@konneal/engine 0.2.35 → 0.2.37

package/dist/{ask-P6KLPBKL.js → ask-J6NGXPOD.js}

@@ -1,7 +1,7 @@
 import {
   handleAsk
-} from "./chunk-YSWKFXXG.js";
-import "./chunk-GHDRKT4K.js";
+} from "./chunk-SEOQWW77.js";
+import "./chunk-37FSCXBQ.js";
 import "./chunk-R2V3X6SQ.js";
 import "./chunk-A3QHHUN5.js";
 import "./chunk-4GJGBGJK.js";

package/dist/{chunk-GHDRKT4K.js → chunk-37FSCXBQ.js}

@@ -23803,6 +23803,55 @@ async function resolveLiveAccount(env, sessionRaw, member) {
   if (!read.ok) return { status: "unavailable", reason: read.reason };
   return { status: "ok", records: read.records, stores: read.stores, readAt: read.readAt };
 }
+function deviceClientIds(env) {
+  return String(env.OIDC_DEVICE_CLIENT_IDS ?? "").split(/[\s,]+/).filter(Boolean);
+}
+function opCfg(env) {
+  return { issuer: String(env.OIDC_ISSUER ?? "").trim().replace(/\/+$/, ""), clientId: String(env.OIDC_CLIENT_ID ?? "") };
+}
+function opMemberCanWrite(member) {
+  if (!member) return false;
+  if (member.via !== "op-token") return true;
+  return /\bwrite\b/.test(member.scope ?? "");
+}
+function opMemberFromIntrospection(answer, ids) {
+  if (!answer?.active) return null;
+  const clientId = String(answer.client_id ?? "");
+  if (!ids.includes(clientId)) return null;
+  const sub = String(answer.sub ?? "");
+  if (!sub) return null;
+  return { sub, scope: String(answer.scope ?? ""), via: "op-token" };
+}
+async function opTokenMember(env, cfg, req) {
+  const m = /^Bearer\s+(.+)$/i.exec((req.headers.get("Authorization") ?? "").trim());
+  const token = m?.[1]?.trim();
+  if (!token || token.split(".").length === 3) return null;
+  const ids = deviceClientIds(env);
+  if (!ids.length || !cfg.issuer || !cfg.clientId) return null;
+  const key = `opint:${await sha256Hex2(token)}`;
+  let answer = null;
+  try {
+    answer = await env.CACHE.get(key, "json");
+  } catch {
+  }
+  if (answer === void 0 || answer === null) {
+    try {
+      const res = await fetch(`${cfg.issuer}/op/introspect`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ token, client_id: cfg.clientId })
+      });
+      answer = res.ok ? await res.json() : { active: false };
+    } catch {
+      return null;
+    }
+    try {
+      await env.CACHE.put(key, JSON.stringify(answer ?? { active: false }), { expirationTtl: 45 });
+    } catch {
+    }
+  }
+  return opMemberFromIntrospection(answer, ids);
+}
 
 // workers/worker_public/src/oidc.ts
 var OidcError = class extends Error {
@@ -24537,6 +24586,9 @@ export {
   liveDataConfig,
   liveTokenFor,
   resolveLiveAccount,
+  opCfg,
+  opMemberCanWrite,
+  opTokenMember,
   handleLogin,
   handleCallback,
   sessionFrom,

