@livedesk/hub 0.1.58 → 0.1.59

package/src/server.js

@@ -60,11 +60,18 @@ import { PRODUCTION_SUPABASE_PUBLISHABLE_KEY, PRODUCTION_SUPABASE_URL } from '..
 import { createHubRuntime } from './runtime/hub-runtime.js';
 import { hubRuntimeStatus } from './runtime/hub-runtime-status.js';
 import { roleGuardResponse } from './http/hub-role-guard.js';
-import {
-  clearHubUiSessionCookie,
-  createHubUiSessionAuthority,
-  serializeHubUiSessionCookie
-} from './http/hub-ui-session.js';
+import {
+  clearHubUiSessionCookie,
+  createHubUiSessionAuthority,
+  serializeHubUiSessionCookie
+} from './http/hub-ui-session.js';
+import {
+  resolveWorkspaceAccess,
+  WorkspaceAccessError,
+  workspaceEntitlementCanRequest,
+  workspaceRoleCanControl,
+  workspaceRoleCanRequest
+} from './auth/workspace-access.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const webDistCandidates = [
@@ -176,7 +183,8 @@ const supabasePublishableKey = String(configuredSupabaseKey || PRODUCTION_SUPABA
 const SUPABASE_AUTH_TIMEOUT_MS = process.env.LIVEDESK_AUTH_TEST_MODE === '1'
   ? readPositiveIntegerEnv('LIVEDESK_AUTH_TEST_TIMEOUT_MS', AUTH_REQUEST_TIMEOUT_MS)
   : AUTH_REQUEST_TIMEOUT_MS;
-const CLIENT_AUTH_STORAGE_KEY = 'livedesk.client.supabase.auth';
+const CLIENT_AUTH_STORAGE_KEY = 'livedesk.client.supabase.auth';
+const HUB_WORKSPACE_STORAGE_KEY = 'livedesk.hub.workspace';
 const runtimeAuthStatePath = process.env.LIVEDESK_DESKTOP_HOST === '1'
   ? ''
   : String(process.env.LIVEDESK_AUTH_STATE_PATH || '').trim();
@@ -194,10 +202,18 @@ const persistentSessionGcToken = persistentSessionGcEnabled
   ? String(process.env.LIVEDESK_PERSISTENT_SESSION_TEST_TOKEN || '').trim()
   : '';
 let connectedDeviceCount = 0;
-let runtimeAccessToken = '';
-let runtimeRefreshToken = '';
-let runtimeAccessTokenExpiresAt = 0;
-const hubUiSessionAuthority = createHubUiSessionAuthority();
+let runtimeAccessToken = '';
+let runtimeRefreshToken = '';
+let runtimeAccessTokenExpiresAt = 0;
+let runtimeAuthEpoch = 0;
+let runtimeAccessTokenRefreshOwner = null;
+let runtimeWorkspaceAccess = null;
+let workspaceAccessLastAttemptAt = 0;
+let licenseRefreshLastAttemptAt = 0;
+const hubUiSessionAuthority = createHubUiSessionAuthority({
+  onRevoke: (session, reason) => retireHubUiSessionSockets(session, reason)
+});
+const consoleProxyToken = crypto.randomBytes(32).toString('base64url');
 let roleWatchInFlight = false;
 let verifiedLicense = {
   userId: '',
@@ -217,7 +233,16 @@ const HUB_HOST_TARGET_RENEW_MS = Math.max(1000, Math.min(
   readPositiveIntegerEnv('LIVEDESK_HOST_TARGET_RENEW_MS', 20_000),
   Math.max(1000, HUB_HOST_TARGET_LEASE_MS - 1000)
 ));
-const HUB_ACCESS_TOKEN_REFRESH_SKEW_MS = 90_000;
+const HUB_ACCESS_TOKEN_REFRESH_SKEW_MS = 90_000;
+const WORKSPACE_ACCESS_REVERIFY_MS = Math.max(
+  30_000,
+  Math.min(5 * 60_000, readPositiveIntegerEnv('LIVEDESK_WORKSPACE_ACCESS_REVERIFY_MS', 60_000))
+);
+const LICENSE_REFRESH_INTERVAL_MS = Math.max(
+  30 * 60_000,
+  readPositiveIntegerEnv('LIVEDESK_LICENSE_REFRESH_INTERVAL_MS', 30 * 60_000)
+);
+const TEAM_UI_ACCESS_MAX_AGE_MS = 60_000;
 const hubWakeBaseUrl = String(process.env.LIVEDESK_WAKE_URL || 'https://livedesk-wake.lovecrdm.workers.dev').trim();
 const hubConsoleDirectSignalBaseUrl = String(
   process.env.LIVEDESK_CONSOLE_SIGNAL_URL
@@ -368,7 +393,7 @@ function handleRemoteHubEvent(type, event) {
   }
 }
 
-function activeLicensePlan() {
+function activeLicensePlan() {
   if (testLicensePlan) {
     return testLicensePlan;
   }
@@ -381,12 +406,22 @@ function activeLicensePlan() {
   if (Number.isFinite(expiresAt) && expiresAt <= now) {
     return 'free';
   }
-  return verifiedLicense.plan === 'pro' ? 'pro' : verifiedLicense.plan === 'ltd' ? 'ltd' : 'free';
-}
-
-function activeDeviceLimit() {
-  const plan = activeLicensePlan();
-  return plan === 'pro' ? Number.POSITIVE_INFINITY : plan === 'ltd' ? PLUS_DEVICE_LIMIT : FREE_DEVICE_LIMIT;
+  return verifiedLicense.plan === 'team'
+    ? 'team'
+    : verifiedLicense.plan === 'pro'
+      ? 'pro'
+      : verifiedLicense.plan === 'ltd'
+        ? 'ltd'
+        : 'free';
+}
+
+function activeDeviceLimit() {
+  const plan = activeLicensePlan();
+  return plan === 'team' || plan === 'pro'
+    ? Number.POSITIVE_INFINITY
+    : plan === 'ltd'
+      ? PLUS_DEVICE_LIMIT
+      : FREE_DEVICE_LIMIT;
 }
 
 function hasHubFeatureAccess() {
@@ -409,7 +444,7 @@ function hasHubFeatureAccessForRequest(req) {
   return ids.size <= limit;
 }
 
-function licenseSnapshot() {
+function licenseSnapshot() {
   const plan = activeLicensePlan();
   const limit = activeDeviceLimit();
   return {
@@ -417,47 +452,80 @@ function licenseSnapshot() {
     status: plan === 'free' ? 'free' : 'active',
     deviceLimit: Number.isFinite(limit) ? limit : null,
     connectedDeviceCount,
-    featureAccess: connectedDeviceCount <= limit,
-    verifiedAt: verifiedLicense.verifiedAt ? new Date(verifiedLicense.verifiedAt).toISOString() : '',
+    featureAccess: connectedDeviceCount <= limit,
+    workspaceId: verifiedLicense.workspaceId || runtimeWorkspaceAccess?.workspaceId || '',
+    workspaceKind: verifiedLicense.workspaceKind || runtimeWorkspaceAccess?.workspaceKind || 'personal',
+    memberLimit: Number.isSafeInteger(verifiedLicense.memberLimit) ? verifiedLicense.memberLimit : 1,
+    commercialUse: verifiedLicense.commercialUse === true,
+    verifiedAt: verifiedLicense.verifiedAt ? new Date(verifiedLicense.verifiedAt).toISOString() : '',
     expiresAt: verifiedLicense.expiresAt || ''
   };
-}
-
-async function syncVerifiedLicense(accessToken) {
-  const token = String(accessToken || '').trim();
+}
+
+function workspaceAccessSnapshot(access = runtimeWorkspaceAccess) {
+  if (!access?.workspaceId) return null;
+  return {
+    workspaceId: access.workspaceId,
+    name: access.workspaceName || '',
+    kind: access.workspaceKind || 'personal',
+    role: access.role || '',
+    membershipRevision: Math.max(0, Number(access.membershipRevision || 0)),
+    plan: access.plan || 'free',
+    status: access.entitlementStatus || 'inactive',
+    deviceLimit: access.deviceLimit,
+    memberLimit: access.memberLimit,
+    commercialUse: access.commercialUse === true,
+    verifiedAt: access.verifiedAt ? new Date(access.verifiedAt).toISOString() : ''
+  };
+}
+
+function workspaceRemoteAccessActive(access = runtimeWorkspaceAccess) {
+  return Boolean(access?.workspaceId) && (access.workspaceKind !== 'team'
+    || (access?.plan === 'team' && access?.entitlementStatus === 'active'));
+}
+
+async function verifyWorkspaceAccess(accessToken, user, requestedWorkspaceId = '') {
+  return resolveWorkspaceAccess({
+    accessToken,
+    requestedWorkspaceId,
+    userId: user?.id || '',
+    supabaseUrl,
+    supabasePublishableKey,
+    fetchResponse: (url, options, timeoutMs) => fetchAuthResponse(fetch, url, options, timeoutMs),
+    timeoutMs: SUPABASE_AUTH_TIMEOUT_MS
+  });
+}
+
+function applyVerifiedWorkspaceLicense(access) {
+  verifiedLicense = {
+    userId: access.userId || '',
+    workspaceId: access.workspaceId,
+    workspaceKind: access.workspaceKind,
+    plan: ['ltd', 'pro', 'team'].includes(access.plan) ? access.plan : 'free',
+    status: access.entitlementStatus === 'active' ? 'active' : 'inactive',
+    expiresAt: '',
+    memberLimit: access.memberLimit,
+    commercialUse: access.commercialUse === true,
+    verifiedAt: Date.now()
+  };
+  return licenseSnapshot();
+}
+
+async function syncVerifiedLicense(accessToken, requestedWorkspaceId = '') {
+  const token = String(accessToken || '').trim();
   if (!token) {
     throw new Error('supabase-access-token-required');
-  }
-  const user = await verifySupabaseUser(token);
-  const headers = {
-    apikey: supabasePublishableKey,
-    Authorization: `Bearer ${token}`,
-    Accept: 'application/json'
-  };
-  const userId = user.id;
-  const query = new URLSearchParams({
-    select: 'user_id,product_key,plan,status,expires_at,updated_at',
-    user_id: `eq.${userId}`,
-    product_key: 'eq.livedesk',
-    limit: '1'
-  });
-  const entitlementResponse = await fetch(`${supabaseUrl}/rest/v1/livedesk_entitlements?${query}`, { headers });
-  if (!entitlementResponse.ok) {
-    throw new Error(`supabase-entitlement-query-failed:${entitlementResponse.status}`);
-  }
-  const rows = await entitlementResponse.json();
-  const entitlement = Array.isArray(rows) ? rows[0] : null;
-  const plan = entitlement?.plan === 'pro' ? 'pro' : entitlement?.plan === 'ltd' ? 'ltd' : 'free';
-  const status = entitlement?.status === 'active' ? 'active' : 'inactive';
-  verifiedLicense = {
-    userId,
-    plan,
-    status,
-    expiresAt: String(entitlement?.expires_at || ''),
-    verifiedAt: Date.now()
-  };
-  return licenseSnapshot();
-}
+  }
+  const user = await verifySupabaseUser(token);
+  const selectedWorkspaceId = String(
+    requestedWorkspaceId
+    || runtimeWorkspaceAccess?.workspaceId
+    || readPersistedWorkspaceId()
+    || ''
+  ).trim();
+  const access = await verifyWorkspaceAccess(token, user, selectedWorkspaceId);
+  return applyVerifiedWorkspaceLicense(access);
+}
 
 function normalizeSessionExpiryMs(value) {
   const numeric = Number(value || 0);
@@ -475,7 +543,7 @@ function readRuntimeAuthState() {
   }
 }
 
