@relaycast/engine 12.2.0 → 12.3.0

package/dist/auth/credentials.js

@@ -0,0 +1,147 @@
+import { AR_KIND_CODES, AR_SECRET_BYTES, LEGACY_CREDENTIAL_PREFIXES, encodeArCredential, isArWorkspaceId, parseCredential, } from '@relaycast/types';
+import { randomHex } from '../lib/crypto.js';
+export { parseCredential };
+/** Why a deployment that mints `ar_` credentials refuses a workspace id. */
+export const AR_WORKSPACE_ID_REQUIRED = 'workspace ids must be snowflakes on deployments that mint ar_ credentials';
+/**
+ * Minting an `ar_` credential for a workspace id that is not a 64-bit
+ * snowflake. Routes check ids before writing; this is the backstop, and it
+ * answers `400 invalid_request`.
+ */
+export class WorkspaceIdNotSnowflakeError extends Error {
+    workspaceId;
+    code = 'invalid_request';
+    status = 400;
+    clientSafe = true;
+    constructor(workspaceId) {
+        super(AR_WORKSPACE_ID_REQUIRED);
+        this.workspaceId = workspaceId;
+        this.name = 'WorkspaceIdNotSnowflakeError';
+    }
+}
+/** Random secret bytes per `legacy` kind (the established lengths). */
+const LEGACY_SECRET_BYTES = {
+    workspace: 16,
+    agent: 16,
+    node: 24,
+    observer: 24,
+    webhook: 24,
+};
+/**
+ * Parse an `ar_` credential, for gateways that route by it. Proves only shape
+ * and checksum; verify its tag with `createCredentialTagSigner(...).verify`.
+ */
+export function parseArCredential(token) {
+    const parsed = parseCredential(token);
+    return parsed?.family === 'ar'
+        ? { kind: parsed.kind, workspaceId: parsed.workspaceId, tag: parsed.tag, keyVersion: parsed.keyVersion }
+        : undefined;
+}
+/** Human-readable shape of a credential kind in the family a deployment mints, for error messages. */
+export function credentialShape(kind, format) {
+    return format === 'ar' ? `ar_${AR_KIND_CODES[kind]}_...` : `${LEGACY_CREDENTIAL_PREFIXES[kind]}...`;
+}
+function hexToBytes(hex) {
+    const bytes = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < bytes.length; i += 1)
+        bytes[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    return bytes;
+}
+const settings = new WeakMap();
+/**
+ * Bind the family a deployment mints, and its tagger, to its database handle.
+ * Every engine path that mints a credential holds the handle, so the settings
+ * travel with it (the same binding pattern as node liveness).
+ */
+export function configureCredentials(db, next) {
+    if (next.format === 'ar' && !next.tagger) {
+        throw new Error("credentialFormat 'ar' needs a credentialTagger");
+    }
+    const bound = settings.get(db);
+    if (bound !== undefined && (bound.format !== next.format || bound.tagger !== next.tagger)) {
+        throw new Error(`This database handle already mints ${bound.format} credentials; one handle serves one credential configuration`);
+    }
+    settings.set(db, next);
+}
+const arOnlyHandles = new WeakSet();
+/**
+ * Accept only `ar_` credentials on `db`'s deployment: legacy ones are refused
+ * with 401, `POST /v1/credentials/upgrade` is not served and no response is
+ * marked deprecated. Inherent to the workspace actor runtime, whose
+ * deployments never issued legacy credentials; call before `createEngine`.
+ */
+export function restrictToArCredentials(db) {
+    arOnlyHandles.add(db);
+}
+/** Whether `db`'s deployment accepts only `ar_` credentials. */
+export function acceptsOnlyAr(db) {
+    return arOnlyHandles.has(db);
+}
+/** Carry `db`'s credential settings onto a derived handle (a transaction). */
+export function inheritCredentials(derived, db) {
+    const bound = settings.get(db);
+    if (bound)
+        configureCredentials(derived, bound);
+    if (arOnlyHandles.has(db))
+        arOnlyHandles.add(derived);
+}
+/** The credential family `db`'s deployment mints; `legacy` unless configured otherwise. */
+export function credentialFormat(db) {
+    return settings.get(db)?.format ?? 'legacy';
+}
+/** The deployment's tagger, when it can mint `ar_` credentials. */
+export function credentialTagger(db) {
+    return settings.get(db)?.tagger;
+}
+/**
+ * Every family a credential derived for `workspaceId` may have been committed
+ * in, the deployment's current one first: `legacy`, and `ar` under each tag
+ * the deployment's tagger knows for the workspace. A replay derives each, so
+ * one retried after a family switch or a keyring rotation still recovers what
+ * the first attempt committed.
+ */
+export async function derivationFamilies(db, workspaceId) {
+    // A workspace id that is not a snowflake cannot carry an ar_ credential.
+    const tagger = isArWorkspaceId(workspaceId) ? credentialTagger(db) : undefined;
+    const ar = tagger ? (await tagger.tags(workspaceId)).map((tag) => ({ format: 'ar', tag })) : [];
+    return credentialFormat(db) === 'ar' ? [...ar, { format: 'legacy' }] : [{ format: 'legacy' }, ...ar];
+}
+/**
+ * Build a credential from caller-supplied hex secret material (a random value
+ * or a deterministic HMAC/SHA-256 digest), at least as long as the family's
+ * secret. An `ar_` credential carries `tag`, by default the deployment's
+ * current tag for the workspace.
+ */
+export async function credentialFromHex(db, format, kind, workspaceId, hex, tag) {
+    if (!/^[0-9a-f]+$/.test(hex))
+        throw new Error('Credential secret material must be lowercase hex');
+    if (format === 'ar') {
+        if (!isArWorkspaceId(workspaceId))
+            throw new WorkspaceIdNotSnowflakeError(workspaceId);
+        if (hex.length < AR_SECRET_BYTES * 2)
+            throw new Error('Credential secret material is too short');
+        const tagger = credentialTagger(db);
+        if (!tag && !tagger)
+            throw new Error('Minting an ar_ credential needs EngineConfig.credentialTagger');
+        return encodeArCredential({
+            kind,
+            workspaceId,
+            tag: tag ?? await tagger.tag(workspaceId),
+            secret: hexToBytes(hex.slice(0, AR_SECRET_BYTES * 2)),
+        });
+    }
+    const length = LEGACY_SECRET_BYTES[kind] * 2;
+    if (hex.length < length)
+        throw new Error('Credential secret material is too short');
+    return `${LEGACY_CREDENTIAL_PREFIXES[kind]}${hex.slice(0, length)}`;
+}
+/** Mint a fresh random credential of `kind` for `workspaceId`, in `format`. */
+export function mintCredential(db, format, kind, workspaceId) {
+    const bytes = format === 'ar' ? AR_SECRET_BYTES : LEGACY_SECRET_BYTES[kind];
+    return credentialFromHex(db, format, kind, workspaceId, randomHex(bytes));
+}
+/** Mint a fresh credential in the family bound to `db`. */
+export function issueCredential(db, kind, workspaceId) {
+    return mintCredential(db, credentialFormat(db), kind, workspaceId);
+}
+//# sourceMappingURL=credentials.js.map

