@volter/supercode-teams 0.2.163 → 0.2.165

package/README.md

@@ -46,10 +46,10 @@ a kind another product serves on the same machine. `title.set` needs `control` o
 `observe` on a `root:/path` reads it (stat, list, read, search); `files` also changes it.
 
 A workplace can open one pane or one folder for someone who is not a member of the team. A
-server started with `--delegated-issuer ORIGIN` (the Worker's `DELEGATED_ISSUER`) trusts short-lived
-tokens that issuer signs. `--delegated-issuers ORIGIN,ORIGIN` (the Worker's
-`DELEGATED_ISSUERS`) adds an explicit list of trusted origins; the legacy singular setting
-remains supported. Keys are cached separately per origin, and each token must match a
+server trusts only admin-consented [app installations](../../docs/guides/teams-apps.md) with
+`delegation.surfaces` or `delegation.sessions` for that team. Register the exact issuer origin
+on the app; install the needed module separately. Operator issuer allowlists grant no access.
+Keys are cached separately per origin, and each token must match a
 publication or session binding for that exact issuer. Staging never opens a production
 binding or publication. Tokens use Ed25519 (keys at `ORIGIN/.well-known/jwks.json`, audience this server's
 public origin), each naming a pane (`pane:<key>`) or a folder (`root:/path`) on one machine of one

package/bin/workspace/args.mjs

@@ -10,8 +10,8 @@ const VALUES = new Set([
   'source', 'cursor', 'limit', 'tail', 'before', 'after', 'revision', 'role',
   'out', 'ttl', 'type', 'name', 'visibility', 'backfill', 'format', 'to',
   'grant', 'binding', 'caps', 'fidelity', 'cwd', 'root', 'workspace-from', 'since', 'until', 'session',
-  'on', 'timeout', 'plan', 'tmux-socket', 'volter-issuer', 'delegated-issuer', 'delegated-issuers', 'workplace', 'organization', 'key', 'room',
-  'conversation', 'rh2', 'scope', 'agent',
+  'on', 'timeout', 'plan', 'tmux-socket', 'volter-issuer', 'workplace', 'organization', 'key', 'room',
+  'conversation', 'rh2', 'scope', 'agent', 'body-file',
 ]);
 
 export function parseArgs(argv) {

package/bin/workspace.mjs

@@ -57,6 +57,7 @@ export async function workspaceMain(argv = process.argv.slice(2), env = process.
   const team = client.team(context.team_id);
   const command = { flags, rest, output, client, context, team, explicitContext, home, contextName: selected, env, dependencies };
   if (teamsPrefix && ['list', 'create'].includes(verb)) return teamsCommand(verb, sub, command);
+  if (verb === 'apps' || verb === 'app-installations') return appsCommand(verb,sub,{...command,output:value=>output(flags.json?value:redactAppSecrets(value))});
   if (verb === 'sessions') return sessionsCommand(sub, command);
   if (verb === 'members') return membersCommand(sub, command);
   if (verb === 'groups') return groupsCommand(sub, command);
@@ -69,6 +70,27 @@ export async function workspaceMain(argv = process.argv.slice(2), env = process.
   usage(`unsupported workspace command ${verb}`);
 }
 
