@tapflowio/relay 0.24.0 → 0.25.0

package/dist/lib/clientAddress.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clientAddress.d.ts","sourceRoot":"","sources":["../../src/lib/clientAddress.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAmB5B,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAMrE;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,OAAO,CAAA;CACjB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,qBAAqB,CAG5F;AA6BD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,IAAI,CAEjE;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAElE"}
+{"version":3,"file":"clientAddress.d.ts","sourceRoot":"","sources":["../../src/lib/clientAddress.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAmB5B,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAMrE;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,OAAO,CAAA;CACjB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,qBAAqB,CAG5F;AA6BD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,IAAI,CAEjE;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAElE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,qBAAqB,CAQ/G"}

package/dist/lib/clientAddress.js

@@ -64,4 +64,19 @@ export function markTunnelIngress(req) {
 export function isTunnelIngress(req) {
     return tunnelRequests.has(req);
 }
+/**
+ * Locality of an HTTP request, for every door that serves only the relay host (`auth/init`,
+ * `auth/status`, `/api/v1/logs`). The trusted-proxy list is an argument rather than read from config
+ * here, so each caller passes the same list the WebSocket path uses: one locality rule, not one per
+ * route. The tunnel listener's mark is read here, so no caller can forget it.
+ */
+export function resolveRequestClient(req, trustedProxies) {
+    const xff = req.headers['x-forwarded-for'];
+    return resolveClientAddress({
+        socketAddr: req.socket.remoteAddress ?? '',
+        forwardedFor: Array.isArray(xff) ? xff[0] : xff,
+        trustedProxies,
+        viaTunnel: isTunnelIngress(req),
+    });
+}
 //# sourceMappingURL=clientAddress.js.map

package/dist/lib/clientAddress.js.map

@@ -1 +1 @@
-{"version":3,"file":"clientAddress.js","sourceRoot":"","sources":["../../src/lib/clientAddress.ts"],"names":[],"mappings":"AAEA,qEAAqE;AACrE,sEAAsE;AAEtE,6EAA6E;AAC7E,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IACnB,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC3B,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IACrC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC5E,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AAC5C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAuB;IACzD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAA;IACnB,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;SACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAChC,CAAC;AAkBD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAgC;IACnE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;IACxC,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;AAC7E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAgC;IACxD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC1C,MAAM,gBAAgB,GAAG,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC9D,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAE7C,IAAI,gBAAgB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,kEAAkE;QAClE,8DAA8D;QAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACxF,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;QACxB,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAA;QAC7D,2CAA2C;QAC3C,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;QAClD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1D,CAAC;IAED,8DAA8D;IAC9D,uDAAuD;IACvD,uDAAuD;IACvD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAA;AACtD,CAAC;AAED,0GAA0G;AAC1G,2GAA2G;AAC3G,kCAAkC;AAClC,MAAM,cAAc,GAAG,IAAI,OAAO,EAAwB,CAAA;AAE1D,MAAM,UAAU,iBAAiB,CAAC,GAAyB;IACzD,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAyB;IACvD,OAAO,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AAChC,CAAC"}
+{"version":3,"file":"clientAddress.js","sourceRoot":"","sources":["../../src/lib/clientAddress.ts"],"names":[],"mappings":"AAEA,qEAAqE;AACrE,sEAAsE;AAEtE,6EAA6E;AAC7E,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IACnB,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC3B,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IACrC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC5E,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACzB,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AAC5C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAuB;IACzD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAA;IACnB,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;SACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAChC,CAAC;AAkBD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAgC;IACnE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;IACxC,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;AAC7E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAgC;IACxD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAC1C,MAAM,gBAAgB,GAAG,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC9D,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAE7C,IAAI,gBAAgB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,kEAAkE;QAClE,8DAA8D;QAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACxF,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;QACxB,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,CAAC,EAAE,CAAA;QAC7D,2CAA2C;QAC3C,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;QAClD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1D,CAAC;IAED,8DAA8D;IAC9D,uDAAuD;IACvD,uDAAuD;IACvD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAA;AACtD,CAAC;AAED,0GAA0G;AAC1G,2GAA2G;AAC3G,kCAAkC;AAClC,MAAM,cAAc,GAAG,IAAI,OAAO,EAAwB,CAAA;AAE1D,MAAM,UAAU,iBAAiB,CAAC,GAAyB;IACzD,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAyB;IACvD,OAAO,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAyB,EAAE,cAAwB;IACtF,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC1C,OAAO,oBAAoB,CAAC;QAC1B,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE;QAC1C,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG;QAC/C,cAAc;QACd,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC;KAChC,CAAC,CAAA;AACJ,CAAC"}