package/dist/auth/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/auth/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,eAAe,EACf,0BAA0B,EAC1B,kBAAkB,EAClB,eAAe,EACf,eAAe,GAIhB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAqB7C,OAAO,EAAE,eAAe,EAAE,CAAC;AAE3B,4EAA4E;AAC5E,MAAM,CAAC,MAAM,wBAAwB,GAAG,2EAA2E,CAAC;AAEpH;;;;GAIG;AACH,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAKhC;IAJZ,IAAI,GAAG,iBAAiB,CAAC;IACzB,MAAM,GAAG,GAAG,CAAC;IACb,UAAU,GAAG,IAAI,CAAC;IAE3B,YAAqB,WAAmB;QACtC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QADb,gBAAW,GAAX,WAAW,CAAQ;QAEtC,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,uEAAuE;AACvE,MAAM,mBAAmB,GAAmC;IAC1D,SAAS,EAAE,EAAE;IACb,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,EAAE;IACR,QAAQ,EAAE,EAAE;IACZ,OAAO,EAAE,EAAE;CACZ,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAa;IAEb,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,MAAM,EAAE,MAAM,KAAK,IAAI;QAC5B,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE;QACxG,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,eAAe,CAAC,IAAoB,EAAE,MAAwB;IAC5E,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;AACtG,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtG,OAAO,KAAK,CAAC;AACf,CAAC;AAOD,MAAM,QAAQ,GAAG,IAAI,OAAO,EAA8B,CAAC;AAE3D;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,EAAU,EAAE,IAAwB;IACvE,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,sCAAsC,KAAK,CAAC,MAAM,8DAA8D,CAAC,CAAC;IACpI,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,OAAO,EAAU,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,EAAU;IAChD,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,OAAO,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,EAAU;IAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,KAAK;QAAE,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QAAE,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACxD,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,gBAAgB,CAAC,EAAU;IACzC,OAAO,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,IAAI,QAAQ,CAAC;AAC9C,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,gBAAgB,CAAC,EAAU;IACzC,OAAO,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;AAClC,CAAC;AASD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAU,EAAE,WAAmB;IACtE,yEAAyE;IACzE,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,MAAM,EAAE,GAAuB,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpH,OAAO,gBAAgB,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;AACvG,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAU,EACV,MAAwB,EACxB,IAAoB,EACpB,WAAmB,EACnB,GAAW,EACX,GAAY;IAEZ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAClG,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC;YAAE,MAAM,IAAI,4BAA4B,CAAC,WAAW,CAAC,CAAC;QACvF,IAAI,GAAG,CAAC,MAAM,GAAG,eAAe,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACjG,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACtG,OAAO,kBAAkB,CAAC;YACxB,IAAI;YACJ,WAAW;YACX,GAAG,EAAE,GAAG,IAAI,MAAM,MAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YAC1C,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,GAAG,CAAC,MAAM,GAAG,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACpF,OAAO,GAAG,0BAA0B,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,EAAU,EAAE,MAAwB,EAAE,IAAoB,EAAE,WAAmB;IAC5G,MAAM,KAAK,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5E,OAAO,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,eAAe,CAAC,EAAU,EAAE,IAAoB,EAAE,WAAmB;IACnF,OAAO,cAAc,CAAC,EAAE,EAAE,gBAAgB,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;AACrE,CAAC"}

package/dist/auth/index.d.ts

@@ -6,10 +6,13 @@ export declare function hashToken(token: string): Promise<string>;
 /**
  * The built-in, self-host authentication provider.
  *
- * Reproduces the original `middleware/auth.ts` behavior: bearer tokens prefixed
- * `rk_live_` (workspace) or `at_live_` (agent) are SHA-256 hashed and looked up
- * in the `workspaces` / `agents` tables. The cloud product replaces this with a
- * provider backed by its own accounts/billing system.
+ * Workspace, agent, node and observer credentials of either family
+ * (`auth/credentials.ts`) are SHA-256 hashed and looked up in the table their
+ * kind names. An `ar_` credential is looked up within the workspace it names,
+ * in one indexed query. A legacy credential replaced through
+ * `POST /v1/credentials/upgrade` keeps authenticating during its grace
+ * (`credential_upgrades`). The cloud product replaces this with a provider
+ * backed by its own accounts/billing system.
  */
 export declare class SqliteApiKeyAuthProvider implements AuthProvider {
     hashToken(token: string): Promise<string>;

