agenttwin 0.3.13 → 0.3.15

package/dist/api.js

@@ -1229,13 +1229,13 @@ async function projectProducts(cwd, data, base) {
     const source = path2 ? await files.read(path2, 2e5) : void 0;
     const entry = source && fn ? exportedEntrypoints(source).find((e) => e.name === fn) : void 0;
     const body2 = source && entry ? source.split("\n").slice(entry.startLine - 1, entry.endLine).join("\n") : fn ? "" : source ?? "";
-    const matches2 = products.filter((p) => found.has(p.key) && p.pattern.test(body2)).map((p) => google.id + ":" + p.key);
-    if (!matches2.length) {
+    const matches3 = products.filter((p) => found.has(p.key) && p.pattern.test(body2)).map((p) => google.id + ":" + p.key);
+    if (!matches3.length) {
       unresolved = true;
       finalWorkflows.push(w);
       continue;
     }
-    finalWorkflows.push({ ...w, tools: [...new Set(w.tools.flatMap((id) => id === google.id ? matches2 : [id]))], steps: w.steps.flatMap((s) => s.tool === google.id ? matches2.map((tool) => ({ ...s, tool })) : [s]) });
+    finalWorkflows.push({ ...w, tools: [...new Set(w.tools.flatMap((id) => id === google.id ? matches3 : [id]))], steps: w.steps.flatMap((s) => s.tool === google.id ? matches3.map((tool) => ({ ...s, tool })) : [s]) });
   }
   const productTools = products.filter((p) => found.has(p.key)).map((p) => ({ ...google, id: google.id + ":" + p.key, title: p.title }));
   return discoveryTransfer({ ...data, tools: [...tools.filter((t) => t.id !== google.id || unresolved || !productTools.length).map((t) => t.id === google.id ? { ...t, title: "Google API (unspecified)" } : t), ...productTools], workflows: finalWorkflows });
@@ -1381,6 +1381,249 @@ var init_session = __esm({
   }
 });
 
+// src/runtime/request-budget.ts
+function requestBudget(limit = 1200) {
+  if (!Number.isSafeInteger(limit) || limit < 1)
+    throw new Error("Invalid API request limit");
+  let until = 0, count = 0;
+  return (res) => {
+    const now = Date.now();
+    if (now >= until) {
+      until = now + 6e4;
+      count = 0;
+    }
+    count++;
+    const reset = Math.max(1, Math.ceil((until - now) / 1e3));
+    res.setHeader("RateLimit-Policy", `"gateway";q=${limit};w=60`);
+    res.setHeader(
+      "RateLimit",
+      `"gateway";r=${Math.max(0, limit - count)};t=${reset}`
+    );
+    if (count > limit) {
+      res.setHeader("Retry-After", String(reset));
+      return false;
+    }
+    return true;
+  };
+}
+
+// src/runtime/oauth.ts
+import { createHash, randomBytes, timingSafeEqual } from "crypto";
+var oauthScopes = {
+  "read:projects": "List this client\u2019s one authorized project",
+  "read:discovery": "Read discovery metadata for the authorized project",
+  "read:runs": "Read test run status and recorded evidence for the authorized project",
+  "read:workflows": "Read saved test configurations for the authorized project",
+  "write:runs": "Submit and cancel reviewed cloud tests for the authorized project",
+  "write:workflows": "Save test configuration drafts for the authorized project"
+};
+var hash = (v) => createHash("sha256").update(v).digest("hex");
+var matches = (a, b) => timingSafeEqual(Buffer.from(hash(a)), Buffer.from(b));
+function newOAuthClient(accountId, label, project, scopes) {
+  if (!Array.isArray(scopes) || !scopes.length || scopes.length > Object.keys(oauthScopes).length || scopes.some(
+    (s) => typeof s !== "string" || !Object.hasOwn(oauthScopes, s)
+  ) || new Set(scopes).size !== scopes.length)
+    throw new Error("Choose explicit supported OAuth scopes");
+  const secret = randomBytes(32).toString("base64url");
+  const client = {
+    id: "at_client_" + randomBytes(16).toString("hex"),
+    secretHash: hash(secret),
+    accountId,
+    label,
+    project,
+    scopes,
+    active: true,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  return { client, secret };
+}
+function oauthMetadata(issuer) {
+  return {
+    issuer,
+    token_endpoint: issuer + "/oauth/token",
+    revocation_endpoint: issuer + "/oauth/revoke",
+    grant_types_supported: ["client_credentials"],
+    response_types_supported: [],
+    token_endpoint_auth_methods_supported: ["client_secret_basic"],
+    revocation_endpoint_auth_methods_supported: ["client_secret_basic"],
+    scopes_supported: Object.keys(oauthScopes),
+    service_documentation: "https://agenttwin.si/auth.md"
+  };
+}
+function resourceMetadata(issuer) {
+  return {
+    resource: issuer,
+    authorization_servers: [issuer],
+    scopes_supported: Object.keys(oauthScopes),
+    bearer_methods_supported: ["header"],
+    resource_documentation: "https://agenttwin.si/auth.md"
+  };
+}
+function oauthGrant(store, raw) {
+  if (!raw.startsWith("at_oauth_")) return void 0;
+  const token = store.oauthTokens?.find(
+    (t) => t.hash === hash(raw) && t.expires > Date.now()
+  );
+  const client = token && store.oauthClients?.find((c) => c.id === token.clientId && c.active);
+  if (!token || !client || !store.accounts.some((a) => a.id === client.accountId && a.active))
+    return void 0;
+  return { token, client };
+}
+function requiredOAuthScope(method, path2) {
+  if (method === "GET") {
+    if (path2 === "/v1/projects") return "read:projects";
+    if (path2 === "/v1/discovery") return "read:discovery";
+    if (path2 === "/v1/workflows") return "read:workflows";
+    if (path2 === "/v1/runs" || /^\/v1\/runs\/[a-f0-9-]{36}$/.test(path2))
+      return "read:runs";
+  }
+  if (method === "POST" && path2 === "/v1/workflows") return "write:workflows";
+  if (method === "POST" && path2 === "/v1/runs" || method === "DELETE" && /^\/v1\/runs\/[a-f0-9-]{36}$/.test(path2))
+    return "write:runs";
+  return void 0;
+}
+function createOAuth(store, save, issuer) {
+  const attempts = /* @__PURE__ */ new Map();
+  const reply = (res, status, data) => {
+    res.writeHead(status, {
+      "content-type": "application/json",
+      "cache-control": "no-store",
+      pragma: "no-cache"
+    });
+    res.end(JSON.stringify(data));
+  };
+  return async (req, res, path2) => {
+    if (!["/oauth/token", "/oauth/revoke"].includes(path2)) return false;
+    if (req.method === "OPTIONS") {
+      res.writeHead(204);
+      res.end();
+      return true;
+    }
+    if (req.method !== "POST") {
+      res.setHeader("Allow", "POST, OPTIONS");
+      reply(res, 405, { error: "invalid_request" });
+      return true;
+    }
+    const now = Date.now(), peer = req.socket.remoteAddress ?? "unknown";
+    for (const [key, value] of attempts)
+      if (value.until <= now) attempts.delete(key);
+    const bucket = attempts.get(peer) ?? { count: 0, until: now + 6e4 };
+    bucket.count++;
+    attempts.set(peer, bucket);
+    res.setHeader("RateLimit-Policy", '"oauth";q=120;w=60');
+    res.setHeader(
+      "RateLimit",
+      `"oauth";r=${Math.max(0, 120 - bucket.count)};t=${Math.max(1, Math.ceil((bucket.until - now) / 1e3))}`
+    );
+    if (bucket.count > 120 || attempts.size > 1e4) {
+      res.setHeader("Retry-After", "60");
+      reply(res, 429, { error: "temporarily_unavailable" });
+      return true;
+    }
+    const basic = req.headers.authorization?.match(
+      /^Basic ([A-Za-z0-9+/]+=*)$/i
+    );
+    let client;
+    try {
+      const decoded = basic ? Buffer.from(basic[1], "base64").toString("utf8") : "";
+      const colon = decoded.indexOf(":");
+      const id = decodeURIComponent(
+        decoded.slice(0, colon).replace(/\+/g, " ")
+      ), secret = decodeURIComponent(
+        decoded.slice(colon + 1).replace(/\+/g, " ")
+      );
+      client = store.oauthClients?.find((c) => c.id === id && c.active);
+      if (colon < 1 || !client || !matches(secret, client.secretHash) || !store.accounts.some((a) => a.id === client.accountId && a.active))
+        client = void 0;
+    } catch {
+      client = void 0;
+    }
+    if (!client) {
+      res.setHeader("WWW-Authenticate", 'Basic realm="AgentTwin OAuth"');
+      reply(res, 401, { error: "invalid_client" });
+      return true;
+    }
+    if (!/^application\/x-www-form-urlencoded(?:;|$)/i.test(
+      req.headers["content-type"] ?? ""
