@teamscala/service-boot 0.23.505 → 0.23.507

package/package.json

@@ -1116,6 +1116,7 @@
     "#service-boot/*.ts": "./src/*.ts"
   },
   "name": "@teamscala/service-boot",
+  "capability": "Lower-tier boot stages composed by service-runtime — page-server SSR, asset proxy, hono pipeline, agreement gate (no-shadow-runtime-exports: only service-runtime composes them).",
   "peerDependencies": {
     "@teamscala/chat-completion": "*"
   },
@@ -1130,5 +1131,5 @@
   "repository": "https://github.com/teamgbg/service-boot",
   "sideEffects": false,
   "type": "module",
-  "version": "0.23.505"
+  "version": "0.23.507"
 }

package/src/agreement-gate/signing-shell.test.ts

@@ -1,11 +1,11 @@
-// ! @system codegen
-// ! @status generated
-// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
-// !
-// ! This suite's assertions are OWNED by the codegen band: the band module
-// ! carries them verbatim, this file is the emission, and hand edits here are
-// ! overwritten on the next run. The rationale each assertion carries moved
-// ! with it into the band.
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { describe, expect, mock, test } from "bun:test";
 

package/src/agreement-gate.test.ts

@@ -1,11 +1,11 @@
-// ! @system codegen
-// ! @status generated
-// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
-// !
-// ! This suite's assertions are OWNED by the codegen band: the band module
-// ! carries them verbatim, this file is the emission, and hand edits here are
-// ! overwritten on the next run. The rationale each assertion carries moved
-// ! with it into the band.
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { describe, expect, test } from "bun:test";
 import { agreementGateConfig } from "./agreement-gate.ts";

package/src/asset-proxy.test.ts

@@ -1,11 +1,11 @@
-// ! @system codegen
-// ! @status generated
-// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
-// !
-// ! This suite's assertions are OWNED by the codegen band: the band module
-// ! carries them verbatim, this file is the emission, and hand edits here are
-// ! overwritten on the next run. The rationale each assertion carries moved
-// ! with it into the band.
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { describe, expect, it } from "bun:test";
 import { handleAssetProxy } from "./asset-proxy.ts";

package/src/attach-portal-members.test.ts

@@ -1,11 +1,11 @@
-// ! @system codegen
-// ! @status generated
-// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
-// !
-// ! This suite's assertions are OWNED by the codegen band: the band module
-// ! carries them verbatim, this file is the emission, and hand edits here are
-// ! overwritten on the next run. The rationale each assertion carries moved
-// ! with it into the band.
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { describe, expect, mock, test } from "bun:test";
 import { Hono } from "hono";

package/src/attach-transfers-upload.test.ts

@@ -1,11 +1,11 @@
-// ! @system codegen
-// ! @status generated
-// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
-// !
-// ! This suite's assertions are OWNED by the codegen band: the band module
-// ! carries them verbatim, this file is the emission, and hand edits here are
-// ! overwritten on the next run. The rationale each assertion carries moved
-// ! with it into the band.
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { describe, expect, it } from "bun:test";
 import { attachTransfersUpload } from "./attach-transfers-upload.ts";

package/src/auth-gate.test.ts

@@ -1,11 +1,11 @@
-// ! @system codegen
-// ! @status generated
-// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
-// !
-// ! This suite's assertions are OWNED by the codegen band: the band module
-// ! carries them verbatim, this file is the emission, and hand edits here are
-// ! overwritten on the next run. The rationale each assertion carries moved
-// ! with it into the band.
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { describe, expect, test } from "bun:test";
 import { isStaticAssetPath } from "./auth-gate.ts";

package/src/bind-page-handler.ts

@@ -22,6 +22,7 @@
 		// wave-parallel loader, brotli) is the sanctioned path; re-adding shared-cache headers needs a fresh operator ruling.
 
 import { getAppLogger } from "@teamscala/logger/app-loggers";
+import { withGateEntryClears } from "./content-gate/gate-entry-clears.ts";
 import type { Context } from "hono";
 import { readHtmlTemplate } from "./read-html-template.ts";
 import {
@@ -123,15 +124,27 @@ export async function bindPageHandler(
 
 		const nonce = c.get("nonce") as string | undefined;
 