package/dist/lib/connectionAuth.d.ts

@@ -1,10 +1,19 @@
 export declare const AGENT_SCOPE = "agent";
+export declare const VIEW_SCOPE = "view";
 export declare const WS_REJECT_REASON = "Unauthorized: agents need a PAT with 'agent' scope (--token / TAPFLOW_AGENT_TOKEN); browsers must sign in";
+/** A PAT with neither `view` nor `agent`: it may upload builds, not open device sessions. */
+export declare const WS_SCOPE_REASON = "Forbidden: this token lacks the 'view' scope needed for device sessions; create an API-type token";
+/** An `agent` token is issued by an Admin and is only as good as that Admin role, checked at every use. */
+export declare const WS_AGENT_OWNER_REASON = "Unauthorized: this agent token's owner is no longer an Admin; an Admin must issue a new agent token";
+/** An open socket whose token was revoked, expired, or went with its owner. */
+export declare const WS_TOKEN_GONE_REASON = "Unauthorized: this token was revoked or has expired, or its owner was removed";
 export interface ConnectionAuthInput {
     isLocal: boolean;
     hasCookieAuth: boolean;
     /** Scopes of a valid PAT on the upgrade request, or null when none was presented. */
     patScopes: string[] | null;
+    /** The PAT owner's current role (from the users table), or null when no PAT was presented. */
+    patOwnerRole: string | null;
 }
 export type ConnectionDecision = {
     action: 'reject';
@@ -13,10 +22,56 @@ export type ConnectionDecision = {
     action: 'accept';
     role: 'browser';
 }
-/** 첫 메시지(agent:register / stream:register)가 역할을 결정한다. */
+/**
+ * 첫 메시지(agent:register / stream:register)가 역할을 결정한다. What the first message may make of
+ * the socket is decided here, with the credentials: `mayBrowse` gates the fallback to `browser`, and
+ * `mayRegisterAgent` gates the two handshakes. A local socket may do both.
+ */
  | {
     action: 'accept';
     role: 'first-message';
+    mayBrowse: boolean;
+    mayRegisterAgent: boolean;
 };
-export declare function classifyConnection({ isLocal, hasCookieAuth, patScopes }: ConnectionAuthInput): ConnectionDecision;
+export declare function classifyConnection({ isLocal, hasCookieAuth, patScopes, patOwnerRole }: ConnectionAuthInput): ConnectionDecision;
+/**
+ * The credential a remote socket was accepted with. Recorded once at the handshake and re-checked
+ * against the database for as long as the socket is open. Local sockets have none: they needed no
+ * credential, so there is nothing to revoke.
+ */
+export type SocketPrincipal = {
+    via: 'cookie';
+    userId: number; /** JWT `exp`, seconds */
+    jwtExp?: number;
+}
+/** The PAT's id, never its hash: the hash is a bearer secret, the id is only a row. */
+ | {
+    via: 'pat';
+    userId: number;
+    patId: number;
+};
+/** What the database says now about a principal's credential. */
+export interface CurrentCredential {
+    /** Cookie principals: the user row still exists. */
+    userExists: boolean;
+    /** PAT principals: the token row, unexpired, with its owner — or null when revoked, expired or cascaded. */
+    pat: {
+        scopes: string[];
+        ownerRole: string;
+    } | null;
+}
+/**
+ * Would this socket still be accepted, given what the database says now? Returns the close reason, or
+ * null when it would.
+ *
+ * **One predicate instead of one rule per event.** Removal, demotion, revocation, expiry and an
+ * invitation accept that changes a role all reach an open socket through the same question, asked on
+ * the heartbeat and again right after any of those writes. A list of "which sockets does this event
+ * affect" is the design this replaced, and it had already missed expiry and the invitation path.
+ *
+ * `role` is what the socket has become: `agent` and `stream` rest on the `agent` scope and its owner's
+ * Admin role; `browser` rests on `view`. A socket that has not sent its first frame yet (`undefined`)
+ * is re-classified as a fresh handshake would be.
+ */
+export declare function revalidatePrincipal(principal: SocketPrincipal, role: 'agent' | 'browser' | 'stream' | undefined, current: CurrentCredential, nowSeconds: number): string | null;
 //# sourceMappingURL=connectionAuth.d.ts.map

