agility-bridge 0.2.0 → 0.3.0

package/dist/index.mjs

@@ -7,17 +7,19 @@ import { closeSync, constants, existsSync, fchmodSync, fstatSync, lstatSync, mkd
 import { parse } from "yaml";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { index, integer, sqliteTable, text, uniqueIndex } from "drizzle-orm/sqlite-core";
-import { and, asc, desc, eq, gte, isNull, lt, lte, or } from "drizzle-orm";
+import { and, asc, desc, eq, gte, inArray, isNull, lt, lte, or, sql } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/sqlite-proxy";
 import { validator } from "hono/validator";
 import { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { mergePath } from "hono/utils/url";
+import { LinearRouter } from "hono/router/linear-router";
 import { DatabaseSync } from "node:sqlite";
-import { homedir } from "node:os";
-import { serve } from "@hono/node-server";
+import { lookup } from "node:dns";
 import { rootCertificates } from "node:tls";
 import { Agent } from "undici";
+import { homedir } from "node:os";
+import { serve } from "@hono/node-server";
 import { serveStdio } from "@modelcontextprotocol/server/stdio";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
@@ -350,7 +352,7 @@ var CircuitBreakers = class {
 //#endregion
 //#region ../../packages/core/src/version.ts
 /** The agility-bridge version reported to MCP clients. Kept equal to apps/cli/package.json (checked in tests). */
-const VERSION$1 = "0.2.0";
+const VERSION$1 = "0.3.0";
 //#endregion
 //#region ../../packages/core/src/agility/xml.ts
 const MAX_DEPTH = 64;
@@ -830,18 +832,98 @@ function invalid$1(reason) {
 * The canonical form of an instance URL, fixed at configuration time (L-054, L-055): HTTPS (plain HTTP only for
 * loopback tests), no user info, query or fragment, the path kept, no trailing slash.
 */
-function canonicalInstanceUrl(input) {
+function canonicalInstanceUrl(input, options = {}) {
 	let url;
 	try {
 		url = new URL(input.trim());
 	} catch {
 		throw invalid$1("is not a valid URL");
 	}
-	if (url.protocol !== "https:" && !(url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname))) throw invalid$1("must use https://");
+	const httpOk = (options.httpLoopback ?? true) && url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname);
+	if (url.protocol !== "https:" && !httpOk) throw invalid$1("must use https://");
 	if (url.username !== "" || url.password !== "") throw invalid$1("must not contain a user name or password");
 	if (url.search !== "" || url.hash !== "" || /[?#]/.test(input)) throw invalid$1("must not contain a query or fragment");
 	return `${url.origin}${url.pathname.replace(/\/+$/, "")}`;
 }
+function ipv4(text) {
+	const parts = text.split(".");
+	if (parts.length !== 4) return null;
+	const out = [];
+	for (const p of parts) {
+		if (!/^\d{1,3}$/.test(p)) return null;
+		const n = Number(p);
+		if (n > 255) return null;
+		out.push(n);
+	}
+	return out;
+}
+function ipv4Class([a, b, c] = []) {
+	if (a === void 0 || b === void 0) return "invalid";
+	if (a === 192 && b === 0 && (c === 0 || c === 2)) return "reserved";
+	if (a === 198 && (b === 18 || b === 19)) return "reserved";
+	if (a === 198 && b === 51 && c === 100 || a === 203 && b === 0 && c === 113) return "reserved";
+	if (a === 0) return "unspecified";
+	if (a === 127) return "loopback";
+	if (a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168) return "private";
+	if (a === 100 && b >= 64 && b <= 127) return "private";
+	if (a === 169 && b === 254) return "link-local";
+	if (a >= 224) return "reserved";
+	return "public";
+}
+/** Expands an IPv6 literal to 8 groups, or null. */
+function ipv6(text) {
+	const raw = text.replace(/^\[|\]$/g, "").toLowerCase();
+	if (!raw.includes(":") || raw.includes("%")) return null;
+	let head = raw;
+	let v4 = null;
+	const lastColon = raw.lastIndexOf(":");
+	if (raw.slice(lastColon + 1).includes(".")) {
+		v4 = ipv4(raw.slice(lastColon + 1));
+		if (v4 === null) return null;
+		head = `${raw.slice(0, lastColon + 1)}${(v4[0] * 256 + v4[1]).toString(16)}:${(v4[2] * 256 + v4[3]).toString(16)}`;
+	}
+	const halves = head.split("::");
+	if (halves.length > 2) return null;
+	const left = halves[0] === "" ? [] : halves[0].split(":");
+	const right = halves.length === 1 || halves[1] === "" ? [] : halves[1].split(":");
+	const fill = halves.length === 2 ? 8 - left.length - right.length : 0;
+	if (fill < 0) return null;
+	const groups = [
+		...left,
+		...Array(fill).fill("0"),
+		...right
+	];
+	if (groups.length !== 8 || groups.some((g) => !/^[0-9a-f]{1,4}$/.test(g))) return null;
+	return groups.map((g) => Number.parseInt(g, 16));
+}
+/** Classifies an IPv4 or IPv6 literal (brackets allowed); IPv4-mapped IPv6 is classified as IPv4. */
+function addressClass(ip) {
+	const v4 = ipv4(ip);
+	if (v4 !== null) return ipv4Class(v4);
+	const g = ipv6(ip);
+	if (g === null) return "invalid";
+	const [g0 = 0, , , , , g5 = 0, g6 = 0, g7 = 0] = g;
+	if (g.every((x) => x === 0)) return "unspecified";
+	if (g.slice(0, 7).every((x) => x === 0) && g7 === 1) return "loopback";
+	const embedded = (hi, lo) => ipv4Class([
+		hi >> 8,
+		hi & 255,
+		lo >> 8,
+		lo & 255
+	]);
+	if (g.slice(0, 5).every((x) => x === 0) && g5 === 65535) return embedded(g6, g7);
+	if (g.slice(0, 4).every((x) => x === 0) && g[4] === 65535 && g5 === 0) return embedded(g6, g7);
+	if (g.slice(0, 6).every((x) => x === 0)) return embedded(g6, g7);
+	if (g0 === 100 && g[1] === 65435 && g.slice(2, 6).every((x) => x === 0)) return embedded(g6, g7);
+	if (g0 === 8194) return embedded(g[1] ?? 0, g[2] ?? 0);
+	if ((g0 & 65472) === 65216) return "private";
+	if (g0 === 256 && g.slice(1, 4).every((x) => x === 0)) return "reserved";
+	if ((g0 & 65024) === 64512) return "private";
+	if ((g0 & 65472) === 65152) return "link-local";
+	if ((g0 & 65280) === 65280) return "reserved";
+	if (g0 === 8193 && g[1] === 3512) return "reserved";
+	return "public";
+}
 //#endregion
 //#region ../../packages/core/src/agility/limiter.ts
 /** A counting semaphore: at most `max` tasks run at once, the rest wait in order (ADR-0010). */
@@ -878,12 +960,19 @@ var Semaphore = class {
 var CredentialLimiters = class {
 	#size;
 	#maxKeys;
+	#perCall;
 	#byKey = /* @__PURE__ */ new Map();
+	/**
+	* `perCall` (Workers, L-096): every `for()` returns a new semaphore, so a call never waits for a slot another request
+	* holds; concurrency is then bounded per call, and Workers bounds connections per request itself.
+	*/
 	constructor(options = {}) {
 		this.#size = options.concurrency ?? 5;
 		this.#maxKeys = options.maxKeys ?? 1e4;
+		this.#perCall = options.perCall ?? false;
 	}
 	for(instanceId, credentialId) {
+		if (this.#perCall) return new Semaphore(this.#size);
 		const key = `${instanceId}\u0000${credentialId}`;
 		let sem = this.#byKey.get(key);
 		if (sem === void 0) {
@@ -1229,12 +1318,15 @@ var InstanceMetadata = class {
 	#service;
 	#ctx;
 	#cache;
+	/** Loads in flight: shared with other calls, or this call's own (`shareInflight: false`). */
+	#inflight;
 	/** Asset types this call asked for that the instance does not have (each one a meta.v1 404, review M6). */
 	#absentInCall = 0;
 	constructor(service, ctx) {
 		this.#service = service;
 		this.#ctx = ctx;
 		this.#cache = service.cache(ctx.instance.id);
+		this.#inflight = service.options.shareInflight === false ? /* @__PURE__ */ new Map() : this.#cache.inflight;
 	}
 	/** The asset type, or AB_INPUT_INVALID when the instance has no such type. */
 	async assetType(name) {
@@ -1248,10 +1340,10 @@ var InstanceMetadata = class {
 		const cached = this.#cache.types.get(name);
 		if (this.#service.fresh(cached)) return cached.value ?? void 0;
 		if (this.#absentInCall >= MAX_ABSENT_PER_CALL && !KNOWN_TYPES.has(name)) return void 0;
-		let pending = this.#cache.inflight.get(name);
+		let pending = this.#inflight.get(name);
 		if (pending === void 0) {
-			pending = this.#load(name).finally(() => this.#cache.inflight.delete(name));
-			this.#cache.inflight.set(name, pending);
+			pending = this.#load(name).finally(() => this.#inflight.delete(name));
+			this.#inflight.set(name, pending);
 		}
 		const meta = await pending;
 		if (meta === null) this.#absentInCall++;
@@ -5474,7 +5566,7 @@ const CORE_TOOLS = Object.freeze([
 ]);
 //#endregion
 //#region package.json
-var version = "0.2.0";
+var version = "0.3.0";
 //#endregion
 //#region src/config.ts
 var ConfigError = class extends Error {
@@ -5529,6 +5621,8 @@ const KNOWN_ENV = /* @__PURE__ */ new Set([
 	"AB_AUDIT_RETENTION_DAYS",
 	"AB_CREDENTIAL_REVALIDATION_HOURS",
 	"AB_PASSTHROUGH",
+	"AB_ALLOW_HTTP_INSTANCES",
+	"AB_INSTANCE_PRIVATE_ADDRESSES",
 	"AB_OAUTH",
 	"AB_PLAN"
 ]);
@@ -5586,7 +5680,7 @@ function int(name, value, fallback, min, max) {
 	if (!Number.isInteger(n) || n < min || n > max) throw new ConfigError(`${name} must be an integer from ${min} to ${max}.`);
 	return n;
 }
-function list$2(name, value, pattern, what) {
+function list$1(name, value, pattern, what) {
 	if (value === void 0 || value.trim() === "") return void 0;
 	const items = value.split(",").map((s) => s.trim()).filter((s) => s !== "");
 	if (items.length === 0) return void 0;
@@ -5596,7 +5690,7 @@ function list$2(name, value, pattern, what) {
 /** `AB_PROJECTS`: unset means every project; set but empty (`" "`, `",,"`) is refused rather than read as "all". */
 function projectList(value) {
 	if (value === void 0) return [];
-	const items = list$2("AB_PROJECTS", value, SCOPE_OID$1, "Agility project (use Scope:1234)");
+	const items = list$1("AB_PROJECTS", value, SCOPE_OID$1, "Agility project (use Scope:1234)");
 	if (items === void 0) throw new ConfigError("AB_PROJECTS is set but empty: unset it to allow every project, or list Scope:<id> tokens.");
 	return items;
 }
@@ -5817,10 +5911,10 @@ function loadConfig(env, options = {}) {
 		...env["AB_CA_FILE"] ? { caFile: env["AB_CA_FILE"] } : {},
 		projects: projectList(env["AB_PROJECTS"]),
 		includeChildProjects: bool("AB_INCLUDE_CHILD_PROJECTS", env["AB_INCLUDE_CHILD_PROJECTS"], true),
-		...list$2("AB_TOOLS", env["AB_TOOLS"], TOOL_NAME$1, "tool name") === void 0 ? {} : { tools: list$2("AB_TOOLS", env["AB_TOOLS"], TOOL_NAME$1, "tool name") },
+		...list$1("AB_TOOLS", env["AB_TOOLS"], TOOL_NAME$1, "tool name") === void 0 ? {} : { tools: list$1("AB_TOOLS", env["AB_TOOLS"], TOOL_NAME$1, "tool name") },
 		assetTypes: {
-			...list$2("AB_ASSET_TYPES_ALLOW", env["AB_ASSET_TYPES_ALLOW"], TYPE_NAME$1, "asset type") === void 0 ? {} : { allow: list$2("AB_ASSET_TYPES_ALLOW", env["AB_ASSET_TYPES_ALLOW"], TYPE_NAME$1, "asset type") },
-			deny: list$2("AB_ASSET_TYPES_DENY", env["AB_ASSET_TYPES_DENY"], TYPE_NAME$1, "asset type") ?? []
+			...list$1("AB_ASSET_TYPES_ALLOW", env["AB_ASSET_TYPES_ALLOW"], TYPE_NAME$1, "asset type") === void 0 ? {} : { allow: list$1("AB_ASSET_TYPES_ALLOW", env["AB_ASSET_TYPES_ALLOW"], TYPE_NAME$1, "asset type") },
+			deny: list$1("AB_ASSET_TYPES_DENY", env["AB_ASSET_TYPES_DENY"], TYPE_NAME$1, "asset type") ?? []
 		},
 		genericQuery: bool("AB_GENERIC_QUERY", env["AB_GENERIC_QUERY"], true),
 		memberEmails: bool("AB_MEMBER_EMAILS", env["AB_MEMBER_EMAILS"], false),
@@ -6826,6 +6920,36 @@ function createSqlStorage(driver, options = {}) {
 			if (typeof tokenHash !== "string") return null;
 			return (await db.select().from(accessTokens).where(eq(accessTokens.tokenHash, tokenHash)).limit(1))[0] ?? null;
 		},
+		async bundleByHash(tokenHash) {
+			if (typeof tokenHash !== "string") return {
+				token: null,
+				grant: null,
+				workspace: null,
+				user: null,
+				instance: null,
+				credential: null
+			};
+			const { accessTokens: t, grants: g, workspaces: w, users: u, instances: i, credentials: c } = schema_exports;
+			const grantIds = db.select({ id: t.grantId }).from(t).where(eq(t.tokenHash, tokenHash));
+			const workspaceIds = db.select({ id: g.workspaceId }).from(g).where(inArray(g.id, grantIds));
+			const credentialIds = db.select({ id: sql`coalesce(${g.credentialId}, ${w.defaultCredentialId})` }).from(g).innerJoin(w, eq(w.id, g.workspaceId)).where(inArray(g.id, grantIds));
+			const [tokens, grantRows, workspaceRows, userRows, instanceRows, credentialRows] = await db.batch([
+				db.select().from(t).where(eq(t.tokenHash, tokenHash)).limit(1),
+				db.select().from(g).where(inArray(g.id, grantIds)).limit(1),
+				db.select().from(w).where(inArray(w.id, workspaceIds)).limit(1),
+				db.select().from(u).where(inArray(u.id, db.select({ id: g.userId }).from(g).where(inArray(g.id, grantIds)))).limit(1),
+				db.select().from(i).where(inArray(i.id, db.select({ id: w.instanceId }).from(w).where(inArray(w.id, workspaceIds)))).limit(1),
+				db.select().from(c).where(inArray(c.id, credentialIds)).limit(1)
+			]);
+			return {
+				token: tokens[0] ?? null,
+				grant: grantRows[0] ?? null,
+				workspace: workspaceRows[0] ?? null,
+				user: userRows[0] ?? null,
+				instance: instanceRows[0] ?? null,
+				credential: credentialRows[0] ?? null
+			};
+		},
 		list(filter = {}) {
 			return tokenRepo.list(filter.grantId === void 0 ? void 0 : eq(accessTokens.grantId, filter.grantId));
 		},
@@ -6975,950 +7099,943 @@ function createSqlStorage(driver, options = {}) {
 	});
 }
 //#endregion
-//#region ../../packages/auth/src/access/guards.ts
-/** The actor may not do this (HTTP 403). The message says which role or condition is needed. */
-var ForbiddenError = class extends Error {
-	code = "forbidden";
-	constructor(message) {
-		super(message);
-		this.name = "ForbiddenError";
+//#region ../../packages/auth/src/secrets/keyring.ts
+/** Fixed purpose labels; a key derived for one purpose is useless for another. */
+const KeyPurpose = {
+	/** Agility access tokens of credentials. */
+	Credentials: "credentials",
+	/** Key-check values that detect a wrong master key. */
+	KeyCheck: "key-check",
+	/** Keyed hashes of identities in the audit log (pass-through token fingerprints). */
+	AuditIdentity: "audit-identity",
+	/** Cache entry ids (P8-01). */
+	CacheId: "cache-id",
+	/** Write approval records (P7-01). */
+	Approval: "approval",
+	/** Task records (P8-10). */
+	Task: "task"
+};
+const ENCRYPTION = /* @__PURE__ */ new Set([
+	KeyPurpose.Credentials,
+	KeyPurpose.Approval,
+	KeyPurpose.Task
+]);
+/** A failure of the secrets layer. Messages never contain key material, ciphertext or plaintext. */
+var SecretsError = class extends Error {
+	code;
+	constructor(code, message, options) {
+		super(message, options);
+		this.name = "SecretsError";
+		this.code = code;
 	}
 };
-const roleOf = (a) => a.kind === "break_glass" ? "owner" : a.role;
-const userIdOf = (a) => a.kind === "user" ? a.userId : null;
-const isOwner = (a) => roleOf(a) === "owner";
-const isManager = (a) => roleOf(a) === "owner" || roleOf(a) === "admin";
-function need(ok, message) {
-	if (!ok) throw new ForbiddenError(message);
+const KEY_BYTES = 32;
+const IV_BYTES = 12;
+const MASTER_KEY = /^(?:v([1-9][0-9]{0,2}):)?([A-Za-z0-9+/]{43}=)$/;
+const HKDF_SALT = new TextEncoder().encode("agility-bridge/hkdf/v1");
+function toBase64(bytes) {
+	let s = "";
+	for (const b of bytes) s += String.fromCharCode(b);
+	return btoa(s);
 }
-const needManager = (a) => need(isManager(a), "This needs an owner or an admin.");
-const needOwner = (a, what) => need(isOwner(a), `Only an owner can ${what}.`);
-/** The services, each call checked against the actor's role (and, for members, ownership). */
-function guardedServices(services, ctx, actor) {
-	const { storage, tools } = ctx;
-	const writeTools = (names) => (names ?? []).filter((n) => tools.get(n) !== void 0 && tools.get(n)?.kind !== "read");
-	const self = userIdOf(actor);
-	async function load(row, what) {
-		const r = await row;
-		if (r === null) throw new NotFoundError(`No ${what} with this id.`);
-		return r;
+function fromBase64(text) {
+	const s = atob(text);
+	const out = new Uint8Array(s.length);
+	for (let i = 0; i < s.length; i++) out[i] = s.charCodeAt(i);
+	return out;
+}
+function toBase64Url(bytes) {
+	return toBase64(bytes).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function fromBase64Url(text) {
+	if (!/^[A-Za-z0-9_-]*$/.test(text)) throw new SecretsError("decrypt_failed", "The sealed value is malformed.");
+	const b64 = text.replaceAll("-", "+").replaceAll("_", "/");
+	return fromBase64(b64 + "=".repeat((4 - b64.length % 4) % 4));
+}
+const hex = (bytes) => [...new Uint8Array(bytes)].map((b) => b.toString(16).padStart(2, "0")).join("");
+/**
+* Parses `v<N>:<base64 of 32 bytes>` (bare base64 is version 1). The error never echoes the input, which is a secret
+* even when malformed.