-		const resp = await handler(c.req.raw, {
-			userId,
-			orgId,
-			visitor,
-			searchParams: c.req.query(),
-			htmlTemplate: await readHtmlTemplate(),
-			nonce,
-		});
+		const { result: resp, clears: gateEntryClears } = await withGateEntryClears(async () =>
+			handler(c.req.raw, {
+				userId,
+				orgId,
+				visitor,
+				searchParams: c.req.query(),
+				htmlTemplate: await readHtmlTemplate(),
+				nonce,
+			}),
+		);
 		const headers = new Headers(resp.headers as HeadersInit);
+		// Gate-entry markers are ONE-VIEW state: the render that consumed one
+		// clears it here, so the next load (a refresh) is unauthorized and shows
+		// the gate again. Without this the marker would outlive the view that
+		// used it and every load would skip the gate.
+		for (const name of gateEntryClears) {
+			headers.append(
+				"Set-Cookie",
+				`${name}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`,
+			);
+		}
 		headers.set(
 			"Cache-Control",
 			"no-store, no-cache, no-transform, must-revalidate, max-age=0",

package/src/build-client-assets/manifest.test.ts

@@ -1,11 +1,11 @@
-// ! @system codegen
-// ! @status generated
-// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
-// !
-// ! This suite's assertions are OWNED by the codegen band: the band module
-// ! carries them verbatim, this file is the emission, and hand edits here are
-// ! overwritten on the next run. The rationale each assertion carries moved
-// ! with it into the band.
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { mkdir, mkdtemp, rm } from "node:fs/promises";
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";

package/src/build-client-assets/source-candidates.test.ts

@@ -1,11 +1,11 @@
-// ! @system codegen
-// ! @status generated
-// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
-// !
-// ! This suite's assertions are OWNED by the codegen band: the band module
-// ! carries them verbatim, this file is the emission, and hand edits here are
-// ! overwritten on the next run. The rationale each assertion carries moved
-// ! with it into the band.
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { describe, expect, test } from "bun:test";
 import { mkdir, rm } from "node:fs/promises";

package/src/build-client-assets/sourcemaps-upload.test.ts

@@ -1,11 +1,11 @@
-// ! @system codegen
-// ! @status generated
-// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
-// !
-// ! This suite's assertions are OWNED by the codegen band: the band module
-// ! carries them verbatim, this file is the emission, and hand edits here are
-// ! overwritten on the next run. The rationale each assertion carries moved
-// ! with it into the band.
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { mkdtemp, mkdir, readdir, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";

package/src/build-client-assets/styles-build.test.ts

@@ -1,11 +1,11 @@
-// ! @system codegen
-// ! @status generated
-// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
-// !
-// ! This suite's assertions are OWNED by the codegen band: the band module
-// ! carries them verbatim, this file is the emission, and hand edits here are
-// ! overwritten on the next run. The rationale each assertion carries moved
-// ! with it into the band.
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { describe, expect, test } from "bun:test";
 import { mkdir, rm } from "node:fs/promises";

package/src/build-client-assets.test.ts

@@ -1,11 +1,11 @@
-// ! @system codegen
-// ! @status generated
-// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
-// !
-// ! This suite's assertions are OWNED by the codegen band: the band module
-// ! carries them verbatim, this file is the emission, and hand edits here are
-// ! overwritten on the next run. The rationale each assertion carries moved
-// ! with it into the band.
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { mkdtemp, mkdir, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";

package/src/capability-slug.test.ts

@@ -1,11 +1,11 @@
-// ! @system codegen
-// ! @status generated
-// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
-// !
-// ! This suite's assertions are OWNED by the codegen band: the band module
-// ! carries them verbatim, this file is the emission, and hand edits here are
-// ! overwritten on the next run. The rationale each assertion carries moved
-// ! with it into the band.
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { describe, expect, test } from "bun:test";
 import { toCapabilitySlug } from "./capability-slug.ts";