package/dist/{chunk-YSWKFXXG.js → chunk-SEOQWW77.js}

@@ -16,6 +16,8 @@ import {
   liveTokenFor,
   machineOffers,
   namedDocumentIn,
+  opCfg,
+  opTokenMember,
   parseContext,
   portModelRunner,
   portStore,
@@ -30,7 +32,7 @@ import {
   syntheticUnderstanding,
   telemetry,
   understandQuery
-} from "./chunk-GHDRKT4K.js";
+} from "./chunk-37FSCXBQ.js";
 import {
   corsHeaders,
   err,
@@ -1895,7 +1897,16 @@ async function handleAsk(env, ctx, req, tier, key) {
   const declaredCtx = parseContext(body);
   const draftAct = P().publisher.features?.drafts ? detectDraftIntent(q.query) : null;
   const apiCallIntent = !draftAct && P().publisher.features?.api_call_drafts ? detectApiCallIntent(q.query, declaredCtx) : null;
-  const member = tier === "member" ? await sessionFrom(req, env) : null;
+  const session = tier === "member" ? await sessionFrom(req, env) : null;
+  const opMember = !session && tier === "member" ? await opTokenMember(env, opCfg(env), req) : null;
+  const member = session ?? (opMember ? {
+    sub: opMember.sub,
+    roles: [],
+    iat: Math.floor(Date.now() / 1e3),
+    exp: Math.floor(Date.now() / 1e3) + 3600,
+    via: "op-token",
+    scope: opMember.scope
+  } : null);
   const effort = requestEffort(env, member, body?.effort);
   const limit = tier === "key" ? key.day_limit : tier === "member" || member ? num(env, "MEMBER_DAY_ASK", 300) : num(env, "ANON_DAY_ASK", 20);
   const bucketId = tier === "key" ? `key:${key.id}` : member ? `sub:${member.sub}` : clientIp(req);

package/dist/{chunk-Z7AQEW6G.js → chunk-YEAAGFHB.js}

@@ -7,7 +7,7 @@ import {
   sessionFrom,
   telemetry,
   understandQuery
-} from "./chunk-GHDRKT4K.js";
+} from "./chunk-37FSCXBQ.js";
 import {
   corsHeaders,
   err,

package/dist/env.d.ts

@@ -31,6 +31,11 @@ export interface Env {
     OIDC_CLIENT_ID?: string;
     OIDC_CLIENT_SECRET?: string;
     OIDC_REDIRECT_URI?: string;
+    /** TODO.ai-platform/14 — the Ommisa tier: the OP device-grant client
+     *  ids (comma/space separated) whose opaque access tokens this
+     *  deployment admits as member-read credentials via introspection.
+     *  Empty/absent = the tier is off. */
+    OIDC_DEVICE_CLIENT_IDS?: string;
     SESSION_SECRET?: string;
     /** TODO.ai-platform/03 — the "my account" live-data delegation: the
      *  platform instance's API base + its client id at the OP (the

package/dist/livedata.d.ts

@@ -88,3 +88,39 @@ export declare function resolveLiveAccount(env: any, sessionRaw: string | null,
     via?: string;
     scope?: string;
 } | null): Promise<LiveAccount>;
+/** The device-grant clients this deployment admits. Empty = the tier is
+ *  off (a Bearer token that is not a service session stays anonymous). */
+export declare function deviceClientIds(env: any): string[];
+/** The introspection call's OP coordinates, read once per call site. */
+export declare function opCfg(env: any): {
+    issuer: string;
+    clientId: string;
+};
+export interface OpMember {
+    sub: string;
+    scope: string;
+    via: "op-token";
+}
+/** Mutations through the device-grant bearer (memories, conversations,
+ *  projects — the member's OWN data) need the token's scope to state a
+ *  write. The grammar is the OP's PAT vocabulary (`<service>:write`);
+ *  a read-only approval stays read-only here, and service sessions
+ *  (the browser) are always full-strength. */
+export declare function opMemberCanWrite(member: {
+    via?: string;
+    scope?: string;
+} | null): boolean;
+/** The introspection answer → the member credential, judged against the
+ *  deployment's allowlist. Inactive, foreign-client or subject-less
+ *  answers all resolve to null — never to a widened guess. */
+export declare function opMemberFromIntrospection(answer: any, ids: string[]): OpMember | null;
+/** The Bearer read + introspection, KV-cached 45s keyed by the token's
+ *  hash (an ask burst costs one introspection; a deactivation lands
+ *  within a minute). The cached object is the OP's RAW answer — the
+ *  allowlist re-judges on every read, so a config change takes effect
+ *  inside the cache window too. JWTs (3 dot-segments) are NOT opaque:
+ *  they belong to the delegated lane and never reach the OP here. */
+export declare function opTokenMember(env: any, cfg: {
+    issuer: string;
+    clientId: string;
+}, req: Request): Promise<OpMember | null>;