+*/
+function parseMasterKey(text) {
+	const m = MASTER_KEY.exec(typeof text === "string" ? text.trim() : "");
+	if (m === null) throw new SecretsError("invalid_key", "The master key must be v<N>:<base64 of 32 random bytes> (generate one with `agility-bridge init`).");
+	const bytes = fromBase64(m[2]);
+	if (bytes.length !== KEY_BYTES) throw new SecretsError("invalid_key", "The master key must be 32 bytes.");
+	if (bytes.every((b) => b === bytes[0])) throw new SecretsError("invalid_key", "The master key is not random; generate one with `agility-bridge init`.");
+	return Object.freeze({
+		version: m[1] === void 0 ? 1 : Number(m[1]),
+		bytes
+	});
+}
+/** A new master key, `v<version>:<base64>`, from the platform CSPRNG. */
+function generateMasterKey(version = 1) {
+	if (!Number.isInteger(version) || version < 1 || version > 999) throw new SecretsError("invalid_key", "Key versions are 1-999.");
+	return `v${version}:${toBase64(crypto.getRandomValues(new Uint8Array(KEY_BYTES)))}`;
+}
+const additionalData = (context, version) => new TextEncoder().encode(`${context}|${version}`);
+/**
+* The current master key and, during a rotation, the previous one. Purpose keys are derived once per version and kept
+* as non-extractable `CryptoKey`s (per process, never request data).
+*/
+var Keyring = class Keyring {
+	currentVersion;
+	versions;
+	#roots;
+	#derived = /* @__PURE__ */ new Map();
+	constructor(currentVersion, roots) {
+		this.currentVersion = currentVersion;
+		this.#roots = roots;
+		this.versions = Object.freeze([...roots.keys()].sort((a, b) => a - b));
 	}
-	/** Members see only their own records: anything else is "not found", never "forbidden" (no existence oracle). */
-	function visible(row, mine) {
-		if (row === null || isManager(actor)) return row;
-		return mine(row) ? row : null;
+	/** Builds a keyring from the current master key and, during a rotation, the previous one (a lower version). */
+	static async create(current, previous) {
+		const cur = parseMasterKey(current);
+		const roots = /* @__PURE__ */ new Map();
+		const importRoot = (bytes) => crypto.subtle.importKey("raw", bytes, "HKDF", false, ["deriveKey"]);
+		roots.set(cur.version, await importRoot(cur.bytes));
+		if (previous !== void 0) {
+			const prev = parseMasterKey(previous);
+			if (prev.version >= cur.version) throw new SecretsError("invalid_key", `The previous master key (version ${prev.version}) must have a lower version than the current one (version ${cur.version}).`);
+			if (prev.bytes.every((b, i) => b === cur.bytes[i])) throw new SecretsError("invalid_key", "The previous and current master keys are the same key.");
+			roots.set(prev.version, await importRoot(prev.bytes));
+		}
+		return new Keyring(cur.version, roots);
 	}
-	async function activeOwners() {
-		return (await storage.users.list()).filter((u) => u.role === "owner" && u.disabledAt === null);
+	has(version) {
+		return this.#roots.has(version);
 	}
-	const users = {
-		async list() {
-			if (isManager(actor)) return storage.users.list();
-			const me = self === null ? null : await storage.users.get(self);
-			return me === null ? [] : [me];
-		},
-		async get(id) {
-			return visible(await storage.users.get(id), (u) => u.id === self);
-		},
-		async create(input) {
-			needManager(actor);
-			if (input.role !== "member") needOwner(actor, "create owners or admins");
-			return services.users.create(input);
-		},
-		async update(id, patch) {
-			needManager(actor);
-			const target = await load(storage.users.get(id), "user");
-			if (target.role !== "member" || patch.role !== void 0 && patch.role !== "member") needOwner(actor, "change owners, admins or roles above member");
-			if (target.role === "owner" && patch.role !== void 0 && patch.role !== "owner") need((await activeOwners()).filter((u) => u.id !== id).length > 0, "The last active owner cannot lose the owner role.");
-			return services.users.update(id, patch);
-		},
-		async disable(id) {
-			needManager(actor);
-			const target = await load(storage.users.get(id), "user");
-			if (target.role !== "member") needOwner(actor, "disable owners or admins");
-			if (target.role === "owner") need((await activeOwners()).filter((u) => u.id !== id).length > 0, "The last active owner cannot be disabled.");
-			return services.users.disable(id);
-		}
-	};
-	const instances = {
-		list: () => storage.instances.list(),
-		get: (id) => storage.instances.get(id),
-		async create(input) {
-			needManager(actor);
-			return services.instances.create(input);
-		},
-		async update(id, patch) {
-			needManager(actor);
-			return services.instances.update(id, patch);
-		},
-		/** THREAT_MODEL A14: owner only, with a recent sign-in. */
-		async retarget(id, target) {
-			needOwner(actor, "change an instance's origin or TLS trust");
-			need(actor.kind === "break_glass" || actor.recentAuth, "Sign in again before changing an instance origin.");
-			return services.instances.retarget(id, target);
-		},
-		async delete(id) {
-			needManager(actor);
-			await storage.instances.delete(id);
+	/**
+	* Derives every purpose key of every loaded version now. Workers boot with it (L-096): the keyring is shared by the
+	* requests of an isolate, and a derivation started by one request must not be awaited by another.
+	*/
+	async warm(purposes = Object.values(KeyPurpose)) {
+		await Promise.all(this.versions.flatMap((v) => purposes.map((purpose) => this.#key(purpose, v))));
+	}
+	#key(purpose, version) {
+		const root = this.#roots.get(version);
+		if (root === void 0) return Promise.reject(new SecretsError("key_unavailable", `Master key version ${version} is not loaded (AB_MASTER_KEY_PREVIOUS?).`));
+		const id = `${version}/${purpose}`;
+		let key = this.#derived.get(id);
+		if (key === void 0) {
+			const info = new TextEncoder().encode(`agility-bridge/${purpose}/v${version}`);
+			const algorithm = {
+				name: "HKDF",
+				hash: "SHA-256",
+				salt: HKDF_SALT,
+				info
+			};
+			key = ENCRYPTION.has(purpose) ? crypto.subtle.deriveKey(algorithm, root, {
+				name: "AES-GCM",
+				length: 256
+			}, false, ["encrypt", "decrypt"]) : crypto.subtle.deriveKey(algorithm, root, {
+				name: "HMAC",
+				hash: "SHA-256",
+				length: 256
+			}, false, ["sign"]);
+			this.#derived.set(id, key);
 		}
-	};
-	const mineCredential = (c) => c.ownerUserId !== null && c.ownerUserId === self;
-	const credentials = {
-		async list(filter = {}) {
-			if (isManager(actor)) return storage.credentials.list(filter);
-			if (self === null) return [];
-			return storage.credentials.list({
-				...filter,
-				ownerUserId: self
-			});
-		},
-		async get(id) {
-			return visible(await storage.credentials.get(id), mineCredential);
-		},
-		/** Shared: owners and admins. Personal: only the user themselves (nobody stores a token for someone else). */
-		async create(input) {
-			if (input.ownerUserId === null) needManager(actor);
-			else need(input.ownerUserId === self, "Only the user themselves can store their personal Agility token.");
-			return services.credentials.create(input);
-		},
-		async replaceToken(id, token) {
-			const c = await load(storage.credentials.get(id), "credential");
-			if (c.ownerUserId === null) needManager(actor);
-			else if (!mineCredential(c)) throw new NotFoundError("No credential with this id.");
-			return services.credentials.replaceToken(id, token);
-		},
-		async update(id, patch) {
-			const c = await load(storage.credentials.get(id), "credential");
-			if (!mineCredential(c) && !isManager(actor)) throw new NotFoundError("No credential with this id.");
-			return services.credentials.update(id, patch);
-		},
-		async validate(id) {
-			const c = await load(storage.credentials.get(id), "credential");
-			if (!mineCredential(c) && !isManager(actor)) throw new NotFoundError("No credential with this id.");
-			return services.credentials.validate(id);
-		},
-		async revoke(id) {
-			const c = await load(storage.credentials.get(id), "credential");
-			if (!mineCredential(c)) {
-				if (!isManager(actor)) throw new NotFoundError("No credential with this id.");
-			}
-			return services.credentials.revoke(id);
-		},
-		async delete(id) {
-			needManager(actor);
-			await storage.credentials.delete(id);
-		}
-	};
-	const checkWorkspaceWrites = (input) => {
-		if (input.writePolicy !== void 0) needOwner(actor, "change write settings");
-		if (input.credentialSource === "passthrough") needOwner(actor, "make a workspace pass-through");
-		if (writeTools(input.enabledTools).length > 0) needOwner(actor, "enable write tools");
-	};
-	const workspaces = {
-		async list() {
-			needManager(actor);
-			return storage.workspaces.list();
-		},
-		async get(id) {
-			needManager(actor);
-			return storage.workspaces.get(id);
-		},
-		async create(input) {
-			needManager(actor);
-			checkWorkspaceWrites(input);
-			return services.workspaces.create(input);
-		},
-		async update(id, patch) {
-			needManager(actor);
-			checkWorkspaceWrites(patch);
-			return services.workspaces.update(id, patch);
-		},
-		async disable(id) {
-			needManager(actor);
-			return services.workspaces.disable(id);
-		},
-		async delete(id) {
-			needManager(actor);
-			await services.workspaces.delete(id);
+		return key;
+	}
+	/** Encrypts with the current key; `context` (a record id) and the version are bound as additional data. */
+	async seal(purpose, context, plaintext) {
+		if (!ENCRYPTION.has(purpose)) throw new TypeError(`${purpose} is not an encryption purpose.`);
+		const version = this.currentVersion;
+		const key = await this.#key(purpose, version);
+		const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
+		const data = await crypto.subtle.encrypt({
+			name: "AES-GCM",
+			iv,
+			additionalData: additionalData(context, version),
+			tagLength: 128
+		}, key, new TextEncoder().encode(plaintext));
+		return Object.freeze({
+			ciphertext: toBase64Url(new Uint8Array(data)),
+			iv: toBase64Url(iv),
+			keyVersion: version
+		});
+	}
+	/** Decrypts a sealed value; a wrong key, context or version, or any tampering, fails with `decrypt_failed`. */
+	async open(purpose, context, sealed) {
+		if (!ENCRYPTION.has(purpose)) throw new TypeError(`${purpose} is not an encryption purpose.`);
+		const key = await this.#key(purpose, sealed.keyVersion);
+		const iv = fromBase64Url(sealed.iv);
+		if (iv.length !== IV_BYTES) throw new SecretsError("decrypt_failed", "The sealed value is malformed.");
+		try {
+			const data = await crypto.subtle.decrypt({
+				name: "AES-GCM",
+				iv,
+				additionalData: additionalData(context, sealed.keyVersion),
+				tagLength: 128
+			}, key, fromBase64Url(sealed.ciphertext));
+			return new TextDecoder("utf-8", { fatal: true }).decode(data);
+		} catch (error) {
+			throw new SecretsError("decrypt_failed", "The sealed value could not be decrypted with this master key.", { cause: error });
 		}
+	}
+	/** HMAC-SHA-256 (hex) with the purpose key of `version` (default current). */
+	async mac(purpose, data, version = this.currentVersion) {
+		if (ENCRYPTION.has(purpose)) throw new TypeError(`${purpose} is an encryption purpose.`);
+		const key = await this.#key(purpose, version);
+		return hex(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(data)));
+	}
+	/** The key-check value of a version: proves the key without revealing it. */
+	keyCheckValue(version) {
+		return this.mac(KeyPurpose.KeyCheck, "agility-bridge key check", version);
+	}
+};
+/** Constant-time comparison of two strings of equal length (false otherwise). */
+function timingSafeEqual(a, b) {
+	if (a.length !== b.length) return false;
+	let diff = 0;
+	for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+	return diff === 0;
+}
+//#endregion
+//#region ../../packages/auth/src/secrets/credentials.ts
+const KCV_KEY = (version) => `crypto:kcv:v${version}`;
+const RETIRED_KEY = (version) => `crypto:retired:v${version}`;
+/** At most the last 4 characters, and nothing for short values. */
+function tokenHint(token) {
+	return token.length >= 16 ? token.slice(-4) : "";
+}
+/** Seals an Agility access token for the credential `credentialId` (additional data: `id | key version`). */
+async function sealCredentialToken(keyring, credentialId, token) {
+	if (typeof token !== "string" || token.length === 0) throw new TypeError("An access token is required.");
+	const sealed = await keyring.seal(KeyPurpose.Credentials, credentialId, token);
+	return {
+		tokenCiphertext: sealed.ciphertext,
+		tokenIv: sealed.iv,
+		keyVersion: sealed.keyVersion,
+		tokenHint: tokenHint(token)
 	};
-	const mineGrant = (g) => g.userId !== null && g.userId === self;
-	const grants = {
-		async list(filter = {}) {
-			if (isManager(actor)) return storage.grants.list(filter);
-			if (self === null) return [];
-			return storage.grants.list({
-				...filter,
-				userId: self
-			});
-		},
-		async get(id) {
-			return visible(await storage.grants.get(id), mineGrant);
-		},
-		async create(input) {
-			needManager(actor);
-			if (writeTools(input.tools).length > 0) needOwner(actor, "grant write tools");
-			return services.grants.create(input);
-		},
-		async update(id, patch) {
-			needManager(actor);
-			if (writeTools(patch.tools).length > 0) needOwner(actor, "grant write tools");
-			const current = await load(storage.grants.get(id), "grant");
-			if (patch.credentialId !== void 0 && patch.credentialId !== current.credentialId) await needCredentialOwner(patch.credentialId, "put a grant on someone's personal Agility token");
-			return services.grants.update(id, patch);
-		},
-		async revoke(id) {
-			needManager(actor);
-			return services.grants.revoke(id);
-		},
-		async delete(id) {
-			needManager(actor);
-			await services.grants.delete(id);
+}
+const toSealed = (c) => ({
+	ciphertext: c.tokenCiphertext,
+	iv: c.tokenIv,
+	keyVersion: c.keyVersion
+});
+/** Decrypts a credential's token. Swapping ciphertexts between credentials or versions fails (`decrypt_failed`). */
+function openCredentialToken(keyring, credential) {
+	return keyring.open(KeyPurpose.Credentials, credential.id, toSealed(credential));
+}
+/**
+* Boot check: every loaded version's key-check value must match the one recorded the first time that version was
+* used, so a wrong key is refused before it decrypts (or seals) anything, and a version number is never reused for
+* other key material. The current version must not be retired.
+*/
+async function verifyKeyring(storage, keyring) {
+	const warnings = [];
+	for (const version of keyring.versions) {
+		const kcv = await keyring.keyCheckValue(version);
+		if (!await storage.kv.setIfAbsent(KCV_KEY(version), kcv)) {
+			const recorded = await storage.kv.get(KCV_KEY(version));
+			if (recorded === null || !timingSafeEqual(recorded, kcv)) throw new SecretsError("wrong_key", `Master key version ${version} is not the key this database was encrypted with. Use the original key; a version number can never be reused for a different key.`);
 		}
-	};
-	/** Members manage the tokens of their own grants; owners and admins every token. */
-	async function ownGrant(grantId) {
-		const g = await load(storage.grants.get(grantId), "grant");
-		if (!isManager(actor) && !mineGrant(g)) throw new NotFoundError("No grant with this id.");
-		return g;
-	}
-	/**
-	* A device token on a grant that uses someone's personal Agility token acts as that person in Agility: only they
-	* may issue one (P2-17 review M2). Grants on shared credentials stay with owners and admins.
-	*/
-	async function needCredentialOwner(credentialId, what) {
-		if (credentialId === null) return;
-		const c = await storage.credentials.get(credentialId);
-		if (c !== null && c.ownerUserId !== null && c.ownerUserId !== self) throw new ForbiddenError(`Only the owner of the personal Agility token can ${what}.`);
 	}
-	return Object.freeze({
-		actor,
-		users,
-		instances,
+	if (await storage.kv.get(RETIRED_KEY(keyring.currentVersion)) !== null) throw new SecretsError("retired", `Master key version ${keyring.currentVersion} was retired; use a newer key.`);
+	for (const version of keyring.versions) if (version !== keyring.currentVersion && await storage.kv.get(RETIRED_KEY(version)) !== null) warnings.push(`Master key version ${version} is retired; remove AB_MASTER_KEY_PREVIOUS.`);
+	const stranded = (await keyStatus(storage, keyring)).filter((v) => !v.loaded && v.credentials > 0);
+	for (const v of stranded) warnings.push(`${v.credentials} credential(s) use master key version ${v.version}, which is not loaded; they cannot be used until that key is provided (as AB_MASTER_KEY_PREVIOUS for a rotation) or their tokens are entered again.`);
+	return { warnings };
+}
+/** Credentials per key version, and which versions are loaded, current or retired. */
+async function keyStatus(storage, keyring) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const c of await storage.credentials.list()) counts.set(c.keyVersion, (counts.get(c.keyVersion) ?? 0) + 1);
+	for (const v of keyring.versions) if (!counts.has(v)) counts.set(v, 0);
+	const out = [];
+	for (const [version, credentials] of [...counts].sort((a, b) => a[0] - b[0])) out.push({
+		version,
 		credentials,
-		workspaces,
-		grants,
-		tokens: {
-			async list(grantId) {
-				await ownGrant(grantId);
-				return services.tokens.list(grantId);
-			},
-			async issue(input) {
-				await needCredentialOwner((await ownGrant(input.grantId)).credentialId, "issue device tokens on this grant");
-				return services.tokens.issue(input);
-			},
-			async revoke(id) {
-				await ownGrant((await load(storage.accessTokens.get(id), "token")).grantId);
-				return services.tokens.revoke(id);
-			}
-		}
+		loaded: keyring.has(version),
+		current: version === keyring.currentVersion,
+		retired: await storage.kv.get(RETIRED_KEY(version)) !== null
 	});
+	return out;
 }
-//#endregion
-//#region ../../packages/auth/src/access/load.ts
 /**
-* Loads the records `resolveAccess` needs for one grant. Reads only; whatever is missing comes back `null` and the
-* resolver denies. (On D1 this becomes one `batch()`, P3-02.)