-function readPersistedRuntimeSession(state = readRuntimeAuthState()) {
+function readPersistedRuntimeSession(state = readRuntimeAuthState()) {
   try {
     const raw = state?.[CLIENT_AUTH_STORAGE_KEY];
     const session = typeof raw === 'string' ? JSON.parse(raw) : raw;
@@ -483,7 +551,12 @@ function readPersistedRuntimeSession(state = readRuntimeAuthState()) {
   } catch {
     return null;
   }
-}
+}
+
+function readPersistedWorkspaceId(state = readRuntimeAuthState()) {
+  const workspaceId = String(state?.[HUB_WORKSPACE_STORAGE_KEY]?.workspaceId || '').trim();
+  return workspaceId.slice(0, 160);
+}
 
 function writePrivateRuntimeAuthState(state) {
   if (!runtimeAuthStatePath) return false;
@@ -501,7 +574,7 @@ function writePrivateRuntimeAuthState(state) {
   }
 }
 
-function persistRuntimeSession(session) {
+function persistRuntimeSession(session) {
   if (!runtimeAuthStatePath) return false;
   const state = readRuntimeAuthState();
   const previous = readPersistedRuntimeSession(state) || {};
@@ -526,25 +599,43 @@ function persistRuntimeSession(session) {
   state[CLIENT_AUTH_STORAGE_KEY] = JSON.stringify(normalized.session);
   writePrivateRuntimeAuthState(state);
   return true;
-}
+}
+
+function persistRuntimeWorkspace(access) {
+  const workspaceId = String(access?.workspaceId || '').trim();
+  if (!runtimeAuthStatePath || !workspaceId) return false;
+  const state = readRuntimeAuthState();
+  state[HUB_WORKSPACE_STORAGE_KEY] = {
+    workspaceId,
+    workspaceKind: String(access?.workspaceKind || 'personal'),
+    selectedAt: new Date().toISOString()
+  };
+  writePrivateRuntimeAuthState(state);
+  return true;
+}
 
-function clearPersistedRuntimeSession() {
+function clearPersistedRuntimeSession() {
   if (!runtimeAuthStatePath) return false;
-  const state = readRuntimeAuthState();
-  delete state[CLIENT_AUTH_STORAGE_KEY];
-  return writePrivateRuntimeAuthState(state);
-}
+  const state = readRuntimeAuthState();
+  delete state[CLIENT_AUTH_STORAGE_KEY];
+  delete state[HUB_WORKSPACE_STORAGE_KEY];
+  return writePrivateRuntimeAuthState(state);
+}
 
-function clearRuntimeSession() {
-  runtimeAccessToken = '';
-  runtimeRefreshToken = '';
-  runtimeAccessTokenExpiresAt = 0;
+function clearRuntimeSession() {
+  runtimeAuthEpoch += 1;
+  runtimeAccessToken = '';
+  runtimeRefreshToken = '';
+  runtimeAccessTokenExpiresAt = 0;
+  runtimeWorkspaceAccess = null;
+  workspaceAccessLastAttemptAt = 0;
+  licenseRefreshLastAttemptAt = 0;
   hubUiSessionAuthority.revokeAll();
   runtimeManager.setAuthenticated(false);
   try { clearPersistedRuntimeSession(); } catch { /* runtime auth is already invalid */ }
 }
 
-async function getRuntimeAccessToken() {
+async function getRuntimeAccessToken() {
   const accessToken = String(runtimeAccessToken || '').trim();
   const expiresSoon = runtimeAccessTokenExpiresAt > 0
     && runtimeAccessTokenExpiresAt <= Date.now() + HUB_ACCESS_TOKEN_REFRESH_SKEW_MS;
@@ -560,52 +651,74 @@ async function getRuntimeAccessToken() {
     return accessToken;
   }
 
-  const refreshToken = String(runtimeRefreshToken || '').trim();
-  if (!refreshToken) {
-    return accessToken;
-  }
-
-  const response = await fetchAuthResponse(
-    fetch,
-    `${supabaseUrl}/auth/v1/token?grant_type=refresh_token`,
-    {
-      method: 'POST',
-      headers: {
-        apikey: supabasePublishableKey,
-        'Content-Type': 'application/json',
-        Accept: 'application/json'
-      },
-      body: JSON.stringify({ refresh_token: refreshToken })
-    },
-    SUPABASE_AUTH_TIMEOUT_MS
-  );
-  if (!response.ok) {
-    if (response.status === 400 || response.status === 401 || response.status === 403) {
-      clearRuntimeSession();
-      throw new Error(`hub-session-refresh-failed:${response.status}`);
-    }
-    throw new Error(`hub-session-refresh-provider-failed:${response.status}`);
-  }
-  const refreshed = await response.json().catch(() => null);
-  const nextAccessToken = String(refreshed?.access_token || '').trim();
-  if (!nextAccessToken) {
-    throw new Error('hub-session-refresh-missing-access-token');
-  }
-  runtimeAccessToken = nextAccessToken;
-  runtimeRefreshToken = String(refreshed?.refresh_token || refreshToken).trim();
-  runtimeAccessTokenExpiresAt = normalizeSessionExpiryMs(refreshed?.expires_at)
-    || (Number(refreshed?.expires_in) > 0 ? Date.now() + Number(refreshed.expires_in) * 1000 : 0);
-  try {
-    persistRuntimeSession({
-      access_token: runtimeAccessToken,
-      refresh_token: runtimeRefreshToken,
-      expires_at: Math.floor(runtimeAccessTokenExpiresAt / 1000)
-    });
-  } catch (error) {
-    console.warn(`[VuvoDesk Hub] Refreshed session persistence failed: ${error?.message || error}`);
-  }
-  return runtimeAccessToken;
-}
+  const refreshToken = String(runtimeRefreshToken || '').trim();
+  if (!refreshToken) {
+    return accessToken;
+  }
+  if (runtimeAccessTokenRefreshOwner?.epoch === runtimeAuthEpoch
+    && runtimeAccessTokenRefreshOwner.refreshToken === refreshToken) {
+    return runtimeAccessTokenRefreshOwner.promise;
+  }
+  const owner = {
+    epoch: runtimeAuthEpoch,
+    userId: currentBoundHubUserId(),
+    workspaceId: currentBoundHubWorkspaceId(),
+    refreshToken,
+    promise: null
+  };
+  owner.promise = (async () => {
+    const response = await fetchAuthResponse(
+      fetch,
+      `${supabaseUrl}/auth/v1/token?grant_type=refresh_token`,
+      {
+        method: 'POST',
+        headers: {
+          apikey: supabasePublishableKey,
+          'Content-Type': 'application/json',
+          Accept: 'application/json'
+        },
+        body: JSON.stringify({ refresh_token: refreshToken })
+      },
+      SUPABASE_AUTH_TIMEOUT_MS
+    );
+    if (!response.ok) {
+      if (response.status === 400 || response.status === 401 || response.status === 403) {
+        if (runtimeAuthEpoch === owner.epoch && runtimeRefreshToken === owner.refreshToken) {
+          clearRuntimeSession();
+        }
+        throw new Error(`hub-session-refresh-failed:${response.status}`);
+      }
+      throw new Error(`hub-session-refresh-provider-failed:${response.status}`);
+    }
+    const refreshed = await response.json().catch(() => null);
+    const nextAccessToken = String(refreshed?.access_token || '').trim();
+    if (!nextAccessToken) throw new Error('hub-session-refresh-missing-access-token');
+    if (runtimeAuthEpoch !== owner.epoch
+      || runtimeRefreshToken !== owner.refreshToken
+      || currentBoundHubUserId() !== owner.userId
+      || currentBoundHubWorkspaceId() !== owner.workspaceId) {
+      throw new Error('hub-session-refresh-superseded');
+    }
+    runtimeAccessToken = nextAccessToken;
+    runtimeRefreshToken = String(refreshed?.refresh_token || refreshToken).trim();
+    runtimeAccessTokenExpiresAt = normalizeSessionExpiryMs(refreshed?.expires_at)
+      || (Number(refreshed?.expires_in) > 0 ? Date.now() + Number(refreshed.expires_in) * 1000 : 0);
+    try {
+      persistRuntimeSession({
+        access_token: runtimeAccessToken,
+        refresh_token: runtimeRefreshToken,
+        expires_at: Math.floor(runtimeAccessTokenExpiresAt / 1000)
+      });
+    } catch (error) {
+      console.warn(`[VuvoDesk Hub] Refreshed session persistence failed: ${error?.message || error}`);
+    }
+    return runtimeAccessToken;
+  })().finally(() => {
+    if (runtimeAccessTokenRefreshOwner === owner) runtimeAccessTokenRefreshOwner = null;
+  });
+  runtimeAccessTokenRefreshOwner = owner;
+  return owner.promise;
+}
 
 async function verifySupabaseUser(accessToken) {
   const token = String(accessToken || '').trim();
@@ -637,21 +750,51 @@ async function verifySupabaseUser(accessToken) {
   };
 }
 
-function authVerificationHttpStatus(message) {
+function authVerificationHttpStatus(message) {
   const upstreamStatus = Number(String(message || '').match(/supabase-user-verification-failed:(\d+)/)?.[1] || 0);
   return upstreamStatus === 401 || upstreamStatus === 403 ? 401 : 502;
 }
 