+function redactAppSecrets(value) {
+  if(!value||typeof value!=='object')return value;
+  if(Array.isArray(value))return value.map(redactAppSecrets);
+  return Object.fromEntries(Object.entries(value).filter(([key])=>!['secret','webhook_secret','code','token'].includes(key)).map(([key,item])=>[key,redactAppSecrets(item)]));
+}
+
+async function appsCommand(verb,sub,{flags,rest,output,team}) {
+  only(flags,['json','help','context','body_file']);
+  const body=()=>{if(!flags.body_file)usage('--body-file is required (use - for stdin)');return JSON.parse(readFileSync(flags.body_file==='-'?0:flags.body_file,'utf8'));};
+  if(verb==='apps') {
+    if(sub==='catalogue'||sub==='list'){requireArgs(rest,0,0,'teams apps catalogue|list');return output(await team.apps[sub]());}
+    if(['get','rotate-secret','deregister'].includes(sub)){requireArgs(rest,1,1,'teams apps get|rotate-secret|deregister APP');return output(await team.apps[sub==='rotate-secret'?'rotateSecret':sub](rest[0]));}
+    if(sub==='register'){requireArgs(rest,0,0,'teams apps register --body-file FILE');return output(await team.apps.register(body()));}
+    if(sub==='install'){requireArgs(rest,1,1,'teams apps install APP --body-file FILE');return output(await team.apps.install(rest[0],body()));}
+  } else {
+    if(sub==='list'){requireArgs(rest,0,0,'teams app-installations list');return output(await team.appInstallations.list());}
+    if(['get','uninstall','delegate'].includes(sub)){requireArgs(rest,1,1,'teams app-installations get|uninstall|delegate INSTALLATION');return output(await team.appInstallations[sub](rest[0],...(sub==='delegate'?[body()]:[])));}
+  }
+  usage('teams apps catalogue|list|get|register|install|rotate-secret|deregister; app-installations list|get|uninstall|delegate');
+}
+
 async function teamsCommand(verb, sub, { flags, rest, output, client }) {
   if (verb === 'list') { only(flags, ['json', 'help', 'context', 'cursor', 'limit']); requireArgs(rest, 0, 0, 'teams list'); return output(await client.teams({ cursor: flags.cursor, limit: positiveInteger(flags.limit, 50, 'limit') })); }
   const names = [sub, ...rest].filter(value => value !== undefined);
@@ -120,7 +142,7 @@ async function serverCommand({ flags, sub, rest, home, output }) {
   // The Node host's store is node:sqlite (Node 22.5+); only this verb loads it, so every client
   // verb runs on the Node 20 the package declares.
   const { createTeamsServer } = await import('../server/index.mjs');
-  const server = createTeamsServer({ dataDir: flags.data_dir ?? resolve(home, 'teams', 'server'), listen: hostPort(flags.listen ?? '127.0.0.1:7331'), publicOrigin: flags.public_origin ?? null, identityIssuer: flags.volter_issuer ?? null, delegatedIssuer: flags.delegated_issuer ?? null, delegatedIssuers: flags.delegated_issuers?.split(',').map(origin => origin.trim()) ?? [], ...(flags.init_team ? { initTeam: flags.init_team } : {}) });
+  const server = createTeamsServer({ dataDir: flags.data_dir ?? resolve(home, 'teams', 'server'), listen: hostPort(flags.listen ?? '127.0.0.1:7331'), publicOrigin: flags.public_origin ?? null, ...(flags.init_team ? { initTeam: flags.init_team } : {}) });
   output(await server.start());
   await new Promise(resolveStop => { const stop = async () => { await server.close(); resolveStop(); }; process.once('SIGINT', stop); process.once('SIGTERM', stop); });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.163",
+  "version": "0.2.165",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",

package/server/event-routes.mjs

@@ -1,3 +1,5 @@
+import { appGrantAllows } from '@volter/teams/server/auth';
+import { appAuthentication } from '@volter/teams/server/apps';
 import { createHash } from 'node:crypto';
 import { validateListQuery } from '../contracts/index.mjs';
 import { cursorHash, cursorToken } from './catalog.mjs';
@@ -82,6 +84,7 @@ export async function sessionNames(api, teamId, descriptor) {
 }
 