package/dist/lib/connectionAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connectionAuth.d.ts","sourceRoot":"","sources":["../../src/lib/connectionAuth.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW,UAAU,CAAA;AAGlC,eAAO,MAAM,gBAAgB,8GACgF,CAAA;AAE7G,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,OAAO,CAAA;IACtB,qFAAqF;IACrF,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;CAC3B;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAE;AACvC,yDAAyD;GACvD;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,CAAA;AAI/C,wBAAgB,kBAAkB,CAChC,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,mBAAmB,GACzD,kBAAkB,CAOpB"}
+{"version":3,"file":"connectionAuth.d.ts","sourceRoot":"","sources":["../../src/lib/connectionAuth.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW,UAAU,CAAA;AAClC,eAAO,MAAM,UAAU,SAAS,CAAA;AAIhC,eAAO,MAAM,gBAAgB,8GACgF,CAAA;AAC7G,6FAA6F;AAC7F,eAAO,MAAM,eAAe,sGACyE,CAAA;AACrG,2GAA2G;AAC3G,eAAO,MAAM,qBAAqB,wGACqE,CAAA;AACvG,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,kFACgD,CAAA;AAEjF,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,OAAO,CAAA;IACtB,qFAAqF;IACrF,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC1B,8FAA8F;IAC9F,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAE;AACvC;;;;GAIG;GACD;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAA;CAAE,CAAA;AAS9F,wBAAgB,kBAAkB,CAChC,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,mBAAmB,GACvE,kBAAkB,CAqBpB;AAED;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,GAAG,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,CAAC,yBAAyB;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AAC9E,uFAAuF;GACrF;IAAE,GAAG,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEjD,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,UAAU,EAAE,OAAO,CAAA;IACnB,4GAA4G;IAC5G,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;CACpD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,eAAe,EAC1B,IAAI,EAAE,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,EAChD,OAAO,EAAE,iBAAiB,EAC1B,UAAU,EAAE,MAAM,GACjB,MAAM,GAAG,IAAI,CAcf"}

package/dist/lib/connectionAuth.js

@@ -1,18 +1,77 @@
 export const AGENT_SCOPE = 'agent';
+export const VIEW_SCOPE = 'view';
+const ADMIN_ROLE = 'Admin';
 // ws close reason은 123바이트 한도 (RFC 6455 §5.5.1).
 export const WS_REJECT_REASON = "Unauthorized: agents need a PAT with 'agent' scope (--token / TAPFLOW_AGENT_TOKEN); browsers must sign in";
+/** A PAT with neither `view` nor `agent`: it may upload builds, not open device sessions. */
+export const WS_SCOPE_REASON = "Forbidden: this token lacks the 'view' scope needed for device sessions; create an API-type token";
+/** An `agent` token is issued by an Admin and is only as good as that Admin role, checked at every use. */
+export const WS_AGENT_OWNER_REASON = "Unauthorized: this agent token's owner is no longer an Admin; an Admin must issue a new agent token";
+/** An open socket whose token was revoked, expired, or went with its owner. */
+export const WS_TOKEN_GONE_REASON = 'Unauthorized: this token was revoked or has expired, or its owner was removed';
 // 새 WebSocket 연결을 첫 메시지 도착 전에 분류한다. (주소 × 자격) 매트릭스를
 // 단위 테스트할 수 있도록 순수 함수로 분리 (#271).
-export function classifyConnection({ isLocal, hasCookieAuth, patScopes }) {
+//
+// **A PAT confers the browser role only with `view`.** Any valid PAT used to, so a `builds:write`
+// token meant for CI uploads could drive devices, and an agent-only token whose first frame was not a
+// handshake fell through to `browser` as well. The HTTP side already asked for `view` (screenshots,
+// UI trees); the socket now asks the same question.
+export function classifyConnection({ isLocal, hasCookieAuth, patScopes, patOwnerRole }) {
+    if (isLocal) {
+        return hasCookieAuth
+            ? { action: 'accept', role: 'browser' }
+            : { action: 'accept', role: 'first-message', mayBrowse: true, mayRegisterAgent: true };
+    }
+    const canView = patScopes?.includes(VIEW_SCOPE) ?? false;
     // 명시적 에이전트 자격은 떠돌이 쿠키보다 우선한다 — 원격 에이전트의 인증 경로.
-    if (!isLocal && patScopes?.includes(AGENT_SCOPE))
-        return { action: 'accept', role: 'first-message' };
+    if (patScopes?.includes(AGENT_SCOPE)) {
+        if (patOwnerRole === ADMIN_ROLE) {
+            return { action: 'accept', role: 'first-message', mayBrowse: canView, mayRegisterAgent: true };
+        }
+        // A demoted owner's `view,agent` token keeps what `view` alone would give: a Viewer's `view` token
+        // may run QA sessions, so taking browsing away here would be stricter than the role model.
+        if (canView)
+            return { action: 'accept', role: 'browser' };
+        return { action: 'reject', reason: WS_AGENT_OWNER_REASON };
+    }
     if (hasCookieAuth)
         return { action: 'accept', role: 'browser' };
-    if (isLocal)
-        return { action: 'accept', role: 'first-message' };
-    if (patScopes)
+    if (canView)
         return { action: 'accept', role: 'browser' };
+    if (patScopes)
+        return { action: 'reject', reason: WS_SCOPE_REASON };
     return { action: 'reject', reason: WS_REJECT_REASON };
 }
+/**
+ * Would this socket still be accepted, given what the database says now? Returns the close reason, or
+ * null when it would.
+ *
+ * **One predicate instead of one rule per event.** Removal, demotion, revocation, expiry and an
+ * invitation accept that changes a role all reach an open socket through the same question, asked on
+ * the heartbeat and again right after any of those writes. A list of "which sockets does this event
+ * affect" is the design this replaced, and it had already missed expiry and the invitation path.
+ *
+ * `role` is what the socket has become: `agent` and `stream` rest on the `agent` scope and its owner's
+ * Admin role; `browser` rests on `view`. A socket that has not sent its first frame yet (`undefined`)
+ * is re-classified as a fresh handshake would be.
+ */
+export function revalidatePrincipal(principal, role, current, nowSeconds) {
+    if (principal.via === 'cookie') {
+        if (!current.userExists)
+            return WS_REJECT_REASON;
+        if (principal.jwtExp !== undefined && principal.jwtExp <= nowSeconds)
+            return WS_REJECT_REASON;
+        return null;
+    }
+    const pat = current.pat;
+    if (!pat)
+        return WS_TOKEN_GONE_REASON;
+    if (role === 'agent' || role === 'stream') {
+        return pat.scopes.includes(AGENT_SCOPE) && pat.ownerRole === ADMIN_ROLE ? null : WS_AGENT_OWNER_REASON;
+    }
+    if (role === 'browser')
+        return pat.scopes.includes(VIEW_SCOPE) ? null : WS_SCOPE_REASON;
+    const again = classifyConnection({ isLocal: false, hasCookieAuth: false, patScopes: pat.scopes, patOwnerRole: pat.ownerRole });
+    return again.action === 'reject' ? again.reason : null;
+}
 //# sourceMappingURL=connectionAuth.js.map