+    )) {
+      reply(res, 400, {
+        error: "invalid_request",
+        error_description: "Use application/x-www-form-urlencoded"
+      });
+      return true;
+    }
+    let raw = "";
+    for await (const chunk of req) {
+      raw += chunk.toString("utf8");
+      if (Buffer.byteLength(raw) > 8192) {
+        reply(res, 400, { error: "invalid_request" });
+        return true;
+      }
+    }
+    const form = new URLSearchParams(raw);
+    if ([...new Set(form.keys())].some((k) => form.getAll(k).length !== 1) || form.has("client_id") || form.has("client_secret")) {
+      reply(res, 400, { error: "invalid_request" });
+      return true;
+    }
+    if (!client.active || !store.accounts.some((a) => a.id === client.accountId && a.active)) {
+      reply(res, 401, { error: "invalid_client" });
+      return true;
+    }
+    if (path2 === "/oauth/revoke") {
+      if (!form.get("token")) {
+        reply(res, 400, { error: "invalid_request" });
+        return true;
+      }
+      if (form.has("token_type_hint") && form.get("token_type_hint") !== "access_token") {
+        reply(res, 400, { error: "unsupported_token_type" });
+        return true;
+      }
+      store.oauthTokens = (store.oauthTokens ?? []).filter(
+        (t) => t.clientId !== client.id || t.hash !== hash(form.get("token"))
+      );
+      await save();
+      reply(res, 200, {});
+      return true;
+    }
+    if (form.get("grant_type") !== "client_credentials") {
+      reply(res, 400, { error: "unsupported_grant_type" });
+      return true;
+    }
+    if (form.has("resource") && form.get("resource") !== issuer) {
+      reply(res, 400, { error: "invalid_target" });
+      return true;
+    }
+    const scopes = form.has("scope") ? form.get("scope").split(" ") : client.scopes;
+    if (!scopes.length || scopes.some((s) => !s || !client.scopes.includes(s)) || new Set(scopes).size !== scopes.length) {
+      reply(res, 400, { error: "invalid_scope" });
+      return true;
+    }
+    store.oauthTokens = (store.oauthTokens ?? []).filter(
+      (t) => t.expires > now
+    );
+    if (store.oauthTokens.length >= 1e5 || store.oauthTokens.filter((t) => t.clientId === client.id).length >= 100) {
+      res.setHeader("Retry-After", "60");
+      reply(res, 429, { error: "temporarily_unavailable" });
+      return true;
+    }
+    const access_token = "at_oauth_" + randomBytes(32).toString("base64url");
+    store.oauthTokens.push({
+      hash: hash(access_token),
+      clientId: client.id,
+      scopes,
+      expires: now + 36e5
+    });
+    await save();
+    reply(res, 200, {
+      access_token,
+      token_type: "Bearer",
+      expires_in: 3600,
+      scope: scopes.join(" ")
+    });
+    return true;
+  };
+}
+
 // src/runtime/workspace-profile.ts
 function validateWorkspaceProfile(input) {
   const allowed = ["name", "workspace", "company", "website", "role", "teamSize", "useCase", "complete"];
@@ -1408,33 +1651,33 @@ function validateWorkspaceProfile(input) {
 }
 
 // src/runtime/email-verification.ts
-import { createHmac, randomBytes, randomInt, timingSafeEqual } from "crypto";
+import { createHmac, randomBytes as randomBytes2, randomInt, timingSafeEqual as timingSafeEqual2 } from "crypto";
 function normalizedEmail(value) {
   const email = typeof value === "string" ? value.trim().toLowerCase() : "";
   if (email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) throw new Error("Enter a valid email address.");
   return email;
 }
 function createEmailVerification(options, secret) {
-  const hash3 = (value) => createHmac("sha256", secret).update(value).digest("hex");
-  const matches2 = (value, expected) => {
-    const a = Buffer.from(hash3(value), "hex"), b = Buffer.from(expected, "hex");
-    return a.length === b.length && timingSafeEqual(a, b);
+  const hash4 = (value) => createHmac("sha256", secret).update(value).digest("hex");
+  const matches3 = (value, expected) => {
+    const a = Buffer.from(hash4(value), "hex"), b = Buffer.from(expected, "hex");
+    return a.length === b.length && timingSafeEqual2(a, b);
   };
   return {
     enabled: !!options,
     challenge(email, origin) {
-      const id = randomBytes(24).toString("hex"), binding = randomBytes(32).toString("hex");
+      const id = randomBytes2(24).toString("hex"), binding = randomBytes2(32).toString("hex");
       const code = String(randomInt(0, 1e8)).padStart(8, "0");
-      const challenge = { email, origin, binding: hash3(binding), codeHash: hash3(id + ":" + code), expires: Date.now() + 10 * 6e4, attempts: 0, sentAt: Date.now() };
+      const challenge = { email, origin, binding: hash4(binding), codeHash: hash4(id + ":" + code), expires: Date.now() + 10 * 6e4, attempts: 0, sentAt: Date.now() };
       return { id, binding, code, challenge };
     },
     bound(challenge, binding, origin) {
-      return !!challenge && challenge.expires > Date.now() && challenge.origin === origin && matches2(binding, challenge.binding);
+      return !!challenge && challenge.expires > Date.now() && challenge.origin === origin && matches3(binding, challenge.binding);
     },
     verify(id, challenge, code) {
       if (challenge.verified || challenge.attempts >= 5 || challenge.expires <= Date.now()) return false;
       challenge.attempts++;
-      if (typeof code !== "string" || !/^\d{8}$/.test(code) || !matches2(id + ":" + code, challenge.codeHash)) return false;
+      if (typeof code !== "string" || !/^\d{8}$/.test(code) || !matches3(id + ":" + code, challenge.codeHash)) return false;
       challenge.verified = true;
       return true;
     },
@@ -1455,8 +1698,8 @@ It expires in 10 minutes. Do not share this code. If you did not request it, ign
 
 // src/runtime/social-auth.ts
 import * as oidc from "openid-client";
-import { randomBytes as randomBytes2, createHash, timingSafeEqual as timingSafeEqual2 } from "crypto";
-var hash = (value) => createHash("sha256").update(value).digest();
+import { randomBytes as randomBytes3, createHash as createHash2, timingSafeEqual as timingSafeEqual3 } from "crypto";
+var hash2 = (value) => createHash2("sha256").update(value).digest();
 var validUrl = (value) => {
   const url = new URL(value);
   if (url.username || url.password || url.search || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1"].includes(url.hostname))) throw new Error("Authentication URLs must use HTTPS (or local HTTP).");
@@ -1498,7 +1741,7 @@ function createSocialAuth(options) {
       if (provider === "sso" && !matchedRealm) throw new Error(typeof realm === "string" && realm ? "unknown_realm" : "provider_not_configured");
       for (const [key, value] of transactions) if (value.expires < Date.now()) transactions.delete(key);
       if (transactions.size >= 1e3) throw new Error("auth_busy");
-      const state = oidc.randomState(), verifier = oidc.randomPKCECodeVerifier(), nonce = oidc.randomNonce(), binding = randomBytes2(32).toString("hex");
+      const state = oidc.randomState(), verifier = oidc.randomPKCECodeVerifier(), nonce = oidc.randomNonce(), binding = randomBytes3(32).toString("hex");
       const challenge = await oidc.calculatePKCECodeChallenge(verifier);
       let url;
       const parameters = { redirect_uri: callback(provider), state, code_challenge: challenge, code_challenge_method: "S256" };
@@ -1510,14 +1753,14 @@ function createSocialAuth(options) {
         url = oidc.buildAuthorizationUrl(configuration, { ...parameters, nonce, scope: "openid email profile" });
       }
       if (transactions.size >= 1e3) throw new Error("auth_busy");
-      transactions.set(state, { provider, origin, signup, onboarding, realm: matchedRealm?.id, verifier, nonce, binding: hash(binding).toString("hex"), expires: Date.now() + 6e5 });
+      transactions.set(state, { provider, origin, signup, onboarding, realm: matchedRealm?.id, verifier, nonce, binding: hash2(binding).toString("hex"), expires: Date.now() + 6e5 });
       return { url: url.href, binding, secure: base.protocol === "https:" };
     },
     // Bind the state to this browser before exchanging any provider code. Consume once.
