) {
   } catch {
     return null;
   }
-  if (typeof claims !== "object" || claims === null || typeof claims.kid !== "string" || typeof claims.app !== "string" || !Array.isArray(claims.scopes)) {
+  if (typeof claims !== "object" || claims === null || typeof claims.kid !== "string" || typeof claims.app !== "string" || ownScopesClaim(claims) === null) {
+    return null;
+  }
+  const claimedTid = ownTenantId(claims);
+  if (claimedTid !== undefined && !isValidTenantId(claimedTid)) {
     return null;
   }
   return { app, body, sig, claims };
 }
 function verifyApiKeyToken(token, options) {
+  const optSigningSecret = ownOption(options, "signingSecret");
+  const optExpectedApp = ownOption(options, "expectedApp");
+  const optNowMs = ownOption(options, "nowMs");
+  const optLeewaySeconds = ownOption(options, "leewaySeconds");
+  const optRequiredScopes = ownOption(options, "requiredScopes");
+  const optRequireTenant = ownOption(options, "requireTenant");
+  const optExpectedTid = ownOption(options, "expectedTid");
   const parsed = parseApiKey(token);
   if (!parsed) {
     return { ok: false, reason: "malformed", message: "Token is malformed." };
@@ -1791,10 +1806,10 @@ function verifyApiKeyToken(token, options) {
   if (claims.app !== app) {
     return { ok: false, reason: "app_mismatch", message: "Token prefix app does not match claims." };
   }
-  if (options.expectedApp !== undefined && app !== options.expectedApp) {
-    return { ok: false, reason: "app_mismatch", message: `Token is for app '${app}', expected '${options.expectedApp}'.` };
+  if (optExpectedApp !== undefined && app !== optExpectedApp) {
+    return { ok: false, reason: "app_mismatch", message: `Token is for app '${app}', expected '${optExpectedApp}'.` };
   }
-  const expected = hmac(options.signingSecret, `${apiKeyPrefix(app)}${body}`);
+  const expected = hmac(optSigningSecret, `${apiKeyPrefix(app)}${body}`);
   let provided;
   try {
     provided = Buffer.from(sig, "base64url");
@@ -1804,16 +1819,41 @@ function verifyApiKeyToken(token, options) {
   if (provided.length !== expected.length || !timingSafeEqual(provided, expected)) {
     return { ok: false, reason: "bad_signature", message: "Signature verification failed." };
   }
-  const now = Math.floor((options.nowMs ?? Date.now()) / 1000);
-  const leeway = options.leewaySeconds ?? 0;
+  const agent = ownAgentClaim(claims);
+  const now = Math.floor((optNowMs ?? Date.now()) / 1000);
+  const leeway = optLeewaySeconds ?? 0;
   if (typeof claims.iat === "number" && now + leeway < claims.iat) {
-    return { ok: false, reason: "not_yet_valid", message: "Token is not yet valid." };
+    return { ok: false, reason: "not_yet_valid", message: "Token is not yet valid.", agent };
   }
   if (claims.exp !== null && typeof claims.exp === "number" && now - leeway >= claims.exp) {
-    return { ok: false, reason: "expired", message: "Token has expired." };
+    return { ok: false, reason: "expired", message: "Token has expired.", agent };
+  }
+  const verifiedTid = ownTenantId(claims);
+  const tid = verifiedTid === undefined ? null : canonicalizeTenantId(verifiedTid);
+  const tenantRequired = Boolean(optRequireTenant) || optExpectedTid !== undefined;
+  if (tenantRequired && tid === null) {
+    return {
+      ok: false,
+      reason: "tenant_required",
+      message: "Token carries no tenant id ('tid') and this service requires one.",
+      kid: claims.kid,
+      tid: null,
+      agent
+    };
   }
-  if (options.requiredScopes && options.requiredScopes.length > 0) {
-    const granted = claims.scopes;