 async function readForEvent(api, auth, ref, tail) {
+  if(!auth.bound&&!await appAuthentication(api,auth))throw Object.assign(new Error('app authorization changed'),{status:401});
   const nextCursorToken = cursorToken();
   const snapshot = await api.store.readSessionSnapshot({
     ...sessionArgs(api, auth, ref), tail,
@@ -121,6 +124,7 @@ export async function handleSessionEvents({ api, req, res, auth, id, url, reques
   const stream = openStream(api, req, res, auth, requestId, fail);
   if (after === null) stream.write({ type: 'snapshot', cursor: initial.event_cursor, revision: initial.revision, data: initial });
   const enqueue = streamQueue(stream, async () => {
+    if(!auth.bound&&!await appAuthentication(api,auth))fail(401,'authentication_required','app authorization changed');
     // This worker operation reads current credential, membership, groups and every constituent ACL together.
     await api.store.authorizedSession(sessionArgs(api, auth, sessionId));
     const replay = await api.store.query('SELECT revision,kind FROM journal WHERE team_id=? AND session_id=? AND revision>? ORDER BY revision', [auth.team_id, sessionId, delivered]);
@@ -153,6 +157,7 @@ async function catalogWindow(api, auth, query) {
     { kind: 'query', sql: 'SELECT s.*,v.descriptor_json,v.sort_at FROM sessions s LEFT JOIN session_versions v ON v.team_id=s.team_id AND v.session_id=s.id AND v.revision=s.revision WHERE s.team_id=? ORDER BY v.sort_at DESC,s.id ASC', params: [auth.team_id] },
     { kind: 'query', sql: 'SELECT * FROM session_grants WHERE team_id=?', params: [auth.team_id] },
   ]);
+  if(!auth.bound&&!await appAuthentication(api,auth))throw Object.assign(new Error('app authorization changed'),{status:401});
   const now = api.clock.nowMs();
   if (!membership?.active || !credential || credential.revoked_at != null || credential.expires_at != null && credential.expires_at <= now) throw Object.assign(new Error('authorization changed'), { status: 401 });
   const byId = new Map(rows.map(row => [row.id, row]));
@@ -168,7 +173,7 @@ async function catalogWindow(api, auth, query) {
     list.push(grant); grantsBySession.set(grant.session_id, list);
   }
   const readable = (row, seen = new Set()) => {
-    if (!row || seen.has(row.id) || row.deleted_at != null || !row.descriptor_json) return false;
+    if (!row || seen.has(row.id) || row.deleted_at != null || !row.descriptor_json || !appGrantAllows(auth,'session',row.id,'sessions.read')) return false;
     seen.add(row.id);
     const own = row.visibility === 'team' || row.custodian_id === auth.principal_id || (grantsBySession.get(row.id) ?? []).some(grant =>
       (grant.expires_at == null || grant.expires_at > now) &&

package/server/harness-routes.mjs

@@ -1,3 +1,4 @@
+import { installedIssuer } from '@volter/teams/server/apps';
 // The harness's routes on a Teams server (company RFC 0008 §6): the session catalog,
 // search, reads, access and correlations; exports, continuations, effects and the
 // attachment relay; sync rules; OTLP ingest, captures and uploads. The neutral handler
@@ -52,7 +53,7 @@ async function preAuth({ api, req, res, path, requestId }) {
     const access=await delegatedSessionOf(api,bearer(req.headers.authorization));
     const ref=decodeURIComponent(early[2]);
     if(!access||access.teamId!==early[1]||access.sessionRef!==ref){console.log(`session-view refused team=${early[1]} session=${ref.slice(0,120)} subject=${access?access.subject:`unverified:${unverifiedSubject(bearer(req.headers.authorization))}`} reason=${!access?'token not admitted':'token names another session'}`);fail(401,'authentication_required','authentication required');}
-    const auth={kind:'session_view',team_id:early[1],principal_id:null,credential_id:null,bound:{issuer:access.issuer,room:access.room,conversation:access.conversation,expiresAt:access.expiresAt}};
+    const auth={kind:'session_view',team_id:early[1],principal_id:null,credential_id:null,bound:{installationId:access.installationId,installedAt:access.installedAt,issuer:access.issuer,room:access.room,conversation:access.conversation,expiresAt:access.expiresAt}};
     const url=new URL(req.url,'http://local');
     if(!early[3])await sessionDescriptor(api,res,auth,ref,requestId);
     else if(early[3]==='/messages')await readSession(api,res,auth,ref,url,requestId);
@@ -424,7 +425,7 @@ async function viewBindingRoute(api,req,res,auth,ref,requestId){
   if(session.custodian_id!==auth.principal_id)fail(403,'forbidden',"only the session's owner binds it to a view");
   const body=await parseJson(req);exact(body,['issuer','room','conversation']);
   if(typeof body.room!=='string'||!body.room||typeof body.conversation!=='string'||!body.conversation)fail(400,'invalid_request','room and conversation are required');
-  if(!api.delegatedIssuers.includes(body.issuer))fail(400,'invalid_request',`this server accepts views signed by ${api.delegatedIssuers.join(', ')||'no workplace'}`);
+  if(!await installedIssuer(api,body.issuer,'delegation.sessions',auth.team_id))fail(400,'invalid_request','this issuer is not an installed session integration');
   const key=[auth.team_id,session.id,body.issuer,body.room,body.conversation];
   await api.store.transaction(req.method==='POST'
     ?[{sql:'INSERT OR IGNORE INTO session_view_bindings(team_id,session_id,issuer,room,conversation,bound_by,created_at) VALUES (?,?,?,?,?,?,?)',params:[...key,auth.principal_id,api.clock.nowMs()]}]