package/dist/lib/connectionAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"connectionAuth.js","sourceRoot":"","sources":["../../src/lib/connectionAuth.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAA;AAElC,gDAAgD;AAChD,MAAM,CAAC,MAAM,gBAAgB,GAC3B,2GAA2G,CAAA;AAe7G,oDAAoD;AACpD,kCAAkC;AAClC,MAAM,UAAU,kBAAkB,CAChC,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAuB;IAE1D,+CAA+C;IAC/C,IAAI,CAAC,OAAO,IAAI,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;IACpG,IAAI,aAAa;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC/D,IAAI,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;IAC/D,IAAI,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC3D,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;AACvD,CAAC"}
+{"version":3,"file":"connectionAuth.js","sourceRoot":"","sources":["../../src/lib/connectionAuth.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAA;AAClC,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAA;AAChC,MAAM,UAAU,GAAG,OAAO,CAAA;AAE1B,gDAAgD;AAChD,MAAM,CAAC,MAAM,gBAAgB,GAC3B,2GAA2G,CAAA;AAC7G,6FAA6F;AAC7F,MAAM,CAAC,MAAM,eAAe,GAC1B,mGAAmG,CAAA;AACrG,2GAA2G;AAC3G,MAAM,CAAC,MAAM,qBAAqB,GAChC,qGAAqG,CAAA;AACvG,+EAA+E;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAC/B,+EAA+E,CAAA;AAqBjF,oDAAoD;AACpD,kCAAkC;AAClC,EAAE;AACF,kGAAkG;AAClG,sGAAsG;AACtG,oGAAoG;AACpG,oDAAoD;AACpD,MAAM,UAAU,kBAAkB,CAChC,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAuB;IAExE,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,aAAa;YAClB,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;YACvC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAA;IAC1F,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAA;IACxD,+CAA+C;IAC/C,IAAI,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,IAAI,YAAY,KAAK,UAAU,EAAE,CAAC;YAChC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAA;QAChG,CAAC;QACD,mGAAmG;QACnG,2FAA2F;QAC3F,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;QACzD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;IAC5D,CAAC;IACD,IAAI,aAAa;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC/D,IAAI,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IACzD,IAAI,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IACnE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;AACvD,CAAC;AAoBD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CACjC,SAA0B,EAC1B,IAAgD,EAChD,OAA0B,EAC1B,UAAkB;IAElB,IAAI,SAAS,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,UAAU;YAAE,OAAO,gBAAgB,CAAA;QAChD,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,IAAI,UAAU;YAAE,OAAO,gBAAgB,CAAA;QAC7F,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;IACvB,IAAI,CAAC,GAAG;QAAE,OAAO,oBAAoB,CAAA;IACrC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAA;IACxG,CAAC;IACD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAA;IACvF,MAAM,KAAK,GAAG,kBAAkB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAA;IAC9H,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;AACxD,CAAC"}