     take(provider, query, cookie) {
       if (query.getAll("state").length !== 1) throw new Error("invalid_state");
       const state = query.get("state"), transaction = transactions.get(state);
-      if (!transaction || transaction.provider !== provider || transaction.expires < Date.now() || !timingSafeEqual2(hash(cookie), Buffer.from(transaction.binding, "hex"))) throw new Error("invalid_state");
+      if (!transaction || transaction.provider !== provider || transaction.expires < Date.now() || !timingSafeEqual3(hash2(cookie), Buffer.from(transaction.binding, "hex"))) throw new Error("invalid_state");
       transactions.delete(state);
       return transaction;
     },
@@ -1566,18 +1809,18 @@ function createSocialAuth(options) {
 }
 
 // src/runtime/auth.ts
-import { randomBytes as randomBytes3, scrypt, timingSafeEqual as timingSafeEqual3, createHash as createHash2 } from "crypto";
-var digest = (value) => createHash2("sha256").update(value).digest("hex");
+import { randomBytes as randomBytes4, scrypt, timingSafeEqual as timingSafeEqual4, createHash as createHash3 } from "crypto";
+var digest = (value) => createHash3("sha256").update(value).digest("hex");
 var derive = (password, salt) => new Promise((resolve5, reject) => scrypt(password, salt, 64, { N: 131072, r: 8, p: 1, maxmem: 160 * 1024 * 1024 }, (error, key) => error ? reject(error) : resolve5(key)));
 async function passwordHash(password) {
-  const salt = randomBytes3(16).toString("hex");
+  const salt = randomBytes4(16).toString("hex");
   return `${salt}:${(await derive(password, salt)).toString("hex")}`;
 }
 async function passwordMatches(password, stored) {
   const [salt, key] = stored.split(":");
   const actual = await derive(password, salt);
   const expected = Buffer.from(key, "hex");
-  return expected.length === actual.length && timingSafeEqual3(expected, actual);
+  return expected.length === actual.length && timingSafeEqual4(expected, actual);
 }
 function credentials(input) {
   if (!input || typeof input !== "object") throw new Error("Enter your email and password.");
@@ -1596,7 +1839,7 @@ var challengeStore = (map, key, value, ttlMs) => {
 init_dashboard_transfer();
 import { generateRegistrationOptions, verifyRegistrationResponse, generateAuthenticationOptions, verifyAuthenticationResponse } from "@simplewebauthn/server";
 import { createServer as createServer2 } from "http";
-import { createHash as createHash9, randomBytes as randomBytes6, randomUUID as randomUUID2, timingSafeEqual as timingSafeEqual4 } from "crypto";
+import { createHash as createHash10, randomBytes as randomBytes7, randomUUID as randomUUID2, timingSafeEqual as timingSafeEqual5 } from "crypto";
 import { mkdir as mkdir7, readFile as readFile12, writeFile as writeFile9, rename, mkdtemp as mkdtemp3, rm as rm4 } from "fs/promises";
 import { resolve as resolve4, join as join13, dirname as dirname2, extname } from "path";
 import { tmpdir as tmpdir3 } from "os";
@@ -1903,7 +2146,7 @@ import { mkdtemp as mkdtemp2, mkdir as mkdir6, readFile as readFile11, writeFile
 import { tmpdir as tmpdir2 } from "os";
 import { basename as basename2, dirname, isAbsolute, join as join12, relative as relative3, resolve as resolve3, sep as sep2 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { createHash as createHash7, randomUUID } from "crypto";
+import { createHash as createHash8, randomUUID } from "crypto";
 
 // src/runtime/credentials.ts
 import { homedir } from "os";
@@ -2155,10 +2398,10 @@ function stripeOperation(method, path2, params, data, sequence) {
 }
 
 // src/runtime/rest-adapters.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 var EPOCH = 17e8;
 var iso = (epoch = EPOCH) => new Date(epoch * 1e3).toISOString();
-var sha = (value) => createHash3("sha256").update(value).digest("hex");
+var sha = (value) => createHash4("sha256").update(value).digest("hex");
 var detUuid = (seed) => {
   const hex = sha(seed).slice(0, 32).split("");
   hex[12] = "4";
@@ -3041,21 +3284,21 @@ function restUnsupportedBody(adapter) {
 var REST_ADAPTER_NAMES = Object.keys(REST_ADAPTERS);
 
 // src/runtime/seed.ts
-import { createHash as createHash4, randomBytes as randomBytes4 } from "crypto";
+import { createHash as createHash5, randomBytes as randomBytes5 } from "crypto";
 var SEED_PATTERN = /^[a-f0-9]{32}$/;
 var normalizeHex = (value) => value.trim().toLowerCase();
 function normalizeSeed(seed) {
-  if (seed === void 0 || seed.trim() === "") return randomBytes4(16).toString("hex");
+  if (seed === void 0 || seed.trim() === "") return randomBytes5(16).toString("hex");
   const text = normalizeHex(seed);
   if (!/^[a-f0-9]+$/.test(text) || text.length > 256) throw new Error(`Seed must be up to 256 hex characters or empty to generate; got ${seed.slice(0, 40)}`);
   if (text.length === 32) return text;
-  return createHash4("sha256").update(text).digest("hex").slice(0, 32);
+  return createHash5("sha256").update(text).digest("hex").slice(0, 32);
 }
 function deriveSeed(base, index) {
   if (!SEED_PATTERN.test(base)) throw new Error(`Invalid base seed: ${base}`);
   if (!Number.isInteger(index) || index < 0) throw new Error("Seed index must be a nonnegative integer");
   if (index === 0) return base;
-  return createHash4("sha256").update(`agenttwin-seed|${base}|${index}`).digest("hex").slice(0, 32);
+  return createHash5("sha256").update(`agenttwin-seed|${base}|${index}`).digest("hex").slice(0, 32);
 }
 var SeedStream = class {
   constructor(seed, purpose) {
@@ -3068,7 +3311,7 @@ var SeedStream = class {
   purpose;
   counter = 0;
   draw() {
-    const value = createHash4("sha256").update(`agenttwin-stream|${this.seed}|${this.purpose}|${this.counter}`).digest("hex");
+    const value = createHash5("sha256").update(`agenttwin-stream|${this.seed}|${this.purpose}|${this.counter}`).digest("hex");
     this.counter++;
     return value;
   }
@@ -3461,12 +3704,12 @@ var HttpWorld = class {
 
 // src/runtime/evaluation.ts
 import { isDeepStrictEqual as isDeepStrictEqual3 } from "util";
-var matches = (row, where) => !where || Object.entries(where).every(([k, v]) => isDeepStrictEqual3(row[k], v));
+var matches2 = (row, where) => !where || Object.entries(where).every(([k, v]) => isDeepStrictEqual3(row[k], v));
 function evaluateState(spec, initial, final, events) {
   const checks = spec.assertions.map((a, index) => {
     const before = initial[a.service]?.[a.path];
     const after = final[a.service]?.[a.path];
-    const actual = after?.filter((row) => matches(row, a.where)).length;
+    const actual = after?.filter((row) => matches2(row, a.where)).length;
     return {
       id: `assertion_${index + 1}`,
       kind: "required-outcome",
@@ -3478,13 +3721,13 @@ function evaluateState(spec, initial, final, events) {
       evidence: {
         initial: `/initialState/${escape(a.service)}/${escape(a.path)}`,
         final: `/finalState/${escape(a.service)}/${escape(a.path)}`,
-        beforeCount: before?.filter((row) => matches(row, a.where)).length ?? null,
+        beforeCount: before?.filter((row) => matches2(row, a.where)).length ?? null,
         eventSequences: events.filter((e) => e.service === a.service && e.path === a.path).map((e) => e.sequence)
       }
     };
   });
   const forbidden = (spec.forbiddenEffects ?? []).map((policy) => {
-    const hits = events.filter((e) => e.service === policy.service && e.path === policy.path && e.operation === policy.operation && (!policy.where || e.record !== void 0 && matches(e.record, policy.where)));
+    const hits = events.filter((e) => e.service === policy.service && e.path === policy.path && e.operation === policy.operation && (!policy.where || e.record !== void 0 && matches2(e.record, policy.where)));
     const unknown = events.some((e) => e.service === policy.service && e.path === policy.path && e.operation === policy.operation && policy.where && !e.record);
     return {
       id: policy.id,