package/server/index.mjs

@@ -16,12 +16,12 @@ import { createTeamsApi, bootstrapServer, maintain, normalizePublicOrigin, produ
 
 function atomicJson(path,value){const tmp=`${path}.${process.pid}.${randomBytes(12).toString('hex')}.tmp`;let fd;try{fd=openSync(tmp,'wx',0o600);writeFileSync(fd,JSON.stringify(value,null,2)+'\n');closeSync(fd);fd=undefined;renameSync(tmp,path);chmodSync(path,0o600);}catch(error){if(fd!==undefined)closeSync(fd);try{unlinkSync(tmp);}catch{}throw error;}}
 
-export function createTeamsServer({dataDir,listen={host:'127.0.0.1',port:7331},publicOrigin=null,identityIssuer=null,delegatedIssuer=null,delegatedIssuers=[],clock=productionClock,ids=productionIds,initTeam,uploadLimitBytes=256*1024*1024}={}) {
+export function createTeamsServer({dataDir,listen={host:'127.0.0.1',port:7331},publicOrigin=null,clock=productionClock,ids=productionIds,initTeam,uploadLimitBytes=256*1024*1024}={}) {
   if(!dataDir) throw new TypeError('dataDir is required');
   const loopback=['127.0.0.1','::1','localhost'].includes(listen.host??'127.0.0.1');
   publicOrigin=normalizePublicOrigin(publicOrigin);
   if(!loopback&&!publicOrigin?.startsWith('https:'))throw new TypeError('non-loopback Teams servers require an HTTPS publicOrigin');
-  const api=createTeamsApi({clock,ids,publicOrigin,identityIssuer,identityOrganizations:identityIssuer?identityOrganizationsFromEnv(process.env):null,delegatedIssuer,delegatedIssuers,uploadLimitBytes});
+  const api=createTeamsApi({clock,ids,publicOrigin,identityOrganizations:identityOrganizationsFromEnv(process.env),uploadLimitBytes});
   // The harness's own routes on this server (harness-routes.mjs); the handler owns the neutral ones.
   api.attach({harnessRoutes});
   const events=api.events;
@@ -43,6 +43,7 @@ export function createTeamsServer({dataDir,listen={host:'127.0.0.1',port:7331},p
         if(!existsSync(credentialPath)&&existsSync(pendingPath)){const pending=JSON.parse(readFileSync(pendingPath,'utf8'));if(pending.server_id!==serverId)throw new Error('bootstrap credential recovery does not match server identity');renameSync(pendingPath,credentialPath);chmodSync(credentialPath,0o600);}
       }
       api.attach({serverId});
+      if(existsSync(credentialPath))api.appRootSecret=JSON.parse(readFileSync(credentialPath,'utf8')).token;
       const maintenance=async()=>{
         let next=60000;
         try{