-async function queryAuthoritativeRuntimeRole() {
-  const accessToken = await getRuntimeAccessToken();
-  if (runtimeRole !== 'hub' || !accessToken || !runtimeDeviceId) {
-    return '';
-  }
-  const query = new URLSearchParams({
-    select: 'role,enabled,role_version,assigned_hub_id',
-    device_id: `eq.${runtimeDeviceId}`,
-    limit: '1'
-  });
+async function queryRuntimeDeviceWorkspace(accessToken) {
+  const token = String(accessToken || '').trim();
+  if (!token || !runtimeDeviceId) return '';
+  const query = new URLSearchParams({
+    select: 'workspace_id,role,enabled',
+    device_id: `eq.${runtimeDeviceId}`,
+    enabled: 'eq.true',
+    limit: '1'
+  });
+  const response = await fetchAuthResponse(
+    fetch,
+    `${supabaseUrl}/rest/v1/livedesk_devices?${query}`,
+    {
+      headers: {
+        apikey: supabasePublishableKey,
+        Authorization: `Bearer ${token}`,
+        Accept: 'application/json'
+      }
+    },
+    SUPABASE_AUTH_TIMEOUT_MS
+  );
+  if (response.status === 401 || response.status === 403) {
+    throw new Error(`hub-device-workspace-query-not-authenticated:${response.status}`);
+  }
+  if (!response.ok) return '';
+  const rows = await response.json().catch(() => []);
+  const record = Array.isArray(rows) ? rows[0] : null;
+  return record?.enabled === false ? '' : String(record?.workspace_id || '').trim();
+}
+
+async function queryAuthoritativeRuntimeDevice() {
+  const accessToken = await getRuntimeAccessToken();
+  if (runtimeRole !== 'hub' || !accessToken || !runtimeDeviceId) {
+    return { role: '', workspaceId: '' };
+  }
+  const query = new URLSearchParams({
+    select: 'workspace_id,role,enabled,role_version,assigned_hub_id',
+    device_id: `eq.${runtimeDeviceId}`,
+    limit: '1'
+  });
   const response = await fetchAuthResponse(
     fetch,
     `${supabaseUrl}/rest/v1/livedesk_devices?${query}`,
@@ -664,38 +807,149 @@ async function queryAuthoritativeRuntimeRole() {
     },
     SUPABASE_AUTH_TIMEOUT_MS
   );
-  if (response.status === 401 || response.status === 403) {
-    if (!desktopMainAuthConfig) clearRuntimeSession();
-    throw new Error(`hub-role-query-not-authenticated:${response.status}`);
+  if (response.status === 401 || response.status === 403) {
+    throw new Error(`hub-role-query-not-authenticated:${response.status}`);
   }
   if (!response.ok) {
     throw new Error(`hub-role-query-failed:${response.status}`);
   }
   const rows = await response.json().catch(() => []);
   const record = Array.isArray(rows) ? rows[0] : null;
-  if (!record || record.enabled === false) {
-    return '';
-  }
-  const role = String(record.role || '').trim().toLowerCase();
-  return role === 'hub' || role === 'client' ? role : '';
-}
+  if (!record || record.enabled === false) {
+    return { role: '', workspaceId: '' };
+  }
+  const role = String(record.role || '').trim().toLowerCase();
+  return {
+    role: role === 'hub' || role === 'client' ? role : '',
+    workspaceId: String(record.workspace_id || '').trim()
+  };
+}
+
+async function queryAuthoritativeRuntimeRole() {
+  return (await queryAuthoritativeRuntimeDevice()).role;
+}
 
-async function watchAuthoritativeRuntimeRole() {
+async function watchAuthoritativeRuntimeRole() {
   if (runtimeRole !== 'hub' || roleWatchInFlight || !runtimeAccessToken) {
     return;
-  }
-  roleWatchInFlight = true;
-  try {
-    const role = await queryAuthoritativeRuntimeRole();
+  }
+  const watchAuthEpoch = runtimeAuthEpoch;
+  const watchUserId = currentBoundHubUserId();
+  const watchWorkspaceId = currentBoundHubWorkspaceId();
+  roleWatchInFlight = true;
+  try {
+    const authoritativeDevice = await queryAuthoritativeRuntimeDevice();
+    if (runtimeAuthEpoch !== watchAuthEpoch
+      || currentBoundHubUserId() !== watchUserId
+      || currentBoundHubWorkspaceId() !== watchWorkspaceId) return;
+    const role = authoritativeDevice.role;
     if (role === 'client') {
       console.warn('[VuvoDesk Hub] Supabase selected another Sync Server. Transitioning this runtime to Client.');
       void clearHubHostTarget('role-demoted').finally(() => {
-        setTimeout(() => process.exit(ROLE_TRANSITION_EXIT_CODE), 150);
-      });
-    }
-  } catch {
-    // A temporary provider failure must not stop a working Hub. The next
-    // interval retries the authoritative role check.
+        setTimeout(() => process.exit(ROLE_TRANSITION_EXIT_CODE), 150);
+      });
+      return;
+    }
+    if (authoritativeDevice.workspaceId
+      && authoritativeDevice.workspaceId !== currentBoundHubWorkspaceId()) {
+      const token = await getRuntimeAccessToken();
+      const userId = currentBoundHubUserId();
+      const movedAccess = await verifyWorkspaceAccess(
+        token,
+        { id: userId },
+        authoritativeDevice.workspaceId
+      );
+      if (movedAccess.userId !== userId || movedAccess.role !== 'owner') {
+        throw new WorkspaceAccessError('hub-device-workspace-mismatch', { status: 403 });
+      }
+      if (runtimeAuthEpoch !== watchAuthEpoch
+        || currentBoundHubUserId() !== watchUserId
+        || currentBoundHubWorkspaceId() !== watchWorkspaceId) return;
+      await clearHubHostTarget('hub-workspace-moved');
+      if (runtimeAuthEpoch !== watchAuthEpoch
+        || currentBoundHubUserId() !== watchUserId
+        || currentBoundHubWorkspaceId() !== watchWorkspaceId) return;
+      hubUiSessionAuthority.revokeAll('hub-workspace-moved');
+      runtimeAuthEpoch += 1;
+      runtimeWorkspaceAccess = movedAccess;
+      try { persistRuntimeWorkspace(movedAccess); } catch {}
+      applyVerifiedWorkspaceLicense(movedAccess);
+      licenseRefreshLastAttemptAt = Date.now();
+      workspaceAccessLastAttemptAt = Date.now();
+      hubConsoleDirect?.invalidateWorkspaceAccess('hub-workspace-moved');
+      if (workspaceRemoteAccessActive(movedAccess)) {
+        scheduleAuthenticatedHubHostTargetPublication('hub-workspace-moved');
+      }
+      return;
+    }
+    const now = Date.now();
+    if (now - workspaceAccessLastAttemptAt < WORKSPACE_ACCESS_REVERIFY_MS) {
+      return;
+    }
+    workspaceAccessLastAttemptAt = now;
+    const token = await getRuntimeAccessToken();
+    const userId = currentBoundHubUserId();
+    const previousAccess = runtimeWorkspaceAccess;
+    const access = await verifyWorkspaceAccess(token, { id: userId }, currentBoundHubWorkspaceId());
+    if (access.role !== 'owner') {
+      throw new WorkspaceAccessError('workspace-owner-required', { status: 403 });
+    }
+    if (runtimeAuthEpoch !== watchAuthEpoch
+      || currentBoundHubUserId() !== watchUserId
+      || currentBoundHubWorkspaceId() !== watchWorkspaceId) return;
+    const licenseChanged = !previousAccess
+      || previousAccess.plan !== access.plan
+      || previousAccess.entitlementStatus !== access.entitlementStatus
+      || previousAccess.deviceLimit !== access.deviceLimit
+      || previousAccess.memberLimit !== access.memberLimit
+      || previousAccess.commercialUse !== access.commercialUse;
+    const teamBecameInactive = access.workspaceKind === 'team'
+      && !workspaceRemoteAccessActive(access)
+      && workspaceRemoteAccessActive(previousAccess);
+    const teamBecameActive = access.workspaceKind === 'team'
+      && workspaceRemoteAccessActive(access)
+      && !workspaceRemoteAccessActive(previousAccess);
+    runtimeWorkspaceAccess = access;
+    try { persistRuntimeWorkspace(access); } catch { /* the verified in-memory owner remains authoritative */ }
+    if (licenseChanged || now - licenseRefreshLastAttemptAt >= LICENSE_REFRESH_INTERVAL_MS) {
+      applyVerifiedWorkspaceLicense(access);
+      licenseRefreshLastAttemptAt = now;
+    }
+    if (teamBecameInactive) {
+      hubConsoleDirect?.close();
+      await clearHubHostTarget('workspace-entitlement-inactive');
+    } else if (teamBecameActive) {
+      hubConsoleDirect?.refresh();
+      scheduleAuthenticatedHubHostTargetPublication('workspace-entitlement-activated');
+    }
+    // The revision also changes for invitations, billing and unrelated member
+    // updates. Closing every healthy peer here would turn a harmless Team
+    // metadata change into an input outage. Exact member removal is handled by
+    // the owner revoke endpoint; every Team signaling socket is independently
+    // revalidated by the Wake Worker within its bounded access window.
+  } catch (error) {
+    if (error instanceof WorkspaceAccessError
+      && error.status < 500
+      && runtimeAuthEpoch === watchAuthEpoch
+      && currentBoundHubUserId() === watchUserId
+      && currentBoundHubWorkspaceId() === watchWorkspaceId) {
+      runtimeWorkspaceAccess = null;
+      verifiedLicense = {
+        userId: '',
+        workspaceId: currentBoundHubWorkspaceId(),
+        workspaceKind: 'personal',
+        plan: 'free',
+        status: 'inactive',
+        expiresAt: '',
+        memberLimit: 1,
+        commercialUse: false,
+        verifiedAt: Date.now()
+      };
+      hubUiSessionAuthority.revokeAll();
+      hubConsoleDirect?.close();
+    }
+    // A temporary provider failure must not stop a working Hub. The next
+    // interval retries the authoritative role check.
   } finally {
     roleWatchInFlight = false;
   }
@@ -1402,17 +1656,87 @@ hubConsoleDirect = createHubConsoleDirect({
   deviceId: runtimeDeviceId,
   httpBaseUrl: `http://127.0.0.1:${httpPort}`,
   stunUrls: hubConsoleDirectStunUrls,
-  getAccessToken: () => getRuntimeAccessToken()
+  getAccessToken: () => getRuntimeAccessToken(),
+  getWorkspaceAccess: () => runtimeWorkspaceAccess,
+  consoleProxyToken
 });
 const httpConnections = new Set();
 const frameWss = new WebSocketServer({ noServer: true, perMessageDeflate: false });
 const atlasWss = new WebSocketServer({ noServer: true, perMessageDeflate: false });
 const inputWss = new WebSocketServer({ noServer: true, perMessageDeflate: false });
 const audioWss = new WebSocketServer({ noServer: true, perMessageDeflate: false });
-const browserWebSocketServers = [frameWss, atlasWss, inputWss, audioWss];
-const frameCaptureTransitionRetries = createLiveCaptureTransitionRetryCoordinator();
-
-httpServer.on('connection', socket => {
+const browserWebSocketServers = [frameWss, atlasWss, inputWss, audioWss];
+const frameCaptureTransitionRetries = createLiveCaptureTransitionRetryCoordinator();
+
+function retireHubUiSessionSocket(ws, reason = 'hub-ui-session-revoked') {
+  if (!ws || ws.liveDeskUiSessionRevoked === true) return false;
+  ws.liveDeskUiSessionRevoked = true;
+  if (ws.liveDeskUiSessionTimer) clearTimeout(ws.liveDeskUiSessionTimer);
+  ws.liveDeskUiSessionTimer = null;
+  if (ws.liveDeskInputClientId) {
+    for (const deviceId of ws.liveDeskInputDeviceIds || []) {
+      remoteHub.releaseInputOwner(
+        deviceId,
+        ws.liveDeskInputClientId,
+        String(reason || 'hub-ui-session-revoked').slice(0, 120)
+      );
+    }
+    ws.liveDeskInputDeviceIds?.clear?.();
+  }
+  try {
+    ws.close(1008, String(reason || 'hub-ui-session-revoked').slice(0, 120));
+  } catch {
+    try { ws.terminate(); } catch {}
+  }
+  return true;
+}
+
+function retireHubUiSessionSockets(session, reason = 'hub-ui-session-revoked') {
+  const sessionId = String(session?.sessionId || '');
+  if (!sessionId) return 0;
+  let retired = 0;
+  for (const wss of browserWebSocketServers) {
+    for (const ws of wss.clients) {
+      if (ws.liveDeskUiSessionId !== sessionId) continue;
+      if (retireHubUiSessionSocket(ws, reason)) retired += 1;
+    }
+  }
+  return retired;
+}
+
+function bindHubUiSessionSocket(ws, req) {
+  const authorization = req?.liveDeskAuthorization;
+  const sessionId = String(authorization?.sessionId || '');
+  if (!sessionId) return;
+  ws.liveDeskUiSessionId = sessionId;
+  ws.liveDeskUiSessionUserId = String(authorization.userId || '');
+  ws.liveDeskUiSessionWorkspaceId = String(authorization.workspaceId || '');
+  ws.liveDeskUiSessionRevoked = false;
+  const armDeadline = () => {
+    if (ws.liveDeskUiSessionRevoked === true) return;
+    const deadline = hubUiSessionAuthority.sessionDeadline(sessionId);
+    if (!deadline) {
+      retireHubUiSessionSocket(ws, 'hub-ui-session-expired');
+      return;
+    }
+    const delay = deadline - Date.now();
+    if (delay <= 0) {
+      retireHubUiSessionSocket(ws, 'hub-ui-session-expired');
+      return;
+    }
+    ws.liveDeskUiSessionTimer = setTimeout(armDeadline, Math.min(delay, 60_000));
+    ws.liveDeskUiSessionTimer.unref?.();
+  };
+  armDeadline();
+  const cleanup = () => {
+    if (ws.liveDeskUiSessionTimer) clearTimeout(ws.liveDeskUiSessionTimer);
+    ws.liveDeskUiSessionTimer = null;
+  };
+  ws.once('close', cleanup);
+  ws.once('error', cleanup);
+}
+
+httpServer.on('connection', socket => {
   httpConnections.add(socket);
   socket.once('close', () => httpConnections.delete(socket));
 });
@@ -1509,13 +1833,34 @@ function isSecureHubHttpRequest(req) {
     || String(req.headers['x-forwarded-proto'] || '').trim().toLowerCase() === 'https';
 }
 