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAIrD,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAE9B,sDAAsD;AACtD,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAExD;AAmBD;;;;;;;GAOG;AACH,qBAAa,wBAAyB,YAAW,YAAY;IAC3D,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAInC,YAAY,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,WAAW,CAAC;QAAC,EAAE,EAAE,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC;CAuErG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAMrD,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAE9B,sDAAsD;AACtD,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAExD;AAmBD;;;;;;;;;;GAUG;AACH,qBAAa,wBAAyB,YAAW,YAAY;IAC3D,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAInC,YAAY,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,WAAW,CAAC;QAAC,EAAE,EAAE,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC;CAoBrG"}

package/dist/auth/index.js

@@ -1,8 +1,10 @@
-import { and, eq, gt } from 'drizzle-orm';
-import { workspaces, agents, nodes } from '../db/schema.js';
+import { and, eq, gt, or } from 'drizzle-orm';
+import { workspaces, agents, nodes, observerTokens } from '../db/schema.js';
 import { sha256Hex } from '../lib/crypto.js';
-import { getActiveObserverTokenByHash } from '../engine/observerToken.js';
+import { activeObserverTokenCondition, getActiveObserverTokenByHash, noteObserverTokenUse, } from '../engine/observerToken.js';
 import { parseAuthToken, validateTokenRequirement } from './tokenKind.js';
+import { credentialFormat } from './credentials.js';
+import { upgradedLegacyCredential } from '../engine/credentialUpgrade.js';
 import { isWorkspaceExpired, workspaceExpiredAuthResult } from './workspaceExpiry.js';
 export { isWorkspaceExpired, authenticateUnexpired, workspaceExpiredAuthResult, WORKSPACE_EXPIRED_CODE, WORKSPACE_EXPIRED_MESSAGE, } from './workspaceExpiry.js';
 /** SHA-256 hash of a raw token to its stored form. */
@@ -25,10 +27,13 @@ function resolved(workspace, extra = {}) {
 /**
  * The built-in, self-host authentication provider.
  *
- * Reproduces the original `middleware/auth.ts` behavior: bearer tokens prefixed
- * `rk_live_` (workspace) or `at_live_` (agent) are SHA-256 hashed and looked up
- * in the `workspaces` / `agents` tables. The cloud product replaces this with a
- * provider backed by its own accounts/billing system.
+ * Workspace, agent, node and observer credentials of either family
+ * (`auth/credentials.ts`) are SHA-256 hashed and looked up in the table their
+ * kind names. An `ar_` credential is looked up within the workspace it names,
+ * in one indexed query. A legacy credential replaced through
+ * `POST /v1/credentials/upgrade` keeps authenticating during its grace
+ * (`credential_upgrades`). The cloud product replaces this with a provider
+ * backed by its own accounts/billing system.
  */
 export class SqliteApiKeyAuthProvider {
     hashToken(token) {
@@ -40,67 +45,116 @@ export class SqliteApiKeyAuthProvider {
         if (!parsedToken) {
             return unauthorized('Invalid token format');
         }
-        const requirement = validateTokenRequirement(parsedToken.kind, require);
+        const requirement = validateTokenRequirement(parsedToken.kind, require, credentialFormat(db));
         if (!requirement.ok) {
             return unauthorized(requirement.message, requirement.code);
         }
         const hash = await hashToken(token);
-        if (parsedToken.kind === 'workspace') {
-            // Current slot first — same shape as the agent-token lookup below.
-            let [workspace] = await db.select().from(workspaces).where(eq(workspaces.apiKeyHash, hash));
-            if (!workspace) {
-                // Superseded key inside its rotation grace window. A rotation with
-                // zero grace writes no usable previous slot, so a compromised key
-                // never lands here.
-                [workspace] = await db
-                    .select()
-                    .from(workspaces)
-                    .where(and(eq(workspaces.previousApiKeyHash, hash), gt(workspaces.previousApiKeyExpiresAt, new Date())));
-            }
-            if (!workspace)
-                return unauthorized('Invalid API key');
-            return resolved(workspace);
+        if (parsedToken.workspaceId !== undefined) {
+            return authenticateAr(db, parsedToken.kind, parsedToken.workspaceId, hash);
         }
-        if (parsedToken.kind === 'agent') {
-            // Current slot first — the common case is a token that has not been
-            // rotated out from under this caller.
-            let [agent] = await db.select().from(agents).where(eq(agents.tokenHash, hash));
-            if (!agent) {
-                // Fall back to the previous slot inside its grace window. This is the
-                // credential a caller that lost a concurrent self-rollover race was
-                // handed (relay#1542); it must remain live long enough for that caller
-                // to upgrade to a persistent session.
-                [agent] = await db
-                    .select()
-                    .from(agents)
-                    .where(and(eq(agents.previousTokenHash, hash), gt(agents.previousTokenExpiresAt, new Date())));
-            }
-            if (!agent)
-                return unauthorized('Invalid agent token', 'agent_token_invalid');
-            const [workspace] = await db.select().from(workspaces).where(eq(workspaces.id, agent.workspaceId));
-            if (!workspace)
-                return unauthorized('Workspace not found');
-            return resolved(workspace, { agent });
-        }
-        if (parsedToken.kind === 'node') {
-            const [node] = await db.select().from(nodes).where(eq(nodes.tokenHash, hash));
-            if (!node)
-                return unauthorized('Invalid node token', 'node_token_invalid');
-            const [workspace] = await db.select().from(workspaces).where(eq(workspaces.id, node.workspaceId));
-            if (!workspace)
-                return unauthorized('Workspace not found');
-            return resolved(workspace, { node });
+        const legacy = await authenticateLegacy(db, parsedToken.kind, hash);
+        if (legacy.ok || legacy.code === 'workspace_expired')
+            return legacy;
+        return await authenticateUpgradedLegacy(db, parsedToken.kind, hash) ?? legacy;
+    }
+}
+async function authenticateLegacy(db, kind, hash) {
+    if (kind === 'workspace') {
+        // Current slot first — same shape as the agent-token lookup below.
+        let [workspace] = await db.select().from(workspaces).where(eq(workspaces.apiKeyHash, hash));
+        if (!workspace) {
+            // Superseded key inside its rotation grace window. A rotation with