package/dist/middleware/auth.d.ts

@@ -7,13 +7,53 @@ export interface AuthContext {
 export declare function signJwt(payload: AuthContext): string;
 export declare function verifyJwtOrThrow(token: string): AuthContext;
 export declare function verifyJwt(token: string): AuthContext | null;
-export declare function getAuth(req: http.IncomingMessage): AuthContext | null;
+/** A signed-in session: who the cookie names, as the users table describes them now. */
+export interface SessionAuth extends AuthContext {
+    /** The JWT's `exp` (seconds since the epoch), so an open socket can be closed when it passes. */
+    exp?: number;
+}
+/**
+ * The cookie's user, **checked against the users table on every call**.
+ *
+ * The JWT lives seven days and removing a member deletes their row, so a signature check alone kept a
+ * removed member signed in for up to a week on every cookie path: this function, `requireViewAuth`,
+ * `requireBuildAuth`, recordings, and the WebSocket handshake. This is the one place all of them pass,
+ * so the row check lives here. User ids are `AUTOINCREMENT`, so a removed id never comes back and "the
+ * row exists" is a sound test. `email` and `role` come from the row, never from the JWT.
+ *
+ * Only the JWT verification failure becomes `null`. A database error propagates: turning a transient
+ * `SQLITE_BUSY` into "not signed in" would sign everyone out and hide the fault.
+ */
+export declare function getAuth(req: http.IncomingMessage): SessionAuth | null;
+export declare function findUser(userId: number): {
+    email: string;
+    role: string;
+} | null;
 export declare function requireAuth(req: http.IncomingMessage, res: http.ServerResponse): AuthContext | null;
+export declare function currentRole(res: http.ServerResponse, userId: number): string | null;
 export declare function requireRole(req: http.IncomingMessage, res: http.ServerResponse, roles: string[]): AuthContext | null;
-export declare function verifyPat(req: http.IncomingMessage): {
+export declare function assertCanWrite(res: http.ServerResponse, userId: number): boolean;
+/** A live PAT and its owner, as the database describes them now. */
+export interface PatAuth {
+    patId: number;
     userId: number;
-    scope: string;
-} | null;
+    scopes: string[];
+    ownerEmail: string;
+    ownerRole: string;
+}
+/**
+ * The PAT on this request, or null when there is none, it is unknown, or it has expired.
+ *
+ * **Reads only.** `last_used_at` is written by `touchPat` once the credential check has accepted the
+ * token: a token refused there (a scope it lacks, a WebSocket refused for its scope or its owner's
+ * role) is not used, and a "last used" that moved on those told an Admin a leaked token was in use
+ * when nothing got through. A route that accepts the token and then refuses the request on the
+ * owner's role (`assertCanWrite` for a Viewer) still counts as a use — the token did reach the route.
+ */
+export declare function verifyPat(req: http.IncomingMessage): PatAuth | null;
+/** The same lookup by id, for re-checking a token an open socket was accepted with. */
+export declare function findPat(patId: number): PatAuth | null;
+export declare function touchPat(patId: number): void;
 export declare function hashPat(token: string): string;
 export declare function requireViewAuth(req: http.IncomingMessage, res: http.ServerResponse): AuthContext | null;
 export declare function requireBuildAuth(req: http.IncomingMessage, res: http.ServerResponse): {