-function currentBoundHubUserId() {
+function currentBoundHubUserId() {
   return String(
     runtimeManager.getSnapshot().userId
     || readPersistedRuntimeSession()?.user?.id
     || ''
   ).trim();
-}
+}
+
+function workspaceAccessHttpStatus(error) {
+  return error instanceof WorkspaceAccessError
+    ? Math.max(400, Math.min(599, Number(error.status || 403)))
+    : authVerificationHttpStatus(error instanceof Error ? error.message : String(error));
+}
+
+function currentBoundHubWorkspaceId() {
+  return String(
+    runtimeWorkspaceAccess?.workspaceId
+    || readPersistedWorkspaceId()
+    || currentBoundHubUserId()
+    || ''
+  ).trim();
+}
+
+function runtimeAuthOwnerIsCurrent(epoch, userId, workspaceId) {
+  return runtimeAuthEpoch === epoch
+    && currentBoundHubUserId() === String(userId || '')
+    && currentBoundHubWorkspaceId() === String(workspaceId || '');
+}
 
 function isPublicHubApiRequest(req) {
   const method = String(req.method || 'GET').toUpperCase();
@@ -1524,21 +1869,98 @@ function isPublicHubApiRequest(req) {
     || (method === 'POST' && path === '/api/auth/session');
 }
 
-function isTrustedNativeLoopbackRequest(req) {
+function isTrustedNativeLoopbackRequest(req) {
   return isLoopbackAddress(req.socket?.remoteAddress)
     && !String(req.headers.origin || '').trim()
     && !String(req.headers['sec-fetch-site'] || '').trim();
-}
-
-function authorizeHubUiRequest(req) {
-  if (process.env.LIVEDESK_TEST_MODE === '1') {
-    return { ok: true, explicitTestMode: true };
-  }
-  if (isTrustedNativeLoopbackRequest(req)) {
-    return { ok: true, nativeLoopback: true };
-  }
-  return hubUiSessionAuthority.authorize(req, currentBoundHubUserId());
-}
+}
+
+function authorizeConsoleProxyRequest(req) {
+  const suppliedToken = String(req.headers['x-livedesk-console-proxy'] || '').trim();
+  if (!suppliedToken) return null;
+  if (!isTrustedNativeLoopbackRequest(req)
+    || !secureExactTestTokenMatches(suppliedToken, consoleProxyToken)) {
+    return { ok: false, status: 403, error: 'console-proxy-not-authorized' };
+  }
+  const workspaceId = String(req.headers['x-livedesk-workspace-id'] || '').trim();
+  const workspaceKind = String(req.headers['x-livedesk-workspace-kind'] || '').trim().toLowerCase();
+  const userId = String(req.headers['x-livedesk-workspace-user-id'] || '').trim();
+  const role = String(req.headers['x-livedesk-workspace-role'] || '').trim().toLowerCase();
+  const membershipRevision = Number(req.headers['x-livedesk-membership-revision'] || 0);
+  const accessExpiresAt = Number(req.headers['x-livedesk-workspace-access-expires-at'] || 0);
+  if (!workspaceId
+    || workspaceKind !== String(runtimeWorkspaceAccess?.workspaceKind || '').trim().toLowerCase()
+    || !userId
+    || workspaceId !== currentBoundHubWorkspaceId()
+    || !workspaceRoleCanControl(role)
+    || !Number.isSafeInteger(membershipRevision)
+    || membershipRevision < 0
+    || !Number.isFinite(accessExpiresAt)
+    || (workspaceKind === 'team' && accessExpiresAt <= Date.now())
+    || (workspaceKind === 'personal' && accessExpiresAt !== 0)) {
+    return { ok: false, status: 403, error: 'console-workspace-access-invalid' };
+  }
+  return {
+    ok: true,
+    consoleProxy: true,
+    workspaceId,
+    workspaceKind,
+    userId,
+    role,
+    plan: String(runtimeWorkspaceAccess?.plan || 'free'),
+    entitlementStatus: String(runtimeWorkspaceAccess?.entitlementStatus || 'inactive'),
+    membershipRevision,
+    accessExpiresAt
+  };
+}
+
+function authorizationWorkspaceAccess(authorization) {
+  return {
+    workspaceKind: String(
+      authorization?.workspaceKind
+      || runtimeWorkspaceAccess?.workspaceKind
+      || 'personal'
+    ).trim().toLowerCase(),
+    plan: String(
+      authorization?.plan
+      || runtimeWorkspaceAccess?.plan
+      || 'free'
+    ).trim().toLowerCase(),
+    entitlementStatus: String(
+      authorization?.entitlementStatus
+      || runtimeWorkspaceAccess?.entitlementStatus
+      || 'active'
+    ).trim().toLowerCase()
+  };
+}
+
+function authorizeHubUiRequest(req) {
+  if (process.env.LIVEDESK_TEST_MODE === '1') {
+    return { ok: true, explicitTestMode: true };
+  }
+  const consoleAuthorization = authorizeConsoleProxyRequest(req);
+  if (consoleAuthorization) return consoleAuthorization;
+  if (isTrustedNativeLoopbackRequest(req)) {
+    return { ok: true, nativeLoopback: true };
+  }
+  return hubUiSessionAuthority.authorize(req, {
+    workspaceId: currentBoundHubWorkspaceId(),
+    allowedRoles: ['owner', 'operator']
+  });
+}
+
+function authorizedWorkspaceRole(req) {
+  if (req.liveDeskAuthorization?.role) return req.liveDeskAuthorization.role;
+  const consoleAuthorization = authorizeConsoleProxyRequest(req);
+  if (consoleAuthorization?.ok) return consoleAuthorization.role;
+  const uiAuthorization = hubUiSessionAuthority.authorize(req, {
+    workspaceId: currentBoundHubWorkspaceId(),
+    allowedRoles: ['owner', 'operator']
+  }, { requireCsrf: false });
+  return uiAuthorization?.ok
+    ? uiAuthorization.role
+    : String(runtimeWorkspaceAccess?.role || '').trim().toLowerCase();
+}
 
 app.use((req, res, next) => {
   if (!isTrustedBrowserRequest(req)) {
@@ -1566,13 +1988,29 @@ app.use((req, res, next) => {
     next();
     return;
   }
-  const authorization = authorizeHubUiRequest(req);
-  if (!authorization.ok) {
+  const authorization = authorizeHubUiRequest(req);
+  if (!authorization.ok) {
     noStore(res);
     res.status(authorization.status).json({ ok: false, error: authorization.error });
-    return;
-  }
-  next();
+    return;
+  }
+  if (!workspaceEntitlementCanRequest(
+    authorizationWorkspaceAccess(authorization),
+    req.method,
+    req.path
+  )) {
+    noStore(res);
+    res.status(403).json({ ok: false, error: 'workspace-entitlement-inactive' });
+    return;
+  }
+  if (authorization.role
+    && !workspaceRoleCanRequest(authorization.role, req.method, req.path)) {
+    noStore(res);
+    res.status(403).json({ ok: false, error: 'workspace-owner-required' });
+    return;
+  }
+  req.liveDeskAuthorization = authorization;
+  next();
 });
 app.use((req, res, next) => {
   if (runtimeRole === 'client' && req.path.startsWith('/api/remote')) {
@@ -3954,7 +4392,7 @@ app.get('/api/settings', async (_req, res) => {
   }
 });
 