+            // zero grace writes no usable previous slot, so a compromised key
+            // never lands here.
+            [workspace] = await db
+                .select()
+                .from(workspaces)
+                .where(and(eq(workspaces.previousApiKeyHash, hash), gt(workspaces.previousApiKeyExpiresAt, new Date())));
         }
-        if (parsedToken.kind === 'observer') {
-            const observerToken = await getActiveObserverTokenByHash(db, hash);
-            if (!observerToken)
-                return unauthorized('Invalid observer token', 'observer_token_invalid');
-            const [workspace] = await db.select().from(workspaces).where(eq(workspaces.id, observerToken.workspaceId));
-            if (!workspace)
-                return unauthorized('Workspace not found');
-            return resolved(workspace, { observerToken });
+        if (!workspace)
+            return unauthorized('Invalid API key');
+        return resolved(workspace);
+    }
+    if (kind === 'agent') {
+        // Current slot first — the common case is a token that has not been
+        // rotated out from under this caller.
+        let [agent] = await db.select().from(agents).where(eq(agents.tokenHash, hash));
+        if (!agent) {
+            // Fall back to the previous slot inside its grace window. This is the
+            // credential a caller that lost a concurrent self-rollover race was
+            // handed (relay#1542); it must remain live long enough for that caller
+            // to upgrade to a persistent session.
+            [agent] = await db
+                .select()
+                .from(agents)
+                .where(and(eq(agents.previousTokenHash, hash), gt(agents.previousTokenExpiresAt, new Date())));
         }
-        return unauthorized('Invalid token format');
+        if (!agent)
+            return unauthorized('Invalid agent token', 'agent_token_invalid');
+        const [workspace] = await db.select().from(workspaces).where(eq(workspaces.id, agent.workspaceId));
+        if (!workspace)
+            return unauthorized('Workspace not found');
+        return resolved(workspace, { agent });
+    }
+    if (kind === 'node') {
+        const [node] = await db.select().from(nodes).where(eq(nodes.tokenHash, hash));
+        if (!node)
+            return unauthorized('Invalid node token', 'node_token_invalid');
+        const [workspace] = await db.select().from(workspaces).where(eq(workspaces.id, node.workspaceId));
+        if (!workspace)
+            return unauthorized('Workspace not found');
+        return resolved(workspace, { node });
+    }
+    if (kind === 'observer') {
+        const observerToken = await getActiveObserverTokenByHash(db, hash);
+        if (!observerToken)
+            return unauthorized('Invalid observer token', 'observer_token_invalid');
+        const [workspace] = await db.select().from(workspaces).where(eq(workspaces.id, observerToken.workspaceId));
+        if (!workspace)
+            return unauthorized('Workspace not found');
+        return resolved(workspace, { observerToken });
+    }
+    return unauthorized('Invalid token format');
+}
+/**
+ * A legacy credential replaced through `POST /v1/credentials/upgrade`, inside
+ * its grace: the principal it was upgraded from, while that principal still
+ * holds the `ar_` credential. `undefined` when the hash is no such credential.
+ */
+async function authenticateUpgradedLegacy(db, kind, hash) {
+    const upgraded = await upgradedLegacyCredential(db, kind, hash);
+    return upgraded ? authenticateAr(db, kind, upgraded.workspaceId, upgraded.arHash) : undefined;
+}
+/**
+ * Verify an `ar_` credential: one indexed query against the table its kind
+ * names, scoped to the workspace it names, returning the principal and its
+ * workspace together. Rotation grace slots match as in the legacy lookups.
+ */
+async function authenticateAr(db, kind, workspaceId, hash) {
+    const now = new Date();
+    if (kind === 'workspace') {
+        const [workspace] = await db.select().from(workspaces).where(and(eq(workspaces.id, workspaceId), or(eq(workspaces.apiKeyHash, hash), and(eq(workspaces.previousApiKeyHash, hash), gt(workspaces.previousApiKeyExpiresAt, now)))));
+        return workspace ? resolved(workspace) : unauthorized('Invalid API key');
+    }
+    if (kind === 'agent') {
+        const [row] = await db.select({ agent: agents, workspace: workspaces }).from(agents)
+            .innerJoin(workspaces, eq(workspaces.id, agents.workspaceId))
+            .where(and(eq(agents.workspaceId, workspaceId), or(eq(agents.tokenHash, hash), and(eq(agents.previousTokenHash, hash), gt(agents.previousTokenExpiresAt, now)))));
+        return row ? resolved(row.workspace, { agent: row.agent }) : unauthorized('Invalid agent token', 'agent_token_invalid');
+    }
+    if (kind === 'node') {
+        const [row] = await db.select({ node: nodes, workspace: workspaces }).from(nodes)
+            .innerJoin(workspaces, eq(workspaces.id, nodes.workspaceId))
+            .where(and(eq(nodes.workspaceId, workspaceId), eq(nodes.tokenHash, hash)));
+        return row ? resolved(row.workspace, { node: row.node }) : unauthorized('Invalid node token', 'node_token_invalid');
     }
+    const [row] = await db.select({ observerToken: observerTokens, workspace: workspaces }).from(observerTokens)
+        .innerJoin(workspaces, eq(workspaces.id, observerTokens.workspaceId))
+        .where(and(eq(observerTokens.workspaceId, workspaceId), eq(observerTokens.tokenHash, hash), activeObserverTokenCondition(now)));
+    if (!row)
+        return unauthorized('Invalid observer token', 'observer_token_invalid');
+    noteObserverTokenUse(db, row.observerToken, now);
+    return resolved(row.workspace, { observerToken: row.observerToken });
 }