package/dist/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AAOvB,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;CACb;AAID,wBAAgB,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAEpD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAM3D;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAM3D;AAED,wBAAgB,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,WAAW,GAAG,IAAI,CAKrE;AAED,wBAAgB,WAAW,CACzB,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,WAAW,GAAG,IAAI,CAQpB;AAED,wBAAgB,WAAW,CACzB,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,MAAM,EAAE,GACd,WAAW,GAAG,IAAI,CASpB;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAe7F;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,WAAW,GAAG,IAAI,CAuBpB;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAa3B"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AAOvB,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;CACb;AAID,wBAAgB,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAEpD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAM3D;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAM3D;AAED,wFAAwF;AACxF,MAAM,WAAW,WAAY,SAAQ,WAAW;IAC9C,iGAAiG;IACjG,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,WAAW,GAAG,IAAI,CASrE;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAK/E;AAED,wBAAgB,WAAW,CACzB,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,WAAW,GAAG,IAAI,CAQpB;AAKD,wBAAgB,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAUnF;AAED,wBAAgB,WAAW,CACzB,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,KAAK,EAAE,MAAM,EAAE,GACd,WAAW,GAAG,IAAI,CAWpB;AAMD,wBAAgB,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAShF;AAED,oEAAoE;AACpE,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CAClB;AAyBD;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,GAAG,IAAI,CAMnE;AAED,uFAAuF;AACvF,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAGrD;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE5C;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,wBAAgB,eAAe,CAC7B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB,WAAW,GAAG,IAAI,CAgBpB;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,GACvB;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAc3B"}