+* Re-encrypts every credential still on an older loaded version with the current key. Each row is replaced only if it
+* still holds the ciphertext that was decrypted (compare-and-swap), so concurrent edits and interrupted runs are safe:
+* run it again to resume.
 */
-async function loadAccessRecords(storage, grantId) {
-	const grant = await storage.grants.get(grantId);
-	if (grant === null) return {
-		grant: null,
-		workspace: null,
-		instance: null,
-		credential: null,
-		user: null
-	};
-	const [workspace, user] = await Promise.all([storage.workspaces.get(grant.workspaceId), grant.userId === null ? Promise.resolve(null) : storage.users.get(grant.userId)]);
-	if (workspace === null) return {
-		grant,
-		workspace: null,
-		instance: null,
-		credential: null,
-		user
-	};
-	const credentialId = grant.credentialId ?? workspace.defaultCredentialId;
-	const [instance, credential] = await Promise.all([storage.instances.get(workspace.instanceId), credentialId === null ? Promise.resolve(null) : storage.credentials.get(credentialId)]);
-	return {
-		grant,
-		workspace,
-		instance,
-		credential,
-		user
+async function rotateCredentialKeys(storage, keyring, options) {
+	const reason = String(options.reason ?? "").slice(0, 200);
+	if (reason.length === 0) throw new TypeError("A rotation reason is required for the audit log.");
+	const batchSize = Math.max(1, Math.min(options.batchSize ?? 100, 1e3));
+	const now = options.now ?? Date.now;
+	const result = {
+		rotated: 0,
+		skipped: 0,
+		failed: [],
+		remaining: 0
 	};
-}
-//#endregion
-//#region ../../packages/auth/src/access/policy.ts
-const SCOPE_OID = /^Scope:\d{1,12}$/;
-const TYPE_NAME = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
-const TOOL_NAME = /^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$/;
-const scopeIds = z.array(z.string().regex(SCOPE_OID)).max(1e3);
-const toolNames = z.array(z.string().regex(TOOL_NAME).max(64)).max(200);
-const typeNames = z.array(z.string().regex(TYPE_NAME)).max(500);
-const assetTypePolicySchema = z.strictObject({
-	/** Only these types (absent = every type the instance exposes). */
-	allow: typeNames.optional(),
-	deny: typeNames.optional()
-});
-/** Numeric limits with their hard bounds, and feature switches (tool conventions, ADR-0010). */
-const limitsPolicySchema = z.strictObject({
-	defaultRows: z.number().int().min(1).max(1e3).optional(),
-	maxRows: z.number().int().min(1).max(1e3).optional(),
-	maxFields: z.number().int().min(1).max(200).optional(),
-	maxNestingDepth: z.number().int().min(0).max(5).optional(),
-	maxAggregations: z.number().int().min(0).max(50).optional(),
-	maxAnyOfGroups: z.number().int().min(0).max(20).optional(),
-	maxResponseBytes: z.number().int().min(65536).max(67108864).optional(),
-	maxAsOfAgeDays: z.number().int().min(0).max(3650).optional(),
-	maxTimeRangeDays: z.number().int().min(1).max(3660).optional(),
-	/** Agility requests per tool call (ADR-0010). */
-	callBudget: z.number().int().min(1).max(1e4).optional(),
-	/** Member emails in output (D-06). */
-	memberEmails: z.boolean().optional(),
-	/** The generic `query_assets` / `get_assets` tools. */
-	genericQuery: z.boolean().optional()
-});
-/** Writes per workspace (ADR-0013); write tools also need the server switch and an explicit listing (Phase 7). */
-const writePolicySchema = z.strictObject({ enabled: z.boolean().optional() });
-/** Per-grant rate limit (P2-07). */
-const rateLimitPolicySchema = z.strictObject({ perMinute: z.number().int().min(1).max(1e5).optional() });
-const workspacePolicySchema = z.strictObject({
-	allowedScopeIds: scopeIds.min(1),
-	includeChildScopes: z.boolean(),
-	assetTypes: assetTypePolicySchema.nullable(),
-	enabledTools: toolNames.nullable(),
-	limits: limitsPolicySchema,
-	writePolicy: writePolicySchema
-});
-const grantPolicySchema = z.strictObject({
-	tools: toolNames.nullable(),
-	scopeIds: scopeIds.min(1).nullable(),
-	assetTypes: assetTypePolicySchema.nullable(),
-	limits: limitsPolicySchema,
-	rateLimit: rateLimitPolicySchema.nullable()
-});
-/** The numbers and switches of `limitsPolicySchema` and how a grant tightens each. */
-const NUMBER_LIMITS = [
-	"defaultRows",
-	"maxRows",
-	"maxFields",
-	"maxNestingDepth",
-	"maxAggregations",
-	"maxAnyOfGroups",
-	"maxResponseBytes",
-	"maxAsOfAgeDays",
-	"maxTimeRangeDays",
-	"callBudget"
-];
-const SWITCHES = ["memberEmails", "genericQuery"];
-/**
-* Workspace limits over the deployment defaults (capped by its ceilings), tightened by the grant: numbers take the
-* minimum, switches stay on only when both allow them. `warnings` name grant values that tried to loosen a limit.
-*/
-function effectiveLimits(deployment, workspace, grant) {
-	const warnings = [];
-	const out = { ...deployment.defaults };
-	for (const key of NUMBER_LIMITS) {
-		let value = workspace[key] ?? deployment.defaults[key];
-		const ceiling = deployment.ceilings[key];
-		if (ceiling !== void 0) value = Math.min(value, ceiling);
-		const g = grant[key];
-		if (g !== void 0) {
-			if (g > value) warnings.push(`The grant's ${key} (${g}) is above the workspace's (${value}); ${value} applies.`);
-			value = Math.min(value, g);
+	const doneWith = /* @__PURE__ */ new Set();
+	const details = (from) => ({
+		fromVersion: from,
+		toVersion: keyring.currentVersion,
+		reason,
+		...options.actor?.via !== void 0 ? { via: options.actor.via } : {}
+	});
+	for (let batch = 0; options.maxBatches === void 0 || batch < options.maxBatches; batch++) {
+		const pending = (await storage.credentials.list()).filter((c) => c.keyVersion !== keyring.currentVersion && !doneWith.has(c.id)).slice(0, batchSize);
+		if (pending.length === 0) break;
+		for (const c of pending) {
+			const expected = {
+				tokenCiphertext: c.tokenCiphertext,
+				tokenIv: c.tokenIv,
+				keyVersion: c.keyVersion
+			};
+			let token;
+			try {
+				token = await openCredentialToken(keyring, c);
+			} catch (error) {
+				const reasonCode = error instanceof SecretsError && error.code === "key_unavailable" ? error.code : "decrypt_failed";
+				doneWith.add(c.id);
+				result.failed.push({
+					id: c.id,
+					keyVersion: c.keyVersion,
+					reason: reasonCode
+				});
+				await storage.audit.append({
+					id: crypto.randomUUID(),
+					ts: now(),
+					kind: "admin",
+					action: "credential.rekey",
+					status: "error",
+					errorCode: reasonCode,
+					userId: options.actor?.userId ?? null,
+					instanceId: c.instanceId,
+					targetType: "credential",
+					targetId: c.id,
+					details: details(c.keyVersion)
+				});
+				continue;
+			}
+			const sealed = await sealCredentialToken(keyring, c.id, token);
+			const next = {
+				tokenCiphertext: sealed.tokenCiphertext,
+				tokenIv: sealed.tokenIv,
+				keyVersion: sealed.keyVersion
+			};
+			if (await storage.credentials.replaceSecret(c.id, expected, next)) {
+				result.rotated++;
+				await storage.audit.append({
+					id: crypto.randomUUID(),
+					ts: now(),
+					kind: "admin",
+					action: "credential.rekey",
+					status: "ok",
+					userId: options.actor?.userId ?? null,
+					instanceId: c.instanceId,
+					targetType: "credential",
+					targetId: c.id,
+					details: details(c.keyVersion)
+				});
+			} else {
+				doneWith.add(c.id);
+				result.skipped++;
+			}
 		}
-		out[key] = value;
-	}
-	for (const key of SWITCHES) {
-		const ws = workspace[key] ?? deployment.defaults[key];
-		const g = grant[key];
-		if (g === true && !ws) warnings.push(`The grant turns ${key} on, but the workspace has it off.`);
-		out[key] = ws && g !== false;
 	}
-	out["defaultRows"] = Math.min(out["defaultRows"], out["maxRows"]);
-	return {
-		limits: Object.freeze(out),
-		warnings
-	};
-}
-/** Allow lists intersect (absent = no restriction), deny lists union. */
-function effectiveAssetTypes(workspace, grant) {
-	const wa = workspace?.allow;
-	const ga = grant?.allow;
-	const allow = wa === void 0 ? ga : ga === void 0 ? wa : wa.filter((t) => ga.includes(t));
-	const deny = [.../* @__PURE__ */ new Set([...workspace?.deny ?? [], ...grant?.deny ?? []])];
-	return allow === void 0 ? { deny } : {
-		allow: [...new Set(allow)],
-		deny
-	};
-}
-//#endregion
-//#region ../../packages/auth/src/access/resolve.ts
-const deny = (reason) => ({
-	ok: false,
-	reason
-});
-const expired = (at, now) => at !== null && at <= now;
-function parseWorkspace(w) {
-	const r = workspacePolicySchema.safeParse({
-		allowedScopeIds: w.allowedScopeIds,
-		includeChildScopes: w.includeChildScopes,
-		assetTypes: w.assetTypes,
-		enabledTools: w.enabledTools,
-		limits: w.limits,
-		writePolicy: w.writePolicy
-	});
-	return r.success ? r.data : null;
-}
-function parseGrant(g) {
-	const r = grantPolicySchema.safeParse({
-		tools: g.tools,
-		scopeIds: g.scopeIds,
-		assetTypes: g.assetTypes,
-		limits: g.limits,
-		rateLimit: g.rateLimit
-	});
-	return r.success ? r.data : null;
+	result.remaining = (await storage.credentials.list()).filter((c) => c.keyVersion !== keyring.currentVersion).length;
+	return result;
 }
 /**
-* Decides what one request may do in the workspace `slug`. Pure: the same records, settings and time give the same
-* answer, so it can be cached (≤ 60 s, never past `expiresAt`, L-068) and tested exhaustively.
+* Marks a key version as retired once no credential uses it; a retired version is refused as the current key at
+* boot. The previous key can then be removed from the configuration.
 */
-function resolveAccess(principal, slug, records, settings, now) {
-	const { grant, workspace, instance, credential, user } = records;
-	if (workspace === null) return deny("workspace_missing");
-	if (workspace.slug !== slug) return deny("wrong_workspace");
-	if (principal.kind === "oauth" && principal.workspaceId !== workspace.id) return deny("wrong_workspace");
-	if (principal.kind === "device_token") {
-		if (principal.token.revokedAt !== null) return deny("token_revoked");
-		if (expired(principal.token.expiresAt, now)) return deny("token_expired");
-	} else if (expired(principal.expiresAt, now)) return deny("token_expired");
-	if (grant === null) return deny("grant_missing");
-	const grantId = principal.kind === "device_token" ? principal.token.grantId : principal.grantId;
-	if (grant.id !== grantId || grant.workspaceId !== workspace.id) return deny("grant_missing");
-	if (grant.revokedAt !== null) return deny("grant_revoked");
-	if (expired(grant.expiresAt, now)) return deny("grant_expired");
-	if (workspace.disabledAt !== null) return deny("workspace_disabled");
-	if (instance === null || instance.id !== workspace.instanceId) return deny("instance_missing");
-	if (instance.disabledAt !== null) return deny("instance_disabled");
-	if (grant.userId !== null) {
-		if (user === null || user.id !== grant.userId) return deny("user_missing");
-		if (user.disabledAt !== null) return deny("user_disabled");
+async function retireKeyVersion(storage, keyring, version, options) {
+	if (version === keyring.currentVersion) throw new SecretsError("in_use", `Master key version ${version} is the current key.`);
+	if (version > keyring.currentVersion || await storage.kv.get(KCV_KEY(version)) === null) throw new SecretsError("in_use", `Master key version ${version} is not an earlier version of this database.`);
+	const users = await storage.credentials.list({ keyVersion: version });
+	if (users.length > 0) throw new SecretsError("in_use", `${users.length} credential(s) still use master key version ${version}; rotate them first.`);
+	const now = options.now ?? Date.now;
+	await storage.kv.set(RETIRED_KEY(version), String(now()));
+	if (options.record === false) return;
+	await storage.audit.append({
+		id: crypto.randomUUID(),
+		ts: now(),
+		kind: "admin",
+		action: "crypto.retire_key",
+		status: "ok",
+		userId: options.actor?.userId ?? null,
+		targetType: "key_version",
+		targetId: String(version),
+		details: {
+			reason: String(options.reason ?? "").slice(0, 200),
+			...options.actor?.via !== void 0 ? { via: options.actor.via } : {}
+		}
+	});
+}
+//#endregion
+//#region ../../packages/auth/src/access/guards.ts
+/** The actor may not do this (HTTP 403). The message says which role or condition is needed. */
+var ForbiddenError = class extends Error {
+	code = "forbidden";
+	constructor(message) {
+		super(message);
+		this.name = "ForbiddenError";
 	}
-	const credentialId = grant.credentialId ?? workspace.defaultCredentialId;
-	if (credentialId === null || credential === null || credential.id !== credentialId) return deny("credential_missing");
-	if (credential.revokedAt !== null) return deny("credential_revoked");
-	if (credential.validationStatus !== "valid") return deny("credential_unvalidated");
-	if (credential.instanceId !== workspace.instanceId) return deny("credential_mismatch");
-	const kind = credential.ownerUserId === null ? "shared" : "personal";
-	if (kind === "personal" && (grant.userId === null || credential.ownerUserId !== grant.userId)) return deny("credential_mismatch");
-	if (grant.credentialId === null && kind !== "shared") return deny("credential_mismatch");
-	const ws = parseWorkspace(workspace);
-	const gp = parseGrant(grant);
-	if (ws === null || gp === null) return deny("malformed_policy");
-	const warnings = [];
-	let projects = ws.allowedScopeIds;
-	if (gp.scopeIds !== null) {
-		const outside = gp.scopeIds.filter((s) => !ws.allowedScopeIds.includes(s));
-		if (outside.length > 0) warnings.push(`The grant names projects outside the workspace: ${outside.join(", ")}.`);
-		projects = ws.allowedScopeIds.filter((s) => gp.scopeIds.includes(s));
+};
+const roleOf = (a) => a.kind === "break_glass" ? "owner" : a.role;
+const userIdOf = (a) => a.kind === "user" ? a.userId : null;
+const isOwner = (a) => roleOf(a) === "owner";
+const isManager = (a) => roleOf(a) === "owner" || roleOf(a) === "admin";
+function need(ok, message) {
+	if (!ok) throw new ForbiddenError(message);
+}
+const needManager = (a) => need(isManager(a), "This needs an owner or an admin.");
+const needOwner = (a, what) => need(isOwner(a), `Only an owner can ${what}.`);
+/** The services, each call checked against the actor's role (and, for members, ownership). */
+function guardedServices(services, ctx, actor) {
+	const { storage, tools } = ctx;
+	const writeTools = (names) => (names ?? []).filter((n) => tools.get(n) !== void 0 && tools.get(n)?.kind !== "read");
+	const self = userIdOf(actor);
+	async function load(row, what) {
+		const r = await row;
+		if (r === null) throw new NotFoundError(`No ${what} with this id.`);
+		return r;
 	}
-	if (credential.reachableScopeIds !== null) {
-		const unreachable = projects.filter((s) => !credential.reachableScopeIds.includes(s));
-		if (unreachable.length > 0) warnings.push(`The credential's member could not see ${unreachable.join(", ")} when it was last validated.`);
+	/** Members see only their own records: anything else is "not found", never "forbidden" (no existence oracle). */
+	function visible(row, mine) {
+		if (row === null || isManager(actor)) return row;
+		return mine(row) ? row : null;
 	}
-	if (projects.length === 0) return deny("no_projects");
-	const { limits, warnings: limitWarnings } = effectiveLimits(settings.limits, ws.limits, gp.limits);
-	warnings.push(...limitWarnings);
-	const known = settings.tools;
-	const workspaceTools = ws.enabledTools ?? [...known.keys()].filter((n) => known.get(n)?.kind === "read");
-	const unknown = [...ws.enabledTools ?? [], ...gp.tools ?? []].filter((n) => !known.has(n));
-	if (unknown.length > 0) warnings.push(`Unknown tools ignored: ${[...new Set(unknown)].join(", ")}.`);
-	const notEnabled = (gp.tools ?? []).filter((n) => known.has(n) && !workspaceTools.includes(n));
-	if (notEnabled.length > 0) warnings.push(`The grant names tools the workspace does not enable: ${notEnabled.join(", ")}.`);
-	const writesPossible = settings.writesEnabled && ws.writePolicy.enabled === true && kind === "personal" && (principal.kind === "device_token" || principal.writeScope);
-	const tools = [];
-	const writeTools = [];
-	for (const name of workspaceTools) {
-		const info = known.get(name);
-		if (info === void 0) continue;
-		if (gp.tools !== null && !gp.tools.includes(name)) continue;
-		if (!limits.genericQuery && info.group === "query") continue;
-		if (info.kind !== "read") {
-			if (!(ws.enabledTools?.includes(name) === true && gp.tools?.includes(name) === true) || !writesPossible) {
-				if (gp.tools?.includes(name)) warnings.push(kind === "shared" ? `${name} needs the user's own credential: shared credentials are read-only.` : `${name} is a write tool and writes are not enabled for this request.`);
-				continue;
-			}
-			writeTools.push(name);
-		}
-		tools.push(name);
+	async function activeOwners() {
+		return (await storage.users.list()).filter((u) => u.role === "owner" && u.disabledAt === null);
 	}
-	if (tools.length === 0) return deny("no_tools");
-	const ends = [principal.kind === "device_token" ? principal.token.expiresAt : principal.expiresAt, grant.expiresAt].filter((t) => t !== null);
-	const assetTypes = effectiveAssetTypes(ws.assetTypes, gp.assetTypes);
-	return {
-		ok: true,
-		access: Object.freeze({
-			workspace: {
-				id: workspace.id,
-				slug: workspace.slug,
-				name: workspace.name
-			},
-			instance: {
-				id: instance.id,
-				baseUrl: instance.baseUrl,
-				tls: instance.tls
-			},
-			grant: {
-				id: grant.id,
-				userId: grant.userId,
-				label: grant.label
-			},
-			tokenId: principal.kind === "device_token" ? principal.token.id : null,
-			credential: {
-				id: credential.id,
-				kind,
-				sealed: {
-					tokenCiphertext: credential.tokenCiphertext,
-					tokenIv: credential.tokenIv,
-					keyVersion: credential.keyVersion
-				}
-			},
-			tools: Object.freeze(tools),
-			writeTools: Object.freeze(writeTools),
-			projects: {
-				allowed: Object.freeze([...projects]),
-				includeChildren: ws.includeChildScopes
-			},
-			assetTypes,
-			limits,
-			rateLimit: gp.rateLimit,
-			expiresAt: ends.length === 0 ? null : Math.min(...ends),
-			warnings: Object.freeze(warnings)
-		})
+	const users = {
+		async list() {
+			if (isManager(actor)) return storage.users.list();
+			const me = self === null ? null : await storage.users.get(self);
+			return me === null ? [] : [me];
+		},
+		async get(id) {
+			return visible(await storage.users.get(id), (u) => u.id === self);
+		},
+		async create(input) {
+			needManager(actor);
+			if (input.role !== "member") needOwner(actor, "create owners or admins");
+			return services.users.create(input);
+		},
+		async update(id, patch) {
+			needManager(actor);
+			const target = await load(storage.users.get(id), "user");
+			if (target.role !== "member" || patch.role !== void 0 && patch.role !== "member") needOwner(actor, "change owners, admins or roles above member");
+			if (target.role === "owner" && patch.role !== void 0 && patch.role !== "owner") need((await activeOwners()).filter((u) => u.id !== id).length > 0, "The last active owner cannot lose the owner role.");
+			return services.users.update(id, patch);
+		},
+		async disable(id) {
+			needManager(actor);
+			const target = await load(storage.users.get(id), "user");
+			if (target.role !== "member") needOwner(actor, "disable owners or admins");
+			if (target.role === "owner") need((await activeOwners()).filter((u) => u.id !== id).length > 0, "The last active owner cannot be disabled.");
+			return services.users.disable(id);
+		}
 	};
-}
-/**
-* Access on a pass-through workspace (P2-14, D-04): the caller authenticated with its own Agility token, already
-* validated against the workspace's instance and known here only by its HMAC fingerprint. Every workspace control
-* applies unchanged (projects, asset types, tools, limits); there is no grant, so nothing can widen or narrow them, and
-* write tools are never granted (read-only in 1.0).