+  if (optExpectedTid !== undefined && !tenantIdsEqual(tid, optExpectedTid)) {
+    const expectationIsWellFormed = typeof optExpectedTid === "string" && isValidTenantId(optExpectedTid.trim());
+    return {
+      ok: false,
+      reason: "tenant_mismatch",
+      message: expectationIsWellFormed ? "Token is for a different tenant than the one this service accepts." : "Token tenant cannot be checked: the expected tenant id is not a valid tenant id.",
+      kid: claims.kid,
+      tid,
+      agent
+    };
+  }
+  if (optRequiredScopes && optRequiredScopes.length > 0) {
+    const granted = ownScopesClaim(claims) ?? [];
     const satisfies = (required) => granted.some((g) => {
       if (g === "*")
         return true;
@@ -1827,15 +1867,16 @@ function verifyApiKeyToken(token, options) {
       const rAction = required.slice(ri + 1);
       return (gApp === "*" || gApp === rApp) && (gAction === "*" || gAction === rAction);
     });
-    for (const required of options.requiredScopes) {
+    for (const required of optRequiredScopes) {
       if (!satisfies(required)) {
-        return { ok: false, reason: "insufficient_scope", message: `Missing required scope '${required}'.` };
+        return { ok: false, reason: "insufficient_scope", message: `Missing required scope '${required}'.`, agent };
       }
     }
   }
-  return { ok: true, claims, kid: claims.kid, app };
+  return { ok: true, claims, kid: claims.kid, app, tid, agent };
 }
 var DEFAULT_API_KEYS_TABLE = "api_keys";
+var API_KEY_ISSUANCE_PENDING_REASON = "credential_delivery_pending";
 function createTableSql(table) {
   return `CREATE TABLE IF NOT EXISTS ${table} (
     kid TEXT PRIMARY KEY,
@@ -1859,6 +1900,11 @@ function apiKeyMigrations(table = DEFAULT_API_KEYS_TABLE) {
       id: `hasna_auth_0002_${table}_indexes`,
       sql: `CREATE INDEX IF NOT EXISTS ${table}_app_idx ON ${table} (app);
             CREATE INDEX IF NOT EXISTS ${table}_token_hash_idx ON ${table} (token_hash);`
+    },
+    {
+      id: `hasna_auth_0003_${table}_tenant`,
+      sql: `ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS tid TEXT;
+            CREATE INDEX IF NOT EXISTS ${table}_tid_idx ON ${table} (tid);`
     }
   ];
 }
@@ -1883,10 +1929,13 @@ function parseScopes(value) {
   return [];
 }
 function rowToRecord(row) {
+  const tid = ownTenantId(row);
+  const agentValue = Object.hasOwn(row, "agent") ? row.agent : null;
   return {
     kid: String(row.kid),
     app: String(row.app),
-    agent: row.agent === null || row.agent === undefined ? null : String(row.agent),
+    agent: agentValue === null || agentValue === undefined ? null : String(agentValue),
+    tid: tid === null || tid === undefined ? null : String(tid),
     scopes: parseScopes(row.scopes),
     tokenHash: String(row.token_hash),
     issuedAt: toIso(row.issued_at) ?? new Date(0).toISOString(),
@@ -1917,31 +1966,63 @@ class ApiKeyStore {
     }
   }
   async insert(input) {
+    await this.insertWithLifecycle(input, null, null);
+  }
+  async insertWithLifecycle(input, revokedAt, revokedReason) {
+    const tid = ownTenantId(input);
+    const agent = ownAgentClaim(input);
     await this.client.execute(`INSERT INTO ${this.table}
-         (kid, app, agent, scopes, token_hash, issued_at, expires_at, created_by)
-       VALUES ($1, $2, $3, $4::jsonb, $5, $6, $7, $8)`, [
+         (kid, app, agent, tid, scopes, token_hash, issued_at, expires_at, created_by, revoked_at, revoked_reason)
+       VALUES ($1, $2, $3, $4, $5::jsonb, $6, $7, $8, $9, $10, $11)`, [
       input.kid,
       input.app,
-      input.agent ?? null,