package/dist/{search-IBZ2BK2E.js → search-V6M4KASL.js}

@@ -1,7 +1,7 @@
 import {
   handleSearch
-} from "./chunk-Z7AQEW6G.js";
-import "./chunk-GHDRKT4K.js";
+} from "./chunk-YEAAGFHB.js";
+import "./chunk-37FSCXBQ.js";
 import "./chunk-R2V3X6SQ.js";
 import "./chunk-A3QHHUN5.js";
 import "./chunk-4GJGBGJK.js";

package/dist/worker_public/src/index.js

@@ -1,6 +1,6 @@
 import {
   handleSearch
-} from "../../chunk-Z7AQEW6G.js";
+} from "../../chunk-YEAAGFHB.js";
 import {
   bindModelNode,
   checkQuoteAnchors,
@@ -9,7 +9,7 @@ import {
   modelGroundingBlock,
   scoreJudge,
   standardForDocNumber
-} from "../../chunk-YSWKFXXG.js";
+} from "../../chunk-SEOQWW77.js";
 import {
   buildMessages,
   citations,
@@ -24,6 +24,9 @@ import {
   handleLogout,
   handleMe,
   namedDocumentIn,
+  opCfg,
+  opMemberCanWrite,
+  opTokenMember,
   parseAppliedContext,
   portModelRunner,
   promptVars,
@@ -32,7 +35,7 @@ import {
   sessionFrom,
   telemetry,
   understandQuery
-} from "../../chunk-GHDRKT4K.js";
+} from "../../chunk-37FSCXBQ.js";
 import {
   authenticate,
   corsHeaders,
@@ -996,7 +999,7 @@ async function handleMcp(env, ctx, req, tier, key) {
       // stream:false forces the JSON lane (anon defaults to SSE)
       body: JSON.stringify({ ...args, stream: false })
     });
-    const res = name === "ask" ? await (await import("../../ask-P6KLPBKL.js")).handleAsk(env, ctx, inner, tier, key) : await (await import("../../search-IBZ2BK2E.js")).handleSearch(env, ctx, inner, tier, key);
+    const res = name === "ask" ? await (await import("../../ask-J6NGXPOD.js")).handleAsk(env, ctx, inner, tier, key) : await (await import("../../search-V6M4KASL.js")).handleSearch(env, ctx, inner, tier, key);
     return res.json().catch(() => ({ error: { message: "tool transport failed", status: res.status } }));
   });
   if (out.ok && "accepted" in out) return new Response(null, { status: 202 });
@@ -1025,8 +1028,9 @@ function routeMatchesPath(pattern, path) {
   return params;
 }
 function matchRoute(routes, method, path) {
+  const effective = method === "HEAD" ? "GET" : method;
   for (const route of routes) {
-    if (route.method !== method && route.method !== "*") continue;
+    if (route.method !== effective && route.method !== "*") continue;
     const params = routeMatchesPath(route.pattern, path);
     if (params) return { route, params };
   }
@@ -1307,30 +1311,54 @@ async function serveIndexPage(c) {
   }
   return err(404, "not_found", "Page not found");
 }
-async function memoriesRoute(c) {
+var MUTATING_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+async function opIdentity(c, signIn) {
   const session = await sessionFrom(c.req, c.env);
-  if (!session) return withCors(err(401, "unauthorized", "Sign in to use memory files"), corsHeaders(c.req));
-  return withCors(await handleMemories(c.env, session.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
+  if (session) return { sub: session.sub, write: true };
+  const member = await opTokenMember(c.env, opCfg(c.env), c.req);
+  if (!member) return err(401, "unauthorized", signIn);
+  return { sub: member.sub, write: opMemberCanWrite(member) };
+}
+function opWriteRefused(c, who) {
+  if (!(who instanceof Response) && MUTATING_METHODS.has(c.req.method) && !who.write) {
+    return err(403, "forbidden", "This sign-in grants read only \u2014 request a write scope at login.");
+  }
+  return null;
+}
+async function memoriesRoute(c) {