-*/
-function resolvePassthroughAccess(slug, records, fingerprint, settings) {
-	const { workspace, instance } = records;
-	if (workspace === null || workspace.slug !== slug) return deny("wrong_workspace");
-	if (workspace.credentialSource !== "passthrough") return deny("not_passthrough");
-	if (workspace.disabledAt !== null) return deny("workspace_disabled");
-	if (instance === null || instance.id !== workspace.instanceId) return deny("instance_missing");
-	if (instance.disabledAt !== null) return deny("instance_disabled");
-	const ws = parseWorkspace(workspace);
-	if (ws === null) return deny("malformed_policy");
-	const { limits } = effectiveLimits(settings.limits, ws.limits, {});
-	const known = settings.tools;
-	const tools = (ws.enabledTools ?? [...known.keys()]).filter((name) => {
-		const info = known.get(name);
-		return info !== void 0 && info.kind === "read" && (limits.genericQuery || info.group !== "query");
-	});
-	if (tools.length === 0) return deny("no_tools");
-	const id = fingerprint.slice(0, 32);
-	return {
-		ok: true,
-		access: Object.freeze({
-			workspace: {
-				id: workspace.id,
-				slug: workspace.slug,
-				name: workspace.name
-			},
-			instance: {
-				id: instance.id,
-				baseUrl: instance.baseUrl,
-				tls: instance.tls
-			},
-			grant: {
-				id: `passthrough:${id}`,
-				userId: null,
-				label: "pass-through"
-			},
-			tokenId: `pt:${id}`,
-			credential: {
-				id: `pt:${id}`,
-				kind: "personal",
-				sealed: null
-			},
-			tools: Object.freeze(tools),
-			writeTools: Object.freeze([]),
-			projects: {
-				allowed: Object.freeze([...ws.allowedScopeIds]),
-				includeChildren: ws.includeChildScopes
-			},
-			assetTypes: effectiveAssetTypes(ws.assetTypes, null),
-			limits,
-			rateLimit: null,
-			expiresAt: null,
-			warnings: Object.freeze([])
-		})
+	const instances = {
+		list: () => storage.instances.list(),
+		get: (id) => storage.instances.get(id),
+		async create(input) {
+			needManager(actor);
+			return services.instances.create(input);
+		},
+		async update(id, patch) {
+			needManager(actor);
+			return services.instances.update(id, patch);
+		},
+		/** THREAT_MODEL A14: owner only, with a recent sign-in. */
+		async retarget(id, target) {
+			needOwner(actor, "change an instance's origin or TLS trust");
+			need(actor.kind === "break_glass" || actor.recentAuth, "Sign in again before changing an instance origin.");
+			return services.instances.retarget(id, target);
+		},
+		async delete(id) {
+			needManager(actor);
+			await storage.instances.delete(id);
+		}
 	};
-}
-//#endregion
-//#region ../../packages/auth/src/secrets/keyring.ts
-/** Fixed purpose labels; a key derived for one purpose is useless for another. */
-const KeyPurpose = {
-	/** Agility access tokens of credentials. */
-	Credentials: "credentials",
-	/** Key-check values that detect a wrong master key. */
-	KeyCheck: "key-check",
-	/** Keyed hashes of identities in the audit log (pass-through token fingerprints). */
-	AuditIdentity: "audit-identity",
-	/** Cache entry ids (P8-01). */
-	CacheId: "cache-id",
-	/** Write approval records (P7-01). */
-	Approval: "approval",
-	/** Task records (P8-10). */
-	Task: "task"
-};
-const ENCRYPTION = /* @__PURE__ */ new Set([
-	KeyPurpose.Credentials,
-	KeyPurpose.Approval,
-	KeyPurpose.Task
-]);
-/** A failure of the secrets layer. Messages never contain key material, ciphertext or plaintext. */
-var SecretsError = class extends Error {
-	code;
-	constructor(code, message, options) {
-		super(message, options);
-		this.name = "SecretsError";
-		this.code = code;
-	}
-};
-const KEY_BYTES = 32;
-const IV_BYTES = 12;
-const MASTER_KEY = /^(?:v([1-9][0-9]{0,2}):)?([A-Za-z0-9+/]{43}=)$/;
-const HKDF_SALT = new TextEncoder().encode("agility-bridge/hkdf/v1");
-function toBase64(bytes) {
-	let s = "";
-	for (const b of bytes) s += String.fromCharCode(b);
-	return btoa(s);
-}
-function fromBase64(text) {
-	const s = atob(text);
-	const out = new Uint8Array(s.length);
-	for (let i = 0; i < s.length; i++) out[i] = s.charCodeAt(i);
-	return out;
-}
-function toBase64Url(bytes) {
-	return toBase64(bytes).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
-}
-function fromBase64Url(text) {
-	if (!/^[A-Za-z0-9_-]*$/.test(text)) throw new SecretsError("decrypt_failed", "The sealed value is malformed.");
-	const b64 = text.replaceAll("-", "+").replaceAll("_", "/");
-	return fromBase64(b64 + "=".repeat((4 - b64.length % 4) % 4));
-}
-const hex = (bytes) => [...new Uint8Array(bytes)].map((b) => b.toString(16).padStart(2, "0")).join("");
-/**
-* Parses `v<N>:<base64 of 32 bytes>` (bare base64 is version 1). The error never echoes the input, which is a secret
-* even when malformed.
-*/
-function parseMasterKey(text) {
-	const m = MASTER_KEY.exec(typeof text === "string" ? text.trim() : "");
-	if (m === null) throw new SecretsError("invalid_key", "The master key must be v<N>:<base64 of 32 random bytes> (generate one with `agility-bridge init`).");
-	const bytes = fromBase64(m[2]);
-	if (bytes.length !== KEY_BYTES) throw new SecretsError("invalid_key", "The master key must be 32 bytes.");
-	if (bytes.every((b) => b === bytes[0])) throw new SecretsError("invalid_key", "The master key is not random; generate one with `agility-bridge init`.");
-	return Object.freeze({
-		version: m[1] === void 0 ? 1 : Number(m[1]),
-		bytes
-	});
-}
-/** A new master key, `v<version>:<base64>`, from the platform CSPRNG. */
-function generateMasterKey(version = 1) {
-	if (!Number.isInteger(version) || version < 1 || version > 999) throw new SecretsError("invalid_key", "Key versions are 1-999.");
-	return `v${version}:${toBase64(crypto.getRandomValues(new Uint8Array(KEY_BYTES)))}`;
-}
-const additionalData = (context, version) => new TextEncoder().encode(`${context}|${version}`);
-/**
-* The current master key and, during a rotation, the previous one. Purpose keys are derived once per version and kept
-* as non-extractable `CryptoKey`s (per process, never request data).
-*/
-var Keyring = class Keyring {
-	currentVersion;
-	versions;
-	#roots;
-	#derived = /* @__PURE__ */ new Map();
-	constructor(currentVersion, roots) {
-		this.currentVersion = currentVersion;
-		this.#roots = roots;
-		this.versions = Object.freeze([...roots.keys()].sort((a, b) => a - b));
-	}
-	/** Builds a keyring from the current master key and, during a rotation, the previous one (a lower version). */
-	static async create(current, previous) {
-		const cur = parseMasterKey(current);
-		const roots = /* @__PURE__ */ new Map();
-		const importRoot = (bytes) => crypto.subtle.importKey("raw", bytes, "HKDF", false, ["deriveKey"]);
-		roots.set(cur.version, await importRoot(cur.bytes));
-		if (previous !== void 0) {
-			const prev = parseMasterKey(previous);
-			if (prev.version >= cur.version) throw new SecretsError("invalid_key", `The previous master key (version ${prev.version}) must have a lower version than the current one (version ${cur.version}).`);
-			if (prev.bytes.every((b, i) => b === cur.bytes[i])) throw new SecretsError("invalid_key", "The previous and current master keys are the same key.");
-			roots.set(prev.version, await importRoot(prev.bytes));
+	const mineCredential = (c) => c.ownerUserId !== null && c.ownerUserId === self;
+	const credentials = {
+		async list(filter = {}) {
+			if (isManager(actor)) return storage.credentials.list(filter);
+			if (self === null) return [];
+			return storage.credentials.list({
+				...filter,
+				ownerUserId: self
+			});
+		},
+		async get(id) {
+			return visible(await storage.credentials.get(id), mineCredential);
+		},
+		/** Shared: owners and admins. Personal: only the user themselves (nobody stores a token for someone else). */
+		async create(input) {
+			if (input.ownerUserId === null) needManager(actor);
+			else need(input.ownerUserId === self, "Only the user themselves can store their personal Agility token.");
+			return services.credentials.create(input);
+		},
+		async replaceToken(id, token) {
+			const c = await load(storage.credentials.get(id), "credential");
+			if (c.ownerUserId === null) needManager(actor);
+			else if (!mineCredential(c)) throw new NotFoundError("No credential with this id.");
+			return services.credentials.replaceToken(id, token);
+		},
+		async update(id, patch) {
+			const c = await load(storage.credentials.get(id), "credential");
+			if (!mineCredential(c) && !isManager(actor)) throw new NotFoundError("No credential with this id.");
+			return services.credentials.update(id, patch);
+		},
+		async validate(id) {
+			const c = await load(storage.credentials.get(id), "credential");
+			if (!mineCredential(c) && !isManager(actor)) throw new NotFoundError("No credential with this id.");
+			return services.credentials.validate(id);
+		},
+		async revoke(id) {
+			const c = await load(storage.credentials.get(id), "credential");
+			if (!mineCredential(c)) {
+				if (!isManager(actor)) throw new NotFoundError("No credential with this id.");
+			}
+			return services.credentials.revoke(id);
+		},
+		async delete(id) {
+			needManager(actor);
+			await storage.credentials.delete(id);
 		}
-		return new Keyring(cur.version, roots);
-	}
-	has(version) {
-		return this.#roots.has(version);
-	}
-	#key(purpose, version) {
-		const root = this.#roots.get(version);
-		if (root === void 0) return Promise.reject(new SecretsError("key_unavailable", `Master key version ${version} is not loaded (AB_MASTER_KEY_PREVIOUS?).`));
-		const id = `${version}/${purpose}`;
-		let key = this.#derived.get(id);
-		if (key === void 0) {
-			const info = new TextEncoder().encode(`agility-bridge/${purpose}/v${version}`);
-			const algorithm = {
-				name: "HKDF",
-				hash: "SHA-256",
-				salt: HKDF_SALT,
-				info
-			};
-			key = ENCRYPTION.has(purpose) ? crypto.subtle.deriveKey(algorithm, root, {
-				name: "AES-GCM",
-				length: 256
-			}, false, ["encrypt", "decrypt"]) : crypto.subtle.deriveKey(algorithm, root, {
-				name: "HMAC",
-				hash: "SHA-256",
-				length: 256
-			}, false, ["sign"]);
-			this.#derived.set(id, key);
+	};
+	const checkWorkspaceWrites = (input) => {
+		if (input.writePolicy !== void 0) needOwner(actor, "change write settings");
+		if (input.credentialSource === "passthrough") needOwner(actor, "make a workspace pass-through");
+		if (writeTools(input.enabledTools).length > 0) needOwner(actor, "enable write tools");
+	};
+	const workspaces = {
+		async list() {
+			needManager(actor);
+			return storage.workspaces.list();
+		},
+		async get(id) {
+			needManager(actor);
+			return storage.workspaces.get(id);
+		},
+		async create(input) {
+			needManager(actor);
+			checkWorkspaceWrites(input);
+			return services.workspaces.create(input);
+		},
+		async update(id, patch) {
+			needManager(actor);
+			checkWorkspaceWrites(patch);
+			return services.workspaces.update(id, patch);
+		},
+		async disable(id) {
+			needManager(actor);
+			return services.workspaces.disable(id);
+		},
+		async delete(id) {
+			needManager(actor);
+			await services.workspaces.delete(id);
 		}
-		return key;
-	}
-	/** Encrypts with the current key; `context` (a record id) and the version are bound as additional data. */
-	async seal(purpose, context, plaintext) {
-		if (!ENCRYPTION.has(purpose)) throw new TypeError(`${purpose} is not an encryption purpose.`);
-		const version = this.currentVersion;
-		const key = await this.#key(purpose, version);
-		const iv = crypto.getRandomValues(new Uint8Array(IV_BYTES));
-		const data = await crypto.subtle.encrypt({
-			name: "AES-GCM",
-			iv,
-			additionalData: additionalData(context, version),
-			tagLength: 128
-		}, key, new TextEncoder().encode(plaintext));
-		return Object.freeze({
-			ciphertext: toBase64Url(new Uint8Array(data)),
-			iv: toBase64Url(iv),
-			keyVersion: version
-		});
-	}
-	/** Decrypts a sealed value; a wrong key, context or version, or any tampering, fails with `decrypt_failed`. */
-	async open(purpose, context, sealed) {
-		if (!ENCRYPTION.has(purpose)) throw new TypeError(`${purpose} is not an encryption purpose.`);
-		const key = await this.#key(purpose, sealed.keyVersion);
-		const iv = fromBase64Url(sealed.iv);
-		if (iv.length !== IV_BYTES) throw new SecretsError("decrypt_failed", "The sealed value is malformed.");
-		try {
-			const data = await crypto.subtle.decrypt({
-				name: "AES-GCM",
-				iv,
-				additionalData: additionalData(context, sealed.keyVersion),
-				tagLength: 128
-			}, key, fromBase64Url(sealed.ciphertext));
-			return new TextDecoder("utf-8", { fatal: true }).decode(data);
-		} catch (error) {
-			throw new SecretsError("decrypt_failed", "The sealed value could not be decrypted with this master key.", { cause: error });
+	};
+	const mineGrant = (g) => g.userId !== null && g.userId === self;
+	const grants = {
+		async list(filter = {}) {
+			if (isManager(actor)) return storage.grants.list(filter);
+			if (self === null) return [];
+			return storage.grants.list({
+				...filter,
+				userId: self
+			});
+		},
+		async get(id) {
+			return visible(await storage.grants.get(id), mineGrant);
+		},
+		async create(input) {
+			needManager(actor);
+			if (writeTools(input.tools).length > 0) needOwner(actor, "grant write tools");
+			return services.grants.create(input);
+		},
+		async update(id, patch) {
+			needManager(actor);
+			if (writeTools(patch.tools).length > 0) needOwner(actor, "grant write tools");
+			const current = await load(storage.grants.get(id), "grant");
+			if (patch.credentialId !== void 0 && patch.credentialId !== current.credentialId) await needCredentialOwner(patch.credentialId, "put a grant on someone's personal Agility token");
+			return services.grants.update(id, patch);
+		},
+		async revoke(id) {
+			needManager(actor);
+			return services.grants.revoke(id);
+		},
+		async delete(id) {
+			needManager(actor);
+			await services.grants.delete(id);
 		}
+	};
+	/** Members manage the tokens of their own grants; owners and admins every token. */
+	async function ownGrant(grantId) {
+		const g = await load(storage.grants.get(grantId), "grant");
+		if (!isManager(actor) && !mineGrant(g)) throw new NotFoundError("No grant with this id.");
+		return g;
 	}
-	/** HMAC-SHA-256 (hex) with the purpose key of `version` (default current). */
-	async mac(purpose, data, version = this.currentVersion) {
-		if (ENCRYPTION.has(purpose)) throw new TypeError(`${purpose} is an encryption purpose.`);
-		const key = await this.#key(purpose, version);
-		return hex(await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(data)));
-	}
-	/** The key-check value of a version: proves the key without revealing it. */
-	keyCheckValue(version) {
-		return this.mac(KeyPurpose.KeyCheck, "agility-bridge key check", version);
+	/**
+	* A device token on a grant that uses someone's personal Agility token acts as that person in Agility: only they
+	* may issue one (P2-17 review M2). Grants on shared credentials stay with owners and admins.
