@volter/teams 0.2.41 → 0.2.42

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.2.41",
+  "version": "0.2.42",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",

package/server/auth.mjs

@@ -26,13 +26,19 @@ const LINEAGE_ROWS = `FROM lineage l JOIN credentials c ON c.id=l.id
   LEFT JOIN apps a ON a.id=i.app_id
   LEFT JOIN memberships installer ON installer.team_id=i.team_id AND installer.principal_id=i.installer_id
   LEFT JOIN memberships service ON service.team_id=i.team_id AND service.principal_id=i.principal_id`;
-export const APP_LINEAGE_REVOKED = `${APP_LINEAGE}, lineage_actors(team,id) AS (
+// Materialize only this credential lineage's actors before checking their
+// agency. When json_each was flattened, the hosted planner checked every
+// agent in the team before matching actor.value (20,794 reads per event).
+// CROSS JOIN keeps the small actor list on the left of the indexed agent
+// lookup. Authority stays live: no predicate or result is cached.
+export const APP_LINEAGE_REVOKED = `${APP_LINEAGE}, lineage_actors(team,id) AS MATERIALIZED (
   SELECT c.team_id,actor.value FROM lineage l JOIN credentials c ON c.id=l.id JOIN principals p ON p.id=c.principal_id
   JOIN app_credentials ac ON ac.credential_id=c.id, json_each(COALESCE(ac.actor_json,'[]')) actor WHERE actor.type='text')
   SELECT 1 FROM lineage l JOIN credentials c ON c.id=l.id JOIN principals p ON p.id=c.principal_id
     WHERE p.kind='agent' AND NOT EXISTS (${AGENT_ACTIVE.replace('VALUES(?,?)','SELECT c.team_id,c.principal_id')})
-  UNION ALL SELECT 1 FROM lineage_actors x JOIN agents named ON named.team_id=x.team AND named.id=x.id
-    WHERE NOT EXISTS (${AGENT_ACTIVE.replace('VALUES(?,?)','SELECT named.team_id,named.id')})
+  UNION ALL SELECT 1 FROM lineage_actors x CROSS JOIN agents named
+    WHERE named.team_id=x.team AND named.id=x.id
+    AND NOT EXISTS (${AGENT_ACTIVE.replace('VALUES(?,?)','SELECT named.team_id,named.id')})
   UNION ALL SELECT 1 ${LINEAGE_ROWS}
     WHERE EXISTS(SELECT 1 FROM agent_credentials d LEFT JOIN memberships dm ON dm.team_id=d.team_id AND dm.principal_id=c.principal_id WHERE d.parent_credential_id=c.id AND d.credential_id IN(SELECT id FROM lineage) AND COALESCE(dm.active,0)!=1)
     OR c.revoked_at IS NOT NULL OR (c.expires_at IS NOT NULL AND c.expires_at<=?)