-app.patch('/api/settings', async (req, res) => {
+app.patch('/api/settings', async (req, res) => {
   noStore(res);
   try {
     const body = req.body && typeof req.body === 'object' && !Array.isArray(req.body) ? req.body : {};
@@ -3974,9 +4412,72 @@ app.patch('/api/settings', async (req, res) => {
     }
     res.status(error?.status || 400).json({ ok: false, error: error instanceof Error ? error.message : String(error) });
   }
-});
-
-function sendCaptureError(res, error) {
+});
+
+function wallPreferencesResponse(record) {
+  return {
+    ok: true,
+    revision: Number(record?.revision || 0),
+    updatedAt: String(record?.updatedAt || ''),
+    wallPreferences: {
+      cadence: String(record?.cadence || record?.settings?.wall?.cadence || 'fast'),
+      viewScale: Number(record?.viewScale ?? record?.settings?.wall?.viewScale ?? 100),
+      showThisComputer: Boolean(
+        record?.settings?.connection?.showThisComputer
+        ?? liveDeskSettingsStore.getCached()?.connection?.showThisComputer
+      )
+    }
+  };
+}
+
+app.get('/api/remote/wall-preferences', async (_req, res) => {
+  noStore(res);
+  try {
+    res.json(wallPreferencesResponse(await liveDeskSettingsStore.getWallPreferencesRecord()));
+  } catch (error) {
+    res.status(500).json({ ok: false, error: error instanceof Error ? error.message : String(error) });
+  }
+});
+
+app.patch('/api/remote/wall-preferences', async (req, res) => {
+  noStore(res);
+  try {
+    const body = req.body && typeof req.body === 'object' && !Array.isArray(req.body) ? req.body : null;
+    const allowedKeys = new Set(['revision', 'cadence', 'viewScale']);
+    if (!body || Object.keys(body).some(key => !allowedKeys.has(key))) {
+      res.status(400).json({ ok: false, error: 'wall-preferences-invalid' });
+      return;
+    }
+    const revision = Number(body.revision);
+    const cadence = String(body.cadence || '').trim().toLowerCase();
+    const viewScale = Number(body.viewScale);
+    if (!Number.isSafeInteger(revision)
+      || revision < 0
+      || !['slow', 'fast'].includes(cadence)
+      || !Number.isFinite(viewScale)
+      || viewScale < 0
+      || viewScale > 100) {
+      res.status(400).json({ ok: false, error: 'wall-preferences-invalid' });
+      return;
+    }
+    const record = await liveDeskSettingsStore.update({ wall: { cadence, viewScale } }, revision);
+    res.json(wallPreferencesResponse(record));
+  } catch (error) {
+    if (error instanceof SettingsConflictError) {
+      const wall = error.settings?.settings?.wall || {};
+      res.status(409).json(wallPreferencesResponse({
+        revision: error.settings.revision,
+        updatedAt: error.settings.updatedAt,
+        cadence: wall.cadence,
+        viewScale: wall.viewScale
+      }));
+      return;
+    }
+    res.status(error?.status || 400).json({ ok: false, error: error instanceof Error ? error.message : String(error) });
+  }
+});
+
+function sendCaptureError(res, error) {
   const rawCode = String(error?.message || error?.code || 'capture-request-failed');
   const code = rawCode.replace(/[^a-z0-9-:]/gi, '-').toLowerCase().slice(0, 100);
   const status = Number.isInteger(error?.status) && error.status >= 400 && error.status <= 599
@@ -4345,20 +4846,23 @@ app.post('/api/settings/agent/summary', async (req, res) => {
   }
 });
 
-app.get('/api/remote/status', async (_req, res) => {
+app.get('/api/remote/status', async (req, res) => {
   noStore(res);
   if (runtimeRole !== 'hub') {
     res.status(403).json({ ok: false, error: 'role-not-allowed' });
     return;
-  }
+  }
   try {
+    const includePairingPin = authorizedWorkspaceRole(req) === 'owner';
     const [secretStatus, wallPreferences] = await Promise.all([
-      Promise.resolve(remoteHub.getStatus({ includeSecrets: true })),
+      Promise.resolve(includePairingPin ? remoteHub.getStatus({ includeSecrets: true }) : {}),
       liveDeskSettingsStore.getWallPreferencesRecord()
     ]);
+    const visibleStatus = { ...remoteHub.getStatus({ includeSecrets: false }) };
+    if (!includePairingPin) delete visibleStatus.pairingPin;
     res.json({
-      ...remoteHub.getStatus({ includeSecrets: false }),
-      pairingPin: secretStatus.pairingPin,
+      ...visibleStatus,
+      ...(includePairingPin ? { pairingPin: secretStatus.pairingPin } : {}),
       product: 'LiveDesk',
       runtimeRole,
       deviceId: runtimeDeviceId,
@@ -4366,6 +4870,7 @@ app.get('/api/remote/status', async (_req, res) => {
       roleSource: runtimeRoleSource,
       agentPackage: '@livedesk/client',
       wallPreferences,
+      workspace: workspaceAccessSnapshot(),
       consoleDirect: hubConsoleDirect?.inspect() || { enabled: false, state: 'starting' },
       frameLanes: snapshotFrameLaneResourceHealth(),
       update: getLiveDeskUpdateStatus()
@@ -4546,72 +5051,242 @@ app.post('/api/runtime/switch-role', (req, res) => {
   res.redirect(307, '/api/runtime/role');
 });
 
-app.get('/api/auth/status', (_req, res) => {
-  noStore(res);
-  res.json({ ok: true, authenticated: runtimeManager.getSnapshot().authenticated, userId: runtimeManager.getSnapshot().userId || null, role: runtimeRole });
-});
+app.get('/api/auth/status', (_req, res) => {
+  noStore(res);
+  res.json({
+    ok: true,
+    authenticated: runtimeManager.getSnapshot().authenticated,
+    userId: runtimeManager.getSnapshot().userId || null,
+    role: runtimeRole,
+    workspace: workspaceAccessSnapshot()
+  });
+});
 