+      agent,
+      tid === undefined || tid === null ? null : normalizeTenantId(tid),
       JSON.stringify(input.scopes),
       input.tokenHash,
       input.issuedAt.toISOString(),
       input.expiresAt ? input.expiresAt.toISOString() : null,
-      input.createdBy ?? null
+      input.createdBy ?? null,
+      revokedAt,
+      revokedReason
     ]);
   }
-  async insertMinted(minted, createdBy) {
+  mintedInput(minted, createdBy) {
     const claims = minted.claims;
-    await this.insert({
+    return {
       kid: minted.kid,
       app: claims.app,
-      agent: claims.agent ?? null,
+      agent: ownAgentClaim(claims),
+      tid: ownTenantId(claims) ?? null,
       scopes: claims.scopes,
       tokenHash: minted.tokenHash,
       issuedAt: new Date(claims.iat * 1000),
       expiresAt: claims.exp === null ? null : new Date(claims.exp * 1000),
       createdBy: createdBy ?? null
-    });
+    };
+  }
+  async insertMinted(minted, createdBy) {
+    await this.insert(this.mintedInput(minted, createdBy));
+  }
+  async insertMintedPending(minted, createdBy, atMs = Date.now()) {
+    await this.insertWithLifecycle(this.mintedInput(minted, createdBy), new Date(atMs).toISOString(), API_KEY_ISSUANCE_PENDING_REASON);
+  }
+  async activatePending(kid, tokenHash) {
+    const row = await this.client.get(`UPDATE ${this.table}
+          SET revoked_at = NULL, revoked_reason = NULL
+        WHERE kid = $1
+          AND revoked_at IS NOT NULL
+          AND revoked_reason = $2
+          AND token_hash = $3
+      RETURNING kid`, [kid, API_KEY_ISSUANCE_PENDING_REASON, tokenHash]);
+    if (row)
+      return true;
+    const active = await this.client.get(`SELECT kid FROM ${this.table}
+        WHERE kid = $1
+          AND token_hash = $2
+          AND revoked_at IS NULL
+          AND revoked_reason IS NULL`, [kid, tokenHash]);
+    return active !== null;
   }
   async findByKid(kid) {
     const row = await this.client.get(`SELECT * FROM ${this.table} WHERE kid = $1`, [kid]);
@@ -1967,6 +2048,9 @@ class ApiKeyStore {
       return "expired";
     return "active";
   }
+  keyStatus = async (kid) => {
+    return this.status(kid);
+  };
   statusChecker() {
     return async (kid) => {
       const status = await this.status(kid);
@@ -1993,11 +2077,16 @@ class ApiKeyStore {
       params.push(options.app);
       clauses.push(`app = $${params.length}`);
     }
+    const tid = ownTenantId(options);
+    if (tid !== undefined) {
+      params.push(normalizeTenantId(tid));
+      clauses.push(`tid = $${params.length}`);
+    }
     if (!options.includeRevoked) {
       clauses.push("revoked_at IS NULL");
     }
     const where = clauses.length > 0 ? `WHERE ${clauses.join(" AND ")}` : "";
-    const rows = await this.client.many(`SELECT * FROM ${this.table} ${where} ORDER BY issued_at DESC`);
+    const rows = await this.client.many(`SELECT * FROM ${this.table} ${where} ORDER BY issued_at DESC`, params);
     return rows.map(rowToRecord);
   }
   async revokedKids() {
@@ -2034,27 +2123,65 @@ function extractToken(source, headerName = "x-api-key", scheme = "Bearer") {
   }
   return null;
 }
+function ownOption2(bag, name) {
+  return Object.hasOwn(bag, name) ? bag[name] : undefined;
+}
 function verifyApiKey(options) {
-  if (!options.app)
+  const optionApp = ownOption2(options, "app");
+  const optionSigningSecret = ownOption2(options, "signingSecret");
+  const optionExpectedTid = ownOption2(options, "expectedTid");
+  const optionRequiredScopes = ownOption2(options, "requiredScopes");
+  const optionRequireTenant = ownOption2(options, "requireTenant");