+  const who = await opIdentity(c, "Sign in to use memory files");
+  if (who instanceof Response) return withCors(who, corsHeaders(c.req));
+  const refused = opWriteRefused(c, who);
+  if (refused) return withCors(refused, corsHeaders(c.req));
+  return withCors(await handleMemories(c.env, who.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
 }
 async function projectsRoute(c) {
-  const session = await sessionFrom(c.req, c.env);
-  if (!session) return withCors(err(401, "unauthorized", "Sign in to use projects"), corsHeaders(c.req));
-  return withCors(await handleProjects(c.env, session.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
+  const who = await opIdentity(c, "Sign in to use projects");
+  if (who instanceof Response) return withCors(who, corsHeaders(c.req));
+  const refused = opWriteRefused(c, who);
+  if (refused) return withCors(refused, corsHeaders(c.req));
+  return withCors(await handleProjects(c.env, who.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
 }
 async function projectFilesRoute(c) {
-  const session = await sessionFrom(c.req, c.env);
-  if (!session) return withCors(err(401, "unauthorized", "Sign in to use projects"), corsHeaders(c.req));
-  return withCors(await handleProjectFiles(c.env, session.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
+  const who = await opIdentity(c, "Sign in to use projects");
+  if (who instanceof Response) return withCors(who, corsHeaders(c.req));
+  const refused = opWriteRefused(c, who);
+  if (refused) return withCors(refused, corsHeaders(c.req));
+  return withCors(await handleProjectFiles(c.env, who.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
 }
 async function conversationsRoute(c) {
-  const session = await sessionFrom(c.req, c.env);
-  if (!session) return withCors(err(401, "unauthorized", "Sign in to sync your conversations across devices"), corsHeaders(c.req));
-  return withCors(await handleConversations(c.env, session.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
+  const who = await opIdentity(c, "Sign in to sync your conversations across devices");
+  if (who instanceof Response) return withCors(who, corsHeaders(c.req));
+  const refused = opWriteRefused(c, who);
+  if (refused) return withCors(refused, corsHeaders(c.req));
+  return withCors(await handleConversations(c.env, who.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
 }
 async function appendMessageRoute(c) {
-  const session = await sessionFrom(c.req, c.env);
-  if (!session) return withCors(err(401, "unauthorized", "Sign in to sync your conversations across devices"), corsHeaders(c.req));
-  return withCors(await handleAppendMessage(c.env, session.sub, c.req, c.params.id), corsHeaders(c.req));
+  const who = await opIdentity(c, "Sign in to sync your conversations across devices");
+  if (who instanceof Response) return withCors(who, corsHeaders(c.req));
+  const refused = opWriteRefused(c, who);
+  if (refused) return withCors(refused, corsHeaders(c.req));
+  return withCors(await handleAppendMessage(c.env, who.sub, c.req, c.params.id), corsHeaders(c.req));
 }
 async function shareRoute(c) {
   const session = await sessionFrom(c.req, c.env);
@@ -1360,6 +1388,7 @@ async function tierFor(c) {
   }
   let tier = isApi ? "key" : "anon";
   if (!isApi && await sessionFrom(c.req, c.env)) tier = "member";
+  else if (!isApi && await opTokenMember(c.env, opCfg(c.env), c.req)) tier = "member";
   return { tier, key };
 }
 async function mcpRoute(c) {