+	*/
+	async function needCredentialOwner(credentialId, what) {
+		if (credentialId === null) return;
+		const c = await storage.credentials.get(credentialId);
+		if (c !== null && c.ownerUserId !== null && c.ownerUserId !== self) throw new ForbiddenError(`Only the owner of the personal Agility token can ${what}.`);
 	}
-};
-/** Constant-time comparison of two strings of equal length (false otherwise). */
-function timingSafeEqual(a, b) {
-	if (a.length !== b.length) return false;
-	let diff = 0;
-	for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-	return diff === 0;
+	return Object.freeze({
+		actor,
+		users,
+		instances,
+		credentials,
+		workspaces,
+		grants,
+		tokens: {
+			async list(grantId) {
+				await ownGrant(grantId);
+				return services.tokens.list(grantId);
+			},
+			async issue(input) {
+				await needCredentialOwner((await ownGrant(input.grantId)).credentialId, "issue device tokens on this grant");
+				return services.tokens.issue(input);
+			},
+			async revoke(id) {
+				await ownGrant((await load(storage.accessTokens.get(id), "token")).grantId);
+				return services.tokens.revoke(id);
+			}
+		},
+		keys: {
+			async status() {
+				needOwner(actor, "see the master-key versions");
+				if (ctx.keyring === void 0) throw new ForbiddenError("Master-key operations are not available here.");
+				return keyStatus(storage, ctx.keyring);
+			},
+			async retire(version, reason) {
+				needOwner(actor, "retire a master-key version");
+				need(actor.kind === "break_glass" || actor.recentAuth, "Sign in again before retiring a master-key version.");
+				if (ctx.keyring === void 0) throw new ForbiddenError("Master-key operations are not available here.");
+				await retireKeyVersion(storage, ctx.keyring, version, {
+					reason,
+					record: false
+				});
+				return keyStatus(storage, ctx.keyring);
+			}
+		}
+	});
 }
 //#endregion
-//#region ../../packages/auth/src/secrets/credentials.ts
-const KCV_KEY = (version) => `crypto:kcv:v${version}`;
-const RETIRED_KEY = (version) => `crypto:retired:v${version}`;
-/** At most the last 4 characters, and nothing for short values. */
-function tokenHint(token) {
-	return token.length >= 16 ? token.slice(-4) : "";
-}
-/** Seals an Agility access token for the credential `credentialId` (additional data: `id | key version`). */
-async function sealCredentialToken(keyring, credentialId, token) {
-	if (typeof token !== "string" || token.length === 0) throw new TypeError("An access token is required.");
-	const sealed = await keyring.seal(KeyPurpose.Credentials, credentialId, token);
-	return {
-		tokenCiphertext: sealed.ciphertext,
-		tokenIv: sealed.iv,
-		keyVersion: sealed.keyVersion,
-		tokenHint: tokenHint(token)
-	};
-}
-const toSealed = (c) => ({
-	ciphertext: c.tokenCiphertext,
-	iv: c.tokenIv,
-	keyVersion: c.keyVersion
+//#region ../../packages/auth/src/access/policy.ts
+const SCOPE_OID = /^Scope:\d{1,12}$/;
+const TYPE_NAME = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
+const TOOL_NAME = /^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$/;
+const scopeIds = z.array(z.string().regex(SCOPE_OID)).max(1e3);
+const toolNames = z.array(z.string().regex(TOOL_NAME).max(64)).max(200);
+const typeNames = z.array(z.string().regex(TYPE_NAME)).max(500);
+const assetTypePolicySchema = z.strictObject({
+	/** Only these types (absent = every type the instance exposes). */
+	allow: typeNames.optional(),
+	deny: typeNames.optional()
 });
-/** Decrypts a credential's token. Swapping ciphertexts between credentials or versions fails (`decrypt_failed`). */
-function openCredentialToken(keyring, credential) {
-	return keyring.open(KeyPurpose.Credentials, credential.id, toSealed(credential));
-}
+/** Numeric limits with their hard bounds, and feature switches (tool conventions, ADR-0010). */
+const limitsPolicySchema = z.strictObject({
+	defaultRows: z.number().int().min(1).max(1e3).optional(),
+	maxRows: z.number().int().min(1).max(1e3).optional(),
+	maxFields: z.number().int().min(1).max(200).optional(),
+	maxNestingDepth: z.number().int().min(0).max(5).optional(),
+	maxAggregations: z.number().int().min(0).max(50).optional(),
+	maxAnyOfGroups: z.number().int().min(0).max(20).optional(),
+	maxResponseBytes: z.number().int().min(65536).max(67108864).optional(),
+	maxAsOfAgeDays: z.number().int().min(0).max(3650).optional(),
+	maxTimeRangeDays: z.number().int().min(1).max(3660).optional(),
+	/** Agility requests per tool call (ADR-0010). */
+	callBudget: z.number().int().min(1).max(1e4).optional(),
+	/** Member emails in output (D-06). */
+	memberEmails: z.boolean().optional(),
+	/** The generic `query_assets` / `get_assets` tools. */
+	genericQuery: z.boolean().optional()
+});
+/** Writes per workspace (ADR-0013); write tools also need the server switch and an explicit listing (Phase 7). */
+const writePolicySchema = z.strictObject({ enabled: z.boolean().optional() });
+/** Per-grant rate limit (P2-07). */
+const rateLimitPolicySchema = z.strictObject({ perMinute: z.number().int().min(1).max(1e5).optional() });
+const workspacePolicySchema = z.strictObject({
+	allowedScopeIds: scopeIds.min(1),
+	includeChildScopes: z.boolean(),
+	assetTypes: assetTypePolicySchema.nullable(),
+	enabledTools: toolNames.nullable(),
+	limits: limitsPolicySchema,
+	writePolicy: writePolicySchema
+});
+const grantPolicySchema = z.strictObject({
+	tools: toolNames.nullable(),
+	scopeIds: scopeIds.min(1).nullable(),
+	assetTypes: assetTypePolicySchema.nullable(),
+	limits: limitsPolicySchema,
+	rateLimit: rateLimitPolicySchema.nullable()
+});
+/** The numbers and switches of `limitsPolicySchema` and how a grant tightens each. */
+const NUMBER_LIMITS = [
+	"defaultRows",
+	"maxRows",
+	"maxFields",
+	"maxNestingDepth",
+	"maxAggregations",
+	"maxAnyOfGroups",
+	"maxResponseBytes",
+	"maxAsOfAgeDays",
+	"maxTimeRangeDays",
+	"callBudget"
+];
+const SWITCHES = ["memberEmails", "genericQuery"];
 /**
-* Boot check: every loaded version's key-check value must match the one recorded the first time that version was
-* used, so a wrong key is refused before it decrypts (or seals) anything, and a version number is never reused for
-* other key material. The current version must not be retired.
+* Workspace limits over the deployment defaults (capped by its ceilings), tightened by the grant: numbers take the
+* minimum, switches stay on only when both allow them. `warnings` name grant values that tried to loosen a limit.
 */
-async function verifyKeyring(storage, keyring) {
+function effectiveLimits(deployment, workspace, grant) {
 	const warnings = [];
-	for (const version of keyring.versions) {
-		const kcv = await keyring.keyCheckValue(version);
-		if (!await storage.kv.setIfAbsent(KCV_KEY(version), kcv)) {
-			const recorded = await storage.kv.get(KCV_KEY(version));
-			if (recorded === null || !timingSafeEqual(recorded, kcv)) throw new SecretsError("wrong_key", `Master key version ${version} is not the key this database was encrypted with. Use the original key; a version number can never be reused for a different key.`);
+	const out = { ...deployment.defaults };
+	for (const key of NUMBER_LIMITS) {
+		let value = workspace[key] ?? deployment.defaults[key];
+		const ceiling = deployment.ceilings[key];
+		if (ceiling !== void 0) value = Math.min(value, ceiling);
+		const g = grant[key];
+		if (g !== void 0) {
+			if (g > value) warnings.push(`The grant's ${key} (${g}) is above the workspace's (${value}); ${value} applies.`);
+			value = Math.min(value, g);
 		}
+		out[key] = value;
 	}
-	if (await storage.kv.get(RETIRED_KEY(keyring.currentVersion)) !== null) throw new SecretsError("retired", `Master key version ${keyring.currentVersion} was retired; use a newer key.`);
-	for (const version of keyring.versions) if (version !== keyring.currentVersion && await storage.kv.get(RETIRED_KEY(version)) !== null) warnings.push(`Master key version ${version} is retired; remove AB_MASTER_KEY_PREVIOUS.`);
-	const stranded = (await keyStatus(storage, keyring)).filter((v) => !v.loaded && v.credentials > 0);
-	for (const v of stranded) warnings.push(`${v.credentials} credential(s) use master key version ${v.version}, which is not loaded; they cannot be used until that key is provided (as AB_MASTER_KEY_PREVIOUS for a rotation) or their tokens are entered again.`);
-	return { warnings };
-}
-/** Credentials per key version, and which versions are loaded, current or retired. */
-async function keyStatus(storage, keyring) {
-	const counts = /* @__PURE__ */ new Map();
-	for (const c of await storage.credentials.list()) counts.set(c.keyVersion, (counts.get(c.keyVersion) ?? 0) + 1);
-	for (const v of keyring.versions) if (!counts.has(v)) counts.set(v, 0);
-	const out = [];
-	for (const [version, credentials] of [...counts].sort((a, b) => a[0] - b[0])) out.push({
-		version,
-		credentials,
-		loaded: keyring.has(version),
-		current: version === keyring.currentVersion,
-		retired: await storage.kv.get(RETIRED_KEY(version)) !== null
-	});
-	return out;
+	for (const key of SWITCHES) {
+		const ws = workspace[key] ?? deployment.defaults[key];
+		const g = grant[key];
+		if (g === true && !ws) warnings.push(`The grant turns ${key} on, but the workspace has it off.`);
+		out[key] = ws && g !== false;
+	}
+	out["defaultRows"] = Math.min(out["defaultRows"], out["maxRows"]);
+	return {
+		limits: Object.freeze(out),
+		warnings
+	};
 }
-/**
-* Re-encrypts every credential still on an older loaded version with the current key. Each row is replaced only if it
-* still holds the ciphertext that was decrypted (compare-and-swap), so concurrent edits and interrupted runs are safe:
-* run it again to resume.
-*/
-async function rotateCredentialKeys(storage, keyring, options) {
-	const reason = String(options.reason ?? "").slice(0, 200);
-	if (reason.length === 0) throw new TypeError("A rotation reason is required for the audit log.");
-	const batchSize = Math.max(1, Math.min(options.batchSize ?? 100, 1e3));
-	const now = options.now ?? Date.now;
-	const result = {
-		rotated: 0,
-		skipped: 0,
-		failed: [],
-		remaining: 0
+/** Allow lists intersect (absent = no restriction), deny lists union. */
+function effectiveAssetTypes(workspace, grant) {
+	const wa = workspace?.allow;
+	const ga = grant?.allow;
+	const allow = wa === void 0 ? ga : ga === void 0 ? wa : wa.filter((t) => ga.includes(t));
+	const deny = [.../* @__PURE__ */ new Set([...workspace?.deny ?? [], ...grant?.deny ?? []])];
+	return allow === void 0 ? { deny } : {
+		allow: [...new Set(allow)],
+		deny
 	};
-	const doneWith = /* @__PURE__ */ new Set();
-	const details = (from) => ({
-		fromVersion: from,
-		toVersion: keyring.currentVersion,
-		reason,
-		...options.actor?.via !== void 0 ? { via: options.actor.via } : {}
-	});
-	for (let batch = 0; options.maxBatches === void 0 || batch < options.maxBatches; batch++) {
-		const pending = (await storage.credentials.list()).filter((c) => c.keyVersion !== keyring.currentVersion && !doneWith.has(c.id)).slice(0, batchSize);
-		if (pending.length === 0) break;
-		for (const c of pending) {
-			const expected = {
-				tokenCiphertext: c.tokenCiphertext,
-				tokenIv: c.tokenIv,
-				keyVersion: c.keyVersion
-			};
-			let token;
-			try {
-				token = await openCredentialToken(keyring, c);
-			} catch (error) {
-				const reasonCode = error instanceof SecretsError && error.code === "key_unavailable" ? error.code : "decrypt_failed";
-				doneWith.add(c.id);
-				result.failed.push({
-					id: c.id,
-					keyVersion: c.keyVersion,
-					reason: reasonCode
-				});
-				await storage.audit.append({
-					id: crypto.randomUUID(),
-					ts: now(),
-					kind: "admin",
-					action: "credential.rekey",
-					status: "error",
-					errorCode: reasonCode,
-					userId: options.actor?.userId ?? null,
-					instanceId: c.instanceId,
-					targetType: "credential",
-					targetId: c.id,
-					details: details(c.keyVersion)
-				});
+}
+//#endregion
+//#region ../../packages/auth/src/access/resolve.ts
+const deny = (reason) => ({
+	ok: false,
+	reason
+});
+const expired = (at, now) => at !== null && at <= now;
+function parseWorkspace(w) {
+	const r = workspacePolicySchema.safeParse({
+		allowedScopeIds: w.allowedScopeIds,
+		includeChildScopes: w.includeChildScopes,
+		assetTypes: w.assetTypes,
+		enabledTools: w.enabledTools,
+		limits: w.limits,
+		writePolicy: w.writePolicy
+	});
+	return r.success ? r.data : null;
+}
+function parseGrant(g) {
+	const r = grantPolicySchema.safeParse({
+		tools: g.tools,
+		scopeIds: g.scopeIds,
+		assetTypes: g.assetTypes,
+		limits: g.limits,
+		rateLimit: g.rateLimit
+	});
+	return r.success ? r.data : null;
+}
+/**
+* Decides what one request may do in the workspace `slug`. Pure: the same records, settings and time give the same
+* answer, so it can be cached (≤ 60 s, never past `expiresAt`, L-068) and tested exhaustively.
+*/
+function resolveAccess(principal, slug, records, settings, now) {
+	const { grant, workspace, instance, credential, user } = records;
+	if (workspace === null) return deny("workspace_missing");
+	if (workspace.slug !== slug) return deny("wrong_workspace");
+	if (principal.kind === "oauth" && principal.workspaceId !== workspace.id) return deny("wrong_workspace");
+	if (principal.kind === "device_token") {
+		if (principal.token.revokedAt !== null) return deny("token_revoked");
+		if (expired(principal.token.expiresAt, now)) return deny("token_expired");
+	} else if (expired(principal.expiresAt, now)) return deny("token_expired");
+	if (grant === null) return deny("grant_missing");
+	const grantId = principal.kind === "device_token" ? principal.token.grantId : principal.grantId;
+	if (grant.id !== grantId || grant.workspaceId !== workspace.id) return deny("grant_missing");
+	if (grant.revokedAt !== null) return deny("grant_revoked");
+	if (expired(grant.expiresAt, now)) return deny("grant_expired");
+	if (workspace.disabledAt !== null) return deny("workspace_disabled");
+	if (instance === null || instance.id !== workspace.instanceId) return deny("instance_missing");
+	if (instance.disabledAt !== null) return deny("instance_disabled");
+	if (grant.userId !== null) {
+		if (user === null || user.id !== grant.userId) return deny("user_missing");
+		if (user.disabledAt !== null) return deny("user_disabled");
+	}
+	const credentialId = grant.credentialId ?? workspace.defaultCredentialId;
+	if (credentialId === null || credential === null || credential.id !== credentialId) return deny("credential_missing");
+	if (credential.revokedAt !== null) return deny("credential_revoked");
+	if (credential.validationStatus !== "valid") return deny("credential_unvalidated");
+	if (credential.instanceId !== workspace.instanceId) return deny("credential_mismatch");
+	const kind = credential.ownerUserId === null ? "shared" : "personal";
+	if (kind === "personal" && (grant.userId === null || credential.ownerUserId !== grant.userId)) return deny("credential_mismatch");
+	if (grant.credentialId === null && kind !== "shared") return deny("credential_mismatch");
+	const ws = parseWorkspace(workspace);
+	const gp = parseGrant(grant);
+	if (ws === null || gp === null) return deny("malformed_policy");
+	const warnings = [];
+	let projects = ws.allowedScopeIds;
+	if (gp.scopeIds !== null) {
+		const outside = gp.scopeIds.filter((s) => !ws.allowedScopeIds.includes(s));
+		if (outside.length > 0) warnings.push(`The grant names projects outside the workspace: ${outside.join(", ")}.`);
+		projects = ws.allowedScopeIds.filter((s) => gp.scopeIds.includes(s));
+	}
+	if (credential.reachableScopeIds !== null) {
+		const unreachable = projects.filter((s) => !credential.reachableScopeIds.includes(s));
+		if (unreachable.length > 0) warnings.push(`The credential's member could not see ${unreachable.join(", ")} when it was last validated.`);
+	}
+	if (projects.length === 0) return deny("no_projects");
+	const { limits, warnings: limitWarnings } = effectiveLimits(settings.limits, ws.limits, gp.limits);
+	warnings.push(...limitWarnings);
+	const known = settings.tools;
+	const workspaceTools = ws.enabledTools ?? [...known.keys()].filter((n) => known.get(n)?.kind === "read");
+	const unknown = [...ws.enabledTools ?? [], ...gp.tools ?? []].filter((n) => !known.has(n));
+	if (unknown.length > 0) warnings.push(`Unknown tools ignored: ${[...new Set(unknown)].join(", ")}.`);
+	const notEnabled = (gp.tools ?? []).filter((n) => known.has(n) && !workspaceTools.includes(n));
+	if (notEnabled.length > 0) warnings.push(`The grant names tools the workspace does not enable: ${notEnabled.join(", ")}.`);
+	const writesPossible = settings.writesEnabled && ws.writePolicy.enabled === true && kind === "personal" && (principal.kind === "device_token" || principal.writeScope);
+	const tools = [];
+	const writeTools = [];
+	for (const name of workspaceTools) {
+		const info = known.get(name);
+		if (info === void 0) continue;
+		if (gp.tools !== null && !gp.tools.includes(name)) continue;
+		if (!limits.genericQuery && info.group === "query") continue;
+		if (info.kind !== "read") {
+			if (!(ws.enabledTools?.includes(name) === true && gp.tools?.includes(name) === true) || !writesPossible) {
+				if (gp.tools?.includes(name)) warnings.push(kind === "shared" ? `${name} needs the user's own credential: shared credentials are read-only.` : `${name} is a write tool and writes are not enabled for this request.`);
 				continue;
 			}
-			const sealed = await sealCredentialToken(keyring, c.id, token);
-			const next = {
-				tokenCiphertext: sealed.tokenCiphertext,
-				tokenIv: sealed.tokenIv,
-				keyVersion: sealed.keyVersion
-			};
-			if (await storage.credentials.replaceSecret(c.id, expected, next)) {
-				result.rotated++;
-				await storage.audit.append({
-					id: crypto.randomUUID(),
-					ts: now(),
-					kind: "admin",
-					action: "credential.rekey",
-					status: "ok",
-					userId: options.actor?.userId ?? null,
-					instanceId: c.instanceId,
-					targetType: "credential",
-					targetId: c.id,
-					details: details(c.keyVersion)
-				});
-			} else {
-				doneWith.add(c.id);
-				result.skipped++;
-			}
+			writeTools.push(name);
 		}
+		tools.push(name);
 	}
-	result.remaining = (await storage.credentials.list()).filter((c) => c.keyVersion !== keyring.currentVersion).length;
-	return result;
+	if (tools.length === 0) return deny("no_tools");
+	const ends = [principal.kind === "device_token" ? principal.token.expiresAt : principal.expiresAt, grant.expiresAt].filter((t) => t !== null);
+	const assetTypes = effectiveAssetTypes(ws.assetTypes, gp.assetTypes);
+	return {
+		ok: true,
+		access: Object.freeze({
+			workspace: {
+				id: workspace.id,
+				slug: workspace.slug,
+				name: workspace.name
+			},
+			instance: {
+				id: instance.id,
+				baseUrl: instance.baseUrl,
+				tls: instance.tls
+			},
+			grant: {
+				id: grant.id,
+				userId: grant.userId,
+				label: grant.label
+			},
+			tokenId: principal.kind === "device_token" ? principal.token.id : null,
+			credential: {
+				id: credential.id,
+				kind,
+				sealed: {
+					tokenCiphertext: credential.tokenCiphertext,
+					tokenIv: credential.tokenIv,
+					keyVersion: credential.keyVersion
+				}
+			},
+			tools: Object.freeze(tools),
+			writeTools: Object.freeze(writeTools),
+			projects: {
+				allowed: Object.freeze([...projects]),
+				includeChildren: ws.includeChildScopes
+			},
+			assetTypes,
+			limits,
+			rateLimit: gp.rateLimit,
+			expiresAt: ends.length === 0 ? null : Math.min(...ends),
+			warnings: Object.freeze(warnings)
+		})
+	};
 }
 /**
-* Marks a key version as retired once no credential uses it; a retired version is refused as the current key at
-* boot. The previous key can then be removed from the configuration.