+  const optionLeewaySeconds = ownOption2(options, "leewaySeconds");
+  const audit = ownOption2(options, "audit");
+  const headerName = ownOption2(options, "headerName") ?? "x-api-key";
+  const scheme = ownOption2(options, "scheme") ?? "Bearer";
+  const clock = ownOption2(options, "nowMs") ?? (() => Date.now());
+  if (!optionApp)
     throw new Error("verifyApiKey requires an 'app' slug.");
-  if (!options.signingSecret) {
+  if (!optionSigningSecret) {
     throw new Error("verifyApiKey requires a 'signingSecret'. Set it from HASNA_<APP>_API_SIGNING_KEY.");
   }
-  const headerName = options.headerName ?? "x-api-key";
-  const scheme = options.scheme ?? "Bearer";
-  const clock = options.nowMs ?? (() => Date.now());
+  if (optionExpectedTid !== undefined && !isValidTenantId(optionExpectedTid)) {
+    throw new Error(`verifyApiKey received an invalid 'expectedTid': '${optionExpectedTid}'.`);
+  }
+  const app = optionApp;
+  const signingSecret = optionSigningSecret;
+  const ownKeyStatus = ownOption2(options, "keyStatus");
+  const ownIsRevoked = ownOption2(options, "isRevoked");
+  const allowUnregistered = ownOption2(options, "allowUnregisteredKeys") === true;
+  if (ownKeyStatus && ownIsRevoked) {
+    throw new Error("verifyApiKey received both 'keyStatus' and 'isRevoked'. Supply exactly one \u2014 " + "letting one silently win would hide which check is actually guarding the service. " + "Use 'keyStatus' (store.keyStatus); drop 'isRevoked'.");
+  }
+  if (!ownKeyStatus && !allowUnregistered) {
+    throw new Error(ownIsRevoked ? "verifyApiKey was given only 'isRevoked', which cannot refuse a key this service has " + "no record of: it returns false both for an active key and for one that was never " + "registered, so an unregistered key is irrevocable. Wire 'keyStatus: store.keyStatus' " + "(or 'isRevoked: store.statusChecker()'), or set 'allowUnregisteredKeys: true' to " + "accept that risk explicitly." : "verifyApiKey requires a key-status hook. Without one this service performs NO " + "revocation check and cannot turn any of its keys off. Wire " + "'keyStatus: store.keyStatus', or set 'allowUnregisteredKeys: true' to declare that " + "this service intentionally cannot revoke keys.");
+  }
   async function emit(event) {
-    if (!options.audit)
+    if (!audit)
       return;
     try {
-      await options.audit(event);
+      await audit(event);
     } catch {}
   }
   async function authenticate(headers, context = {}) {
-    const method = context.method ?? null;
-    const path = context.path ?? null;
-    const requiredScopes = [...options.requiredScopes ?? [], ...context.requiredScopes ?? []];
+    const method = ownOption2(context, "method") ?? null;
+    const path = ownOption2(context, "path") ?? null;
+    const requiredScopes = [
+      ...optionRequiredScopes ?? [],
+      ...ownOption2(context, "requiredScopes") ?? []
+    ];
     const at = new Date(clock()).toISOString();
+    const perCallTid = ownOption2(context, "expectedTid");
+    const expectedTid = perCallTid !== undefined ? perCallTid : optionExpectedTid;
+    if (perCallTid !== undefined && optionExpectedTid !== undefined && !tenantIdsEqual(perCallTid, optionExpectedTid)) {
+      await emit({ outcome: "deny", app, kid: null, tid: null, reason: "tenant_mismatch", scopesRequired: requiredScopes, method, path, status: 403, at });
+      return {
+        ok: false,
+        status: 403,
+        reason: "tenant_mismatch",
+        message: "This route addresses a tenant other than the one this service is pinned to."