 //# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAG1E,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAEtF,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAE9B,sDAAsD;AACtD,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,IAAI,GAAG,cAAc;IAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CACf,SAAyC,EACzC,QAAqE,EAAE;IAEvE,IAAI,kBAAkB,CAAC,SAAS,CAAC;QAAE,OAAO,0BAA0B,EAAE,CAAC;IACvE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,wBAAwB;IACnC,SAAS,CAAC,KAAa;QACrB,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAA2D;QAC5E,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;QACpC,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,YAAY,CAAC,sBAAsB,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,WAAW,GAAG,wBAAwB,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,YAAY,CAAC,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QAEpC,IAAI,WAAW,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACrC,mEAAmE;YACnE,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;YAC5F,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,mEAAmE;gBACnE,kEAAkE;gBAClE,oBAAoB;gBACpB,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE;qBACnB,MAAM,EAAE;qBACR,IAAI,CAAC,UAAU,CAAC;qBAChB,KAAK,CAAC,GAAG,CACR,EAAE,CAAC,UAAU,CAAC,kBAAkB,EAAE,IAAI,CAAC,EACvC,EAAE,CAAC,UAAU,CAAC,uBAAuB,EAAE,IAAI,IAAI,EAAE,CAAC,CACnD,CAAC,CAAC;YACP,CAAC;YACD,IAAI,CAAC,SAAS;gBAAE,OAAO,YAAY,CAAC,iBAAiB,CAAC,CAAC;YACvD,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAED,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACjC,oEAAoE;YACpE,sCAAsC;YACtC,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YAC/E,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,sEAAsE;gBACtE,oEAAoE;gBACpE,uEAAuE;gBACvE,sCAAsC;gBACtC,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;qBACf,MAAM,EAAE;qBACR,IAAI,CAAC,MAAM,CAAC;qBACZ,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,sBAAsB,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACnG,CAAC;YACD,IAAI,CAAC,KAAK;gBAAE,OAAO,YAAY,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;YAC9E,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YACnG,IAAI,CAAC,SAAS;gBAAE,OAAO,YAAY,CAAC,qBAAqB,CAAC,CAAC;YAC3D,OAAO,QAAQ,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACxC,CAAC;QAED,IAAI,WAAW,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;YAC9E,IAAI,CAAC,IAAI;gBAAE,OAAO,YAAY,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;YAC3E,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YAClG,IAAI,CAAC,SAAS;gBAAE,OAAO,YAAY,CAAC,qBAAqB,CAAC,CAAC;YAC3D,OAAO,QAAQ,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,WAAW,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACpC,MAAM,aAAa,GAAG,MAAM,4BAA4B,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACnE,IAAI,CAAC,aAAa;gBAAE,OAAO,YAAY,CAAC,wBAAwB,EAAE,wBAAwB,CAAC,CAAC;YAC5F,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;YAC3G,IAAI,CAAC,SAAS;gBAAE,OAAO,YAAY,CAAC,qBAAqB,CAAC,CAAC;YAC3D,OAAO,QAAQ,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;QAChD,CAAC;QAED,OAAO,YAAY,CAAC,sBAAsB,CAAC,CAAC;IAC9C,CAAC;CACF"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAEtF,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAE9B,sDAAsD;AACtD,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,IAAI,GAAG,cAAc;IAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CACf,SAAyC,EACzC,QAAqE,EAAE;IAEvE,IAAI,kBAAkB,CAAC,SAAS,CAAC;QAAE,OAAO,0BAA0B,EAAE,CAAC;IACvE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,wBAAwB;IACnC,SAAS,CAAC,KAAa;QACrB,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAA2D;QAC5E,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;QACpC,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,YAAY,CAAC,sBAAsB,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,WAAW,GAAG,wBAAwB,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9F,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,YAAY,CAAC,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,WAAW,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,cAAc,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACpE,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,mBAAmB;YAAE,OAAO,MAAM,CAAC;QACpE,OAAO,MAAM,0BAA0B,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC;IAChF,CAAC;CACF;AAED,KAAK,UAAU,kBAAkB,CAC/B,EAAY,EACZ,IAAiD,EACjD,IAAY;IAEZ,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,mEAAmE;QACnE,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,mEAAmE;YACnE,kEAAkE;YAClE,oBAAoB;YACpB,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,EAAE;iBACR,IAAI,CAAC,UAAU,CAAC;iBAChB,KAAK,CAAC,GAAG,CACR,EAAE,CAAC,UAAU,CAAC,kBAAkB,EAAE,IAAI,CAAC,EACvC,EAAE,CAAC,UAAU,CAAC,uBAAuB,EAAE,IAAI,IAAI,EAAE,CAAC,CACnD,CAAC,CAAC;QACP,CAAC;QACD,IAAI,CAAC,SAAS;YAAE,OAAO,YAAY,CAAC,iBAAiB,CAAC,CAAC;QACvD,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,oEAAoE;QACpE,sCAAsC;QACtC,IAAI,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,sEAAsE;YACtE,oEAAoE;YACpE,uEAAuE;YACvE,sCAAsC;YACtC,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;iBACf,MAAM,EAAE;iBACR,IAAI,CAAC,MAAM,CAAC;iBACZ,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,sBAAsB,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,OAAO,YAAY,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;QAC9E,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QACnG,IAAI,CAAC,SAAS;YAAE,OAAO,YAAY,CAAC,qBAAqB,CAAC,CAAC;QAC3D,OAAO,QAAQ,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;QAC3E,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QAClG,IAAI,CAAC,SAAS;YAAE,OAAO,YAAY,CAAC,qBAAqB,CAAC,CAAC;QAC3D,OAAO,QAAQ,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,MAAM,aAAa,GAAG,MAAM,4BAA4B,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,aAAa;YAAE,OAAO,YAAY,CAAC,wBAAwB,EAAE,wBAAwB,CAAC,CAAC;QAC5F,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;QAC3G,IAAI,CAAC,SAAS;YAAE,OAAO,YAAY,CAAC,qBAAqB,CAAC,CAAC;QAC3D,OAAO,QAAQ,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,YAAY,CAAC,sBAAsB,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,0BAA0B,CACvC,EAAY,EACZ,IAAiD,EACjD,IAAY;IAEZ,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAChE,OAAO,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChG,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAC3B,EAAY,EACZ,IAAiD,EACjD,WAAmB,EACnB,IAAY;IAEZ,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,CAC9D,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,WAAW,CAAC,EAC9B,EAAE,CACA,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,EAC/B,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,kBAAkB,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC,CAC1F,CACF,CAAC,CAAC;QACH,OAAO,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;aACjF,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;aAC5D,KAAK,CAAC,GAAG,CACR,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,EACnC,EAAE,CACA,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,EAC1B,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC,CAChF,CACF,CAAC,CAAC;QACL,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;IAC1H,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;aAC9E,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;aAC3D,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7E,OAAO,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;IACtH,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;SACzG,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;SACpE,KAAK,CAAC,GAAG,CACR,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,EAC3C,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,EAClC,4BAA4B,CAAC,GAAG,CAAC,CAClC,CAAC,CAAC;IACL,IAAI,CAAC,GAAG;QAAE,OAAO,YAAY,CAAC,wBAAwB,EAAE,wBAAwB,CAAC,CAAC;IAClF,oBAAoB,CAAC,EAAE,EAAE,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IACjD,OAAO,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;AACvE,CAAC"}