+* Access on a pass-through workspace (P2-14, D-04): the caller authenticated with its own Agility token, already
+* validated against the workspace's instance and known here only by its HMAC fingerprint. Every workspace control
+* applies unchanged (projects, asset types, tools, limits); there is no grant, so nothing can widen or narrow them, and
+* write tools are never granted (read-only in 1.0).
 */
-async function retireKeyVersion(storage, keyring, version, options) {
-	if (version === keyring.currentVersion) throw new SecretsError("in_use", `Master key version ${version} is the current key.`);
-	const users = await storage.credentials.list({ keyVersion: version });
-	if (users.length > 0) throw new SecretsError("in_use", `${users.length} credential(s) still use master key version ${version}; rotate them first.`);
-	const now = options.now ?? Date.now;
-	await storage.kv.set(RETIRED_KEY(version), String(now()));
-	await storage.audit.append({
-		id: crypto.randomUUID(),
-		ts: now(),
-		kind: "admin",
-		action: "crypto.retire_key",
-		status: "ok",
-		userId: options.actor?.userId ?? null,
-		targetType: "key_version",
-		targetId: String(version),
-		details: {
-			reason: String(options.reason ?? "").slice(0, 200),
-			...options.actor?.via !== void 0 ? { via: options.actor.via } : {}
-		}
+function resolvePassthroughAccess(slug, records, fingerprint, settings) {
+	const { workspace, instance } = records;
+	if (workspace === null || workspace.slug !== slug) return deny("wrong_workspace");
+	if (workspace.credentialSource !== "passthrough") return deny("not_passthrough");
+	if (workspace.disabledAt !== null) return deny("workspace_disabled");
+	if (instance === null || instance.id !== workspace.instanceId) return deny("instance_missing");
+	if (instance.disabledAt !== null) return deny("instance_disabled");
+	const ws = parseWorkspace(workspace);
+	if (ws === null) return deny("malformed_policy");
+	const { limits } = effectiveLimits(settings.limits, ws.limits, {});
+	const known = settings.tools;
+	const tools = (ws.enabledTools ?? [...known.keys()]).filter((name) => {
+		const info = known.get(name);
+		return info !== void 0 && info.kind === "read" && (limits.genericQuery || info.group !== "query");
 	});
+	if (tools.length === 0) return deny("no_tools");
+	const id = fingerprint.slice(0, 32);
+	return {
+		ok: true,
+		access: Object.freeze({
+			workspace: {
+				id: workspace.id,
+				slug: workspace.slug,
+				name: workspace.name
+			},
+			instance: {
+				id: instance.id,
+				baseUrl: instance.baseUrl,
+				tls: instance.tls
+			},
+			grant: {
+				id: `passthrough:${id}`,
+				userId: null,
+				label: "pass-through"
+			},
+			tokenId: `pt:${id}`,
+			credential: {
+				id: `pt:${id}`,
+				kind: "personal",
+				sealed: null
+			},
+			tools: Object.freeze(tools),
+			writeTools: Object.freeze([]),
+			projects: {
+				allowed: Object.freeze([...ws.allowedScopeIds]),
+				includeChildren: ws.includeChildScopes
+			},
+			assetTypes: effectiveAssetTypes(ws.assetTypes, null),
+			limits,
+			rateLimit: null,
+			expiresAt: null,
+			warnings: Object.freeze([])
+		})
+	};
 }
 //#endregion
 //#region ../../packages/auth/src/tokens/device.ts
@@ -8010,7 +8127,7 @@ async function authenticateDeviceToken(storage, presented, slug, settings, now)
 		reason: "token_malformed"
 	};
 	const hash = await hashDeviceToken(presented);
-	const token = await storage.accessTokens.getByHash(hash);
+	const { token, ...records } = await storage.accessTokens.bundleByHash(hash);
 	if (token === null || !timingSafeEqual(token.tokenHash, hash)) return {
 		ok: false,
 		reason: "token_unknown"
@@ -8018,7 +8135,7 @@ async function authenticateDeviceToken(storage, presented, slug, settings, now)
 	const decision = resolveAccess({
 		kind: "device_token",
 		token
-	}, slug, await loadAccessRecords(storage, token.grantId), settings, now);
+	}, slug, records, settings, now);
 	if (!decision.ok) return decision;
 	try {
 		await storage.accessTokens.touch(token.id, TOUCH_INTERVAL_MS);
@@ -8292,30 +8409,37 @@ function accessServices(options) {
 		const token = await openCredentialToken(keyring, c);
 		return record(id, await options.validator.validate(instance, id, token));
 	}
-	return Object.freeze({
-		users: {
-			async create(input) {
-				const email = typeof input.email === "string" ? input.email.trim().toLowerCase() : input.email;
-				return storage.users.create({
-					...input,
-					id: newId("usr"),
-					email
-				});
-			},
-			async update(id, patch) {
-				const email = typeof patch.email === "string" ? patch.email.trim().toLowerCase() : void 0;
-				return storage.users.update(id, email === void 0 ? patch : {
-					...patch,
-					email
-				});
-			},
-			disable: (id) => storage.users.update(id, { disabledAt: now() })
+	const users = {
+		async create(input) {
+			const email = typeof input.email === "string" ? input.email.trim().toLowerCase() : input.email;
+			return storage.users.create({
+				...input,
+				id: newId("usr"),
+				email
+			});
+		},
+		async update(id, patch) {
+			const email = typeof patch.email === "string" ? patch.email.trim().toLowerCase() : void 0;
+			return storage.users.update(id, email === void 0 ? patch : {
+				...patch,
+				email
+			});
 		},
+		disable: (id) => storage.users.update(id, { disabledAt: now() })
+	};
+	/** Canonical, and allowed by this deployment's policy (P2-19). */
+	const acceptedInstanceUrl = async (input) => {
+		const url = canonicalInstanceUrl(input, { httpLoopback: options.instanceUrls?.httpLoopback ?? true });
+		await options.instanceUrls?.checkHost?.(new URL(url).hostname);
+		return url;
+	};
+	return Object.freeze({
+		users,
 		instances: {
 			async create(input) {
 				let baseUrl;
 				try {
-					baseUrl = canonicalInstanceUrl(input.baseUrl);
+					baseUrl = await acceptedInstanceUrl(input.baseUrl);
 				} catch (error) {
 					throw new InvalidInputError(`baseUrl: ${error.message}`);
 				}
@@ -8352,7 +8476,7 @@ function accessServices(options) {
 				const current = await mustGet(storage.instances.get(id), "instance");
 				let baseUrl;
 				try {
-					baseUrl = canonicalInstanceUrl(target.baseUrl);
+					baseUrl = await acceptedInstanceUrl(target.baseUrl);
 				} catch (error) {
 					throw new InvalidInputError(`baseUrl: ${error.message}`);
 				}
@@ -8434,10 +8558,14 @@ function accessServices(options) {
 			* Revalidates every unrevoked credential last validated before `olderThan` (or never), one at a time. Returns how
 			* many were checked; failures are recorded on the credential, never thrown.
 			*/
-			async revalidate(olderThan) {
+			/**
+			* Revalidates live credentials not validated since `olderThan`, never-validated and oldest first, at most `limit`
+			* (Workers revalidate one per scheduled run: each costs Agility requests, P3-08).
+			*/
+			async revalidate(olderThan, limit = Number.POSITIVE_INFINITY) {
+				const due = (await storage.credentials.list()).filter((c) => c.revokedAt === null && (c.validatedAt === null || c.validatedAt < olderThan)).sort((a, b) => (a.validatedAt ?? -1) - (b.validatedAt ?? -1));
 				let n = 0;
-				for (const c of await storage.credentials.list()) {
-					if (c.revokedAt !== null || c.validatedAt !== null && c.validatedAt >= olderThan) continue;
+				for (const c of due.slice(0, Math.max(0, limit))) {
 					await validateCredential(c.id).catch(() => void 0);
 					n++;
 				}
@@ -10317,6 +10445,9 @@ function toAdminError(error) {
 	} else if (error instanceof UpstreamCheckError) {
 		code = "upstream";
 		message = error.message;
+	} else if (error instanceof SecretsError && error.code === "in_use") {
+		code = "conflict";
+		message = error.message;
 	} else if (error instanceof SecretsError) {
 		code = "unavailable";
 		message = "The server cannot use its master key for this.";
@@ -10563,13 +10694,19 @@ const ERROR_RESPONSES = Object.fromEntries([
 	description: "Error"
 }]));
 function createAdminApi(options) {
-	const api = new OpenAPIHono({ defaultHook: (result, c) => {
-		if (!result.success) {
-			const issue = result.error.issues[0];
-			const field = issue?.path.map(String).join(".") || void 0;
-			return c.json(errorBody("invalid_input", `${field ?? "request"}: ${issue?.message ?? "invalid"}.`, field), 422);
+	const keep = (c, work) => {
+		if (work !== void 0) options.background?.(c, work);
+	};
+	const api = new OpenAPIHono({
+		...options.lightweightRouter === true ? { router: new LinearRouter() } : {},
+		defaultHook: (result, c) => {
+			if (!result.success) {
+				const issue = result.error.issues[0];
+				const field = issue?.path.map(String).join(".") || void 0;
+				return c.json(errorBody("invalid_input", `${field ?? "request"}: ${issue?.message ?? "invalid"}.`, field), 422);
+			}
 		}
-	} });
+	});
 	api.use("*", async (c, next) => {
 		const ip = options.clientIp(c);
 		const now = options.clock.now();
@@ -10579,7 +10716,7 @@ function createAdminApi(options) {
 		if (actor === null) {
 			if (await options.limits?.failuresExhausted?.(ip, now) === true) return c.json(errorBody("rate_limited", "Too many failed attempts."), 429, { "retry-after": "300" });
 			await options.limits?.onAuthFailure?.(ip, now);
-			options.audit.request({
+			keep(c, options.audit.request({
 				requestId: c.get("requestId") ?? "",
 				ip,
 				slug: "(admin)",
@@ -10588,7 +10725,7 @@ function createAdminApi(options) {
 				mcp: null,
 				access: null,
 				refusal: "admin_unauthenticated"
-			});
+			}));
 			return c.json(errorBody("unauthorized", "Authentication required."), 401, { "www-authenticate": "Bearer" });
 		}
 		c.set("actor", actor);
@@ -10615,12 +10752,13 @@ function createAdminApi(options) {
 	});
 	const services = (c) => guardedServices(options.services, {
 		storage: options.storage,
-		tools: options.tools
+		tools: options.tools,
+		...options.keyring === void 0 ? {} : { keyring: options.keyring }
 	}, c.get("actor"));
 	function auditRow(c, spec, status, targetId, extra = {}) {
 		if (spec.audit === void 0) return;
 		const actor = c.get("actor");
-		options.audit.admin({
+		keep(c, options.audit.admin({
 			action: spec.audit.action,
 			status,
 			userId: actor.kind === "user" ? actor.userId : null,
@@ -10632,7 +10770,7 @@ function createAdminApi(options) {
 				actor: actor.kind === "user" ? actor.role : "break_glass",
 				...extra
 			}
-		});
+		}));
 	}
 	function add(spec, handler) {
 		const route = createRoute({
@@ -10669,7 +10807,10 @@ function createAdminApi(options) {
 					query
 				});
 				if (spec.audit !== void 0) {
-					auditRow(c, spec, "ok", id || (result?.record?.id ?? result?.id ?? ""), { fields: Object.keys(body).filter((k) => k !== "token") });
+					auditRow(c, spec, "ok", id || (result?.record?.id ?? result?.id ?? ""), {
+						fields: Object.keys(body).filter((k) => k !== "token"),
+						...Object.fromEntries((spec.auditBody ?? []).map((k) => [k, String(body[k] ?? "").slice(0, 200)]))
+					});
 					options.onChange();
 				}
 				return c.json(result, spec.status ?? 200);
@@ -11124,6 +11265,39 @@ function createAdminApi(options) {
 			} } : {}
 		});
 	});
+	const KeyVersionOut = z$1.object({
+		version: z$1.number(),
+		credentials: z$1.number(),
+		loaded: z$1.boolean(),
+		current: z$1.boolean(),
+		retired: z$1.boolean()
+	}).openapi("KeyVersion");
+	const keys = { tag: "keys" };
+	add({
+		method: "get",
+		path: "/keys",
+		...keys,
+		summary: "Master-key versions: credentials on each, loaded, current, retired (owner)",
+		out: z$1.array(KeyVersionOut)
+	}, (c) => services(c).keys.status());
+	add({
+		method: "post",
+		path: "/keys/{id}/retire",
+		...keys,
+		params: true,
+		summary: "Retire a master-key version no credential uses any more (owner; recorded in the audit log)",
+		body: z$1.object({ reason: z$1.string().min(1).max(200) }),
+		out: z$1.array(KeyVersionOut),
+		audit: {
+			action: "crypto.retire_key",
+			targetType: "key_version"
+		},
+		auditBody: ["reason"]
+	}, (c, { id, body }) => {
+		const version = Number(id);
+		if (!Number.isInteger(version) || version < 1) throw new AdminError("invalid_input", "The key version is a whole number ≥ 1.", "id");
+		return services(c).keys.retire(version, body.reason);
+	});
 	api.openAPIRegistry.registerComponent("securitySchemes", "bearer", {
 		type: "http",
 		scheme: "bearer"
@@ -11384,6 +11558,8 @@ function jsonRpcError(code, message, id = null) {
 	});
 }
 const UNAUTHORIZED = JSON.stringify({ error: "unauthorized" });
+/** Carries the request id into the lazily built admin app (Workers); set by the server, never trusted from clients. */
+const INTERNAL_REQUEST_ID = "x-agility-bridge-internal-request-id";
 /** Pass-through identities kept at most (P2-14). */
 const MAX_IDENTITIES = 1e4;
 /** Ends a streamed body at the deadline. */
@@ -11444,12 +11620,20 @@ function createHttpApp(options) {
 		identities.set(key, until);
 	};
 	const { services } = options;
-	const registry = new ToolRegistry();
-	for (const tool of options.tools) registry.register(tool);
+	const registry = options.registry ?? new ToolRegistry();
+	if (options.registry === void 0) for (const tool of options.tools) registry.register(tool);
 	const clientIp = options.clientIp ?? (() => "unknown");
-	const observe = (kind, event) => {
+	const keepAlive = (c, work) => {
+		const settled = work.catch((error) => {
+			services.logger.warn("background work failed", { error: error.name });
+		});
+		options.background?.(c, settled);
+	};
+	const perRequest = options.isolation === "request";
+	const observe = (c, kind, event) => {
 		try {
-			(options.observer?.[kind])?.(event);
+			const work = (options.observer?.[kind])?.(event);
+			if (work instanceof Promise) keepAlive(c, work);
 		} catch (error) {
 			services.logger.warn("observer failed", {
 				kind,
@@ -11466,7 +11650,7 @@ function createHttpApp(options) {
 			onToolCall: prepared.onToolCall
 		});
 	}, { legacy: "stateless" });
-	const app = new Hono();
+	const app = perRequest ? new Hono({ router: new LinearRouter() }) : new Hono();
 	app.use("*", async (c, next) => {
 		const requestId = services.random.uuid();
 		c.set("requestId", requestId);
@@ -11487,16 +11671,52 @@ function createHttpApp(options) {
 		return c.json({ error: "internal error" }, 500);
 	});
 	app.notFound((c) => c.json({ error: "not found" }, 404));
-	if (options.admin !== void 0) app.route(ADMIN_BASE, createAdminApi({
-		...options.admin,
-		storage: options.storage,
-		tools: options.access.tools,
-		onChange: () => cache.clear(),
-		...options.limits === void 0 ? {} : { limits: options.limits },
-		clientIp,
-		logger: services.logger,
-		clock: services.clock
-	}));
+	if (options.admin !== void 0) {
+		const admin = options.admin;
+		const build = () => createAdminApi({
+			...admin,
+			storage: options.storage,
+			tools: options.access.tools,
+			onChange: () => cache.clear(),
+			...options.limits === void 0 ? {} : { limits: options.limits },
+			clientIp,
+			logger: services.logger,
+			clock: services.clock,
+			background: keepAlive,
+			keyring: options.keyring,
+			...perRequest ? { lightweightRouter: true } : {}
+		});
+		if (!perRequest) app.route(ADMIN_BASE, build());
+		else {
+			let adminApp;
+			app.all(`${ADMIN_BASE}/*`, (c) => {
+				if (adminApp === void 0) {
+					const inner = new Hono({ router: new LinearRouter() });
+					inner.use(async (ic, next) => {
+						ic.set("requestId", ic.req.header(INTERNAL_REQUEST_ID) ?? "");
+						await next();
+					});
+					inner.route(ADMIN_BASE, build());
+					inner.onError((error, ic) => {
+						services.logger.error("unhandled error", { error: error.name });
+						return ic.json({ error: "internal error" }, 500);
+					});
+					inner.notFound((ic) => ic.json({ error: "not found" }, 404));
+					adminApp = inner;
+				}
+				const headers = new Headers(c.req.raw.headers);
+				headers.set(INTERNAL_REQUEST_ID, c.get("requestId"));
+				const forwarded = new Request(c.req.raw, { headers });
+				let ctx;
+				try {
+					ctx = c.executionCtx;
+				} catch {
+					ctx = void 0;
+				}
+				return ctx === void 0 ? adminApp.fetch(forwarded, c.env) : adminApp.fetch(forwarded, c.env, ctx);
+			});
+		}
+	}
 	app.get("/health", (c) => c.json({ status: "ok" }));
 	app.get("/version", (c) => c.json({ version: options.version }));
 	app.all("/w/:slug/mcp", async (c) => {
@@ -11507,7 +11727,7 @@ function createHttpApp(options) {
 		let mcp = null;
 		let access = null;
 		const finish = (res, refusal) => {
-			observe("request", {
+			observe(c, "request", {
 				requestId,
 				ip,
 				slug: slug.slice(0, 63),
@@ -11567,7 +11787,7 @@ function createHttpApp(options) {
 						if (cap !== void 0 && !cap.ok) return tooMany(cap.retryAfterSeconds);
 						const credentialId = decision.access.credential.id;
 						pending = pt.validator.validate(instance, credentialId, agilityToken).finally(() => validating.delete(key));
-						validating.set(key, pending);
+						if (!perRequest) validating.set(key, pending);
 					}
 					const result = await pending;
 					if (result.status === "unavailable") return finish(c.json({ error: "temporarily unavailable" }, 503, { "retry-after": "5" }), "unavailable");
@@ -11663,7 +11883,7 @@ function createHttpApp(options) {
 				},
 				limits: resolved.limits,
 				budget: createBudget(resolved.limits.callBudget),
-				limiter: services.limiters.for(resolved.instance.id, resolved.credential.id),
+				limiter: (perRequest ? new CredentialLimiters() : services.limiters).for(resolved.instance.id, resolved.credential.id),
 				breaker: services.breakers.for(resolved.instance.id, resolved.credential.id),
 				fetch: services.fetchFor(resolved.instance),
 				metadata: services.metadata,
@@ -11671,7 +11891,7 @@ function createHttpApp(options) {
 				clock: services.clock,
 				random: services.random
 			},
-			onToolCall: (event) => observe("toolCall", {
+			onToolCall: (event) => observe(c, "toolCall", {
 				...event,
 				requestId,
 				access: resolved
@@ -11705,7 +11925,7 @@ function createHttpApp(options) {
 	});
 	return {
 		app,
-		fetch: (request, env) => app.fetch(request, env),
+		fetch: (request, env, executionCtx) => executionCtx === void 0 ? app.fetch(request, env) : app.fetch(request, env, executionCtx),
 		clearAccessCache: () => cache.clear()
 	};
 }
@@ -11720,6 +11940,7 @@ var AuditWriter = class {
 	#pending = 0;
 	#dropped = 0;
 	#tail = Promise.resolve();
+	#inflight = /* @__PURE__ */ new Set();
 	#window = {
 		start: 0,
 		written: 0,
@@ -11731,7 +11952,10 @@ var AuditWriter = class {
 		this.#perMinute = options.refusalsPerMinute ?? 60;
 		this.#maxPending = options.maxPending ?? 1e4;
 	}
-	/** Queues a row; never throws, never blocks the request. */
+	/**
+	* Queues a row; never throws, never blocks the request. Detached, it returns the write (which never rejects) for the
+	* host to keep alive; queued, it returns nothing.