-app.post('/api/auth/session', async (req, res) => {
-  noStore(res);
-  const normalized = normalizeRuntimeAuthSession(req.body);
+app.post('/api/auth/session', async (req, res) => {
+  noStore(res);
+  const consoleProxyAuthorization = authorizeConsoleProxyRequest(req);
+  if (consoleProxyAuthorization) {
+    if (!consoleProxyAuthorization.ok) {
+      res.status(consoleProxyAuthorization.status).json({ ok: false, error: consoleProxyAuthorization.error });
+      return;
+    }
+    const validConsoleWorkspaceMember = consoleProxyAuthorization.workspaceKind === 'team'
+      ? ['owner', 'operator'].includes(consoleProxyAuthorization.role)
+      : consoleProxyAuthorization.workspaceKind === 'personal'
+        && consoleProxyAuthorization.role === 'owner';
+    if (!validConsoleWorkspaceMember
+      || !workspaceEntitlementCanRequest(consoleProxyAuthorization, 'POST', '/api/auth/session')) {
+      res.status(403).json({ ok: false, error: 'workspace-member-session-required' });
+      return;
+    }
+    const accessExpiresAt = consoleProxyAuthorization.workspaceKind === 'team'
+      ? Math.min(Number(consoleProxyAuthorization.accessExpiresAt || 0), Date.now() + TEAM_UI_ACCESS_MAX_AGE_MS)
+      : 0;
+    const uiSession = hubUiSessionAuthority.renew(req, consoleProxyAuthorization.userId, {
+      workspaceId: consoleProxyAuthorization.workspaceId,
+      workspaceKind: consoleProxyAuthorization.workspaceKind,
+      role: consoleProxyAuthorization.role,
+      plan: consoleProxyAuthorization.plan,
+      entitlementStatus: consoleProxyAuthorization.entitlementStatus,
+      membershipRevision: consoleProxyAuthorization.membershipRevision,
+      accessExpiresAt
+    });
+    res.setHeader('Set-Cookie', serializeHubUiSessionCookie(uiSession.sessionId, uiSession.expiresAt, {
+      secure: isSecureHubHttpRequest(req)
+    }));
+    res.json({
+      ok: true,
+      authenticated: true,
+      persisted: false,
+      runtimeOwner: false,
+      userId: consoleProxyAuthorization.userId,
+      role: runtimeRole,
+      workspace: {
+        workspaceId: consoleProxyAuthorization.workspaceId,
+        kind: consoleProxyAuthorization.workspaceKind,
+        role: consoleProxyAuthorization.role,
+        membershipRevision: consoleProxyAuthorization.membershipRevision,
+        plan: consoleProxyAuthorization.plan,
+        status: consoleProxyAuthorization.entitlementStatus
+      },
+      license: licenseSnapshot(),
+      uiSession: {
+        csrfToken: uiSession.csrfToken,
+        expiresAt: uiSession.expiresAt,
+        accessExpiresAt
+      }
+    });
+    return;
+  }
+  const requestAuthEpoch = runtimeAuthEpoch;
+  const requestBoundUserId = currentBoundHubUserId();
+  const requestBoundWorkspaceId = currentBoundHubWorkspaceId();
+  const normalized = normalizeRuntimeAuthSession(req.body);
   if (!normalized.ok) {
     res.status(400).json({ ok: false, error: normalized.error });
     return;
-  }
-  const { access_token: accessToken, refresh_token: refreshToken, expires_at: expiresAt } = normalized.session;
-  try {
-    const user = await verifySupabaseUser(accessToken);
-    const boundUserId = currentBoundHubUserId();
-    if (boundUserId && boundUserId !== user.id) {
-      res.status(403).json({ ok: false, error: 'hub-account-mismatch' });
-      return;
-    }
-    if (!boundUserId && !isLoopbackAddress(req.socket?.remoteAddress)) {
-      res.status(403).json({ ok: false, error: 'hub-first-account-binding-must-be-local' });
-      return;
-    }
-    runtimeAccessToken = accessToken;
-    runtimeRefreshToken = refreshToken;
-    runtimeAccessTokenExpiresAt = normalizeSessionExpiryMs(expiresAt);
-    runtimeManager.setAuthenticated(true, user.id);
+  }
+  const { access_token: accessToken, refresh_token: refreshToken, expires_at: expiresAt } = normalized.session;
+  try {
+    const user = await verifySupabaseUser(accessToken);
+    const explicitlyRequestedWorkspaceId = req.body?.workspaceId ?? req.body?.workspace_id ?? '';
+    const authoritativeWorkspaceId = await queryRuntimeDeviceWorkspace(accessToken);
+    const nativeRuntimeWorkspaceFallback = !String(explicitlyRequestedWorkspaceId || '').trim()
+      && isTrustedNativeLoopbackRequest(req)
+      ? currentBoundHubWorkspaceId() || authoritativeWorkspaceId
+      : '';
+    const access = await verifyWorkspaceAccess(
+      accessToken,
+      user,
+      explicitlyRequestedWorkspaceId || nativeRuntimeWorkspaceFallback
+    );
+    const boundUserId = currentBoundHubUserId();
+    const boundWorkspaceId = currentBoundHubWorkspaceId();
+    if (runtimeAuthEpoch !== requestAuthEpoch
+      || boundUserId !== requestBoundUserId
+      || boundWorkspaceId !== requestBoundWorkspaceId) {
+      res.status(409).json({ ok: false, error: 'hub-auth-session-superseded' });
+      return;
+    }
+    if (authoritativeWorkspaceId && authoritativeWorkspaceId !== access.workspaceId) {
+      res.status(403).json({ ok: false, error: 'hub-device-workspace-mismatch' });
+      return;
+    }
+    const sameRuntimeOwner = Boolean(boundUserId) && boundUserId === user.id;
+    const memberUiOnly = Boolean(boundUserId)
+      && boundWorkspaceId === access.workspaceId
+      && ['owner', 'operator'].includes(access.role)
+      && (!sameRuntimeOwner
+        || access.role !== 'owner'
+        || !isTrustedNativeLoopbackRequest(req));
+    const ownerLocalWorkspaceRebind = sameRuntimeOwner
+      && boundWorkspaceId
+      && boundWorkspaceId !== access.workspaceId
+      && access.role === 'owner'
+      && isTrustedNativeLoopbackRequest(req)
+      && authoritativeWorkspaceId === access.workspaceId;
+    if (boundWorkspaceId && boundWorkspaceId !== access.workspaceId && !ownerLocalWorkspaceRebind) {
+      res.status(403).json({ ok: false, error: 'hub-workspace-mismatch' });
+      return;
+    }
+    if (!boundUserId
+      && (access.role !== 'owner' || !isLoopbackAddress(req.socket?.remoteAddress))) {
+      res.status(403).json({
+        ok: false,
+        error: access.role === 'owner'
+          ? 'hub-first-account-binding-must-be-local'
+          : 'hub-owner-session-required'
+      });
+      return;
+    }
+    if (!memberUiOnly && !refreshToken) {
+      res.status(400).json({ ok: false, error: 'refresh-token-required' });
+      return;
+    }
+    if (ownerLocalWorkspaceRebind) {
+      hubUiSessionAuthority.revokeAll('hub-workspace-rebound');
+    }
+    if (access.workspaceKind === 'team' && !workspaceRemoteAccessActive(access)) {
+      hubUiSessionAuthority.revokeWorkspaceMember(access.workspaceId, user.id);
+    }
+    const uiAccessExpiresAt = access.workspaceKind === 'team'
+      ? Date.now() + TEAM_UI_ACCESS_MAX_AGE_MS
+      : 0;
+    const uiSession = hubUiSessionAuthority.renew(req, user.id, {
+      workspaceId: access.workspaceId,
+      workspaceKind: access.workspaceKind,
+      role: access.role,
+      plan: access.plan,
+      entitlementStatus: access.entitlementStatus,
+      membershipRevision: access.membershipRevision,
+      accessExpiresAt: uiAccessExpiresAt
+    });
+    res.setHeader('Set-Cookie', serializeHubUiSessionCookie(uiSession.sessionId, uiSession.expiresAt, {
+      secure: isSecureHubHttpRequest(req)
+    }));
+    if (memberUiOnly) {
+      res.json({
+        ok: true,
+        authenticated: true,
+        persisted: false,
+        runtimeOwner: false,
+        userId: user.id,
+        role: runtimeRole,
+        workspace: workspaceAccessSnapshot(access),
+        license: licenseSnapshot(),
+        hostTarget: {
+          ok: true,
+          pending: false,
+          active: remoteHub.getStatus({ includeSecrets: false }).hostTargetActive === true
+        },
+        uiSession: {
+          csrfToken: uiSession.csrfToken,
+          expiresAt: uiSession.expiresAt,
+          accessExpiresAt: uiAccessExpiresAt
+        }
+      });
+      return;
+    }
+    if (boundUserId && !sameRuntimeOwner) {
+      res.status(403).json({ ok: false, error: 'hub-account-mismatch' });
+      return;
+    }
+    runtimeAuthEpoch += 1;
+    runtimeAccessToken = accessToken;
+    runtimeRefreshToken = refreshToken;
+    runtimeAccessTokenExpiresAt = normalizeSessionExpiryMs(expiresAt);
+    runtimeWorkspaceAccess = access;
+    if (ownerLocalWorkspaceRebind) {
+      hubConsoleDirect?.invalidateWorkspaceAccess('hub-workspace-rebound');
+    }
+    workspaceAccessLastAttemptAt = Date.now();
+    licenseRefreshLastAttemptAt = Date.now();
+    runtimeManager.setAuthenticated(true, user.id);
     const persisted = persistRuntimeSession({
       access_token: accessToken,
       refresh_token: refreshToken,
       expires_at: expiresAt,
-      user
-    });
-    const hostTarget = runtimeRole === 'hub'
-      ? {
-          ok: true,
-          pending: true,
-          active: remoteHub.getStatus({ includeSecrets: false }).hostTargetActive === true
-        }
-      : { ok: true, pending: false, active: false };
-    const uiSession = hubUiSessionAuthority.issue(user.id);
-    res.setHeader('Set-Cookie', serializeHubUiSessionCookie(uiSession.sessionId, uiSession.expiresAt, {
-      secure: isSecureHubHttpRequest(req)
-    }));
-    res.json({
+      user
+    });
+    const workspacePersisted = persistRuntimeWorkspace(access);
+    applyVerifiedWorkspaceLicense(access);
+    const teamRemoteActive = workspaceRemoteAccessActive(access);
+    let hostTarget = runtimeRole === 'hub'
+      ? {
+          ok: true,
+          pending: true,
+          active: remoteHub.getStatus({ includeSecrets: false }).hostTargetActive === true
+        }
+      : { ok: true, pending: false, active: false };
+    if (runtimeRole === 'hub' && !teamRemoteActive) {
+      hubConsoleDirect?.close();
+      const cleared = await clearHubHostTarget('workspace-entitlement-inactive');
+      hostTarget = { ok: cleared.ok, pending: false, active: false, error: cleared.error || '' };
+    }
+    res.json({
       ok: true,
-      authenticated: true,
-      persisted,
-      userId: user.id,
-      role: runtimeRole,
+      authenticated: true,
+      persisted: persisted && workspacePersisted,
+      runtimeOwner: true,
+      userId: user.id,
+      role: runtimeRole,
+      workspace: workspaceAccessSnapshot(access),
+      license: licenseSnapshot(),
       hostTarget,
       uiSession: {
         csrfToken: uiSession.csrfToken,
         expiresAt: uiSession.expiresAt
       }
     });
-    if (runtimeRole === 'hub') {
+    if (runtimeRole === 'hub' && teamRemoteActive) {
       hubConsoleDirect?.refresh();
       scheduleAuthenticatedHubHostTargetPublication('session-received');
     }
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    const status = authVerificationHttpStatus(message);
-    res.status(status).json({ ok: false, error: message });
-  }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const status = workspaceAccessHttpStatus(error);
+    res.status(status).json({ ok: false, error: message });
+  }
 });
 
 function updateHubHostTargetLeaseState(patch = {}) {
@@ -4643,19 +5318,20 @@ function hubWakeSignalUrl() {
   return url.toString();
 }
 
-function buildHubWakeEventId(target, remoteStatus, endpointCandidates) {
-  return crypto.createHash('sha256').update(JSON.stringify({
-    deviceId: runtimeDeviceId,
+function buildHubWakeEventId(target, remoteStatus, endpointCandidates, workspaceId = currentBoundHubWorkspaceId()) {
+  return crypto.createHash('sha256').update(JSON.stringify({
+    workspaceId,
+    deviceId: runtimeDeviceId,
     leaseId: target.leaseId || '',
     hostInstanceId: target.hostInstanceId || remoteStatus.hostInstanceId || '',
     endpointCandidates: [...endpointCandidates].sort()
   })).digest('hex').slice(0, 40);
 }
 
-async function notifyHubOnline({ accessToken, target, remoteStatus, endpointCandidates }) {
-  const url = hubWakeSignalUrl();
-  if (!url) return { ok: false, skipped: true, reason: 'wake-disabled' };
-  const eventId = buildHubWakeEventId(target, remoteStatus, endpointCandidates);
+async function notifyHubOnline({ accessToken, target, remoteStatus, endpointCandidates, workspaceId }) {
+  const url = hubWakeSignalUrl();
+  if (!url) return { ok: false, skipped: true, reason: 'wake-disabled' };
+  const eventId = buildHubWakeEventId(target, remoteStatus, endpointCandidates, workspaceId);
   if (hubWakeNotificationState.lastEventId === eventId && hubWakeNotificationState.state === 'notified') {
     return { ok: true, skipped: true, eventId };
   }
@@ -4678,7 +5354,11 @@ async function notifyHubOnline({ accessToken, target, remoteStatus, endpointCand
         'Content-Type': 'application/json',
         Accept: 'application/json'
       },
-      body: JSON.stringify({ deviceId: runtimeDeviceId, eventId })
+      body: JSON.stringify({
+        workspaceId,
+        deviceId: runtimeDeviceId,
+        eventId
+      })
     }, SUPABASE_AUTH_TIMEOUT_MS);
     const data = await response.json().catch(() => null);
     if (!response.ok || data?.ok === false) {
@@ -4727,9 +5407,8 @@ async function callHubSupabaseRpc(name, payload, accessToken) {
   );
   const data = await response.json().catch(() => null);
   const result = Array.isArray(data) ? data[0] : data;
-  if (response.status === 401 || response.status === 403) {
-    if (!desktopMainAuthConfig) clearRuntimeSession();
-    throw new Error(`${name}-not-authenticated:${response.status}`);
+  if (response.status === 401 || response.status === 403) {
+    throw new Error(`${name}-not-authenticated:${response.status}`);
   }
   if (!response.ok) {
     throw new Error(`${name}-failed:${response.status}`);
@@ -4740,16 +5419,21 @@ async function callHubSupabaseRpc(name, payload, accessToken) {
   return result;
 }
 