package/package.json

@@ -27,7 +27,7 @@
     "playwright": "^1.62.1",
     "yaml": "^2.9.1"
   },
-  "version": "0.2.35",
+  "version": "0.2.37",
   "description": "The Konneal engine: the publisher-agnostic build pipeline and API plane for standards intelligence (retrieval, answer contract, verdicts, evaluation).",
   "license": "BSD-3-Clause",
   "type": "module",

package/workers/shared/router.ts

@@ -43,8 +43,11 @@ export function routeMatchesPath(pattern: string, path: string): Record<string,
 }
 
 export function matchRoute(routes: Route[], method: string, path: string): { route: Route; params: Record<string, string> } | null {
+  // HEAD rides the GET route (the fetch pipeline strips the body) — a
+  // bare HEAD / must not answer 405 to link previewers and probes.
+  const effective = method === "HEAD" ? "GET" : method;
   for (const route of routes) {
-    if (route.method !== method && route.method !== "*") continue;
+    if (route.method !== effective && route.method !== "*") continue;
     const params = routeMatchesPath(route.pattern, path);
     if (params) return { route, params };
   }

package/workers/shared/session.ts

@@ -16,8 +16,9 @@ export interface SessionClaims {
   exp: number;
   /** the credential kind: absent = the service session; "delegated" =
    *  the OP-minted RFC 8693 bearer (TODO.ai-platform/12 — the session
-   *  bridge; delegated.ts) */
-  via?: "delegated";
+   *  bridge; delegated.ts); "op-token" = the device-grant CLI's opaque
+   *  bearer, admitted through RFC 7662 introspection (livedata.ts) */
+  via?: "delegated" | "op-token";
   /** the delegating surface (the delegated bearer's act.sub — the
    *  platform instance's OP client) */
   delegator?: string;

package/workers/worker_public/src/ask.ts

@@ -19,7 +19,7 @@ import { canonicalRefusal } from "./refusal";
 import { contractV2, tableRetyped } from "./refs";
 import { completeTables, completeFigures } from "./completion";
 import { NO_CONTEXT, appliedContext, contextNote, namedDocumentIn, parseContext, resolveDocScope, syntheticUnderstanding } from "./context";
-import { liveDataConfig, liveTokenFor, resolveLiveAccount, type LiveRecord } from "./livedata";
+import { liveDataConfig, liveTokenFor, opCfg, opTokenMember, resolveLiveAccount, type LiveRecord } from "./livedata";
 import { bindModelNode, licenseBoundaryNote, licenseBoundaryRefusal, licensedEntryForPackage, modelCitation, modelEcho, modelGroundingBlock, modelNodeRefIn, standardForDocNumber } from "./modelplane";
 import { evaluate as machineEvaluate, verdictNote } from "./verdict";
 import { evaluateConditionSets, quantitiesIn, type ConditionVerdict } from "./conditions";
@@ -29,7 +29,7 @@ import { detectDraftIntent, prepareDraft } from "./drafts";
 import { detectApiCallIntent, prepareApiCall } from "./apicalls";
 import { memoryNote } from "./memories";
 import { entitlementScope, resolveRequestScope, requestSalt, standardKeysFrom } from "./requestScope";
-import { rawSessionToken } from "./session";
+import { rawSessionToken, type SessionClaims } from "./session";
 import { cacheKeyMaterial, corpusGen, exactCacheKey, freshRequested, semanticCacheKey } from "./answercache";
 import type { Env } from "./env";
 export type { Env };
@@ -286,7 +286,23 @@ async function handleAsk(
   // account's standing, never on the query alone.
   const apiCallIntent = !draftAct && P().publisher.features?.api_call_drafts ? detectApiCallIntent(q.query, declaredCtx) : null;
 