@@ -3500,7 +3743,7 @@ function evaluateState(spec, initial, final, events) {
   const preserved = (spec.preservedState ?? []).map((policy) => {
     const before = initial[policy.service]?.[policy.path];
     const after = final[policy.service]?.[policy.path];
-    const passed = !!before && !!after && isDeepStrictEqual3(before.filter((row) => matches(row, policy.where)), after.filter((row) => matches(row, policy.where)));
+    const passed = !!before && !!after && isDeepStrictEqual3(before.filter((row) => matches2(row, policy.where)), after.filter((row) => matches2(row, policy.where)));
     return {
       id: policy.id,
       kind: "preserved-state",
@@ -3523,7 +3766,7 @@ function evaluateProperty(policy, final, events) {
   const base = { id: policy.id, kind: "property", propertyKind: policy.kind, service: policy.service, path: policy.path, passed: false };
   const rows2 = final[policy.service]?.[policy.path];
   if (!rows2) return { ...base, expected: "intact", actual: "missing collection", evidence: { evidenceGap: `final state has no collection "${policy.path}" in "${policy.service}"` } };
-  const eventsFor = (operation2, where2) => events.filter((e) => e.service === policy.service && e.path === policy.path && e.operation === operation2 && (!where2 || e.record !== void 0 && matches(e.record, where2)));
+  const eventsFor = (operation2, where2) => events.filter((e) => e.service === policy.service && e.path === policy.path && e.operation === operation2 && (!where2 || e.record !== void 0 && matches2(e.record, where2)));
   if (policy.kind === "unique-per-act") {
     const field = String(policy.params?.field);
     const keyed = /* @__PURE__ */ new Map();
@@ -3668,7 +3911,7 @@ init_git();
 // src/runtime/e2b.ts
 import { Sandbox } from "e2b";
 import { readFile as readFile4 } from "fs/promises";
-import { randomBytes as randomBytes5 } from "crypto";
+import { randomBytes as randomBytes6 } from "crypto";
 import { homedir as homedir2 } from "os";
 import { join as join5 } from "path";
 async function executeE2B(stage, spec, log, signal) {
@@ -3708,7 +3951,7 @@ async function executeE2B(stage, spec, log, signal) {
     await sandbox.commands.run("chmod -R a+rX /input", { user: "root" });
     const runtimeEnv = {};
     if (spec.postgres) {
-      const password = randomBytes5(24).toString("hex");
+      const password = randomBytes6(24).toString("hex");
       secrets.push(password);
       await sandbox.commands.run("pg_ctlcluster --skip-systemctl-redirect 15 main start -o '-c ssl=off -c listen_addresses=127.0.0.1'", { user: "root" });
       await sandbox.files.write("/tmp/agenttwin-init.sql", `CREATE ROLE agenttwin LOGIN PASSWORD '${password}';
@@ -3722,7 +3965,7 @@ CREATE DATABASE agenttwin OWNER agenttwin;
       }
     }
     if (spec.redis) {
-      const password = randomBytes5(24).toString("hex");
+      const password = randomBytes6(24).toString("hex");
       secrets.push(password);
       await sandbox.files.write("/tmp/agenttwin-redis.conf", `bind 127.0.0.1
 port 6379
@@ -3762,14 +4005,14 @@ logfile /tmp/agenttwin-redis.log
 }
 
 // src/runtime/scenarios.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import { mkdir as mkdir2, readFile as readFile5, readdir as readdir2, writeFile as writeFile3 } from "fs/promises";
 import { join as join6 } from "path";
 import { isDeepStrictEqual as isDeepStrictEqual4 } from "util";
 var identifier = /^[a-z][a-z0-9_]{0,39}$/;
 var object2 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 var sort = (v) => Array.isArray(v) ? v.map(sort) : object2(v) ? Object.fromEntries(Object.keys(v).sort().map((k) => [k, sort(v[k])])) : v;
-var scenarioDigest = (scenario) => createHash5("sha256").update(JSON.stringify(sort(scenario))).digest("hex");
+var scenarioDigest = (scenario) => createHash6("sha256").update(JSON.stringify(sort(scenario))).digest("hex");
 function parseScenario(value) {
   const fail = (detail) => {
     throw new Error(`Invalid scenario: ${detail}`);
@@ -3821,14 +4064,14 @@ function applyScenario(world, scenario) {
 }
 
 // src/runtime/matrix.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 import { mkdir as mkdir3, readFile as readFile6, writeFile as writeFile4 } from "fs/promises";
 import { join as join7, relative, resolve as resolve2 } from "path";
 var MAX_SEEDS = 128;
 var APP_RANDOMNESS_NOTE = "The seed controls twin-side behavior only: fault scheduling, latency jitter and test credentials. The application's own randomness, wall-clock behavior and threading are not controlled.";
 function filesDigest(sourceDigests) {
   const canonical2 = Object.keys(sourceDigests).sort().map((file) => `${file}:${sourceDigests[file]}`).join("\n");
-  return createHash6("sha256").update(canonical2).digest("hex");
+  return createHash7("sha256").update(canonical2).digest("hex");
 }
 function checksOfReceipt(receipt) {
   const checks = (receipt.evaluation?.checks ?? []).map((c) => ({
@@ -3913,7 +4156,7 @@ function buildMatrixReport(input) {
 async function runSeedMatrix(cwd, opts) {
   if (!Number.isInteger(opts.seeds) || opts.seeds < 1 || opts.seeds > MAX_SEEDS) throw new CliError(`--seeds must be an integer between 1 and ${MAX_SEEDS}`, { code: EXIT.USAGE });
   const baseSeed = normalizeSeed(opts.seed);
-  const matrixName = `matrix-${createHash6("sha256").update(`${baseSeed}:${opts.seeds}`).digest("hex").slice(0, 8)}`;
+  const matrixName = `matrix-${createHash7("sha256").update(`${baseSeed}:${opts.seeds}`).digest("hex").slice(0, 8)}`;
   const matrixDir = resolve2(cwd, opts.out ?? join7(".agenttwin/runs", matrixName));
   await mkdir3(matrixDir, { recursive: true, mode: 448 });
   const results = [];
@@ -3970,7 +4213,7 @@ async function stageApplication(root, files, destination) {
     const target = join12(destination, file);
     await mkdir6(dirname(target), { recursive: true });
     await writeFile8(target, contents, { mode: 420 });
-    digests[file] = createHash7("sha256").update(contents).digest("hex");
+    digests[file] = createHash8("sha256").update(contents).digest("hex");
   }
   return digests;
 }
@@ -4032,7 +4275,7 @@ async function runWorld(cwd, opts) {
       opts.log("Testing through the CLI with in-process service twins. No cloud VM or containers.");
       const report2 = await executeLocal(join12(stage, "app"), spec, opts.signal, void 0, suppliedSeed);
       const runId2 = randomUUID();
-      const receipt2 = { ...report2, sourceDirectory: relative3(cwd, dirname(file)).split(sep2).join("/"), runId: runId2, runtime, project, git, createdAt: (/* @__PURE__ */ new Date()).toISOString(), sourceDigests, specDigest: createHash7("sha256").update(JSON.stringify(spec)).digest("hex"), provenance: "CLI-reported execution" };
+      const receipt2 = { ...report2, sourceDirectory: relative3(cwd, dirname(file)).split(sep2).join("/"), runId: runId2, runtime, project, git, createdAt: (/* @__PURE__ */ new Date()).toISOString(), sourceDigests, specDigest: createHash8("sha256").update(JSON.stringify(spec)).digest("hex"), provenance: "CLI-reported execution" };
       const out2 = resolve3(cwd, opts.out ?? `.agenttwin/runs/${runId2}`);
       await mkdir6(out2, { recursive: true });
       const evidencePath = join12(out2, "run.json"), reportPath = join12(out2, "report.md");
@@ -4053,7 +4296,7 @@ ${receipt2.reproducibility ?? ""}
     if (runtime === "hosted") {
       const receipt2 = await executeRemote(stage, spec, opts.log, { git, project });
       if (receipt2.schema !== "agenttwin/run-v1" || typeof receipt2.runId !== "string" || !/^[a-f0-9-]{36}$/.test(receipt2.runId) || !["passed", "failed", "error", "incomplete"].includes(String(receipt2.status))) throw new CliError("Invalid hosted receipt");
-      const expectedSpec = createHash7("sha256").update(JSON.stringify(spec)).digest("hex");
+      const expectedSpec = createHash8("sha256").update(JSON.stringify(spec)).digest("hex");
       const reportedSources = receipt2.sourceDigests;