package/dist/auth/tokenKind.d.ts

@@ -1,33 +1,24 @@
-import { z } from 'zod';
 import type { AuthRequire } from '../ports/auth.js';
-declare const tokenKindConfig: {
-    readonly workspace: {
-        readonly prefix: "rk_live_";
-        readonly requiredMessage: "Workspace key required (rk_live_...)";
-    };
-    readonly agent: {
-        readonly prefix: "at_live_";
-        readonly requiredMessage: "Agent token required (at_live_...)";
-    };
-    readonly node: {
-        readonly prefix: "nt_live_";
-        readonly requiredMessage: "Node token required (nt_live_...)";
-    };
-    readonly observer: {
-        readonly prefix: "ot_live_";
-        readonly requiredMessage: "Observer token required (ot_live_...)";
-    };
+import { type CredentialFormat } from './credentials.js';
+declare const tokenKindLabel: {
+    readonly workspace: "Workspace key";
+    readonly agent: "Agent token";
+    readonly node: "Node token";
+    readonly observer: "Observer token";
 };
-export type AuthTokenKind = keyof typeof tokenKindConfig;
-type ParsedTokenFor<Kind extends AuthTokenKind> = {
-    kind: Kind;
+export type AuthTokenKind = keyof typeof tokenKindLabel;
+export interface ParsedAuthToken {
+    kind: AuthTokenKind;
     token: string;
-};
-export declare const authTokenSchema: z.ZodUnion<readonly [z.ZodPipe<z.ZodString, z.ZodTransform<ParsedTokenFor<"workspace">, string>>, z.ZodPipe<z.ZodString, z.ZodTransform<ParsedTokenFor<"agent">, string>>, z.ZodPipe<z.ZodString, z.ZodTransform<ParsedTokenFor<"node">, string>>, z.ZodPipe<z.ZodString, z.ZodTransform<ParsedTokenFor<"observer">, string>>]>;
-export type ParsedAuthToken = z.infer<typeof authTokenSchema>;
+    /** The credential's family. */
+    family: 'legacy' | 'ar';
+    /** The workspace an `ar_` credential names. */
+    workspaceId?: string;
+}
+/** Classify an API credential of either family. */
 export declare function parseAuthToken(token: string): ParsedAuthToken | undefined;
 export declare function getAuthTokenKind(token: string): AuthTokenKind | undefined;
-export declare function requiredTokenMessage(kind: Exclude<AuthRequire, 'any' | 'sender'>): string;
+export declare function requiredTokenMessage(kind: Exclude<AuthRequire, 'any' | 'sender'>, format: CredentialFormat): string;
 export type AuthRequirementValidation = {
     ok: true;
 } | {
@@ -35,6 +26,6 @@ export type AuthRequirementValidation = {
     code: string;
     message: string;
 };
-export declare function validateTokenRequirement(tokenKind: AuthTokenKind, require: AuthRequire): AuthRequirementValidation;
+export declare function validateTokenRequirement(tokenKind: AuthTokenKind, require: AuthRequire, format: CredentialFormat): AuthRequirementValidation;
 export {};
 //# sourceMappingURL=tokenKind.d.ts.map