-  const member = tier === "member" ? await sessionFrom(req, env as any) : null;
+  const session = tier === "member" ? await sessionFrom(req, env as any) : null;
+  // The Ommisa tier: no service session but a device-grant CLI's opaque
+  // bearer → the OP's introspection answer admits a member-READ
+  // credential (livedata.ts). No sessionRaw behind it, so the draft and
+  // live-data lanes keep their honest "unsigned" refusals.
+  const opMember = !session && tier === "member" ? await opTokenMember(env, opCfg(env), req) : null;
+  const member: SessionClaims | null = session
+    ?? (opMember
+      ? {
+          sub: opMember.sub,
+          roles: [],
+          iat: Math.floor(Date.now() / 1000),
+          exp: Math.floor(Date.now() / 1000) + 3600,
+          via: "op-token",
+          scope: opMember.scope,
+        }
+      : null);
   // resolved before the quota check: the effort choice prices the ask
   const effort = requestEffort(env, member, (body as any)?.effort);
 

package/workers/worker_public/src/env.ts

@@ -33,6 +33,11 @@ export interface Env {
   OIDC_CLIENT_ID?: string;
   OIDC_CLIENT_SECRET?: string;
   OIDC_REDIRECT_URI?: string;
+  /** TODO.ai-platform/14 — the Ommisa tier: the OP device-grant client
+   *  ids (comma/space separated) whose opaque access tokens this
+   *  deployment admits as member-read credentials via introspection.
+   *  Empty/absent = the tier is off. */
+  OIDC_DEVICE_CLIENT_IDS?: string;
   SESSION_SECRET?: string;
   /** TODO.ai-platform/03 — the "my account" live-data delegation: the
    *  platform instance's API base + its client id at the OP (the

package/workers/worker_public/src/index.ts

@@ -3,6 +3,7 @@ export { setProfile } from "./profile.ts";
 import { retrieve } from "./pipeline";
 import type { Hit } from "./pipeline";
 import { handleCallback, handleLogin, handleLogout, handleMe, sessionFrom } from "./auth";
+import { opCfg, opMemberCanWrite, opTokenMember } from "./livedata";
 import { handleAppendMessage, handleConversations } from "./conversations";
 import { handleMemories } from "./memories";
 import { handleProjects, handleProjectFiles } from "./projects";
@@ -60,34 +61,63 @@ async function serveIndexPage(c: RouteContext): Promise<Response> {
   return err(404, "not_found", "Page not found");
 }
 
-async function memoriesRoute(c: RouteContext): Promise<Response> {
+/** The member identity behind one member-data request: the service
+ *  session first; else the Ommisa tier's introspected device-grant
+ *  bearer (READ by default — mutations also need `opMemberCanWrite`).
+ *  The CLI's memories/conversations/projects ride this. */
+const MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+async function opIdentity(c: RouteContext, signIn: string): Promise<{ sub: string; write: boolean } | Response> {
   const session = await sessionFrom(c.req, c.env as any);
-  if (!session) return withCors(err(401, "unauthorized", "Sign in to use memory files"), corsHeaders(c.req));
-  return withCors(await handleMemories(c.env, session.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
+  if (session) return { sub: session.sub, write: true };
+  const member = await opTokenMember(c.env, opCfg(c.env), c.req);
+  if (!member) return err(401, "unauthorized", signIn);
+  return { sub: member.sub, write: opMemberCanWrite(member) };
+}
+function opWriteRefused(c: RouteContext, who: { write: boolean } | Response): Response | null {
+  if (!(who instanceof Response) && MUTATING_METHODS.has(c.req.method) && !who.write) {
+    return err(403, "forbidden", "This sign-in grants read only — request a write scope at login.");
+  }
+  return null;
+}
+
+async function memoriesRoute(c: RouteContext): Promise<Response> {
+  const who = await opIdentity(c, "Sign in to use memory files");
+  if (who instanceof Response) return withCors(who, corsHeaders(c.req));
+  const refused = opWriteRefused(c, who);
+  if (refused) return withCors(refused, corsHeaders(c.req));
+  return withCors(await handleMemories(c.env, who.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
 }
 