       if (receipt2.specDigest !== expectedSpec || !reportedSources || Object.keys(reportedSources).length !== Object.keys(sourceDigests).length || Object.entries(sourceDigests).some(([path2, digest2]) => reportedSources[path2] !== digest2)) throw new CliError("Hosted receipt does not match the submitted source/specification");
       const out2 = resolve3(cwd, opts.out ?? `.agenttwin/runs/${receipt2.runId}`);
@@ -4091,7 +4334,7 @@ See run.json for assertions, service state, application output and isolation met
       image,
       templateBuildId,
       sourceDigests,
-      specDigest: createHash7("sha256").update(JSON.stringify(spec)).digest("hex"),
+      specDigest: createHash8("sha256").update(JSON.stringify(spec)).digest("hex"),
       isolation
     };
     const out = resolve3(cwd, opts.out ?? `.agenttwin/runs/${runId}`);
@@ -4107,7 +4350,7 @@ See run.json for assertions, service state, application output and isolation met
 }
 
 // src/runtime/analytics.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 function analyticsConfiguration() {
   const key = process.env.POSTHOG_API_KEY;
   const host = process.env.POSTHOG_API_HOST || "https://us.i.posthog.com";
@@ -4142,7 +4385,7 @@ function captureAnalytics(event) {
 }
 
 // src/runtime/gateway.ts
-var hash2 = (value) => createHash9("sha256").update(value).digest("hex");
+var hash3 = (value) => createHash10("sha256").update(value).digest("hex");
 function uploadPath(path2) {
   if (!path2 || path2.startsWith("/") || path2.includes("\\") || path2.includes("\0") || path2.split("/").some((p) => !p || p === "." || p === ".." || /^(\.env.*|\.git|\.ssh|\.aws|\.azure|\.config|\.npmrc|\.netrc|credentials.*)$/i.test(p)) || /\.(pem|key|p12|pfx)$/i.test(path2)) throw new Error("Unsafe uploaded file path");
   return path2;
@@ -4158,6 +4401,11 @@ async function body(req, limit = 28 * 1024 * 1024) {
   return JSON.parse(Buffer.concat(chunks).toString("utf8"));
 }
 function send(res, code, value) {
+  if (code === 429 && !res.hasHeader("Retry-After")) {
+    const error = value?.error ?? "";
+    const wait = error.startsWith("daily_") ? 86400 - Math.floor(Date.now() / 1e3) % 86400 : 60;
+    res.setHeader("Retry-After", String(wait));
+  }
   res.writeHead(code, {
     "content-type": "application/json",
     "cache-control": "no-store",
@@ -4169,11 +4417,14 @@ function send(res, code, value) {
   res.end(JSON.stringify(value));
 }
 function equal(a, b) {
-  const x = Buffer.from(hash2(a)), y = Buffer.from(hash2(b));
-  return timingSafeEqual4(x, y);
+  const x = Buffer.from(hash3(a)), y = Buffer.from(hash3(b));
+  return timingSafeEqual5(x, y);
 }
 async function startGateway(opts) {
   if (opts.adminToken.length < 40) throw new Error("AGENTTWIN_ADMIN_TOKEN must have at least 40 characters");
+  const issuer = opts.publicUrl ?? "https://api.agenttwin.si";
+  const issuerUrl = new URL(issuer);
+  if (issuerUrl.origin !== issuer || issuerUrl.protocol !== "https:" && !(issuerUrl.protocol === "http:" && ["localhost", "127.0.0.1"].includes(issuerUrl.hostname))) throw new Error("Invalid API public URL");
   const socialAuth = createSocialAuth(opts.socialAuth);
   const emailVerification = createEmailVerification(opts.emailVerification, opts.adminToken);
   const allowedOrigins = new Set(opts.allowedOrigins ?? []);
@@ -4219,6 +4470,7 @@ async function startGateway(opts) {
     });
     return writes;
   };
+  const oauth = createOAuth(store, save, issuer);
   for (const thread of store.chats ?? []) {
     const last = thread.messages.at(-1);
     if (last?.role === "user") thread.messages.push({ id: randomUUID2(), role: "assistant", content: "The API restarted before this response completed. Your message is saved.", error: "model_interrupted", requestId: last.requestId, createdAt: (/* @__PURE__ */ new Date()).toISOString(), context: last.context });
@@ -4290,7 +4542,9 @@ async function startGateway(opts) {
   const passkeyChallenges = {};
   const devices = /* @__PURE__ */ new Map();
   let hashing = 0;
-  const dummyPassword = randomBytes6(16).toString("hex") + ":" + randomBytes6(64).toString("hex");
+  let localOnboardingUntil = 0;
+  const dummyPassword = randomBytes7(16).toString("hex") + ":" + randomBytes7(64).toString("hex");
+  const budget = requestBudget(opts.requestsPerMinute);
   const server = createServer2(async (req, res) => {
     try {
       const requestUrl = new URL(req.url ?? "/", "http://localhost");
@@ -4317,6 +4571,11 @@ async function startGateway(opts) {
         }
         return;
       }
+      if (!budget(res)) {
+        send(res, 429, { error: "rate_limit_exceeded" });
+        return;
+      }
+      res.setHeader("Access-Control-Expose-Headers", "RateLimit, RateLimit-Policy, Retry-After, WWW-Authenticate, Location");
       const origin = req.headers.origin;
       if (origin) {
         if (!allowedOrigins.has(origin)) {
@@ -4328,13 +4587,26 @@ async function startGateway(opts) {
         res.setHeader("Access-Control-Allow-Credentials", "true");
         if (req.method === "OPTIONS") {
           res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
-          res.setHeader("Access-Control-Allow-Headers", "Authorization, Content-Type");
+          res.setHeader("Access-Control-Allow-Headers", "Authorization, Content-Type, Idempotency-Key");
           res.setHeader("Access-Control-Max-Age", "600");
           res.writeHead(204);
           res.end();
           return;
         }
       }
+      if (req.method === "GET" && path2 === "/.well-known/oauth-authorization-server") {
+        send(res, 200, oauthMetadata(issuer));
+        return;
+      }
+      if (req.method === "GET" && path2 === "/.well-known/oauth-protected-resource") {
+        send(res, 200, resourceMetadata(issuer));
+        return;
+      }
+      if (!storageHealthy) {
+        send(res, 503, { error: "storage_unavailable" });
+        return;
+      }
+      if (await oauth(req, res, path2)) return;
       if (path2 === "/healthz" && req.method === "GET") {
         send(res, 200, { status: stopping ? "stopping" : "ok" });
         return;
@@ -4343,7 +4615,26 @@ async function startGateway(opts) {
         send(res, 503, { error: "storage_unavailable" });
         return;
       }
-      const token = req.headers.authorization?.replace(/^Bearer /, "") ?? "";
+      const token = req.headers.authorization?.match(/^Bearer (.+)$/i)?.[1] ?? "";
+      const grant = oauthGrant(store, token);
+      if (token.startsWith("at_oauth_") && !grant) {
+        res.setHeader("WWW-Authenticate", `Bearer resource_metadata="${issuer}/.well-known/oauth-protected-resource", error="invalid_token"`);
+        send(res, 401, { error: "invalid_token" });
+        return;
+      }
+      if (grant) {
+        const required = requiredOAuthScope(req.method ?? "", path2);
+        if (!required || !grant.token.scopes.includes(required)) {
+          res.setHeader("WWW-Authenticate", `Bearer error="insufficient_scope"${required ? `, scope="${required}"` : ""}`);
+          send(res, 403, { error: "insufficient_scope" });
+          return;
+        }
+        if (requestUrl.searchParams.has("project") && requestUrl.searchParams.get("project") !== grant.client.project) {
+          send(res, 403, { error: "project_not_authorized" });
+          return;
+        }
+        requestUrl.searchParams.set("project", grant.client.project);
+      }
       const cookieToken = req.headers.cookie?.split(";").map((v) => v.trim()).find((v) => v.startsWith("at_session="))?.slice(11) ?? "";
       const session = store.sessions?.find((s) => s.hash === digest(cookieToken) && s.expires > Date.now());
       if (cookieToken && !token && !["GET", "HEAD", "OPTIONS"].includes(req.method ?? "") && (!origin || !allowedOrigins.has(origin))) {
@@ -4356,7 +4647,7 @@ async function startGateway(opts) {
       };