package/dist/auth/tokenKind.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokenKind.d.ts","sourceRoot":"","sources":["../../src/auth/tokenKind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,QAAA,MAAM,eAAe;;;;;;;;;;;;;;;;;CAiBX,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,eAAe,CAAC;AAEzD,KAAK,cAAc,CAAC,IAAI,SAAS,aAAa,IAAI;IAChD,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAsBF,eAAO,MAAM,eAAe,iUAK1B,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAGzE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAEzE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,KAAK,GAAG,QAAQ,CAAC,GAAG,MAAM,CAEzF;AAeD,MAAM,MAAM,yBAAyB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjD,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,WAAW,GACnB,yBAAyB,CA+B3B"}
+{"version":3,"file":"tokenKind.d.ts","sourceRoot":"","sources":["../../src/auth/tokenKind.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAoC,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE3F,QAAA,MAAM,cAAc;;;;;CAKV,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,cAAc,CAAC;AAExD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,+BAA+B;IAC/B,MAAM,EAAE,QAAQ,GAAG,IAAI,CAAC;IACxB,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,mDAAmD;AACnD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAMzE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAEzE;AAED,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,KAAK,GAAG,QAAQ,CAAC,EAC5C,MAAM,EAAE,gBAAgB,GACvB,MAAM,CAER;AAeD,MAAM,MAAM,yBAAyB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjD,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,gBAAgB,GACvB,yBAAyB,CA+B3B"}

package/dist/auth/tokenKind.js

@@ -1,53 +1,24 @@
-import { z } from 'zod';
-const tokenKindConfig = {
-    workspace: {
-        prefix: 'rk_live_',
-        requiredMessage: 'Workspace key required (rk_live_...)',
-    },
-    agent: {
-        prefix: 'at_live_',
-        requiredMessage: 'Agent token required (at_live_...)',
-    },
-    node: {
-        prefix: 'nt_live_',
-        requiredMessage: 'Node token required (nt_live_...)',
-    },
-    observer: {
-        prefix: 'ot_live_',
-        requiredMessage: 'Observer token required (ot_live_...)',
-    },
+import { credentialShape, parseCredential } from './credentials.js';
+const tokenKindLabel = {
+    workspace: 'Workspace key',
+    agent: 'Agent token',
+    node: 'Node token',
+    observer: 'Observer token',
 };
-const workspaceTokenSchema = z
-    .string()
-    .startsWith(tokenKindConfig.workspace.prefix)
-    .transform((token) => ({ kind: 'workspace', token }));
-const agentTokenSchema = z
-    .string()
-    .startsWith(tokenKindConfig.agent.prefix)
-    .transform((token) => ({ kind: 'agent', token }));
-const nodeTokenSchema = z
-    .string()
-    .startsWith(tokenKindConfig.node.prefix)
-    .transform((token) => ({ kind: 'node', token }));
-const observerTokenSchema = z
-    .string()
-    .startsWith(tokenKindConfig.observer.prefix)
-    .transform((token) => ({ kind: 'observer', token }));
-export const authTokenSchema = z.union([
-    workspaceTokenSchema,
-    agentTokenSchema,
-    nodeTokenSchema,
-    observerTokenSchema,
-]);
+/** Classify an API credential of either family. */
 export function parseAuthToken(token) {
-    const parsed = authTokenSchema.safeParse(token);
-    return parsed.success ? parsed.data : undefined;
+    const parsed = parseCredential(token);
+    if (!parsed || parsed.kind === 'webhook')
+        return undefined;
+    return parsed.family === 'ar'
+        ? { kind: parsed.kind, token, family: 'ar', workspaceId: parsed.workspaceId }
+        : { kind: parsed.kind, token, family: 'legacy' };
 }
 export function getAuthTokenKind(token) {
     return parseAuthToken(token)?.kind;
 }
-export function requiredTokenMessage(kind) {
-    return tokenKindConfig[kind].requiredMessage;
+export function requiredTokenMessage(kind, format) {
+    return `${tokenKindLabel[kind]} required (${credentialShape(kind, format)})`;
 }
 const allowedKindsByRequire = {
     workspace: ['workspace'],
@@ -61,7 +32,7 @@ const allowedKindsByRequire = {
     // (posts as itself), or a node token (posts as an explicit `from` agent).
     sender: ['workspace', 'agent', 'node'],
 };
-export function validateTokenRequirement(tokenKind, require) {
+export function validateTokenRequirement(tokenKind, require, format) {
     const allowedKinds = allowedKindsByRequire[require];
     if (allowedKinds.includes(tokenKind)) {
         return { ok: true };
@@ -86,7 +57,7 @@ export function validateTokenRequirement(tokenKind, require) {
     return {
         ok: false,
         code: 'unauthorized',
-        message: requiredTokenMessage(require),
+        message: requiredTokenMessage(require, format),
     };
 }
 //# sourceMappingURL=tokenKind.js.map