-async function promoteCurrentRuntimeToHub() {
-  if (runtimeRole !== 'hub' || !runtimeDeviceId) {
-    throw new Error('hub-runtime-identity-unavailable');
-  }
+async function promoteCurrentRuntimeToHub() {
+  if (runtimeRole !== 'hub' || !runtimeDeviceId) {
+    throw new Error('hub-runtime-identity-unavailable');
+  }
+  if (runtimeWorkspaceAccess?.workspaceKind === 'team'
+    && !workspaceRemoteAccessActive(runtimeWorkspaceAccess)) {
+    throw new Error('workspace-entitlement-inactive');
+  }
   const accessToken = await getRuntimeAccessToken();
   if (!accessToken) {
     throw new Error('hub-session-required');
   }
-  const result = await callHubSupabaseRpc('set_livedesk_device_role', {
-    p_device_id: runtimeDeviceId,
+  const result = await callHubSupabaseRpc('set_livedesk_workspace_device_role', {
+    p_workspace_id: currentBoundHubWorkspaceId(),
+    p_device_id: runtimeDeviceId,
     p_role: 'hub',
     p_assigned_hub_id: null,
     p_expected_role_version: null
@@ -4758,10 +5442,22 @@ async function promoteCurrentRuntimeToHub() {
   return result;
 }
 
-async function publishHubHostTarget({ takeover = false, reason = 'renewal' } = {}) {
-  if (runtimeRole !== 'hub') {
-    throw new Error('hub-role-not-allowed');
-  }
+async function publishHubHostTarget({ takeover = false, reason = 'renewal' } = {}) {
+  const operationAuthEpoch = runtimeAuthEpoch;
+  const operationUserId = currentBoundHubUserId();
+  const operationWorkspaceId = currentBoundHubWorkspaceId();
+  if (runtimeRole !== 'hub') {
+    throw new Error('hub-role-not-allowed');
+  }
+  if (runtimeWorkspaceAccess?.workspaceKind === 'team'
+    && !workspaceRemoteAccessActive(runtimeWorkspaceAccess)) {
+    updateHubHostTargetLeaseState({
+      state: 'inactive',
+      lastReason: String(reason || 'renewal'),
+      lastError: 'workspace-entitlement-inactive'
+    });
+    return { ok: false, active: false, error: 'workspace-entitlement-inactive' };
+  }
   if (hubHostTargetRenewInFlight) {
     return { ok: false, error: 'host-target-publish-already-running', hostTarget: remoteHub.getStatus({ includeSecrets: false }) };
   }
@@ -4777,7 +5473,10 @@ async function publishHubHostTarget({ takeover = false, reason = 'renewal' } = {
     if (!accessToken) {
       throw new Error('hub-session-required');
     }
-    const authoritativeRole = await queryAuthoritativeRuntimeRole();
+    const authoritativeRole = await queryAuthoritativeRuntimeRole();
+    if (!runtimeAuthOwnerIsCurrent(operationAuthEpoch, operationUserId, operationWorkspaceId)) {
+      return { ok: false, superseded: true, error: 'host-target-publish-superseded' };
+    }
     if (authoritativeRole !== 'hub') {
       throw new Error(authoritativeRole === 'client' ? 'hub-role-no-longer-authoritative' : 'hub-role-not-authoritative');
     }
@@ -4788,9 +5487,12 @@ async function publishHubHostTarget({ takeover = false, reason = 'renewal' } = {
       leaseMs: HUB_HOST_TARGET_LEASE_MS,
       takeover
     });
-    if (!local?.ok || !local.hostTarget) {
-      throw new Error(local?.error || 'local-host-target-failed');
-    }
+    if (!local?.ok || !local.hostTarget) {
+      throw new Error(local?.error || 'local-host-target-failed');
+    }
+    if (!runtimeAuthOwnerIsCurrent(operationAuthEpoch, operationUserId, operationWorkspaceId)) {
+      return { ok: false, superseded: true, error: 'host-target-publish-superseded' };
+    }
 
     const remoteStatus = remoteHub.getStatus({ includeSecrets: true });
     if (!remoteStatus.agentEndpointAccountRouteReady) {
@@ -4800,8 +5502,9 @@ async function publishHubHostTarget({ takeover = false, reason = 'renewal' } = {
     const endpointCandidates = Array.isArray(target.endpointCandidates) && target.endpointCandidates.length > 0
       ? target.endpointCandidates
       : [target.endpoint].filter(Boolean);
-    await callHubSupabaseRpc('set_livedesk_remote_host_target', {
-      p_node_id: runtimeDeviceId,
+    await callHubSupabaseRpc('set_livedesk_workspace_remote_host_target', {
+      p_workspace_id: operationWorkspaceId,
+      p_node_id: runtimeDeviceId,
       p_lease_id: target.leaseId,
       p_host_instance_id: target.hostInstanceId || remoteStatus.hostInstanceId || runtimeDeviceId,
       p_endpoint: target.endpoint || remoteStatus.agentEndpoint,
@@ -4815,7 +5518,19 @@ async function publishHubHostTarget({ takeover = false, reason = 'renewal' } = {
       p_endpoint_candidates: endpointCandidates,
       p_pairing_pin: remoteStatus.pairingPin || ''
     }, accessToken);
-    await notifyHubOnline({ accessToken, target, remoteStatus, endpointCandidates });
+    if (!runtimeAuthOwnerIsCurrent(operationAuthEpoch, operationUserId, operationWorkspaceId)) {
+      return { ok: false, superseded: true, error: 'host-target-publish-superseded' };
+    }
+    await notifyHubOnline({
+      accessToken,
+      target,
+      remoteStatus,
+      endpointCandidates,
+      workspaceId: operationWorkspaceId
+    });
+    if (!runtimeAuthOwnerIsCurrent(operationAuthEpoch, operationUserId, operationWorkspaceId)) {
+      return { ok: false, superseded: true, error: 'host-target-publish-superseded' };
+    }
 
     updateHubHostTargetLeaseState({
       state: 'active',
@@ -4851,7 +5566,10 @@ async function publishHubHostTargetWithPendingRoleTakeover(reason = 'renewal') {
   return result;
 }
 
-async function clearHubHostTarget(reason = 'shutdown') {
+async function clearHubHostTarget(reason = 'shutdown') {
+  const operationAuthEpoch = runtimeAuthEpoch;
+  const operationUserId = currentBoundHubUserId();
+  const operationWorkspaceId = currentBoundHubWorkspaceId();
   if (hubHostTargetRenewTimer) {
     clearInterval(hubHostTargetRenewTimer);
     hubHostTargetRenewTimer = null;
@@ -4864,18 +5582,24 @@ async function clearHubHostTarget(reason = 'shutdown') {
   try {
     const accessToken = await getRuntimeAccessToken();
     if (accessToken && targetNodeId && targetLeaseId && targetInstanceId) {
-      await callHubSupabaseRpc('clear_livedesk_remote_host_target', {
-        p_node_id: targetNodeId,
+      await callHubSupabaseRpc('clear_livedesk_workspace_remote_host_target', {
+        p_workspace_id: operationWorkspaceId,
+        p_node_id: targetNodeId,
         p_lease_id: targetLeaseId,
         p_host_instance_id: targetInstanceId,
         p_force: false
       }, accessToken);
     }
-  } catch (cause) {
-    error = cause instanceof Error ? cause.message : String(cause);
-    console.error(`[VuvoDesk Hub] Host target ${reason} clear failed: ${error}`);
-  }
-  try {
+  } catch (cause) {
+    error = cause instanceof Error ? cause.message : String(cause);
+    console.error(`[VuvoDesk Hub] Host target ${reason} clear failed: ${error}`);
+  }
+  const currentRemoteStatus = remoteHub.getStatus({ includeSecrets: false });
+  if (!runtimeAuthOwnerIsCurrent(operationAuthEpoch, operationUserId, operationWorkspaceId)
+    || (targetLeaseId && String(currentRemoteStatus.hostTargetLeaseId || '') !== targetLeaseId)) {
+    return { ok: true, superseded: true, error, lease: getHubHostTargetLeaseStatus() };
+  }
+  try {
     await remoteHub.setHostTarget({ enabled: false, nodeId: targetNodeId });
   } catch (cause) {
     error = error || (cause instanceof Error ? cause.message : String(cause));
@@ -4914,16 +5638,31 @@ function scheduleAuthenticatedHubHostTargetPublication(reason = 'session-receive
   });
 }
 
-app.delete('/api/auth/session', async (req, res) => {
-  noStore(res);
+app.delete('/api/auth/session', async (req, res) => {
+  noStore(res);
+  const nativeOwnerLogout = isTrustedNativeLoopbackRequest(req)
+    && !String(req.headers['x-livedesk-console-proxy'] || '').trim();
+  if (!nativeOwnerLogout) {
+    const revoked = hubUiSessionAuthority.revoke(req);
+    res.setHeader('Set-Cookie', clearHubUiSessionCookie({ secure: isSecureHubHttpRequest(req) }));
+    res.json({
+      ok: true,
+      authenticated: runtimeManager.getSnapshot().authenticated,
+      role: runtimeRole,
+      runtimePreserved: true,
+      signedOutUserId: revoked?.userId || null,
+      workspaceId: revoked?.workspaceId || currentBoundHubWorkspaceId()
+    });
+    return;
+  }
   const hostTarget = runtimeRole === 'hub'
     ? await clearHubHostTarget('logout')
     : { ok: true, active: false };
   clearRuntimeSession();
   hubConsoleDirect?.close();
   res.setHeader('Set-Cookie', clearHubUiSessionCookie({ secure: isSecureHubHttpRequest(req) }));
-  res.json({ ok: true, authenticated: false, role: runtimeRole, hostTarget });
-});
+  res.json({ ok: true, authenticated: false, role: runtimeRole, runtimePreserved: false, hostTarget });
+});
 
 app.get('/api/hub/status', (_req, res) => {
   noStore(res);
@@ -5015,34 +5754,19 @@ app.post('/api/runtime/role', async (req, res) => {
     res.status(400).json({ ok: false, error: 'hub-can-only-transition-to-client' });
     return;
   }
-  const authorization = String(req.headers.authorization || '').trim();
-  const accessToken = authorization.replace(/^Bearer\s+/i, '').trim();
+  const accessToken = await getRuntimeAccessToken().catch(() => '');
   if (!accessToken || !runtimeDeviceId) {
     res.status(401).json({ ok: false, error: 'supabase-access-token-and-device-id-required' });
     return;
   }
   try {
-    const response = await fetch(`${supabaseUrl}/rest/v1/rpc/set_livedesk_device_role`, {
-      method: 'POST',
-      headers: {
-        apikey: supabasePublishableKey,
-        Authorization: `Bearer ${accessToken}`,
-        'Content-Type': 'application/json',
-        Accept: 'application/json'
-      },
-      body: JSON.stringify({
-        p_device_id: runtimeDeviceId,
-        p_role: 'client',
-        p_assigned_hub_id: String(req.body?.assignedHubId || '').trim() || null,
-        p_expected_role_version: Number.isInteger(Number(req.body?.expectedRoleVersion)) ? Number(req.body.expectedRoleVersion) : null
-      })
-    });
-    const data = await response.json().catch(() => null);
-    const result = Array.isArray(data) ? data[0] : data;
-    if (!response.ok || result?.ok === false) {
-      res.status(409).json({ ok: false, error: result?.reason || `role-change-rejected:${response.status}` });
-      return;
-    }
+    const result = await callHubSupabaseRpc('set_livedesk_workspace_device_role', {
+      p_workspace_id: currentBoundHubWorkspaceId(),
+      p_device_id: runtimeDeviceId,
+      p_role: 'client',
+      p_assigned_hub_id: String(req.body?.assignedHubId || '').trim() || null,
+      p_expected_role_version: Number.isInteger(Number(req.body?.expectedRoleVersion)) ? Number(req.body.expectedRoleVersion) : null
+    }, accessToken);
     await clearHubHostTarget('role-transition');
     res.json({ ok: true, restarting: true, role: 'client', roleVersion: result?.role_version || 0 });
     setTimeout(() => process.exit(ROLE_TRANSITION_EXIT_CODE), 150);
@@ -5090,38 +5814,103 @@ app.get('/api/remote/registry-credentials', (_req, res) => {
   });
 });
 