       const profile = (a) => ({ accountId: a.id, email: a.identity?.email, name: a.identity?.name ?? a.label, workspace: a.label, organization: a.organization, workspaceProfile: a.workspaceProfile, passwordEnabled: !!a.identity?.passwordHash, passwordSetupAllowed: !a.identity?.passwordHash && !!a.externalIdentities?.some((i) => i.provider === "google") });
       if (path2 === "/v1/dev/workspace" && req.method === "GET" && opts.localDevelopment && ["127.0.0.1", "localhost"].includes(opts.host ?? "") && verificationUrl === "http://localhost:3000/onboarding/") {
-        send(res, 200, { schema: "agenttwin/local-workspace-v1", dashboard: verificationUrl });
+        send(res, 200, { schema: "agenttwin/local-workspace-v1", dashboard: verificationUrl, onboarding: localOnboardingUntil > Date.now() });
         return;
       }
       if (path2 === "/v1/auth/providers" && req.method === "GET") {
@@ -4486,12 +4777,12 @@ async function startGateway(opts) {
               return;
             }
             if (store.accounts.length >= 1e4) throw new Error("account_capacity");
-            owner = { id: randomUUID2(), tokenHash: hash2(randomBytes6(32).toString("hex")), label: identity.name + "'s workspace", active: true, usageDay: "", runs: 0, identity: { email: identity.email, name: identity.name }, externalIdentities: [{ provider: identity.provider, issuer: identity.issuer, subject: identity.subject }], ...identity.organization ? { organization: identity.organization } : {} };
+            owner = { id: randomUUID2(), tokenHash: hash3(randomBytes7(32).toString("hex")), label: identity.name + "'s workspace", active: true, usageDay: "", runs: 0, identity: { email: identity.email, name: identity.name }, externalIdentities: [{ provider: identity.provider, issuer: identity.issuer, subject: identity.subject }], ...identity.organization ? { organization: identity.organization } : {} };
             store.accounts.push(owner);
             captureAnalytics({ event: "account_created", distinctId: owner.id, properties: { method: identity.provider, realm: identity.organization || identity.issuer } });
           }
           if (!owner.active) throw new Error("account_inactive");
-          const secret = randomBytes6(32).toString("hex");
+          const secret = randomBytes7(32).toString("hex");
           store.sessions = (store.sessions ?? []).filter((s) => s.expires > Date.now());
           const owned = store.sessions.filter((s) => s.accountId === owner.id);
           if (owned.length >= 10) store.sessions = store.sessions.filter((s) => s !== owned[0]);
@@ -4512,7 +4803,7 @@ async function startGateway(opts) {
           send(res, 429, { error: "Try again shortly." });
           return;
         }
-        const secret = randomBytes6(32).toString("hex"), code = randomBytes6(5).toString("hex").toUpperCase();
+        const secret = randomBytes7(32).toString("hex"), code = randomBytes7(5).toString("hex").toUpperCase();
         devices.set(digest(secret), { code, expires: Date.now() + 6e5, lastPoll: 0 });
         send(res, 200, { deviceCode: secret, userCode: code, verificationUrl, expiresIn: 600 });
         return;
@@ -4533,7 +4824,7 @@ async function startGateway(opts) {
         }
         const rpID = requestUrl.hostname === "localhost" || requestUrl.hostname === "127.0.0.1" ? "localhost" : new URL(origin).hostname;
         const options = await generateRegistrationOptions({ rpName: "AgentTwin", rpID, userName: owner.identity?.email ?? owner.label, userDisplayName: owner.identity?.name ?? owner.label, excludeCredentials: (owner.passkeys ?? []).map((k) => ({ id: k.id })) });
-        const challengeId = randomBytes6(16).toString("hex");
+        const challengeId = randomBytes7(16).toString("hex");
         challengeStore(passkeyChallenges, challengeId, options.challenge, 12e4);
         send(res, 200, { options, challengeId });
         return;
@@ -4580,7 +4871,7 @@ async function startGateway(opts) {
         const credentialId = typeof input.credentialId === "string" ? input.credentialId.slice(0, 1024) : "";
         const owner = credentialId ? store.accounts.find((a) => a.active && (a.passkeys ?? []).some((k) => k.id === credentialId)) : void 0;
         const options = await generateAuthenticationOptions({ rpID: requestUrl.hostname === "localhost" || requestUrl.hostname === "127.0.0.1" ? "localhost" : new URL(origin).hostname, allowCredentials: credentialId && owner ? [{ id: credentialId }] : void 0, userVerification: "preferred" });
-        const challengeId = randomBytes6(16).toString("hex");
+        const challengeId = randomBytes7(16).toString("hex");
         challengeStore(passkeyChallenges, challengeId, options.challenge, 12e4);
         send(res, 200, { options, challengeId });
         return;
@@ -4611,7 +4902,7 @@ async function startGateway(opts) {
           return;
         }
         key.counter = verification.authenticationInfo.newCounter;
-        const secret = randomBytes6(32).toString("hex");
+        const secret = randomBytes7(32).toString("hex");
         store.sessions = (store.sessions ?? []).filter((s) => s.expires > Date.now());
         const owned = store.sessions.filter((s) => s.accountId === owner.id);
         if (owned.length >= 10) store.sessions = store.sessions.filter((s) => s !== owned[0]);
@@ -4672,7 +4963,8 @@ async function startGateway(opts) {
           send(res, 400, { error: "Use a valid email and a password with 12\u2013128 characters." });
           return;
         }
-        if (emailVerification.enabled && (!emailGrant?.verified || emailGrant.email !== parsed.email || !emailVerification.bound(emailGrant, emailBinding ?? "", origin))) {
+        const demoLogin = path2 === "/v1/auth/login" && parsed.email === "demo@agenttwin.si" && store.accounts.some((a) => a.identity?.email === parsed.email && a.identity.emailVerified === true);
+        if (emailVerification.enabled && !demoLogin && (!emailGrant?.verified || emailGrant.email !== parsed.email || !emailVerification.bound(emailGrant, emailBinding ?? "", origin))) {
           send(res, 403, { error: "Verify your email with a one-time code before continuing.", code: "email_verification_required" });
           return;
         }
@@ -4707,21 +4999,21 @@ async function startGateway(opts) {
               send(res, 429, { error: "account_capacity" });
               return;
             }
-            a = { id: randomUUID2(), tokenHash: hash2(randomBytes6(32).toString("hex")), label: workspace, active: true, usageDay: "", runs: 0, identity: { email: parsed.email, name, passwordHash: encoded } };
+            a = { id: randomUUID2(), tokenHash: hash3(randomBytes7(32).toString("hex")), label: workspace, active: true, usageDay: "", runs: 0, identity: { email: parsed.email, name, passwordHash: encoded } };
             store.accounts.push(a);
             captureAnalytics({ event: "account_created", distinctId: a.id, properties: { method: "email", realm: "password" } });
           } else {
-            const matches2 = await passwordMatches(parsed.password, a?.identity?.passwordHash ?? dummyPassword);
-            if (!a?.active || !a.identity?.passwordHash || !matches2) {
+            const matches3 = await passwordMatches(parsed.password, a?.identity?.passwordHash ?? dummyPassword);
+            if (!a?.active || !a.identity?.passwordHash || !matches3) {
               send(res, 401, { error: "Email or password is incorrect." });
               return;
             }
           }
-          const secret = randomBytes6(32).toString("hex");
+          const secret = randomBytes7(32).toString("hex");
           store.sessions = (store.sessions ?? []).filter((s) => s.expires > Date.now());
           const owned = store.sessions.filter((s) => s.accountId === a.id);
           if (owned.length >= 10) store.sessions = store.sessions.filter((s) => s !== owned[0]);
-          if (emailVerification.enabled) {
+          if (emailVerification.enabled && !demoLogin) {
             if (store.emailChallenges?.[emailChallengeId] !== emailGrant || !emailVerification.bound(emailGrant, emailBinding ?? "", origin)) {