package/src/compose-page-title.test.ts

@@ -1,11 +1,11 @@
-// ! @system codegen
-// ! @status generated
-// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
-// !
-// ! This suite's assertions are OWNED by the codegen band: the band module
-// ! carries them verbatim, this file is the emission, and hand edits here are
-// ! overwritten on the next run. The rationale each assertion carries moved
-// ! with it into the band.
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { describe, expect, test } from "bun:test";
 import { composePageTitle } from "./compose-page-title.ts";

package/src/content-gate/access.ts

@@ -101,6 +101,17 @@ export async function attachContentGateAccess(
 				"Set-Cookie",
 				`${config.cookieName}=${encodeURIComponent(token)}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${maxAge}`,
 			);
+			if (config.entryCookieName) {
+				// The ENTRY MARKER: it authorizes exactly the redirect this sets it
+				// on — the gate requires it and the render it consumed clears it.
+				// Max-Age matches the token only as a safety net; consumption is
+				// what ends its life, never the clock.
+				c.header(
+					"Set-Cookie",
+					`${config.entryCookieName}=1; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${maxAge}`,
+					{ append: true },
+				);
+			}
 		}
 		return c.redirect(back, 302);
 	});

package/src/content-gate/catalog.test.ts

@@ -1,11 +1,11 @@
-// ! @system codegen
-// ! @status generated
-// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
-// !
-// ! This suite's assertions are OWNED by the codegen band: the band module
-// ! carries them verbatim, this file is the emission, and hand edits here are
-// ! overwritten on the next run. The rationale each assertion carries moved
-// ! with it into the band.
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { describe, expect, test } from "bun:test";
 import {

package/src/content-gate/config-types.ts

@@ -70,6 +70,15 @@ export interface ContentGateConfig {
 	 *  capable so a gate can load its display/behaviour settings from a registry
 	 *  row (DB-driven, not hardcoded); sync implementations remain valid. */
 	onUnauthorized(resolved: Resolved, resourceId: string): void | Promise<void>;
+	/**
+	 * OPT-IN REQUIRED-GATE-ENTRY. When set, a valid token authorizes ONLY on a
+	 * request that also carries this marker cookie — set by the access endpoint
+	 * alongside the token and consumed (cleared) by the render it authorizes, so
+	 * the marker lives exactly one view: the submit's own redirect releases the
+	 * content, and every later load (a refresh) is unauthorized, showing the
+	 * gate again. Omit for gates whose token is session-scoped by design.
+	 */
+	entryCookieName?: string;
 }
 
 /** Drives the public access endpoint (access.ts / attachContentGateAccess). */
@@ -80,6 +89,12 @@ export interface AccessConfig {
 	cookieName: string;
 	/** Cookie lifetime in ms (Max-Age). */
 	ttlMs: number;
+	/**
+	 * Marker cookie set alongside the token on a match. The gate requires it
+	 * (ContentGateConfig.entryCookieName) and the render it authorizes clears
+	 * it, so it authorizes exactly the submit's own redirect.
+	 */
+	entryCookieName?: string;
 	/** Form field carrying the resource id, e.g. "proposalId". */
 	recordIdField: string;
 	/**

package/src/content-gate/gate-entry-clears.ts

@@ -0,0 +1,41 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * REQUEST-SCOPED channel for gate-entry marker clears. A gate that declares an
+ * entry marker (config.entryCookieName) consumes it on the render that the
+ * access endpoint's own redirect produces; that render's response must clear
+ * the marker, or the next load (a refresh) would still carry it and skip the
+ * gate. The gate writes the name here; bindPageHandler — which owns the page
+ * Response — drains it into Set-Cookie, so the marker lives exactly one view.
+ *
+ * THE CLEARS COME BACK AS THE CALL'S RETURN VALUE, never from a post-hoc
+ * read: the store only exists inside the run() scope, so a reader called after
+ * the awaited call has already left it and would see an empty list — which is
+ * exactly how the first version of this file shipped a marker that was never
+ * cleared (measured live 2026-09-14: the cookie survived the render).
+ *
+ * AsyncLocalStorage rather than a module-level map: request-scoped by
+ * construction, no accumulated process state that a restart would silently
+ * reset (in-memory-state-is-not-durable).
+ */
+import { AsyncLocalStorage } from "node:async_hooks";
+
+const clears = new AsyncLocalStorage<string[]>();
+
+export async function withGateEntryClears<T>(
+	fn: () => Promise<T>,
+): Promise<{ result: T; clears: string[] }> {
+	const list: string[] = [];
+	const result = await clears.run(list, fn);
+	return { result, clears: [...list] };
+}
+
+export function recordGateEntryClear(cookieName: string): void {
+	const list = clears.getStore();
+	// Outside a bound request there is no response to write to (a direct gate
+	// run, a unit test). Dropping the record is the only correct answer —
+	// throwing would make an otherwise valid direct invocation a failure.
+	if (list && !list.includes(cookieName)) list.push(cookieName);
+}

