@volter/teams 0.2.41 → 0.2.43

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.2.41",
+  "version": "0.2.43",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",

package/redact.mjs

@@ -170,6 +170,11 @@ let custodyBasis = null;
 /** What a redaction was made under (the rule set and the custody values), as a digest: text found clean under one
  * basis is clean under it again, and needs another look only when it changes. */
 export function redactionBasis(env = process.env) { custodyValues(env); return custodyBasis; }
+/** One custody observation and its basis, for a batch that must not change policy between its values. */
+export function redactionSnapshot(env = process.env) {
+  const values = custodyValues(env);
+  return { values, basis: custodyBasis };
+}
 
 // Text this far either side of a keyword is searched by a bounded rule, beyond its longest match.
 const WINDOW_MARGIN = 256;
@@ -184,12 +189,12 @@ function keywordSpans(hits, length, keywords, reach) {
 }
 
 /** `text` with every secret replaced by its marker. */
-export function redactText(text, env = process.env) {
+export function redactText(text, env = process.env, custody) {
   if (typeof text !== 'string' || text.length < 8) return text;
   let out = text;
   // Custody values are random, so one alternation of them gives the regex engine nothing to skip on: each is looked
   // for on its own, which reads a 5 MB text in a few dozen milliseconds.
-  for (const { value, name } of custodyValues(env)) if (out.includes(value)) out = out.split(value).join(`[redacted:${name}]`);
+  for (const { value, name } of custody ?? custodyValues(env)) if (out.includes(value)) out = out.split(value).join(`[redacted:${name}]`);
   if (/(?:sct|sci|sca|sat|whsec)_/.test(out)) out = out.replace(TEAM_TOKENS, (_, kind, hook) => `[redacted:teams-${kind ?? hook}-token]`);
   // Every rule has keywords, so a text holding none of them is done (the one test is cheap; finding where each keyword
   // occurs is not, and most texts are short and hold none).
@@ -220,9 +225,9 @@ export function redactText(text, env = process.env) {
 }
 
 /** A JSON value with every string in it redacted (keys kept). */
-export function redactValue(value, env = process.env) {
-  if (typeof value === 'string') return redactText(value, env);
-  if (Array.isArray(value)) return value.map((item) => redactValue(item, env));
-  if (value && typeof value === 'object') return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, redactValue(item, env)]));
+export function redactValue(value, env = process.env, custody) {
+  if (typeof value === 'string') return redactText(value, env, custody);
+  if (Array.isArray(value)) return value.map((item) => redactValue(item, env, custody));
+  if (value && typeof value === 'object') return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, redactValue(item, env, custody)]));
   return value;
 }

package/server/auth.mjs

@@ -26,13 +26,19 @@ const LINEAGE_ROWS = `FROM lineage l JOIN credentials c ON c.id=l.id
   LEFT JOIN apps a ON a.id=i.app_id
   LEFT JOIN memberships installer ON installer.team_id=i.team_id AND installer.principal_id=i.installer_id
   LEFT JOIN memberships service ON service.team_id=i.team_id AND service.principal_id=i.principal_id`;
-export const APP_LINEAGE_REVOKED = `${APP_LINEAGE}, lineage_actors(team,id) AS (
+// Materialize only this credential lineage's actors before checking their
+// agency. When json_each was flattened, the hosted planner checked every
+// agent in the team before matching actor.value (20,794 reads per event).
+// CROSS JOIN keeps the small actor list on the left of the indexed agent
+// lookup. Authority stays live: no predicate or result is cached.
+export const APP_LINEAGE_REVOKED = `${APP_LINEAGE}, lineage_actors(team,id) AS MATERIALIZED (
   SELECT c.team_id,actor.value FROM lineage l JOIN credentials c ON c.id=l.id JOIN principals p ON p.id=c.principal_id
   JOIN app_credentials ac ON ac.credential_id=c.id, json_each(COALESCE(ac.actor_json,'[]')) actor WHERE actor.type='text')
   SELECT 1 FROM lineage l JOIN credentials c ON c.id=l.id JOIN principals p ON p.id=c.principal_id
     WHERE p.kind='agent' AND NOT EXISTS (${AGENT_ACTIVE.replace('VALUES(?,?)','SELECT c.team_id,c.principal_id')})
-  UNION ALL SELECT 1 FROM lineage_actors x JOIN agents named ON named.team_id=x.team AND named.id=x.id
-    WHERE NOT EXISTS (${AGENT_ACTIVE.replace('VALUES(?,?)','SELECT named.team_id,named.id')})
+  UNION ALL SELECT 1 FROM lineage_actors x CROSS JOIN agents named
+    WHERE named.team_id=x.team AND named.id=x.id
+    AND NOT EXISTS (${AGENT_ACTIVE.replace('VALUES(?,?)','SELECT named.team_id,named.id')})
   UNION ALL SELECT 1 ${LINEAGE_ROWS}
     WHERE EXISTS(SELECT 1 FROM agent_credentials d LEFT JOIN memberships dm ON dm.team_id=d.team_id AND dm.principal_id=c.principal_id WHERE d.parent_credential_id=c.id AND d.credential_id IN(SELECT id FROM lineage) AND COALESCE(dm.active,0)!=1)
     OR c.revoked_at IS NOT NULL OR (c.expires_at IS NOT NULL AND c.expires_at<=?)