package/server/store-core.mjs

@@ -7,6 +7,7 @@ import { ingestOtlpBatch, correlateSessions } from './arc2-transactions.mjs';
 import { claimEffect, getEffect, listEffects, reportEffect } from './effects-transactions.mjs';
 import { applyCaptureMessages } from './capture-transactions.mjs';
 import { MIGRATIONS, MESSAGE_AT } from '@volter/teams/server/migrations';
+import { APP_LINEAGE_REVOKED, appGrantAllows } from '@volter/teams/server/auth';
 
 /** Bring a database to the newest schema. `version()`/`setVersion(n)` name where the host records it. */
 export function migrate({ exec, tx, version, setVersion }) {
@@ -26,12 +27,23 @@ export function createStoreHandlers({ all, get, run, tx }) {
     const {teamId,principalId,credentialId,ref,now,bound}=args;
     // `bound`: a workplace's session-view token ({issuer, room, conversation, expiresAt}), which reads only a
     // session its owner bound to that Room and Conversation; it holds no credential and is no member.
-    let membership=null;
+    let membership=null,appFence=null,grantSource=null;
+    if((args.delegationDepth??0)>16)domainError(401,'authentication_required','delegation lineage is too deep');
     if(bound){
+      if(!get(`SELECT 1 FROM app_installations i JOIN apps a ON a.id=i.app_id JOIN memberships m ON m.team_id=i.team_id AND m.principal_id=i.principal_id JOIN memberships installer ON installer.team_id=i.team_id AND installer.principal_id=i.installer_id WHERE i.team_id=? AND a.issuer=? AND i.id=? AND i.created_at=? AND i.state='active' AND a.state='active' AND m.active=1 AND installer.active=1 AND installer.role IN ('owner','admin') AND EXISTS (SELECT 1 FROM json_each(i.actions_json) WHERE value='delegation.sessions')`,[teamId,bound.issuer,bound.installationId,bound.installedAt]))domainError(401,'authentication_required','integration was uninstalled');
       if(!(bound.expiresAt>now))domainError(401,'authentication_required','authentication required');
     }else{
       const credential=get("SELECT id FROM credentials WHERE id=? AND principal_id=? AND kind IN ('user','service') AND (team_id IS NULL OR team_id=?) AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at>?)",[credentialId,principalId,teamId,now]);
       membership=get('SELECT role FROM memberships WHERE team_id=? AND principal_id=? AND active=1',[teamId,principalId]);
+      const identity=get(`SELECT i.state,a.state app_state,m.active,m.role FROM identity_app_credentials c JOIN app_installations i ON i.id=c.installation_id JOIN apps a ON a.id=i.app_id JOIN memberships m ON m.team_id=i.team_id AND m.principal_id=i.installer_id WHERE c.credential_id=?`,[credentialId]);
+      if(identity&&(identity.state!=='active'||identity.app_state!=='active'||!identity.active||!['owner','admin'].includes(identity.role)))domainError(401,'authentication_required','identity integration revoked');
+      const app=get('SELECT ac.*,i.state,a.state app_state,installer.active,installer.role FROM app_credentials ac JOIN app_installations i ON i.id=ac.installation_id JOIN apps a ON a.id=i.app_id JOIN memberships installer ON installer.team_id=i.team_id AND installer.principal_id=i.installer_id WHERE ac.credential_id=?',[credentialId]);
+      if(app){
+        if(app.state!=='active'||app.app_state!=='active'||!app.active||!['owner','admin'].includes(app.role)||!JSON.parse(app.actions_json).includes('sessions.read'))domainError(403,'forbidden','app session read authorization changed');
+        if(get(APP_LINEAGE_REVOKED,[credentialId,now]))domainError(401,'authentication_required','delegation authority revoked');
+        appFence=JSON.parse(app.grants_json);
+        if(appFence!==null)grantSource=get('SELECT id,principal_id FROM credentials WHERE id=?',[app.subject_credential_id??app.parent_id]);
+      }
       if(!credential||!membership)domainError(401,'authentication_required','authentication required');
     }
     if(typeof ref!=='string'||ref.length<8)domainError(404,'not_found','not found');
@@ -52,6 +64,11 @@ export function createStoreHandlers({ all, get, run, tx }) {
       const family=all('WITH RECURSIVE family(id) AS (SELECT ? UNION SELECT s.id FROM sessions s JOIN family f ON s.canonical_id=f.id WHERE s.team_id=?) SELECT s.* FROM sessions s JOIN family f ON f.id=s.id WHERE s.team_id=?',[root.id,teamId,teamId]);
       const readable=bound?Boolean(get('SELECT 1 ok FROM session_view_bindings WHERE team_id=? AND session_id=? AND issuer=? AND room=? AND conversation=?',[teamId,root.id,bound.issuer,bound.room,bound.conversation]))&&family.every(session=>session.deleted_at==null):family.every(session=>{
         if(session.deleted_at!=null)return false;
+        if(!appGrantAllows({app_grants:appFence},'session',session.id,'sessions.read'))return false;
+        if(appFence!==null){
+          if(!grantSource)return false;
+          try{authorizedSession({teamId,principalId:grantSource.principal_id,credentialId:grantSource.id,ref:session.id,now,delegationDepth:(args.delegationDepth??0)+1,projectionDepth:1});}catch{return false;}
+        }
         if(session.visibility==='team'||session.custodian_id===principalId)return true;
         const grants=all('SELECT subject_kind,subject_id,expires_at FROM session_grants WHERE team_id=? AND session_id=?',[teamId,session.id]);
         return grants.some(grant=>(grant.subject_kind==='principal'&&grant.subject_id===principalId||grant.subject_kind==='group'&&groups.includes(grant.subject_id))&&(grant.expires_at==null||grant.expires_at>now));