+      };
+    }
     const token = extractToken(headers, headerName, scheme);
     if (!token) {
       const decision = {
@@ -2063,25 +2190,72 @@ function verifyApiKey(options) {
         reason: "missing_token",
         message: `Missing API key. Send it as '${headerName}: <key>' or 'Authorization: ${scheme} <key>'.`
       };
-      await emit({ outcome: "deny", app: options.app, kid: null, reason: "missing_token", scopesRequired: requiredScopes, method, path, status: 401, at });
+      await emit({ outcome: "deny", app, kid: null, tid: null, reason: "missing_token", scopesRequired: requiredScopes, method, path, status: 401, at });
       return decision;
     }
     const verified = verifyApiKeyToken(token, {
-      signingSecret: options.signingSecret,
-      expectedApp: options.app,
+      signingSecret,
+      expectedApp: app,
       nowMs: clock(),
-      ...options.leewaySeconds !== undefined ? { leewaySeconds: options.leewaySeconds } : {},
+      ...optionLeewaySeconds !== undefined ? { leewaySeconds: optionLeewaySeconds } : {},
+      ...optionRequireTenant !== undefined ? { requireTenant: optionRequireTenant } : {},
+      ...expectedTid !== undefined ? { expectedTid } : {},
       requiredScopes
     });
     if (!verified.ok) {
-      const status = verified.reason === "insufficient_scope" ? 403 : 401;
-      await emit({ outcome: "deny", app: options.app, kid: null, reason: verified.reason, scopesRequired: requiredScopes, method, path, status, at });
+      const status = verified.reason === "insufficient_scope" || verified.reason === "tenant_mismatch" || verified.reason === "tenant_required" ? 403 : 401;
+      await emit({
+        outcome: "deny",
+        app,
+        kid: ownOption2(verified, "kid") ?? null,
+        tid: ownTenantId(verified) ?? null,
+        ...Object.hasOwn(verified, "agent") ? { agent: verified.agent } : {},
+        reason: verified.reason,
+        scopesRequired: requiredScopes,
+        method,
+        path,
+        status,
+        at
+      });
       return { ok: false, status, reason: verified.reason, message: verified.message };
     }
-    if (options.isRevoked) {
-      const revoked = await options.isRevoked(verified.kid);
+    if (ownKeyStatus) {
+      let status;
+      try {
+        status = await ownKeyStatus(verified.kid);
+      } catch {
+        await emit({ outcome: "deny", app, kid: verified.kid, tid: verified.tid, agent: verified.agent, reason: "status_unavailable", scopesRequired: requiredScopes, method, path, status: 503, at });
+        return {
+          ok: false,
+          status: 503,
+          reason: "status_unavailable",
+          message: "Could not verify API key status. Try again shortly."
+        };
+      }
+      if (status !== "active") {
+        const known = status === "revoked" || status === "expired" || status === "unknown";
+        if (!(status === "unknown" && allowUnregistered)) {
+          const reason = status === "revoked" || status === "expired" ? status : "unknown_key";
+          const message = reason === "unknown_key" ? known ? "API key is not registered with this service." : "API key status could not be recognized." : status === "expired" ? "API key has expired." : "API key has been revoked.";
+          await emit({ outcome: "deny", app, kid: verified.kid, tid: verified.tid, agent: verified.agent, reason, scopesRequired: requiredScopes, method, path, status: 401, at });
+          return { ok: false, status: 401, reason, message };
+        }
+      }
+    } else if (ownIsRevoked) {
+      let revoked;
+      try {
+        revoked = await ownIsRevoked(verified.kid);
+      } catch {
+        await emit({ outcome: "deny", app, kid: verified.kid, tid: verified.tid, agent: verified.agent, reason: "status_unavailable", scopesRequired: requiredScopes, method, path, status: 503, at });
+        return {
+          ok: false,
+          status: 503,
+          reason: "status_unavailable",
+          message: "Could not verify API key status. Try again shortly."