+	*/
 	enqueue(row) {
 		if (this.#pending >= this.#maxPending) {
 			this.#dropped++;
@@ -11744,7 +11968,7 @@ var AuditWriter = class {
 			ts: this.#options.clock.now()
 		};
 		this.#pending++;
-		this.#tail = this.#tail.then(() => this.#options.storage.audit.append(entry)).catch((error) => {
+		const write = () => this.#options.storage.audit.append(entry).catch((error) => {
 			this.#options.logger.error("audit write failed", {
 				action: entry.action,
 				error: error.name
@@ -11752,11 +11976,19 @@ var AuditWriter = class {
 		}).finally(() => {
 			this.#pending--;
 		});
+		if (this.#options.detached === true) {
+			const written = write();
+			this.#inflight.add(written);
+			written.finally(() => this.#inflight.delete(written));
+			return written;
+		}
+		this.#tail = this.#tail.then(write);
 	}
 	/** Resolves when every queued row has been written (or failed). For shutdown and tests. */
 	async flush() {
 		this.#flushWindow(Number.POSITIVE_INFINITY);
 		await this.#tail;
+		await Promise.all([...this.#inflight]);
 	}
 	/**
 	* Writes a row now and fails if it cannot be stored: for the intent of a write, recorded before the mutation (L-109,
@@ -11772,7 +12004,7 @@ var AuditWriter = class {
 		return id;
 	}
 	toolCall(e) {
-		this.enqueue({
+		return this.enqueue({
 			kind: "tool_call",
 			action: e.tool,
 			status: e.status,
@@ -11792,16 +12024,16 @@ var AuditWriter = class {
 	}
 	/** A refused MCP request (authentication or limits), capped per minute. */
 	request(e) {
-		if (e.refusal === null || !AUDITED_REFUSALS.has(e.status)) return;
+		if (e.refusal === null || !AUDITED_REFUSALS.has(e.status)) return void 0;
 		const now = this.#options.clock.now();
-		this.#flushWindow(now);
+		const summary = this.#flushWindow(now);
 		if (this.#window.written >= this.#perMinute) {
 			if (this.#window.suppressed === 0) this.#window.firstSuppressed = now;
 			this.#window.suppressed++;
-			return;
+			return summary;
 		}
 		this.#window.written++;
-		this.enqueue({
+		return both(summary, this.enqueue({
 			kind: "auth",
 			action: e.status === 429 ? "mcp.rate_limited" : "mcp.unauthenticated",
 			status: "denied",
@@ -11819,10 +12051,10 @@ var AuditWriter = class {
 				ip: e.ip.slice(0, 64),
 				...e.mcp?.method ? { method: e.mcp.method } : {}
 			}
-		});
+		}));
 	}
 	admin(change) {
-		this.enqueue(this.#adminRow(change));
+		return this.enqueue(this.#adminRow(change));
 	}
 	#adminRow(change) {
 		return {
@@ -11845,8 +12077,9 @@ var AuditWriter = class {
 	/** Ends the refusal window once a minute has passed, writing a summary of what was suppressed. */
 	#flushWindow(now) {
 		const w = this.#window;
-		if (now - w.start < 6e4) return;
-		if (w.suppressed > 0) this.enqueue({
+		if (now - w.start < 6e4) return void 0;
+		let summary;
+		if (w.suppressed > 0) summary = this.enqueue({
 			kind: "auth",
 			action: "audit.refusals_suppressed",
 			status: "denied",
@@ -11862,29 +12095,31 @@ var AuditWriter = class {
 			suppressed: 0,
 			firstSuppressed: 0
 		};
+		return summary;
 	}
-	/** The observer to give `createHttpApp`. */
+	/** The observer to give `createHttpApp`; it returns the writes it started (detached) for the host to keep alive. */
 	observer(next) {
 		return {
-			request: (e) => {
-				this.request(e);
-				next?.request?.(e);
-			},
-			toolCall: (e) => {
-				this.toolCall(e);
-				next?.toolCall?.(e);
-			}
+			request: (e) => both(this.request(e), next?.request?.(e)),
+			toolCall: (e) => both(this.toolCall(e), next?.toolCall?.(e))
 		};
 	}
 };
+/** One promise for the work two steps started, or nothing when neither started any. */
+function both(a, b) {
+	const work = [a, b].filter((w) => w instanceof Promise);
+	if (work.length === 0) return void 0;
+	return Promise.all(work).then(() => void 0);
+}
 /**
-* Deletes audit rows older than `retentionDays` (0 keeps them forever), in bounded batches. Returns the number deleted.
+* Deletes audit rows older than `retentionDays` (0 keeps them forever), in batches of 1,000, at most `maxBatches`
+* (default 1,000; Workers use a few per scheduled run, P3-08). Returns the number deleted.
 */
-async function purgeAudit(storage, retentionDays, now) {
+async function purgeAudit(storage, retentionDays, now, maxBatches = 1e3) {
 	if (retentionDays <= 0) return 0;
 	const before = now - retentionDays * 864e5;
 	let total = 0;
-	for (let i = 0; i < 1e3; i++) {
+	for (let i = 0; i < maxBatches; i++) {
 		const n = await storage.audit.purge(before, 1e3);
 		total += n;
 		if (n < 1e3) break;
@@ -12058,6 +12293,215 @@ function clientAddress(peer, forwardedFor, trustedHops) {
 	return candidate !== void 0 && /^[0-9A-Fa-f:.[\]]{2,45}$/.test(candidate) ? candidate : socket;
 }
 //#endregion
+//#region ../../packages/http-app/src/server.ts
+/** A setting is missing or malformed; the message names the setting, never its value. */
+var SettingsError = class extends Error {
+	name = "SettingsError";
+};
+Object.freeze([
+	"AB_LOG_LEVEL",
+	"AB_ENVIRONMENT",
+	"AB_PUBLIC_URL",
+	"AB_ALLOWED_HOSTS",
+	"AB_ALLOWED_ORIGINS",
+	"AB_ACCESS_CACHE_TTL",
+	"AB_CALL_BUDGET",
+	"AB_LIMITS_MAX_RESPONSE_BYTES",
+	"AB_RATE_LIMIT",
+	"AB_RATE_LIMIT_IP_PER_MINUTE",
+	"AB_RATE_LIMIT_AUTH_FAILURES",
+	"AB_RATE_LIMIT_TOKEN_PER_MINUTE",
+	"AB_RATE_LIMIT_GRANT_PER_MINUTE",
+	"AB_RATE_LIMIT_VALIDATIONS_PER_MINUTE",
+	"AB_AUDIT_RETENTION_DAYS",
+	"AB_CREDENTIAL_REVALIDATION_HOURS",
+	"AB_PASSTHROUGH",
+	"AB_WRITE_TOOLS",
+	"AB_ALLOW_HTTP_INSTANCES"
+]);
+function settingList(value) {
+	return (value ?? "").split(",").map((s) => s.trim()).filter((s) => s !== "");
+}
+function settingInteger(name, value, fallback, min, max) {
+	if (value === void 0 || value === "") return fallback;
+	const n = Number(value);
+	if (!Number.isInteger(n) || n < min || n > max) throw new SettingsError(`${name} must be an integer from ${min} to ${max}.`);
+	return n;
+}
+function onOff(name, value, fallback) {
+	if (value === void 0 || value === "") return fallback;
+	if (value === "on") return true;
+	if (value === "off") return false;
+	throw new SettingsError(`${name} must be on or off.`);
+}
+/** Parses and checks the shared settings. Throws `SettingsError` naming the first bad one. */
+function parseServerSettings(env, defaults) {
+	const level = env["AB_LOG_LEVEL"] ?? "info";
+	if (![
+		"debug",
+		"info",
+		"warn",
+		"error"
+	].includes(level)) throw new SettingsError("AB_LOG_LEVEL must be debug, info, warn or error.");
+	const environment = env["AB_ENVIRONMENT"] ?? "production";
+	if (environment !== "production" && environment !== "test") throw new SettingsError("AB_ENVIRONMENT must be production (device tokens ab_live_…) or test (ab_test_…).");
+	let publicUrl;
+	if (env["AB_PUBLIC_URL"] !== void 0 && env["AB_PUBLIC_URL"] !== "") try {
+		const u = new URL(env["AB_PUBLIC_URL"]);
+		if (u.protocol !== "https:" && u.protocol !== "http:" || u.username !== "" || u.search !== "" || u.hash !== "") throw new Error("bad");
+		publicUrl = u.origin;
+	} catch {
+		throw new SettingsError("AB_PUBLIC_URL must be the public origin, e.g. https://mcp.example.com.");
+	}
+	for (const o of settingList(env["AB_ALLOWED_ORIGINS"])) if (o === "null" || !/^https?:\/\/[^/\s]+$/.test(o)) throw new SettingsError(`AB_ALLOWED_ORIGINS has an invalid origin: "${o.slice(0, 60)}".`);
+	const int = settingInteger;
+	return {
+		...publicUrl === void 0 ? {} : { publicUrl },
+		allowedHosts: settingList(env["AB_ALLOWED_HOSTS"]),
+		allowedOrigins: settingList(env["AB_ALLOWED_ORIGINS"]),
+		accessCacheTtlSeconds: int("AB_ACCESS_CACHE_TTL", env["AB_ACCESS_CACHE_TTL"], 30, 0, 60),
+		environment: environment === "production" ? "live" : "test",
+		callBudget: int("AB_CALL_BUDGET", env["AB_CALL_BUDGET"], defaults.callBudget, 1, 1e4),
+		maxResponseBytes: int("AB_LIMITS_MAX_RESPONSE_BYTES", env["AB_LIMITS_MAX_RESPONSE_BYTES"], defaults.maxResponseBytes, 65536, 67108864),
+		logLevel: level,
+		rateLimits: {
+			enabled: onOff("AB_RATE_LIMIT", env["AB_RATE_LIMIT"], true),
+			ipPerMinute: int("AB_RATE_LIMIT_IP_PER_MINUTE", env["AB_RATE_LIMIT_IP_PER_MINUTE"], DEFAULT_RATE_LIMITS.ipPerMinute, 1, 1e6),
+			authFailuresPer5Minutes: int("AB_RATE_LIMIT_AUTH_FAILURES", env["AB_RATE_LIMIT_AUTH_FAILURES"], DEFAULT_RATE_LIMITS.authFailuresPer5Minutes, 1, 1e4),
+			tokenPerMinute: int("AB_RATE_LIMIT_TOKEN_PER_MINUTE", env["AB_RATE_LIMIT_TOKEN_PER_MINUTE"], DEFAULT_RATE_LIMITS.tokenPerMinute, 1, 1e5),
+			grantPerMinute: int("AB_RATE_LIMIT_GRANT_PER_MINUTE", env["AB_RATE_LIMIT_GRANT_PER_MINUTE"], DEFAULT_RATE_LIMITS.grantPerMinute, 1, 1e5),
+			validationsPerMinute: int("AB_RATE_LIMIT_VALIDATIONS_PER_MINUTE", env["AB_RATE_LIMIT_VALIDATIONS_PER_MINUTE"], DEFAULT_RATE_LIMITS.validationsPerMinute, 1, 1e4)
+		},
+		auditRetentionDays: int("AB_AUDIT_RETENTION_DAYS", env["AB_AUDIT_RETENTION_DAYS"], 90, 0, 36500),
+		revalidationHours: int("AB_CREDENTIAL_REVALIDATION_HOURS", env["AB_CREDENTIAL_REVALIDATION_HOURS"], 24, 0, 8760),
+		passthrough: onOff("AB_PASSTHROUGH", env["AB_PASSTHROUGH"], false),
+		allowHttpInstances: onOff("AB_ALLOW_HTTP_INSTANCES", env["AB_ALLOW_HTTP_INSTANCES"], false)
+	};
+}
+/** The warnings both hosts log at start for risky but valid settings. */
+function settingWarnings(env, settings) {
+	const warnings = [];
+	if (env["AB_WRITE_TOOLS"] === "on") warnings.push("AB_WRITE_TOOLS is on, but this version has no write tools.");
+	if (!settings.rateLimits.enabled) warnings.push("AB_RATE_LIMIT is off: no request, token or authentication-failure limits.");
+	if (settings.allowHttpInstances) warnings.push("AB_ALLOW_HTTP_INSTANCES is on: plain-HTTP loopback instance URLs are accepted (tests only).");
+	if (settings.passthrough) warnings.push("AB_PASSTHROUGH is on: pass-through workspaces accept any valid Agility token of their instance.");
+	return warnings;
+}
+/**
+* Revalidates a credential after 3 consecutive `AB_AGILITY_AUTH` errors (a revoked token), at most once per 10 minutes
+* per credential, so a dead token is marked invalid instead of failing every call (P2-13, A10). Returns the
+* revalidation it started, for the host to keep alive.