               send(res, 403, { error: "Email verification expired. Request a new code." });
               return;
@@ -4827,8 +5119,8 @@ async function startGateway(opts) {
           send(res, 400, { error: "label_required" });
           return;
         }
-        const accessToken = `at_user_${randomBytes6(32).toString("hex")}`;
-        const account2 = { id: randomUUID2(), tokenHash: hash2(accessToken), label: data.label, active: true, usageDay: "", runs: 0 };
+        const accessToken = `at_user_${randomBytes7(32).toString("hex")}`;
+        const account2 = { id: randomUUID2(), tokenHash: hash3(accessToken), label: data.label, active: true, usageDay: "", runs: 0 };
         if (store.accounts.length >= 1e4) {
           send(res, 429, { error: "account_capacity" });
           return;
@@ -4854,11 +5146,21 @@ async function startGateway(opts) {
         send(res, 200, { revoked: true });
         return;
       }
-      const account = store.accounts.find((a) => a.active && (token ? a.tokenHash === hash2(token) || a.cliTokens?.includes(hash2(token)) : a.id === session?.accountId));
+      const account = store.accounts.find((a) => a.active && (grant ? a.id === grant.client.accountId : token ? a.tokenHash === hash3(token) || a.cliTokens?.includes(hash3(token)) : a.id === session?.accountId));
       if (!account) {
+        res.setHeader("WWW-Authenticate", `Bearer resource_metadata="${issuer}/.well-known/oauth-protected-resource"`);
         send(res, 401, { error: "unauthorized" });
         return;
       }
+      if (path2 === "/v1/dev/workspace" && req.method === "POST" && opts.localDevelopment && ["127.0.0.1", "localhost"].includes(opts.host ?? "") && verificationUrl === "http://localhost:3000/onboarding/") {
+        if (token || !session || origin !== "http://localhost:3000") {
+          send(res, 403, { error: "browser_session_required" });
+          return;
+        }
+        localOnboardingUntil = Date.now() + 10 * 6e4;
+        send(res, 200, { waiting: true });
+        return;
+      }
       if (path2 === "/v1/auth/password" && req.method === "POST") {
         if (token || !session || !account.identity || !origin || !allowedOrigins.has(origin)) {
           send(res, 403, { error: "browser_session_required" });
@@ -4897,7 +5199,7 @@ async function startGateway(opts) {
             return;
           }
           const previousIdentity = account.identity, previousSessions = store.sessions;
-          const secret = randomBytes6(32).toString("hex");
+          const secret = randomBytes7(32).toString("hex");
           account.identity = { ...account.identity, passwordHash: encoded };
           store.sessions = [...store.sessions.filter((s) => s.accountId !== account.id), { accountId: account.id, hash: digest(secret), expires: Date.now() + 7 * 864e5 }];
           try {
@@ -4919,8 +5221,8 @@ async function startGateway(opts) {
           send(res, 400, { error: "terminal_token_required" });
           return;
         }
-        account.cliTokens = (account.cliTokens ?? []).filter((t) => t !== hash2(token));
-        if (account.tokenHash === hash2(token)) account.tokenHash = hash2(randomBytes6(32).toString("hex"));
+        account.cliTokens = (account.cliTokens ?? []).filter((t) => t !== hash3(token));
+        if (account.tokenHash === hash3(token)) account.tokenHash = hash3(randomBytes7(32).toString("hex"));
         await save();
         send(res, 200, { signedOut: true });
         return;
@@ -4933,8 +5235,8 @@ async function startGateway(opts) {
           send(res, 400, { error: "Code not found or expired. Run agenttwin login again." });
           return;
         }
-        const accessToken = `at_user_${randomBytes6(32).toString("hex")}`;
-        account.cliTokens = [...(account.cliTokens ?? []).slice(-9), hash2(accessToken)];
+        const accessToken = `at_user_${randomBytes7(32).toString("hex")}`;
+        account.cliTokens = [...(account.cliTokens ?? []).slice(-9), hash3(accessToken)];
         device.accountId = account.id;
         await save();
         device.token = accessToken;
@@ -4981,6 +5283,47 @@ async function startGateway(opts) {
       const projectInventories = [...store.projectDiscoveries?.[account.id] ?? []];
       const latestInventory = store.discoveries?.[account.id];
       if (latestInventory && !projectInventories.some((p) => p.name === latestInventory.name)) projectInventories.push(latestInventory);
+      if (path2 === "/v1/oauth/clients" && req.method === "POST") {
+        const input = await body(req, 8192);
+        if (typeof input.label !== "string" || !input.label.trim() || input.label.length > 100 || typeof input.project !== "string" || !projectInventories.some((p) => p.name === input.project)) {
+          send(res, 400, { error: "valid_label_and_synced_project_required" });
+          return;
+        }
+        if ((store.oauthClients ?? []).filter((c) => c.accountId === account.id && c.active).length >= 20) {
+          send(res, 429, { error: "client_capacity" });
+          return;
+        }
+        if (!account.active) {
+          send(res, 401, { error: "unauthorized" });
+          return;
+        }
+        if ((store.oauthClients ?? []).length >= 1e4) {
+          send(res, 429, { error: "client_capacity" });
+          return;
+        }
+        const { client, secret } = newOAuthClient(account.id, input.label.trim(), input.project, input.scopes);
+        store.oauthClients ??= [];
+        store.oauthClients.push(client);
+        await save();
+        send(res, 201, { client_id: client.id, client_secret: secret, project: client.project, scope: client.scopes.join(" "), token_endpoint: issuer + "/oauth/token" });
+        return;
+      }
+      if (path2 === "/v1/oauth/clients" && req.method === "GET") {
+        send(res, 200, { clients: (store.oauthClients ?? []).filter((c) => c.accountId === account.id && c.active).map(({ secretHash, accountId, ...client }) => client) });
+        return;
+      }
+      if (/^\/v1\/oauth\/clients\/at_client_[a-f0-9]{32}$/.test(path2) && req.method === "DELETE") {
+        const client = store.oauthClients?.find((c) => c.id === path2.split("/").at(-1) && c.accountId === account.id);
+        if (!client) {
+          send(res, 404, { error: "not_found" });
+          return;
+        }
+        client.active = false;
+        store.oauthTokens = (store.oauthTokens ?? []).filter((t) => t.clientId !== client.id);
+        await save();
+        send(res, 200, { revoked: true });
+        return;
+      }
       const requestedProject = requestUrl.searchParams.get("project");
       const selectedInventory = requestedProject === null ? latestInventory : projectInventories.find((p) => p.name === requestedProject);
       if (path2.startsWith("/v1/projects/") && req.method === "DELETE") {
@@ -5023,7 +5366,7 @@ async function startGateway(opts) {
         return;
       }
       if (path2 === "/v1/projects" && req.method === "GET") {
-        send(res, 200, { projects: projectInventories.map((p) => ({ name: p.name, tools: p.tools.length, workflows: p.workflows.length })), latest: latestInventory?.name ?? null });
+        send(res, 200, { projects: projectInventories.filter((p) => !grant || p.name === grant.client.project).map((p) => ({ name: p.name, tools: p.tools.length, workflows: p.workflows.length })), latest: grant ? grant.client.project : latestInventory?.name ?? null });
         return;
       }
       if (path2 === "/v1/discovery" && req.method === "GET") {
@@ -5081,7 +5424,20 @@ async function startGateway(opts) {
         return;
       }
       if (path2 === "/v1/runs" && req.method === "GET") {