package/worker/index.mjs

@@ -5,11 +5,10 @@
 // Configuration (wrangler.toml [vars] and secrets):
 //   PUBLIC_ORIGIN                      the https origin the Worker is served at
 //   INIT_TEAM                          the first team's name (used once, at bootstrap)
-//   VOLTER_ISSUER                      optional: an identity service members may sign in with (https://id.volter.ai)
+// Identity and delegation issuers are registered apps installed by team admins through the public doors.
 //   VOLTER_ORG_CLIENT_ID, VOLTER_ORG_CLIENT_SECRET, VOLTER_TEAM_ORGS
-//                                      optional: this server's product credential at VOLTER_ISSUER, and the teams whose
+//                                      optional: this server's product credential at the organization's identity issuer, and the teams whose
 //                                      organization there admits its members with no invitation (`team=slug,…`)
-//   DELEGATED_ISSUER                   optional: a workplace (RH2) whose delegated tokens open one pane or folder at /view
 //   SUPERCODE_TEAMS_BOOTSTRAP_TOKEN    secret: the owner's first credential, minted with
 //                                      `supercode teams server token`
 import { DurableObject } from 'cloudflare:workers';
@@ -81,7 +80,7 @@ export class TeamsServer extends DurableObject {
       console.log(`storage: database_bytes=${ctx.storage.sql.databaseSize}`);
       const db = durableSql(ctx.storage);
       migrate({ exec: db.exec, tx: db.tx, version: () => ctx.storage.kv.get('schema_version') ?? 0, setVersion: (n) => ctx.storage.kv.put('schema_version', n) });
-      this.api = createTeamsApi({ publicOrigin: normalizePublicOrigin(env.PUBLIC_ORIGIN), identityIssuer: env.VOLTER_ISSUER || null, identityOrganizations: identityOrganizationsFromEnv(env), delegatedIssuer: env.DELEGATED_ISSUER || null, delegatedIssuers: env.DELEGATED_ISSUERS ? env.DELEGATED_ISSUERS.split(',').map(origin => origin.trim()) : [] });
+      this.api = createTeamsApi({ publicOrigin: normalizePublicOrigin(env.PUBLIC_ORIGIN), appRootSecret: env.SUPERCODE_TEAMS_BOOTSTRAP_TOKEN || null, identityOrganizations: identityOrganizationsFromEnv(env) });
       this.api.storageUsage = () => {
         const sql = ctx.storage.sql;
         let freeBytes = null;