package/dist/middleware/auth.js

@@ -23,12 +23,34 @@ export function verifyJwt(token) {
         return null;
     }
 }
+/**
+ * The cookie's user, **checked against the users table on every call**.
+ *
+ * The JWT lives seven days and removing a member deletes their row, so a signature check alone kept a
+ * removed member signed in for up to a week on every cookie path: this function, `requireViewAuth`,
+ * `requireBuildAuth`, recordings, and the WebSocket handshake. This is the one place all of them pass,
+ * so the row check lives here. User ids are `AUTOINCREMENT`, so a removed id never comes back and "the
+ * row exists" is a sound test. `email` and `role` come from the row, never from the JWT.
+ *
+ * Only the JWT verification failure becomes `null`. A database error propagates: turning a transient
+ * `SQLITE_BUSY` into "not signed in" would sign everyone out and hide the fault.
+ */
 export function getAuth(req) {
     const cookie = req.headers.cookie ?? '';
     const match = /(?:^|;\s*)tapflow_token=([^;]+)/.exec(cookie);
     if (!match)
         return null;
-    return verifyJwt(match[1]);
+    const claims = verifyJwt(match[1]);
+    if (!claims)
+        return null;
+    const user = findUser(claims.userId);
+    if (!user)
+        return null;
+    return { userId: claims.userId, email: user.email, role: user.role, exp: claims.exp };
+}
+export function findUser(userId) {
+    const row = getDb().prepare('SELECT email, role FROM users WHERE id = ?').get(userId);
+    return row ?? null;
 }
 export function requireAuth(req, res) {
     const auth = getAuth(req);
@@ -39,34 +61,90 @@ export function requireAuth(req, res) {
     }
     return auth;
 }
+// The cookie JWT carries a role for its whole 7-day life, so a demoted member would keep their old
+// rights for a week and a promoted one would be refused for a week. Every role decision reads the
+// users table instead; the JWT only says who is asking. A missing row means the member was removed.
+export function currentRole(res, userId) {
+    const row = getDb().prepare('SELECT role FROM users WHERE id = ?').get(userId);
+    if (!row) {
+        res.writeHead(401, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Unauthorized' }));
+        return null;
+    }
+    return row.role;
+}
 export function requireRole(req, res, roles) {
     const auth = requireAuth(req, res);
     if (!auth)
         return null;
-    if (!roles.includes(auth.role)) {
+    const role = currentRole(res, auth.userId);
+    if (role === null)
+        return null;
+    if (!roles.includes(role)) {
         res.writeHead(403, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error: 'Forbidden' }));
         return null;
     }
-    return auth;
+    return { ...auth, role };
 }
+// Viewer is read-only: it can look at builds, test them in a QA Session and comment, but not change
+// builds, apps or webhooks. Called after a route's own auth, so it never changes which credentials
+// the route accepts. The PAT path matters most here: any role can mint a builds:write token through
+// the API, so the owner's role is what decides, at the moment the token is used.
+export function assertCanWrite(res, userId) {
+    const role = currentRole(res, userId);
+    if (role === null)
+        return false;
+    if (role === 'Viewer') {
+        res.writeHead(403, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Viewers have read-only access' }));
+        return false;
+    }
+    return true;
+}
+function toPatAuth(row) {
+    return {
+        patId: row.id,
+        userId: row.user_id,
+        scopes: row.scope.split(',').map((s) => s.trim()),
+        ownerEmail: row.email,
+        ownerRole: row.role,
+    };
+}
+// Joined with users so the owner's current role comes with the token: an `agent` token is only as good
+// as its owner's Admin role, and a Viewer's `builds:write` token is refused on write routes.
+// `datetime(expires_at)`, not the bare column: it is written by `toISOString()` ('2026-09-27T10:00:00.000Z')
+// and `datetime('now')` is '2026-09-27 10:00:00'. Compared as text, 'T' sorts after ' ', so a token that
+// expired this morning kept passing until the end of its UTC day.
+const PAT_SELECT = `
+  SELECT pat.id, pat.user_id, pat.scope, u.email, u.role
+  FROM personal_access_tokens pat
+  JOIN users u ON u.id = pat.user_id
+  WHERE (pat.expires_at IS NULL OR datetime(pat.expires_at) > datetime('now'))`;
+/**
+ * The PAT on this request, or null when there is none, it is unknown, or it has expired.
+ *
+ * **Reads only.** `last_used_at` is written by `touchPat` once the credential check has accepted the
+ * token: a token refused there (a scope it lacks, a WebSocket refused for its scope or its owner's
+ * role) is not used, and a "last used" that moved on those told an Admin a leaked token was in use
+ * when nothing got through. A route that accepts the token and then refuses the request on the
+ * owner's role (`assertCanWrite` for a Viewer) still counts as a use — the token did reach the route.
+ */
 export function verifyPat(req) {
     const header = req.headers.authorization ?? '';
     if (!header.startsWith('Bearer tflw_pat_'))
         return null;
-    const token = header.slice(7);
-    const hash = hashPat(token);
-    const db = getDb();
-    const row = db.prepare(`
-    SELECT pat.user_id, pat.scope
-    FROM personal_access_tokens pat
-    WHERE pat.token_hash = ?
-      AND (pat.expires_at IS NULL OR pat.expires_at > datetime('now'))
-  `).get(hash);
-    if (!row)
-        return null;
-    db.prepare(`UPDATE personal_access_tokens SET last_used_at = datetime('now') WHERE token_hash = ?`).run(hash);
-    return { userId: row.user_id, scope: row.scope };
+    const hash = hashPat(header.slice(7));
+    const row = getDb().prepare(`${PAT_SELECT} AND pat.token_hash = ?`).get(hash);
+    return row ? toPatAuth(row) : null;
+}
+/** The same lookup by id, for re-checking a token an open socket was accepted with. */
+export function findPat(patId) {
+    const row = getDb().prepare(`${PAT_SELECT} AND pat.id = ?`).get(patId);
+    return row ? toPatAuth(row) : null;
+}
+export function touchPat(patId) {
+    getDb().prepare(`UPDATE personal_access_tokens SET last_used_at = datetime('now') WHERE id = ?`).run(patId);
 }
 export function hashPat(token) {
     return crypto.createHash('sha256').update(token).digest('hex');
@@ -81,29 +159,23 @@ export function requireViewAuth(req, res) {
         res.end(JSON.stringify({ error: 'Unauthorized' }));
         return null;
     }
-    if (!pat.scope.split(',').map((s) => s.trim()).includes('view')) {
+    if (!pat.scopes.includes('view')) {
         res.writeHead(403, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error: 'Insufficient scope' }));
         return null;
     }
-    const user = getDb()
-        .prepare('SELECT email, role FROM users WHERE id = ?')
-        .get(pat.userId);
-    if (!user) {
-        res.writeHead(401, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ error: 'Unauthorized' }));
-        return null;
-    }
-    return { userId: pat.userId, email: user.email, role: user.role };
+    touchPat(pat.patId);
+    return { userId: pat.userId, email: pat.ownerEmail, role: pat.ownerRole };
 }
 export function requireBuildAuth(req, res) {
     const pat = verifyPat(req);
     if (pat !== null) {
-        if (!pat.scope.split(',').map((s) => s.trim()).includes('builds:write')) {
+        if (!pat.scopes.includes('builds:write')) {
             res.writeHead(403, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Insufficient scope' }));
             return null;
         }
+        touchPat(pat.patId);
         return { userId: pat.userId };
     }
     const auth = requireAuth(req, res);