+        };
+      }
       if (revoked) {
-        await emit({ outcome: "deny", app: options.app, kid: verified.kid, reason: "revoked", scopesRequired: requiredScopes, method, path, status: 401, at });
+        await emit({ outcome: "deny", app, kid: verified.kid, tid: verified.tid, agent: verified.agent, reason: "revoked", scopesRequired: requiredScopes, method, path, status: 401, at });
         return { ok: false, status: 401, reason: "revoked", message: "API key has been revoked." };
       }
     }
@@ -2089,13 +2263,14 @@ function verifyApiKey(options) {
       kid: verified.kid,
       app: verified.app,
       scopes: verified.claims.scopes,
-      agent: verified.claims.agent ?? null,
+      agent: verified.agent,
+      tid: verified.tid,
       claims: verified.claims
     };
-    await emit({ outcome: "allow", app: options.app, kid: verified.kid, reason: null, scopesRequired: requiredScopes, method, path, status: 200, at });
+    await emit({ outcome: "allow", app, kid: verified.kid, tid: verified.tid, agent: verified.agent, reason: null, scopesRequired: requiredScopes, method, path, status: 200, at });
     return { ok: true, status: 200, principal };
   }
-  return { authenticate, app: options.app };
+  return { authenticate, app };
 }
 function honoApiKey(options) {
   const verifier = verifyApiKey(options);
@@ -2111,6 +2286,7 @@ function honoApiKey(options) {
     return c.json({ error: decision.message, reason: decision.reason }, decision.status);
   };
 }
+var MAX_FLEET_TOKEN_TTL_SECONDS = 24 * 60 * 60;
 
 // src/generated/storage-kit/own.ts
 function ownProp(source, key) {
@@ -2936,113 +3112,113 @@ import { basename, dirname as dirname2, isAbsolute, join as join2, parse, relati
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
 var exports_external = {};
 __export(exports_external, {
-  void: () => voidType,
-  util: () => util,
-  unknown: () => unknownType,
-  union: () => unionType,
-  undefined: () => undefinedType,
-  tuple: () => tupleType,
-  transformer: () => effectsType,
-  symbol: () => symbolType,
-  string: () => stringType,
-  strictObject: () => strictObjectType,
-  setErrorMap: () => setErrorMap,
-  set: () => setType,
-  record: () => recordType,
-  quotelessJson: () => quotelessJson,
-  promise: () => promiseType,
-  preprocess: () => preprocessType,
-  pipeline: () => pipelineType,
-  ostring: () => ostring,
-  optional: () => optionalType,
-  onumber: () => onumber,
-  oboolean: () => oboolean,
-  objectUtil: () => objectUtil,
-  object: () => objectType,
-  number: () => numberType,
-  nullable: () => nullableType,
-  null: () => nullType,
-  never: () => neverType,
-  nativeEnum: () => nativeEnumType,
-  nan: () => nanType,
-  map: () => mapType,
-  makeIssue: () => makeIssue,
-  literal: () => literalType,
-  lazy: () => lazyType,
-  late: () => late,
-  isValid: () => isValid,
-  isDirty: () => isDirty,
-  isAsync: () => isAsync,
-  isAborted: () => isAborted,
-  intersection: () => intersectionType,
-  instanceof: () => instanceOfType,
-  getParsedType: () => getParsedType,
-  getErrorMap: () => getErrorMap,
-  function: () => functionType,
-  enum: () => enumType,
-  effect: () => effectsType,
-  discriminatedUnion: () => discriminatedUnionType,
-  defaultErrorMap: () => en_default,
-  datetimeRegex: () => datetimeRegex,
-  date: () => dateType,
-  custom: () => custom,
-  coerce: () => coerce,
-  boolean: () => booleanType,
-  bigint: () => bigIntType,
-  array: () => arrayType,
-  any: () => anyType,
-  addIssueToContext: () => addIssueToContext,
-  ZodVoid: () => ZodVoid,
-  ZodUnknown: () => ZodUnknown,
-  ZodUnion: () => ZodUnion,
-  ZodUndefined: () => ZodUndefined,
-  ZodType: () => ZodType,