 async function projectsRoute(c: RouteContext): Promise<Response> {
-  const session = await sessionFrom(c.req, c.env as any);
-  if (!session) return withCors(err(401, "unauthorized", "Sign in to use projects"), corsHeaders(c.req));
-  return withCors(await handleProjects(c.env, session.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
+  const who = await opIdentity(c, "Sign in to use projects");
+  if (who instanceof Response) return withCors(who, corsHeaders(c.req));
+  const refused = opWriteRefused(c, who);
+  if (refused) return withCors(refused, corsHeaders(c.req));
+  return withCors(await handleProjects(c.env, who.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
 }
 
 async function projectFilesRoute(c: RouteContext): Promise<Response> {
-  const session = await sessionFrom(c.req, c.env as any);
-  if (!session) return withCors(err(401, "unauthorized", "Sign in to use projects"), corsHeaders(c.req));
-  return withCors(await handleProjectFiles(c.env, session.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
+  const who = await opIdentity(c, "Sign in to use projects");
+  if (who instanceof Response) return withCors(who, corsHeaders(c.req));
+  const refused = opWriteRefused(c, who);
+  if (refused) return withCors(refused, corsHeaders(c.req));
+  return withCors(await handleProjectFiles(c.env, who.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
 }
 
 async function conversationsRoute(c: RouteContext): Promise<Response> {
-  const session = await sessionFrom(c.req, c.env as any);
-  if (!session) return withCors(err(401, "unauthorized", "Sign in to sync your conversations across devices"), corsHeaders(c.req));
-  return withCors(await handleConversations(c.env, session.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
+  const who = await opIdentity(c, "Sign in to sync your conversations across devices");
+  if (who instanceof Response) return withCors(who, corsHeaders(c.req));
+  const refused = opWriteRefused(c, who);
+  if (refused) return withCors(refused, corsHeaders(c.req));
+  return withCors(await handleConversations(c.env, who.sub, c.req, { method: c.req.method, id: c.params.id }), corsHeaders(c.req));
 }
 
 async function appendMessageRoute(c: RouteContext): Promise<Response> {
-  const session = await sessionFrom(c.req, c.env as any);
-  if (!session) return withCors(err(401, "unauthorized", "Sign in to sync your conversations across devices"), corsHeaders(c.req));
-  return withCors(await handleAppendMessage(c.env, session.sub, c.req, c.params.id!), corsHeaders(c.req));
+  const who = await opIdentity(c, "Sign in to sync your conversations across devices");
+  if (who instanceof Response) return withCors(who, corsHeaders(c.req));
+  const refused = opWriteRefused(c, who);
+  if (refused) return withCors(refused, corsHeaders(c.req));
+  return withCors(await handleAppendMessage(c.env, who.sub, c.req, c.params.id!), corsHeaders(c.req));
 }
 
 async function shareRoute(c: RouteContext): Promise<Response> {
@@ -128,7 +158,10 @@ async function tierFor(c: RouteContext): Promise<{ tier: "anon" | "key" | "membe
   // No SESSION_SECRET precondition: the delegated bearer (the platform
   // bubble's OP-minted JWT, delegated.ts) admits the member lane on its
   // own — sessionFrom returns null honestly when neither lane applies.
+  // The Ommisa tier rides the same admission: a device-grant CLI's
+  // opaque bearer, introspected at the OP (livedata.ts).
   if (!isApi && (await sessionFrom(c.req, c.env as any))) tier = "member";
+  else if (!isApi && (await opTokenMember(c.env, opCfg(c.env), c.req))) tier = "member";
   return { tier, key };
 }
 