package/src/content-gate/gate-entry-marker.test.ts

@@ -0,0 +1,111 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Locks the OPT-IN gate-entry marker. A gate that does NOT declare
+ * entryCookieName must behave exactly as before — a valid token authorizes on
+ * any load and nothing is recorded for clearing (condition 1: every non-opting
+ * service unchanged). An opting gate authorizes ONLY the request that carries
+ * the marker (the identity submit's own redirect) and returns the marker name
+ * so the page Response clears it — one view, then the gate is presented again.
+ *
+ * The clears are asserted from the CALL'S RETURN VALUE: the store lives only
+ * inside the run() scope, and the first shipped version read it afterwards,
+ * saw nothing, and left the marker in the browser (measured live 2026-09-14).
+ *
+ * Operator ruling 2026-09-14 (refresh must return to the identity gate),
+ * mechanism measured live: the quiz_token cookie alone was the carrier that
+ * skipped the gate on reload.
+ */
+import { describe, expect, test } from "bun:test";
+import type { ContentGateConfig } from "./config-types.ts";
+import { runContentGate } from "./gate.ts";
+import { withGateEntryClears } from "./gate-entry-clears.ts";
+
+function makeConfig(entryCookieName?: string) {
+	const calls = { authorized: 0, unauthorized: 0 };
+	const cfg: ContentGateConfig = {
+		cookieName: "quiz_token",
+		entryCookieName,
+		getResourceId: () => "res-1",
+		verifyToken: (token) =>
+			token === "good" ? { email: "v@example.com", name: "V" } : null,
+		onAuthorized: () => {
+			calls.authorized++;
+		},
+		onUnauthorized: () => {
+			calls.unauthorized++;
+		},
+	};
+	return { cfg, calls };
+}
+
+describe("gate entry marker is opt-in and one-view", () => {
+	test("non-opting gate: a valid token authorizes on any load, nothing cleared — behaviour unchanged", async () => {
+		const { cfg, calls } = makeConfig();
+		const { clears } = await withGateEntryClears(async () => {
+			const out = await runContentGate({}, "quiz_token=good", Date.now(), cfg);
+			expect(out.authorized).toBe(true);
+			expect(calls.authorized).toBe(1);
+		});
+		expect(clears).toEqual([]);
+	});
+
+	test("opting gate: token WITHOUT the marker is unauthorized — a refresh shows the gate", async () => {
+		const { cfg, calls } = makeConfig("quiz_token_entered");
+		const { clears } = await withGateEntryClears(async () => {
+			const out = await runContentGate({}, "quiz_token=good", Date.now(), cfg);
+			expect(out.authorized).toBe(false);
+			expect(calls.unauthorized).toBe(1);
+			expect(calls.authorized).toBe(0);
+		});
+		expect(clears).toEqual([]);
+	});
+
+	test("opting gate: token + marker authorizes and RETURNS the marker for clearing — one view", async () => {
+		const { cfg, calls } = makeConfig("quiz_token_entered");
+		const { clears } = await withGateEntryClears(async () => {
+			const out = await runContentGate(
+				{},
+				"quiz_token=good; quiz_token_entered=1",
+				Date.now(),
+				cfg,
+			);
+			expect(out.authorized).toBe(true);
+			expect(calls.authorized).toBe(1);
+		});
+		expect(clears).toEqual(["quiz_token_entered"]);
+	});
+
+	test("opting gate: marker present but token invalid stays unauthorized and clears nothing", async () => {
+		const { cfg, calls } = makeConfig("quiz_token_entered");
+		const { clears } = await withGateEntryClears(async () => {
+			const out = await runContentGate(
+				{},
+				"quiz_token=bad; quiz_token_entered=1",
+				Date.now(),
+				cfg,
+			);
+			expect(out.authorized).toBe(false);
+			expect(calls.unauthorized).toBe(1);
+		});
+		expect(clears).toEqual([]);
+	});
+
+	test("two gates in one request each report their own marker, drained once", async () => {
+		const first = makeConfig("gate_a_entered");
+		const second = makeConfig("gate_b_entered");
+		const { clears } = await withGateEntryClears(async () => {
+			await runContentGate({}, "quiz_token=good; gate_a_entered=1", Date.now(), first.cfg);
+			await runContentGate({}, "quiz_token=good; gate_b_entered=1", Date.now(), second.cfg);
+		});
+		expect(clears).toEqual(["gate_a_entered", "gate_b_entered"]);
+	});
+
+	test("the quiz gate and its access endpoint both opt in on the same marker name", async () => {
+		const { quizAccessConfig, quizGateConfig } = await import("../quiz-gate.ts");
+		expect(quizGateConfig.entryCookieName).toBe("quiz_token_entered");
+		expect(quizAccessConfig.entryCookieName).toBe("quiz_token_entered");
+	});
+});

