@volter/supercode-teams 0.2.175 → 0.2.176

package/README.md

@@ -61,7 +61,13 @@ anything else, for a wildcard (`pane:*`) or for the whole filesystem (`root:/`)
 token must carry `iat` and live at most 15 minutes (`exp - iat` and `exp - now`). The hosted viewer
 at `/view#token=…` opens it; the server turns the token into a machine grant on exactly that target
 (a pane: `observe`, and `control` to type; a folder: `observe` to read, `files` to change) that
-expires with the token, and closes the channel then. A page embedding the viewer sends it a fresh
+expires with the token, and closes the channel then. Before it writes that grant, and while the
+channel is open every 15 seconds, the server asks the workplace whether the token still admits what it was issued for
+(`POST <issuer>/api/v3/delegated/status`); when the workplace answers that it does not (the member's
+binding revoked, their Task closed, their contract ended), the grant is deleted and the channel closes
+with `access_revoked`, which the viewer shows rather than reconnecting; an open with such a token is
+refused (403 `access_revoked`) and writes no grant. An unreachable workplace leaves the channel to
+the token's expiry. A page embedding the viewer sends it a fresh
 token by `postMessage({ type: 'delegated-token', token })`, which the viewer asks for with
 `delegated-token-needed`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/supercode-teams",
-  "version": "0.2.175",
+  "version": "0.2.176",
   "type": "module",
   "description": "A machine daemon serving this machine's doors, and a local or remote Teams server for shared session discovery, OpenTelemetry ingestion and access to enrolled machines.",
   "license": "MIT",