-        send(res, 200, { jobs: store.jobs.filter((j) => j.accountId === account.id).sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt)).slice(0, 100).map((job) => ({ id: job.id, status: job.status, createdAt: job.createdAt, name: job.name ?? (typeof job.receipt?.name === "string" ? job.receipt.name : void 0), workflowId: job.workflowId ?? (typeof job.receipt?.workflowId === "string" ? job.receipt.workflowId : void 0), project: job.project ?? (typeof job.receipt?.project === "string" ? job.receipt.project : void 0) })) });
+        const limitText = requestUrl.searchParams.get("limit") ?? "100";
+        if (!/^[1-9][0-9]?$|^100$/.test(limitText)) {
+          send(res, 400, { error: "invalid_page_limit" });
+          return;
+        }
+        const limit = Number(limitText), project = requestUrl.searchParams.get("project");
+        const jobs = store.jobs.filter((j) => j.accountId === account.id && (project === null || (j.project ?? j.receipt?.project) === project)).sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt) || b.id.localeCompare(a.id));
+        const cursor = requestUrl.searchParams.get("cursor"), offset = cursor === null ? 0 : jobs.findIndex((j) => j.id === cursor) + 1;
+        if (cursor !== null && offset === 0) {
+          send(res, 400, { error: "invalid_page_cursor" });
+          return;
+        }
+        const page = jobs.slice(offset, offset + limit);
+        send(res, 200, { jobs: page.map((job) => ({ id: job.id, status: job.status, createdAt: job.createdAt, name: job.name ?? job.receipt?.name, workflowId: job.workflowId ?? job.receipt?.workflowId, project: job.project ?? job.receipt?.project })), nextCursor: offset + limit < jobs.length ? page.at(-1).id : null });
         return;
       }
       if (path2 === "/v1/runs" && req.method === "POST") {
@@ -5089,24 +5445,38 @@ async function startGateway(opts) {
           send(res, 503, { error: "stopping" });
           return;
         }
-        if (!process.env.E2B_API_KEY || !process.env.E2B_TEMPLATE_ID) {
-          send(res, 503, { error: "cloud_runner_not_configured", message: "Run through the CLI, or configure a cloud runner when this workflow needs one." });
+        const input = await body(req);
+        if (grant && !oauthGrant(store, token)) {
+          send(res, 401, { error: "invalid_token" });
           return;
         }
-        if (busy(account.id)) {
-          send(res, 429, { error: "run_in_progress_or_queue_full" });
+        if (grant && input.project !== grant.client.project) {
+          send(res, 403, { error: "project_not_authorized" });
           return;
         }
-        const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-        if (account.usageDay !== today) {
-          account.usageDay = today;
-          account.runs = 0;
+        const idempotencyKey = req.headers["idempotency-key"];
+        if (idempotencyKey !== void 0 && (typeof idempotencyKey !== "string" || !/^[A-Za-z0-9._:-]{1,128}$/.test(idempotencyKey))) {
+          send(res, 400, { error: "invalid_idempotency_key" });
+          return;
         }
-        if (account.runs >= dailyLimit) {
-          send(res, 429, { error: "daily_run_limit" });
+        const requestDigest = hash3(JSON.stringify(input));
+        if (idempotencyKey) {
+          const prior = store.jobs.find((j) => j.accountId === account.id && j.idempotencyKey === idempotencyKey);
+          if (prior) {
+            if (prior.requestDigest !== requestDigest) {
+              send(res, 409, { error: "idempotency_key_conflict" });
+              return;
+            }
+            res.setHeader("Location", issuer + "/v1/runs/" + prior.id);
+            res.setHeader("Idempotency-Replayed", "true");
+            send(res, 202, { id: prior.id, status: prior.status });
+            return;
+          }
+        }
+        if (!process.env.E2B_API_KEY || !process.env.E2B_TEMPLATE_ID) {
+          send(res, 503, { error: "cloud_runner_not_configured", message: "Run through the CLI, or configure a cloud runner when this workflow needs one." });
           return;
         }
-        const input = await body(req);
         const spec = parseWorld(input.spec);
         if (spec.browser || spec.background) {
           send(res, 422, { error: "unsupported_runtime", message: "Browser recipes and background completion checks currently require the local runtime. No cloud job was queued." });
@@ -5114,6 +5484,10 @@ async function startGateway(opts) {
         }
         const git = validateGit(input.git);
         const project = input.project;
+        if (grant && project !== grant.client.project) {
+          send(res, 403, { error: "project_not_authorized" });
+          return;
+        }
         if (project !== void 0 && (typeof project !== "string" || !projectInventories.some((p) => p.name === project))) {
           send(res, 409, { error: "sync_project_before_run" });
           return;
@@ -5146,11 +5520,12 @@ async function startGateway(opts) {
           return;
         }
         store.jobs = store.jobs.filter((j) => Date.parse(j.createdAt) > Date.now() - 30 * 864e5);
-        const job = { id: randomUUID2(), accountId: account.id, status: "queued", createdAt: (/* @__PURE__ */ new Date()).toISOString(), name: spec.name, workflowId: spec.workflowId, project };
+        const job = { id: randomUUID2(), accountId: account.id, status: "queued", createdAt: (/* @__PURE__ */ new Date()).toISOString(), name: spec.name, workflowId: spec.workflowId, project, ...idempotencyKey ? { idempotencyKey, requestDigest } : {} };
         account.runs++;
         store.jobs.push(job);
         await save();
         captureAnalytics({ event: "run_submitted", distinctId: account.id, properties: { jobId: job.id, project } });
+        res.setHeader("Location", issuer + "/v1/runs/" + job.id);
         controllers.set(job.id, new AbortController());
         queue.push({ job, spec, files: input.files, git, project });
         schedule();
@@ -5172,6 +5547,10 @@ async function startGateway(opts) {
           return;
         }
         const input = await body(req);
+        if (grant && !oauthGrant(store, token)) {
+          send(res, 401, { error: "invalid_token" });
+          return;
+        }
         const project = selectedInventory?.name;
         if (!project || input.project !== project) {
           send(res, 409, { error: "sync_project_before_saving" });
@@ -5337,7 +5716,7 @@ async function startGateway(opts) {
         const controller = new AbortController();
         chatControllers.set(account.id, controller);
         const timeout = setTimeout(() => controller.abort(), 45e3);
-        const context = { project, discoveryDigest: inventory ? hash2(JSON.stringify(inventory)) : null, jobId: job?.id ?? null };
+        const context = { project, discoveryDigest: inventory ? hash3(JSON.stringify(inventory)) : null, jobId: job?.id ?? null };
         thread.messages.push({ id: randomUUID2(), role: "user", content: input.content.trim(), requestId: input.requestId, createdAt: (/* @__PURE__ */ new Date()).toISOString(), context });
         try {
           await save();
@@ -5374,7 +5753,7 @@ async function startGateway(opts) {
       }
       const match = path2.match(/^\/v1\/runs\/([a-f0-9-]{36})$/);
       if (match && req.method === "DELETE") {
-        const job = store.jobs.find((j) => j.id === match[1] && j.accountId === account.id);
+        const job = store.jobs.find((j) => j.id === match[1] && j.accountId === account.id && (!grant || (j.project ?? j.receipt?.project) === grant.client.project));
         if (!job) {
           send(res, 404, { error: "not_found" });
           return;
@@ -5397,7 +5776,7 @@ async function startGateway(opts) {
         return;
       }
       if (match && req.method === "GET") {
-        const job = store.jobs.find((j) => j.id === match[1] && j.accountId === account.id);
+        const job = store.jobs.find((j) => j.id === match[1] && j.accountId === account.id && (!grant || (j.project ?? j.receipt?.project) === grant.client.project));
         if (!job) {
           send(res, 404, { error: "not_found" });
           return;