package/worker/wrangler.toml

@@ -4,24 +4,14 @@
 #     --var PUBLIC_ORIGIN:https://<worker>.<account>.workers.dev --var INIT_TEAM:<first team>
 # The token printed above is the owner's first credential (`supercode teams login <origin> --token-stdin`).
 #
-# Origin and identity variables are retained with keep_vars. The explicit delegated
-# allowlist below is versioned and installed by deploy-teams CI.
-#   PUBLIC_ORIGIN     the https origin the Worker is served at (required)
-#   INIT_TEAM         the first team's name, used once at bootstrap
-#   VOLTER_ISSUER     optional: members sign in with Volter (supercode teams login --volter); the issuer
-#                     must have this origin registered as a resource
-#   DELEGATED_ISSUER  optional: a workplace (RH2) whose delegated tokens open published panes and folders and
-#                     bound sessions; its keys are at <issuer>/.well-known/jwks.json
-#   DELEGATED_ISSUERS comma-separated exact origins, additive with legacy DELEGATED_ISSUER
+# Identity and delegated access are admin-consented app installations, never operator allowlists.
+# PUBLIC_ORIGIN and INIT_TEAM supply the listener and bootstrap team.
 name = "supercode-teams"
 main = "index.mjs"
 compatibility_date = "2026-09-01"
 compatibility_flags = ["nodejs_compat"]
 keep_vars = true
 
-[vars]
-DELEGATED_ISSUERS = "https://pilot.runhuman.com,https://rh2-staging.voltertest.xyz"
-
 # Workers Logs: the Worker's log lines (viewer-error, session-view refused, maintain) kept and searchable after the fact.
 [observability]
 enabled = true