-  ZodTuple: () => ZodTuple,
-  ZodTransformer: () => ZodEffects,
-  ZodSymbol: () => ZodSymbol,
-  ZodString: () => ZodString,
-  ZodSet: () => ZodSet,
-  ZodSchema: () => ZodType,
-  ZodRecord: () => ZodRecord,
-  ZodReadonly: () => ZodReadonly,
-  ZodPromise: () => ZodPromise,
-  ZodPipeline: () => ZodPipeline,
-  ZodParsedType: () => ZodParsedType,
-  ZodOptional: () => ZodOptional,
-  ZodObject: () => ZodObject,
-  ZodNumber: () => ZodNumber,
-  ZodNullable: () => ZodNullable,
-  ZodNull: () => ZodNull,
-  ZodNever: () => ZodNever,
-  ZodNativeEnum: () => ZodNativeEnum,
-  ZodNaN: () => ZodNaN,
-  ZodMap: () => ZodMap,
-  ZodLiteral: () => ZodLiteral,
-  ZodLazy: () => ZodLazy,
-  ZodIssueCode: () => ZodIssueCode,
-  ZodIntersection: () => ZodIntersection,
-  ZodFunction: () => ZodFunction,
-  ZodFirstPartyTypeKind: () => ZodFirstPartyTypeKind,
-  ZodError: () => ZodError,
-  ZodEnum: () => ZodEnum,
-  ZodEffects: () => ZodEffects,
-  ZodDiscriminatedUnion: () => ZodDiscriminatedUnion,
-  ZodDefault: () => ZodDefault,
-  ZodDate: () => ZodDate,
-  ZodCatch: () => ZodCatch,
-  ZodBranded: () => ZodBranded,
-  ZodBoolean: () => ZodBoolean,
-  ZodBigInt: () => ZodBigInt,
-  ZodArray: () => ZodArray,
-  ZodAny: () => ZodAny,
-  Schema: () => ZodType,
-  ParseStatus: () => ParseStatus,
-  OK: () => OK,
-  NEVER: () => NEVER,
-  INVALID: () => INVALID,
-  EMPTY_PATH: () => EMPTY_PATH,
+  BRAND: () => BRAND,
   DIRTY: () => DIRTY,
-  BRAND: () => BRAND
+  EMPTY_PATH: () => EMPTY_PATH,
+  INVALID: () => INVALID,
+  NEVER: () => NEVER,
+  OK: () => OK,
+  ParseStatus: () => ParseStatus,
+  Schema: () => ZodType,
+  ZodAny: () => ZodAny,
+  ZodArray: () => ZodArray,
+  ZodBigInt: () => ZodBigInt,
+  ZodBoolean: () => ZodBoolean,
+  ZodBranded: () => ZodBranded,
+  ZodCatch: () => ZodCatch,
+  ZodDate: () => ZodDate,
+  ZodDefault: () => ZodDefault,
+  ZodDiscriminatedUnion: () => ZodDiscriminatedUnion,
+  ZodEffects: () => ZodEffects,
+  ZodEnum: () => ZodEnum,
+  ZodError: () => ZodError,
+  ZodFirstPartyTypeKind: () => ZodFirstPartyTypeKind,
+  ZodFunction: () => ZodFunction,
+  ZodIntersection: () => ZodIntersection,
+  ZodIssueCode: () => ZodIssueCode,
+  ZodLazy: () => ZodLazy,
+  ZodLiteral: () => ZodLiteral,
+  ZodMap: () => ZodMap,
+  ZodNaN: () => ZodNaN,
+  ZodNativeEnum: () => ZodNativeEnum,
+  ZodNever: () => ZodNever,
+  ZodNull: () => ZodNull,
+  ZodNullable: () => ZodNullable,
+  ZodNumber: () => ZodNumber,
+  ZodObject: () => ZodObject,
+  ZodOptional: () => ZodOptional,
+  ZodParsedType: () => ZodParsedType,
+  ZodPipeline: () => ZodPipeline,
+  ZodPromise: () => ZodPromise,
+  ZodReadonly: () => ZodReadonly,
+  ZodRecord: () => ZodRecord,
+  ZodSchema: () => ZodType,
+  ZodSet: () => ZodSet,
+  ZodString: () => ZodString,
+  ZodSymbol: () => ZodSymbol,
+  ZodTransformer: () => ZodEffects,
+  ZodTuple: () => ZodTuple,
+  ZodType: () => ZodType,
+  ZodUndefined: () => ZodUndefined,
+  ZodUnion: () => ZodUnion,
+  ZodUnknown: () => ZodUnknown,
+  ZodVoid: () => ZodVoid,
+  addIssueToContext: () => addIssueToContext,
+  any: () => anyType,
+  array: () => arrayType,
+  bigint: () => bigIntType,
+  boolean: () => booleanType,
+  coerce: () => coerce,
+  custom: () => custom,
+  date: () => dateType,
+  datetimeRegex: () => datetimeRegex,
+  defaultErrorMap: () => en_default,
+  discriminatedUnion: () => discriminatedUnionType,
+  effect: () => effectsType,
+  enum: () => enumType,
+  function: () => functionType,
+  getErrorMap: () => getErrorMap,
+  getParsedType: () => getParsedType,
+  instanceof: () => instanceOfType,
+  intersection: () => intersectionType,
+  isAborted: () => isAborted,
+  isAsync: () => isAsync,