package/dist/auth/tokenKind.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokenKind.js","sourceRoot":"","sources":["../../src/auth/tokenKind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,eAAe,GAAG;IACtB,SAAS,EAAE;QACT,MAAM,EAAE,UAAU;QAClB,eAAe,EAAE,sCAAsC;KACxD;IACD,KAAK,EAAE;QACL,MAAM,EAAE,UAAU;QAClB,eAAe,EAAE,oCAAoC;KACtD;IACD,IAAI,EAAE;QACJ,MAAM,EAAE,UAAU;QAClB,eAAe,EAAE,mCAAmC;KACrD;IACD,QAAQ,EAAE;QACR,MAAM,EAAE,UAAU;QAClB,eAAe,EAAE,uCAAuC;KACzD;CACO,CAAC;AASX,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC;KAC5C,SAAS,CAAC,CAAC,KAAK,EAA+B,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAErF,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC;KACxC,SAAS,CAAC,CAAC,KAAK,EAA2B,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAE7E,MAAM,eAAe,GAAG,CAAC;KACtB,MAAM,EAAE;KACR,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;KACvC,SAAS,CAAC,CAAC,KAAK,EAA0B,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAE3E,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,EAAE;KACR,UAAU,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC;KAC3C,SAAS,CAAC,CAAC,KAAK,EAA8B,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAEnF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC;IACrC,oBAAoB;IACpB,gBAAgB;IAChB,eAAe;IACf,mBAAmB;CACpB,CAAC,CAAC;AAIH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,cAAc,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAA4C;IAC/E,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC;AAC/C,CAAC;AAED,MAAM,qBAAqB,GAAG;IAC5B,SAAS,EAAE,CAAC,WAAW,CAAC;IACxB,KAAK,EAAE,CAAC,OAAO,CAAC;IAChB,IAAI,EAAE,CAAC,MAAM,CAAC;IACd,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,+EAA+E;IAC/E,mDAAmD;IACnD,GAAG,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC;IAC3B,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC;CAC0B,CAAC;AAMnE,MAAM,UAAU,wBAAwB,CACtC,SAAwB,EACxB,OAAoB;IAEpB,MAAM,YAAY,GAA6B,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC9E,IAAI,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,0CAA0C;SACpD,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,8CAA8C;SACxD,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAC9E,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,oBAAoB,CAAC,OAAO,CAAC;KACvC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"tokenKind.js","sourceRoot":"","sources":["../../src/auth/tokenKind.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,eAAe,EAAyB,MAAM,kBAAkB,CAAC;AAE3F,MAAM,cAAc,GAAG;IACrB,SAAS,EAAE,eAAe;IAC1B,KAAK,EAAE,aAAa;IACpB,IAAI,EAAE,YAAY;IAClB,QAAQ,EAAE,gBAAgB;CAClB,CAAC;AAaX,mDAAmD;AACnD,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3D,OAAO,MAAM,CAAC,MAAM,KAAK,IAAI;QAC3B,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE;QAC7E,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,cAAc,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAA4C,EAC5C,MAAwB;IAExB,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,cAAc,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC;AAC/E,CAAC;AAED,MAAM,qBAAqB,GAAG;IAC5B,SAAS,EAAE,CAAC,WAAW,CAAC;IACxB,KAAK,EAAE,CAAC,OAAO,CAAC;IAChB,IAAI,EAAE,CAAC,MAAM,CAAC;IACd,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,+EAA+E;IAC/E,mDAAmD;IACnD,GAAG,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC;IAC3B,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC;CAC0B,CAAC;AAMnE,MAAM,UAAU,wBAAwB,CACtC,SAAwB,EACxB,OAAoB,EACpB,MAAwB;IAExB,MAAM,YAAY,GAA6B,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC9E,IAAI,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,0CAA0C;SACpD,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,8CAA8C;SACxD,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAC9E,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC;KAC/C,CAAC;AACJ,CAAC"}

package/dist/auth/workspaceExpiry.d.ts

@@ -19,6 +19,8 @@ export declare function workspaceExpiredAuthResult(): AuthResult;
  * seam: a cloud provider backed by its own identity store must not be able to
  * admit an expired workspace. Every credential-accepting path in the engine
  * goes through this wrapper so the check holds whatever provider is installed.
+ * The same holds for a deployment that accepts only `ar_` credentials
+ * (`restrictToArCredentials`): a legacy one is refused before the provider runs.
  */
 export declare function authenticateUnexpired(auth: AuthProvider, args: {
     token: string;

package/dist/auth/workspaceExpiry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspaceExpiry.d.ts","sourceRoot":"","sources":["../../src/auth/workspaceExpiry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,kFAAkF;AAClF,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAC1D,eAAO,MAAM,yBAAyB,0BAA0B,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EACvC,GAAG,GAAE,IAAiB,GACrB,OAAO,CAGT;AAED,wBAAgB,0BAA0B,IAAI,UAAU,CAOvD;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,WAAW,CAAC;IAAC,EAAE,EAAE,QAAQ,CAAA;CAAE,GAC1D,OAAO,CAAC,UAAU,CAAC,CAKrB"}
+{"version":3,"file":"workspaceExpiry.d.ts","sourceRoot":"","sources":["../../src/auth/workspaceExpiry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAIrD,kFAAkF;AAClF,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAC1D,eAAO,MAAM,yBAAyB,0BAA0B,CAAC;AAEjE;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EACvC,GAAG,GAAE,IAAiB,GACrB,OAAO,CAGT;AAED,wBAAgB,0BAA0B,IAAI,UAAU,CAOvD;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,WAAW,CAAC;IAAC,EAAE,EAAE,QAAQ,CAAA;CAAE,GAC1D,OAAO,CAAC,UAAU,CAAC,CAQrB"}

package/dist/auth/workspaceExpiry.js

@@ -1,3 +1,5 @@
+import { parseCredential } from '@relaycast/types';
+import { acceptsOnlyAr } from './credentials.js';
 /** Error code every credential path returns for a workspace past `expires_at`. */
 export const WORKSPACE_EXPIRED_CODE = 'workspace_expired';
 export const WORKSPACE_EXPIRED_MESSAGE = 'Workspace has expired';
@@ -27,8 +29,13 @@ export function workspaceExpiredAuthResult() {
  * seam: a cloud provider backed by its own identity store must not be able to
  * admit an expired workspace. Every credential-accepting path in the engine
  * goes through this wrapper so the check holds whatever provider is installed.
+ * The same holds for a deployment that accepts only `ar_` credentials
+ * (`restrictToArCredentials`): a legacy one is refused before the provider runs.
  */
 export async function authenticateUnexpired(auth, args) {
+    if (acceptsOnlyAr(args.db) && parseCredential(args.token)?.family !== 'ar') {
+        return { ok: false, status: 401, code: 'unauthorized', message: 'Invalid token format' };
+    }
     const result = await auth.authenticate(args);
     if (!result.ok)
         return result;