package/workers/worker_public/src/livedata.ts

@@ -390,3 +390,97 @@ export async function resolveLiveAccount(
   if (!read.ok) return { status: "unavailable", reason: read.reason };
   return { status: "ok", records: read.records, stores: read.stores, readAt: read.readAt };
 }
+
+// ── the Ommisa tier (RFC 7662 introspection) ─────────────────────────
+// The CLI signs in through the OP's device grant (RFC 8628) and holds an
+// OPAQUE access token. This deployment never saw that grant — it learns
+// the token the only honest way: it asks the OP (introspection, as an
+// active registered client), then admits the caller as a member-READ
+// credential. Writes, drafts and the live-data exchange stay session
+// acts (the CLI has no service session to exchange — rawSessionToken is
+// null, so those lanes already refuse honestly).
+
+/** The device-grant clients this deployment admits. Empty = the tier is
+ *  off (a Bearer token that is not a service session stays anonymous). */
+export function deviceClientIds(env: any): string[] {
+  return String(env.OIDC_DEVICE_CLIENT_IDS ?? "")
+    .split(/[\s,]+/)
+    .filter(Boolean);
+}
+
+/** The introspection call's OP coordinates, read once per call site. */
+export function opCfg(env: any): { issuer: string; clientId: string } {
+  return { issuer: String(env.OIDC_ISSUER ?? "").trim().replace(/\/+$/, ""), clientId: String(env.OIDC_CLIENT_ID ?? "") };
+}
+
+export interface OpMember {
+  sub: string;
+  scope: string;
+  via: "op-token";
+}
+
+/** Mutations through the device-grant bearer (memories, conversations,
+ *  projects — the member's OWN data) need the token's scope to state a
+ *  write. The grammar is the OP's PAT vocabulary (`<service>:write`);
+ *  a read-only approval stays read-only here, and service sessions
+ *  (the browser) are always full-strength. */
+export function opMemberCanWrite(member: { via?: string; scope?: string } | null): boolean {
+  if (!member) return false;
+  if (member.via !== "op-token") return true;
+  return /\bwrite\b/.test(member.scope ?? "");
+}
+
+/** The introspection answer → the member credential, judged against the
+ *  deployment's allowlist. Inactive, foreign-client or subject-less
+ *  answers all resolve to null — never to a widened guess. */
+export function opMemberFromIntrospection(answer: any, ids: string[]): OpMember | null {
+  if (!answer?.active) return null;
+  const clientId = String(answer.client_id ?? "");
+  if (!ids.includes(clientId)) return null;
+  const sub = String(answer.sub ?? "");
+  if (!sub) return null;
+  return { sub, scope: String(answer.scope ?? ""), via: "op-token" };
+}
+
+/** The Bearer read + introspection, KV-cached 45s keyed by the token's
+ *  hash (an ask burst costs one introspection; a deactivation lands
+ *  within a minute). The cached object is the OP's RAW answer — the
+ *  allowlist re-judges on every read, so a config change takes effect
+ *  inside the cache window too. JWTs (3 dot-segments) are NOT opaque:
+ *  they belong to the delegated lane and never reach the OP here. */
+export async function opTokenMember(
+  env: any,
+  cfg: { issuer: string; clientId: string },
+  req: Request,
+): Promise<OpMember | null> {
+  const m = /^Bearer\s+(.+)$/i.exec((req.headers.get("Authorization") ?? "").trim());
+  const token = m?.[1]?.trim();
+  if (!token || token.split(".").length === 3) return null;
+  const ids = deviceClientIds(env);
+  if (!ids.length || !cfg.issuer || !cfg.clientId) return null;
+  const key = `opint:${await sha256Hex(token)}`;
+  let answer: any = null;
+  try {
+    answer = await env.CACHE.get(key, "json");
+  } catch {
+    /* a KV hiccup costs one extra introspection */
+  }
+  if (answer === undefined || answer === null) {
+    try {
+      const res = await fetch(`${cfg.issuer}/op/introspect`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ token, client_id: cfg.clientId }),
+      });
+      answer = res.ok ? await res.json() : { active: false };
+    } catch {
+      return null;
+    }
+    try {
+      await env.CACHE.put(key, JSON.stringify(answer ?? { active: false }), { expirationTtl: 45 });
+    } catch {
+      /* cacheless = introspect per ask */
+    }
+  }
+  return opMemberFromIntrospection(answer, ids);
+}