package/workspace-client.d.ts

@@ -36,9 +36,26 @@ export declare class TeamsClient {
   capabilities(options?:RequestOptions):Promise<Capabilities>;
   teams(query?:{limit?:number;cursor?:string},options?:RequestOptions):Promise<ServerPage<Team>>;
   createTeam(body:{name:string},options?:RequestOptions):Promise<Result<Team>>;
+  redeemAppCode(body:{app_id:string;app_secret:string;code:string;redirect_url:string},options?:RequestOptions):Promise<AppCodeExchange>;
   team(id:string):TeamClient;
 }
+export interface TeamsApp {
+  id:string; team_id:string; principal_id:string; name:string; description:string;
+  actions:string[]; event_kinds:string[]; redirect_urls:string[]; webhook_url:string|null;
+  issuer:string|null; state:'active'|'retired'; created_at:number;
+}
+export type RegisterTeamsApp=Pick<TeamsApp,'name'|'actions'|'redirect_urls'> & Partial<Pick<TeamsApp,'description'|'event_kinds'|'webhook_url'|'issuer'>>;
+export interface AppInstallation {
+  id:string; app_id:string; team_id:string; principal_id:string; installer_id:string;
+  actions:string[]; state:'active'|'uninstalled'; created_at:number; uninstalled_at:number|null;
+}
+export interface AppResourceGrant { kind:'session'; id:string; actions:('sessions.read'|'sessions.write'|'sessions.access')[] }
+export interface AppDelegation { actions:string[]; actor:string; expires_in_ms?:number; principal_id?:string; grants?:AppResourceGrant[]; subject_token?:string }
+export interface AppToken { grants?:AppResourceGrant[]|null; token:string; kind:'service'; expires_at:number; actions:string[]; subject:string; act:string[] }
+export interface AppCodeExchange { version:1; installation:AppInstallation; credential:AppToken; webhook_secret:string }
 export interface TeamClient {
+  apps:{deregister(id:string,options?:RequestOptions):Promise<null>;catalogue(options?:RequestOptions):Promise<Result<{actions:string[];event_kinds:string[]}>>;list(options?:RequestOptions):Promise<Page<TeamsApp>>;get(id:string,options?:RequestOptions):Promise<Result<TeamsApp>>;register(body:RegisterTeamsApp,options?:RequestOptions):Promise<Result<TeamsApp & {secret?:string}>>;rotateSecret(id:string,options?:RequestOptions):Promise<Result<{id:string;secret?:string}>>;install(id:string,body:{redirect_url:string;state:string;actions?:string[]},options?:RequestOptions):Promise<Result<{installation:AppInstallation;code?:string;state:string;redirect_url:string;expires_at:number}>>};
+  appInstallations:{list(options?:RequestOptions):Promise<Page<AppInstallation>>;get(id:string,options?:RequestOptions):Promise<Result<AppInstallation>>;uninstall(id:string,options?:RequestOptions):Promise<null>;delegate(id:string,body:AppDelegation,options?:RequestOptions):Promise<Result<AppToken|null>>};
   sessions:{list(query?:ListQuery,options?:RequestOptions):Promise<Page<Descriptor>>;search(query:SearchQuery,options?:RequestOptions):Promise<SearchPage>;watch(query?:ListQuery,options?:StreamOptions):AsyncIterable<Event>;get(id:string):SessionClient};
   members:{list(query?:Record<string,unknown>,options?:RequestOptions):Promise<Page<Membership>>;update(id:string,body:{role:Membership['role']},options?:RequestOptions):Promise<Result<Membership>>;remove(id:string,options?:RequestOptions):Promise<null>};
   groups:{list(query?:Record<string,unknown>,options?:RequestOptions):Promise<Page<Group>>;create(body:{name:string},options?:RequestOptions):Promise<Result<Group>>;remove(id:string,options?:RequestOptions):Promise<null>;addMember(groupId:string,memberId:string,options?:RequestOptions):Promise<null>;removeMember(groupId:string,memberId:string,options?:RequestOptions):Promise<null>};

package/workspace-client.mjs

@@ -12,6 +12,7 @@ export class TeamsClient {
     throw last;
   }
   me(options){return this.request('GET','/api/v1/me',options);} capabilities(options){return this.request('GET','/api/v1/capabilities',options);} team(id){return new TeamClient(this,id);}
+  redeemAppCode(body,options){return this.request('POST','/api/v1/apps/token',{...options,body});}
   teams(queryValue={},options){return this.request('GET','/api/v1/teams'+query(queryValue),options);}
   createTeam(body,options){return this.request('POST','/api/v1/teams',{...options,body});}
 }
@@ -28,6 +29,19 @@ class TeamClient {
     const patch = (path, body, options) => root.request('PATCH', base + path, { ...options, body });
     const remove = (path, options) => root.request('DELETE', base + path, options);
     const resource = (path, id) => `${path}/${segment(id)}`;
+    this.apps = {
+      catalogue: o => get('/apps/catalogue', o),
+      list: o => get('/apps', o), get: (id, o) => get(resource('/apps', id), o),
+      register: (body, o) => post('/apps', body, o),
+      deregister: (id, o) => remove(resource('/apps', id), o),
+      rotateSecret: (id, o) => post(resource('/apps', id) + '/secret', {}, o),
+      install: (id, body, o) => post(resource('/apps', id) + '/installations', body, o),
+    };
+    this.appInstallations = {
+      list: o => get('/app-installations', o), get: (id, o) => get(resource('/app-installations', id), o),
+      uninstall: (id, o) => remove(resource('/app-installations', id), o),
+      delegate: (id, body, o) => post(resource('/app-installations', id) + '/delegations', body, o),
+    };
     this.sessions = {
       list: (q = {}, o) => get('/sessions' + query(q), o),
       search: (q, o) => get('/sessions/search' + query(q), o),