-app.get('/api/remote/license', (_req, res) => {
+app.get('/api/remote/license', (_req, res) => {
   noStore(res);
-  res.json(licenseSnapshot());
-});
-
-app.post('/api/remote/license/sync', async (req, res) => {
+  res.json(licenseSnapshot());
+});
+
+app.post('/api/remote/workspace/members/:userId/revoke', async (req, res) => {
+  noStore(res);
+  const workspaceId = String(req.body?.workspaceId || '').trim();
+  const memberUserId = String(req.params.userId || '').trim().slice(0, 160);
+  if (authorizedWorkspaceRole(req) !== 'owner') {
+    res.status(403).json({ ok: false, error: 'workspace-owner-required' });
+    return;
+  }
+  if (!workspaceId || workspaceId !== currentBoundHubWorkspaceId() || !memberUserId) {
+    res.status(400).json({ ok: false, error: 'workspace-and-member-required' });
+    return;
+  }
+  const retiredPeers = hubConsoleDirect?.revokeWorkspaceMember(
+    workspaceId,
+    memberUserId,
+    'workspace-member-revoked'
+  ) || 0;
+  const revokedUiSessions = hubUiSessionAuthority.revokeWorkspaceMember(workspaceId, memberUserId);
+  let wakeRevoked = false;
+  let wakeError = '';
+  try {
+    const accessToken = await getRuntimeAccessToken();
+    if (!accessToken) throw new Error('hub-session-required');
+    const revokeUrl = new URL('/v2/rtc/revoke-member', hubWakeBaseUrl);
+    const response = await fetchAuthResponse(fetch, revokeUrl.href, {
+      method: 'POST',
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        'Content-Type': 'application/json',
+        Accept: 'application/json'
+      },
+      body: JSON.stringify({ workspaceId, memberUserId })
+    }, SUPABASE_AUTH_TIMEOUT_MS);
+    wakeRevoked = response.ok;
+    if (!response.ok) wakeError = `wake-member-revoke-failed:${response.status}`;
+  } catch (error) {
+    wakeError = error instanceof Error ? error.message : String(error);
+  }
+  res.json({
+    ok: true,
+    workspaceId,
+    memberUserId,
+    retiredPeers,
+    revokedUiSessions,
+    wakeRevoked,
+    ...(wakeError ? { wakeError } : {})
+  });
+});
+
+app.post('/api/remote/license/sync', async (req, res) => {
   noStore(res);
   try {
-    const authorization = String(req.headers.authorization || '');
-    const accessToken = authorization.replace(/^Bearer\s+/i, '').trim();
-    res.json(await syncVerifiedLicense(accessToken));
-  } catch (err) {
-    verifiedLicense = {
-      userId: '',
-      plan: 'free',
-      status: 'inactive',
-      expiresAt: '',
-      verifiedAt: Date.now()
-    };
-    res.status(401).json({ ok: false, error: err instanceof Error ? err.message : String(err), license: licenseSnapshot() });
-  }
-});
+    const authorization = String(req.headers.authorization || '');
+    const accessToken = authorization.replace(/^Bearer\s+/i, '').trim();
+    res.json(await syncVerifiedLicense(accessToken, req.body?.workspaceId ?? req.body?.workspace_id ?? ''));
+  } catch (err) {
+    const explicitAccessRejection = err instanceof WorkspaceAccessError && err.status < 500;
+    if (explicitAccessRejection) {
+      verifiedLicense = {
+        userId: '',
+        workspaceId: currentBoundHubWorkspaceId(),
+        workspaceKind: runtimeWorkspaceAccess?.workspaceKind || 'personal',
+        plan: 'free',
+        status: 'inactive',
+        expiresAt: '',
+        memberLimit: 1,
+        commercialUse: false,
+        verifiedAt: Date.now()
+      };
+    }
+    res.status(workspaceAccessHttpStatus(err)).json({
+      ok: false,
+      error: err instanceof Error ? err.message : String(err),
+      preserved: !explicitAccessRejection && Date.now() - verifiedLicense.verifiedAt <= LICENSE_VERIFY_MAX_AGE_MS,
+      license: licenseSnapshot()
+    });
+  }
+});
 
 app.delete('/api/remote/license', (_req, res) => {
   noStore(res);
-  verifiedLicense = {
-    userId: '',
-    plan: 'free',
-    status: 'inactive',
-    expiresAt: '',
-    verifiedAt: Date.now()
-  };
+  verifiedLicense = {
+    userId: '',
+    workspaceId: currentBoundHubWorkspaceId(),
+    workspaceKind: runtimeWorkspaceAccess?.workspaceKind || 'personal',
+    plan: 'free',
+    status: 'inactive',
+    expiresAt: '',
+    memberLimit: 1,
+    commercialUse: false,
+    verifiedAt: Date.now()
+  };
   res.json(licenseSnapshot());
 });
 
@@ -5787,10 +6576,26 @@ httpServer.on('upgrade', (req, socket, head) => {
     const label = authorization.status === 403 ? 'Forbidden' : 'Unauthorized';
     socket.write(`HTTP/1.1 ${authorization.status} ${label}\r\nConnection: close\r\n\r\n`);
     socket.destroy();
-    return;
-  }
-  try {
-    const parsed = new URL(req.url || '/', `http://${req.headers.host || '127.0.0.1'}`);
+    return;
+  }
+  try {
+    const parsed = new URL(req.url || '/', `http://${req.headers.host || '127.0.0.1'}`);
+    if (!workspaceEntitlementCanRequest(
+      authorizationWorkspaceAccess(authorization),
+      'GET',
+      parsed.pathname
+    )) {
+      socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
+      socket.destroy();
+      return;
+    }
+    if (authorization.role
+      && !workspaceRoleCanRequest(authorization.role, 'GET', parsed.pathname)) {
+      socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
+      socket.destroy();
+      return;
+    }
+    req.liveDeskAuthorization = authorization;
     if (parsed.pathname === '/api/remote/frames/ws') {
       frameWss.handleUpgrade(req, socket, head, ws => frameWss.emit('connection', ws, req));
       return;
@@ -5815,7 +6620,8 @@ httpServer.on('upgrade', (req, socket, head) => {
   }
 });
 
-frameWss.on('connection', (ws, req) => {
+frameWss.on('connection', (ws, req) => {
+  bindHubUiSessionSocket(ws, req);
   frameClients.add(ws);
   ws.liveDeskFrameClientId = `rfws-${++frameClientSeq}`;
   try {
@@ -5834,6 +6640,7 @@ frameWss.on('connection', (ws, req) => {
     updateFrameSubscription(ws, {});
   }
   ws.on('message', data => {
+    if (ws.liveDeskUiSessionRevoked === true) return;
     try {
       const payload = JSON.parse(Buffer.isBuffer(data) ? data.toString('utf8') : String(data || ''));
       if (payload?.type === 'subscribe') {
@@ -5857,7 +6664,8 @@ frameWss.on('connection', (ws, req) => {
   });
 });
 
-atlasWss.on('connection', ws => {
+atlasWss.on('connection', (ws, req) => {
+  bindHubUiSessionSocket(ws, req);
   ws.liveDeskFrameClientId = `atlas-${++frameClientSeq}`;
   try { ws._socket?.setNoDelay?.(true); } catch {}
   const cleanup = () => {
@@ -5871,7 +6679,8 @@ atlasWss.on('connection', ws => {
     ws.liveDeskAtlasSession = null;
     retireFrameClientSendLane(ws);
   };
-  ws.on('message', data => {
+  ws.on('message', data => {
+    if (ws.liveDeskUiSessionRevoked === true) return;
     try {
       const payload = JSON.parse(Buffer.isBuffer(data) ? data.toString('utf8') : String(data || ''));
       if (payload?.type === 'subscribe' || payload?.type === 'configure') {
@@ -5891,7 +6700,8 @@ atlasWss.on('connection', ws => {
   });
 });
 
-audioWss.on('connection', (ws, req) => {
+audioWss.on('connection', (ws, req) => {
+  bindHubUiSessionSocket(ws, req);
   audioClients.add(ws);
   ws.liveDeskAudioClientId = `raws-${++audioClientSeq}`;
   ws.liveDeskAudioCleanupComplete = false;
@@ -5904,7 +6714,8 @@ audioWss.on('connection', (ws, req) => {
   } catch {
     updateAudioSubscription(ws, {});
   }
-  ws.on('message', data => {
+  ws.on('message', data => {
+    if (ws.liveDeskUiSessionRevoked === true) return;
     try {
       const payload = JSON.parse(Buffer.isBuffer(data) ? data.toString('utf8') : String(data || ''));
       if (payload?.type === 'subscribe') {
@@ -5925,7 +6736,8 @@ audioWss.on('connection', (ws, req) => {
   });
 });
 
-inputWss.on('connection', ws => {
+inputWss.on('connection', (ws, req) => {
+  bindHubUiSessionSocket(ws, req);
   inputClients.add(ws);
   ws.liveDeskInputClientId = `riws-${++inputClientSeq}`;
   ws.liveDeskInputDeviceIds = new Set();
@@ -5934,7 +6746,8 @@ inputWss.on('connection', ws => {
   } catch {
     // Best-effort latency hint for browser input sockets.
   }
-  ws.on('message', data => {
+  ws.on('message', data => {
+    if (ws.liveDeskUiSessionRevoked === true) return;
     let payload;
     try {
       payload = JSON.parse(Buffer.isBuffer(data) ? data.toString('utf8') : String(data || ''));