package/dist/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,GAAG,MAAM,cAAc,CAAA;AAC9B,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAQ/C,MAAM,WAAW,GAAG,IAAI,CAAA;AAExB,MAAM,UAAU,OAAO,CAAC,OAAoB;IAC1C,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAA;AACtE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,CAAgB,CAAA;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,SAAS,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IACjE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAyB;IAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAA;IACvC,MAAM,KAAK,GAAG,iCAAiC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC5D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;AAC5B,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,GAAyB,EACzB,GAAwB;IAExB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IACzB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,GAAyB,EACzB,GAAwB,EACxB,KAAe;IAEf,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;QAC/C,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAyB;IACjD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;IAC9C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAAE,OAAO,IAAI,CAAA;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;IAC3B,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;;;;;GAKtB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAmD,CAAA;IAC9D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,EAAE,CAAC,OAAO,CAAC,uFAAuF,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC7G,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAChE,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,GAAyB,EACzB,GAAwB;IAExB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,UAAU;QAAE,OAAO,UAAU,CAAA;IACjC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAA;QACxD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,EAAE;SACjB,OAAO,CAAC,4CAA4C,CAAC;SACrD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAgD,CAAA;IACjE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAA;AACnE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,GAAyB,EACzB,GAAwB;IAExB,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;YAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAA;YACxD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAA;IAC/B,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;AAChC,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,GAAG,MAAM,cAAc,CAAA;AAC9B,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAQ/C,MAAM,WAAW,GAAG,IAAI,CAAA;AAExB,MAAM,UAAU,OAAO,CAAC,OAAoB;IAC1C,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAA;AACtE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,CAAgB,CAAA;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,SAAS,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IACjE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAQD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,OAAO,CAAC,GAAyB;IAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAA;IACvC,MAAM,KAAK,GAAG,iCAAiC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC5D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAA4C,CAAA;IAC7E,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAA;AACvF,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAAc;IACrC,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC,GAAG,CAAC,MAAM,CAEvE,CAAA;IACb,OAAO,GAAG,IAAI,IAAI,CAAA;AACpB,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,GAAyB,EACzB,GAAwB;IAExB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IACzB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,mGAAmG;AACnG,kGAAkG;AAClG,oGAAoG;AACpG,MAAM,UAAU,WAAW,CAAC,GAAwB,EAAE,MAAc;IAClE,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,GAAG,CAAC,MAAM,CAEhE,CAAA;IACb,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,GAAyB,EACzB,GAAwB,EACxB,KAAe;IAEf,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;QAC/C,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED,oGAAoG;AACpG,mGAAmG;AACnG,oGAAoG;AACpG,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,GAAwB,EAAE,MAAc;IACrE,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACrC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC/B,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC,CAAA;QACnE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAaD,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,EAAE;QACb,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,UAAU,EAAE,GAAG,CAAC,KAAK;QACrB,SAAS,EAAE,GAAG,CAAC,IAAI;KACpB,CAAA;AACH,CAAC;AAED,uGAAuG;AACvG,6FAA6F;AAC7F,6GAA6G;AAC7G,yGAAyG;AACzG,kEAAkE;AAClE,MAAM,UAAU,GAAG;;;;+EAI4D,CAAA;AAE/E;;;;;;;;GAQG;AACH,MAAM,UAAU,SAAS,CAAC,GAAyB;IACjD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;IAC9C,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAAE,OAAO,IAAI,CAAA;IACvD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACrC,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,UAAU,yBAAyB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAuB,CAAA;IACnG,OAAO,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACpC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,UAAU,iBAAiB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAuB,CAAA;IAC5F,OAAO,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACpC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,KAAK,EAAE,CAAC,OAAO,CAAC,+EAA+E,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AAC7G,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAChE,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,GAAyB,EACzB,GAAwB;IAExB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,UAAU;QAAE,OAAO,UAAU,CAAA;IACjC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;QAClD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAA;QACxD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACnB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,CAAA;AAC3E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,GAAyB,EACzB,GAAwB;IAExB,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC1B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;YAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAA;YACxD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACnB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAA;IAC/B,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;AAChC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tapflowio/relay",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "description": "WebSocket relay server for tapflow — NAT traversal, session routing, JWT auth, bundled dashboard",
   "keywords": [
     "tapflow",
@@ -52,8 +52,8 @@
     "nodemailer": "^9.1.1",
     "ws": "^8.21.3",
     "zod": "^4.6.5",
-    "@tapflowio/agent-core": "0.24.0",
-    "@tapflowio/protocol": "0.24.0"
+    "@tapflowio/agent-core": "0.25.0",
+    "@tapflowio/protocol": "0.25.0"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",