+  isDirty: () => isDirty,
+  isValid: () => isValid,
+  late: () => late,
+  lazy: () => lazyType,
+  literal: () => literalType,
+  makeIssue: () => makeIssue,
+  map: () => mapType,
+  nan: () => nanType,
+  nativeEnum: () => nativeEnumType,
+  never: () => neverType,
+  null: () => nullType,
+  nullable: () => nullableType,
+  number: () => numberType,
+  object: () => objectType,
+  objectUtil: () => objectUtil,
+  oboolean: () => oboolean,
+  onumber: () => onumber,
+  optional: () => optionalType,
+  ostring: () => ostring,
+  pipeline: () => pipelineType,
+  preprocess: () => preprocessType,
+  promise: () => promiseType,
+  quotelessJson: () => quotelessJson,
+  record: () => recordType,
+  set: () => setType,
+  setErrorMap: () => setErrorMap,
+  strictObject: () => strictObjectType,
+  string: () => stringType,
+  symbol: () => symbolType,
+  transformer: () => effectsType,
+  tuple: () => tupleType,
+  undefined: () => undefinedType,
+  union: () => unionType,
+  unknown: () => unknownType,
+  util: () => util,
+  void: () => voidType
 });
 
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/util.js
@@ -7145,6 +7321,9 @@ var DEPRECATED_CONFIG_AGENT_SET = new Set(DEPRECATED_CONFIG_AGENTS);
 
 // src/lib/cursor-authority.ts
 var CURSOR_GLOBAL_AUTHORITY_MAX_BYTES = 256 * 1024;
+
+// src/lib/session-authority.ts
+var CLAUDE_LEGACY_AUTHORITY_MAX_BYTES = 256 * 1024;
 // src/lib/session-render.ts
 var SESSION_RENDER_PROFILE_ENTRYPOINTS = [
   ".claude/CLAUDE.md",
@@ -7602,9 +7781,15 @@ async function createConfig2(client, input) {
     throw new Error("category is required");
   const id = randomUUID();
   const slug = await uniqueSlug(client, input.name);
-  await client.execute(`INSERT INTO configs
-       (id, name, slug, kind, category, agent, target_path, outputs, format, content, description, tags, is_template, version, created_at, updated_at)
-     VALUES ($1,$2,$3,$4,$5,$6,$7,$8::jsonb,$9,$10,$11,$12::jsonb,$13,1,now(),now())`, [
+  const snapshotId = randomUUID();
+  await client.execute(`WITH inserted_config AS (
+       INSERT INTO configs
+         (id, name, slug, kind, category, agent, target_path, outputs, format, content, description, tags, is_template, version, created_at, updated_at)
+       VALUES ($1,$2,$3,$4,$5,$6,$7,$8::jsonb,$9,$10,$11,$12::jsonb,$13,1,now(),now())
+       RETURNING id, content, version
+     )
+     INSERT INTO config_snapshots (id, config_id, content, version, created_at)
+     SELECT $14, id, content, version, now() FROM inserted_config`, [
     id,
     input.name,
     slug,
@@ -7617,7 +7802,8 @@ async function createConfig2(client, input) {
     input.content ?? "",
     input.description ?? null,
     JSON.stringify(input.tags ?? []),
-    input.is_template ?? false
+    input.is_template ?? false,
+    snapshotId
   ]);
   return getConfig2(client, id);
 }
@@ -7656,7 +7842,15 @@ async function updateConfig2(client, idOrSlug, input) {
   if (input.synced_at !== undefined)
     set("synced_at", input.synced_at, "::timestamptz");
   params.push(existing.id);
-  await client.execute(`UPDATE configs SET ${sets.join(", ")} WHERE id = $${params.length}`, params);
+  const configIdParam = params.length;
+  params.push(randomUUID());
+  const snapshotIdParam = params.length;
+  await client.execute(`WITH updated_config AS (
+       UPDATE configs SET ${sets.join(", ")} WHERE id = $${configIdParam}
+       RETURNING id, content, version
+     )
+     INSERT INTO config_snapshots (id, config_id, content, version, created_at)
+     SELECT $${snapshotIdParam}, id, content, version, now() FROM updated_config`, params);
   return getConfig2(client, existing.id);
 }
 async function deleteConfig2(client, idOrSlug) {