package/src/content-gate/gate.ts

@@ -27,6 +27,7 @@
 
 import type { ContentGateConfig } from "./config-types.ts";
 import { parseCookie } from "./parse-cookie.ts";
+import { recordGateEntryClear } from "./gate-entry-clears.ts";
 
 export interface ContentGateOutcome {
 	applies: boolean;
@@ -44,9 +45,24 @@ export async function runContentGate(
 	if (!resourceId) return { applies: false, authorized: false };
 
 	const token = parseCookie(cookieHeader, config.cookieName);
+
+	// A gate that declares an ENTRY MARKER authorizes only on the request that
+	// carries it — the one the access endpoint's own redirect produces. The
+	// marker is cleared on that render's response (bindPageHandler drains
+	// gate-entry-clears), so a refresh afterwards is unauthorized and the gate
+	// is presented again: that is the whole point of the marker.
+	if (config.entryCookieName) {
+		const entry = parseCookie(cookieHeader, config.entryCookieName);
+		if (entry === undefined) {
+			await config.onUnauthorized(resolved, resourceId);
+			return { applies: true, authorized: false };
+		}
+	}
+
 	const identity = config.verifyToken(token, resourceId, nowMs);
 
 	if (identity) {
+		if (config.entryCookieName) recordGateEntryClear(config.entryCookieName);
 		await config.onAuthorized(resolved, resourceId, identity);
 		return { applies: true, authorized: true, email: identity.email };
 	}

package/src/content-gate/token.test.ts

@@ -1,11 +1,11 @@
-// ! @system codegen
-// ! @status generated
-// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
-// !
-// ! This suite's assertions are OWNED by the codegen band: the band module
-// ! carries them verbatim, this file is the emission, and hand edits here are
-// ! overwritten on the next run. The rationale each assertion carries moved
-// ! with it into the band.
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 process.env.AUTH_SECRET = "test-secret-at-least-16-chars-long";
 

package/src/content-page-floor.test.ts

@@ -1,11 +1,11 @@
-// ! @system codegen
-// ! @status generated
-// ! @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
-// !
-// ! This suite's assertions are OWNED by the codegen band: the band module
-// ! carries them verbatim, this file is the emission, and hand edits here are
-// ! overwritten on the next run. The rationale each assertion carries moved
-// ! with it into the band.
+// @system codegen
+// @status generated
+// @edit change the suite in the owned-suites band, then re-run codegen. Hand-edits are overwritten.
+//
+// This suite's assertions are OWNED by the codegen band: the band module
+// carries them verbatim, this file is the emission, and hand edits here are
+// overwritten on the next run. The rationale each assertion carries moved
+// with it into the band.
 
 import { test, expect } from "bun:test";
 import {