+*/
+function revalidateOnAuthErrors(services, logger, now = Date.now) {
+	const streaks = /* @__PURE__ */ new Map();
+	const last = /* @__PURE__ */ new Map();
+	return (credentialId, errorCode) => {
+		if (errorCode !== "AB_AGILITY_AUTH") {
+			streaks.delete(credentialId);
+			return;
+		}
+		const n = (streaks.get(credentialId) ?? 0) + 1;
+		streaks.set(credentialId, n);
+		if (n < 3 || now() - (last.get(credentialId) ?? 0) < 6e5) return void 0;
+		last.set(credentialId, now());
+		streaks.delete(credentialId);
+		return services.credentials.validate(credentialId).then((c) => {
+			logger.warn("credential revalidated after Agility refused it", {
+				credential: c.id,
+				status: c.validationStatus
+			});
+		}).catch((error) => {
+			logger.error("credential revalidation failed", { error: error.name });
+		});
+	};
+}
+/** The app both hosts serve, with audit, admin API, rate limits and pass-through as configured. */
+function assembleServer(parts) {
+	const { settings, storage, keyring, host, logger } = parts;
+	const tools = new Map(CORE_TOOLS.map((t) => [t.name, {
+		kind: t.kind,
+		group: t.group
+	}]));
+	const audit = new AuditWriter({
+		storage,
+		logger,
+		clock: host.clock,
+		random: host.random,
+		...parts.isolation === "request" ? { detached: true } : {}
+	});
+	const validator = credentialValidator(host);
+	const services = accessServices({
+		storage,
+		keyring,
+		tools,
+		environment: settings.environment,
+		validator,
+		instanceUrls: {
+			httpLoopback: settings.allowHttpInstances,
+			...parts.checkInstanceHost === void 0 ? {} : { checkHost: parts.checkInstanceHost }
+		}
+	});
+	const authErrors = revalidateOnAuthErrors(services, logger, () => host.clock.now());
+	return {
+		app: createHttpApp({
+			storage,
+			keyring,
+			access: {
+				tools,
+				writesEnabled: false,
+				environment: settings.environment,
+				limits: {
+					defaults: {
+						...DEFAULT_LIMITS,
+						maxResponseBytes: settings.maxResponseBytes,
+						callBudget: settings.callBudget,
+						genericQuery: true
+					},
+					ceilings: parts.ceilings ?? {}
+				}
+			},
+			tools: CORE_TOOLS,
+			services: host,
+			...settings.publicUrl === void 0 ? {} : { publicUrl: settings.publicUrl },
+			allowedHosts: settings.allowedHosts,
+			allowedOrigins: settings.allowedOrigins,
+			accessCacheTtlSeconds: settings.accessCacheTtlSeconds,
+			limits: createRequestLimits(parts.limiter, settings.rateLimits, logger),
+			...settings.passthrough ? { passthrough: {
+				validator,
+				secure: parts.passthroughSecure
+			} } : {},
+			...parts.adminVerifier === void 0 ? {} : { admin: {
+				services,
+				audit,
+				authenticate: adminTokenAuthenticator(parts.adminVerifier)
+			} },
+			clientIp: parts.clientIp,
+			observer: audit.observer({
+				toolCall: (e) => authErrors(e.access.credential.id, e.errorCode),
+				request: (e) => {
+					logger.info("request", {
+						requestId: e.requestId,
+						workspace: e.slug,
+						status: e.status,
+						method: e.mcp?.method ?? null,
+						kind: e.mcp?.kind ?? null,
+						tool: e.mcp?.tool ?? null,
+						durationMs: e.durationMs,
+						...e.refusal === null ? {} : { refusal: e.refusal }
+					});
+				}
+			}),
+			isolation: parts.isolation,
+			...parts.registry === void 0 ? {} : { registry: parts.registry },
+			...parts.background === void 0 ? {} : { background: parts.background },
+			version: parts.version
+		}),
+		audit,
+		services
+	};
+}
+//#endregion
 //#region ../../packages/storage-sqlite/src/driver.ts
 const MAX_CACHED_STATEMENTS = 256;
 function bindable(value) {
@@ -12319,6 +12763,56 @@ async function restoreSqliteBackup(source, target) {
 	copyPrivateFile(from, to);
 }
 //#endregion
+//#region src/agility-fetch.ts
+/** Thrown for an instance host that is not a public address; the message names the host, never a token. */
+var PrivateAddressError = class extends Error {
+	name = "PrivateAddressError";
+};
+/** `dns.lookup` that fails when any address of the name is not public (so a rebinding answer is refused too). */
+function publicOnlyLookup(hostname, options, callback) {
+	lookup(hostname, {
+		...options,
+		all: true
+	}, ((error, addresses) => {
+		if (error !== null) return callback(error, []);
+		if (addresses.find((a) => addressClass(a.address) !== "public") !== void 0 || addresses.length === 0) return callback(Object.assign(new PrivateAddressError(`${hostname} resolves to a non-public address.`), { code: "EACCES" }), []);
+		if (options.all === true) return callback(null, addresses);
+		const first = addresses[0];
+		callback(null, first.address, first.family);
+	}));
+}
+/** Refuses a host that is, or resolves to, a non-public address (instance create and retarget, P2-19). */
+async function checkPublicHost(hostname) {
+	const host = hostname.replace(/^\[|\]$/g, "");
+	const literal = addressClass(host);
+	if (literal !== "invalid") {
+		if (literal !== "public") throw new PrivateAddressError(`${hostname} is a ${literal} address.`);
+		return;
+	}
+	await new Promise((resolve, reject) => publicOnlyLookup(host, { all: true }, (error) => error === null ? resolve() : reject(error)));
+}
+function createNodeFetch(options = {}) {
+	if (options.caFile === void 0 && options.publicOnly !== true) return (request) => fetch(request);
+	let ca;
+	if (options.caFile !== void 0) {
+		const pem = readFileSync(options.caFile, "utf8");
+		if (!pem.includes("-----BEGIN CERTIFICATE-----")) throw new Error(`AB_CA_FILE ${options.caFile} holds no PEM certificate.`);
+		ca = [...rootCertificates, pem];
+	}
+	const dispatcher = new Agent({ connect: {
+		...ca === void 0 ? {} : { ca },
+		...options.publicOnly === true ? { lookup: publicOnlyLookup } : {}
+	} });
+	const send = (request) => fetch(request, { dispatcher });
+	if (options.publicOnly !== true) return send;
+	return async (request) => {
+		const host = new URL(request.url).hostname.replace(/^\[|\]$/g, "");
+		const kind = addressClass(host);
+		if (kind !== "invalid" && kind !== "public") throw new PrivateAddressError(`${host} is a ${kind} address.`);
+		return send(request);
+	};
+}
+//#endregion
 //#region src/master-key.ts
 /** The user configuration directory of agility-bridge (`$XDG_CONFIG_HOME` or `~/.config`; `%APPDATA%` on Windows). */
 function configDir(env, platform = process.platform, home = homedir()) {
@@ -12411,85 +12905,35 @@ function createMasterKeyFile(path, version = 1) {
 	return target;
 }
 //#endregion
-//#region src/agility-fetch.ts
-function createNodeFetch(options = {}) {
-	if (options.caFile === void 0) return (request) => fetch(request);
-	const pem = readFileSync(options.caFile, "utf8");
-	if (!pem.includes("-----BEGIN CERTIFICATE-----")) throw new Error(`AB_CA_FILE ${options.caFile} holds no PEM certificate.`);
-	const dispatcher = new Agent({ connect: { ca: [...rootCertificates, pem] } });
-	return (request) => fetch(request, { dispatcher });
-}
-//#endregion
 //#region src/serve.ts
 /** The default data directory (`$XDG_DATA_HOME` or `~/.local/share`; `%LOCALAPPDATA%` on Windows). */
 function dataDir(env, platform = process.platform, home = homedir()) {
 	const base = platform === "win32" ? env["LOCALAPPDATA"] ?? join(home, "AppData", "Local") : env["XDG_DATA_HOME"] ?? join(home, ".local", "share");
 	return join(base, "agility-bridge");
 }
-function list$1(value) {
-	return (value ?? "").split(",").map((s) => s.trim()).filter((s) => s !== "");
-}
-function integer$1(name, value, fallback, min, max) {
-	if (value === void 0 || value === "") return fallback;
-	const n = Number(value);
-	if (!Number.isInteger(n) || n < min || n > max) throw new ConfigError(`${name} must be an integer from ${min} to ${max}.`);
-	return n;
+function privateAddressPolicy(value) {
+	if (value === void 0 || value === "" || value === "allow") return "allow";
+	if (value === "refuse") return "refuse";
+	throw new ConfigError("AB_INSTANCE_PRIVATE_ADDRESSES must be allow or refuse.");
 }
+/** The shared settings (checked by `parseServerSettings`, P3-01) plus the Node-only ones. */
 function loadServeConfig(env) {
 	checkEnvNames(env);
-	const level = env["AB_LOG_LEVEL"] ?? "info";
-	if (![
-		"debug",
-		"info",
-		"warn",
-		"error"
-	].includes(level)) throw new ConfigError("AB_LOG_LEVEL must be debug, info, warn or error.");
-	const environment = env["AB_ENVIRONMENT"] ?? "production";
-	if (environment !== "production" && environment !== "test") throw new ConfigError("AB_ENVIRONMENT must be production (device tokens ab_live_…) or test (ab_test_…).");
-	let publicUrl;
-	if (env["AB_PUBLIC_URL"] !== void 0 && env["AB_PUBLIC_URL"] !== "") try {
-		const u = new URL(env["AB_PUBLIC_URL"]);
-		if (u.protocol !== "https:" && u.protocol !== "http:" || u.username !== "" || u.search !== "" || u.hash !== "") throw new Error("bad");
-		publicUrl = u.origin;
-	} catch {
-		throw new ConfigError("AB_PUBLIC_URL must be the public origin, e.g. https://mcp.example.com.");
+	try {
+		const settings = parseServerSettings(env, DEFAULTS);
+		const dbPath = env["AB_DB_PATH"] || join(env["AB_DATA_DIR"] || dataDir(env), "agility-bridge.db");
+		return {
+			...settings,
+			dbPath,
+			host: env["AB_HOST"] || "127.0.0.1",
+			port: settingInteger("AB_PORT", env["AB_PORT"], 8787, 0, 65535),
+			trustedProxyHops: settingInteger("AB_TRUSTED_PROXY_HOPS", env["AB_TRUSTED_PROXY_HOPS"], 0, 0, 10),
+			privateAddresses: privateAddressPolicy(env["AB_INSTANCE_PRIVATE_ADDRESSES"])
+		};
+	} catch (error) {
+		if (error instanceof SettingsError) throw new ConfigError(error.message);
+		throw error;
 	}
-	for (const o of list$1(env["AB_ALLOWED_ORIGINS"])) if (o === "null" || !/^https?:\/\/[^/\s]+$/.test(o)) throw new ConfigError(`AB_ALLOWED_ORIGINS has an invalid origin: "${o.slice(0, 60)}".`);
-	return {
-		dbPath: env["AB_DB_PATH"] || join(env["AB_DATA_DIR"] || dataDir(env), "agility-bridge.db"),
-		host: env["AB_HOST"] || "127.0.0.1",
-		port: integer$1("AB_PORT", env["AB_PORT"], 8787, 0, 65535),
-		...publicUrl === void 0 ? {} : { publicUrl },
-		allowedHosts: list$1(env["AB_ALLOWED_HOSTS"]),
-		allowedOrigins: list$1(env["AB_ALLOWED_ORIGINS"]),
-		accessCacheTtlSeconds: integer$1("AB_ACCESS_CACHE_TTL", env["AB_ACCESS_CACHE_TTL"], 30, 0, 60),
-		environment: environment === "production" ? "live" : "test",
-		callBudget: integer$1("AB_CALL_BUDGET", env["AB_CALL_BUDGET"], DEFAULTS.callBudget, 1, 1e4),
-		maxResponseBytes: integer$1("AB_LIMITS_MAX_RESPONSE_BYTES", env["AB_LIMITS_MAX_RESPONSE_BYTES"], DEFAULTS.maxResponseBytes, 65536, 67108864),
-		logLevel: level,
-		rateLimits: {
-			enabled: rateLimitSwitch(env["AB_RATE_LIMIT"]),
-			ipPerMinute: integer$1("AB_RATE_LIMIT_IP_PER_MINUTE", env["AB_RATE_LIMIT_IP_PER_MINUTE"], DEFAULT_RATE_LIMITS.ipPerMinute, 1, 1e6),
-			authFailuresPer5Minutes: integer$1("AB_RATE_LIMIT_AUTH_FAILURES", env["AB_RATE_LIMIT_AUTH_FAILURES"], DEFAULT_RATE_LIMITS.authFailuresPer5Minutes, 1, 1e4),
-			tokenPerMinute: integer$1("AB_RATE_LIMIT_TOKEN_PER_MINUTE", env["AB_RATE_LIMIT_TOKEN_PER_MINUTE"], DEFAULT_RATE_LIMITS.tokenPerMinute, 1, 1e5),
-			grantPerMinute: integer$1("AB_RATE_LIMIT_GRANT_PER_MINUTE", env["AB_RATE_LIMIT_GRANT_PER_MINUTE"], DEFAULT_RATE_LIMITS.grantPerMinute, 1, 1e5),
-			validationsPerMinute: integer$1("AB_RATE_LIMIT_VALIDATIONS_PER_MINUTE", env["AB_RATE_LIMIT_VALIDATIONS_PER_MINUTE"], DEFAULT_RATE_LIMITS.validationsPerMinute, 1, 1e4)
-		},
-		trustedProxyHops: integer$1("AB_TRUSTED_PROXY_HOPS", env["AB_TRUSTED_PROXY_HOPS"], 0, 0, 10),
-		auditRetentionDays: integer$1("AB_AUDIT_RETENTION_DAYS", env["AB_AUDIT_RETENTION_DAYS"], 90, 0, 36500),
-		revalidationHours: integer$1("AB_CREDENTIAL_REVALIDATION_HOURS", env["AB_CREDENTIAL_REVALIDATION_HOURS"], 24, 0, 8760),
-		passthrough: onOff("AB_PASSTHROUGH", env["AB_PASSTHROUGH"])
-	};
-}
-function onOff(name, value) {
-	if (value === void 0 || value === "" || value === "off") return false;
-	if (value === "on") return true;
-	throw new ConfigError(`${name} must be on or off.`);
-}
-function rateLimitSwitch(value) {
-	if (value === void 0 || value === "" || value === "on") return true;
-	if (value === "off") return false;
-	throw new ConfigError("AB_RATE_LIMIT must be on or off.");
 }
 /** Opens storage, checks the master key, and listens. Throws ConfigError before listening on any problem. */
 async function startServe(env, options = {}) {
@@ -12499,9 +12943,7 @@ async function startServe(env, options = {}) {
 		sink: options.sink ?? stderrSink,
 		fields: { mode: "serve" }
 	});
-	if (env["AB_WRITE_TOOLS"] === "on") logger.warn("AB_WRITE_TOOLS is on, but this version has no write tools.");
-	if (!config.rateLimits.enabled) logger.warn("AB_RATE_LIMIT is off: no request, token or authentication-failure limits.");
-	if (config.passthrough) logger.warn("AB_PASSTHROUGH is on: pass-through workspaces accept any valid Agility token of their instance.");
+	for (const warning of settingWarnings(env, config)) logger.warn(warning);
 	const keys = readMasterKeys(env, { dataDir: dirname(config.dbPath) });
 	const keyring = await Keyring.create(keys.current, keys.previous);
 	const storage = await openSqliteStorage({
@@ -12523,76 +12965,22 @@ async function startServe(env, options = {}) {
 		await storage.close();
 		throw error instanceof ConfigError ? error : new ConfigError(`AB_ADMIN_TOKEN: ${error.message}`);
 	}
-	const tools = new Map(CORE_TOOLS.map((t) => [t.name, {
-		kind: t.kind,
-		group: t.group
-	}]));
-	const audit = new AuditWriter({
+	const { app, audit, services } = assembleServer({
+		settings: config,
 		storage,
+		keyring,
+		host: nodeHostServices(logger, { publicOnly: config.privateAddresses === "refuse" }),
 		logger,
-		clock: systemClock,
-		random: webCryptoRandom
+		limiter: new MemoryRateLimiter(),
+		version,
+		isolation: "process",
+		...adminVerifier === void 0 ? {} : { adminVerifier },
+		...config.privateAddresses === "refuse" ? { checkInstanceHost: checkPublicHost } : {},
+		clientIp: (c) => clientAddress(c.env?.incoming?.socket?.remoteAddress, c.req.header("x-forwarded-for"), config.trustedProxyHops),
+		passthroughSecure: (c) => config.trustedProxyHops > 0 && c.req.header("x-forwarded-proto") === "https"
 	});
 	const stopRetention = scheduleAuditRetention(storage, config.auditRetentionDays, systemClock, logger);
-	const hostServices = nodeHostServices(logger);
-	const services = accessServices({
-		storage,
-		keyring,
-		tools,
-		environment: config.environment,
-		validator: credentialValidator(hostServices)
-	});
 	const stopRevalidation = scheduleRevalidation(services, config.revalidationHours, logger);
-	const authErrors = revalidateOnAuthErrors(services, logger);
-	const app = createHttpApp({
-		storage,
-		keyring,
-		access: {
-			tools,
-			writesEnabled: false,
-			environment: config.environment,
-			limits: {
-				defaults: {
-					...DEFAULT_LIMITS,
-					maxResponseBytes: config.maxResponseBytes,
-					callBudget: config.callBudget,
-					genericQuery: true
-				},
-				ceilings: {}
-			}
-		},
-		tools: CORE_TOOLS,
-		services: hostServices,
-		...config.publicUrl === void 0 ? {} : { publicUrl: config.publicUrl },
-		allowedHosts: config.allowedHosts,
-		allowedOrigins: config.allowedOrigins,
-		accessCacheTtlSeconds: config.accessCacheTtlSeconds,
-		limits: createRequestLimits(new MemoryRateLimiter(), config.rateLimits, logger),
-		...config.passthrough ? { passthrough: {
-			validator: credentialValidator(hostServices),
-			secure: (c) => config.trustedProxyHops > 0 && c.req.header("x-forwarded-proto") === "https"
-		} } : {},
-		...adminVerifier === void 0 ? {} : { admin: {
-			services,
-			audit,
-			authenticate: adminTokenAuthenticator(adminVerifier)
-		} },
-		clientIp: (c) => clientAddress(c.env?.incoming?.socket?.remoteAddress, c.req.header("x-forwarded-for"), config.trustedProxyHops),
-		observer: audit.observer({
-			toolCall: (e) => authErrors(e.access.credential.id, e.errorCode),
-			request: (e) => logger.info("request", {
-				requestId: e.requestId,
-				workspace: e.slug,
-				status: e.status,
-				method: e.mcp?.method ?? null,
-				kind: e.mcp?.kind ?? null,
-				tool: e.mcp?.tool ?? null,
-				durationMs: e.durationMs,
-				...e.refusal === null ? {} : { refusal: e.refusal }
-			})
-		}),
-		version
-	});
 	const server = await new Promise((resolve, reject) => {
 		const s = serve({
 			fetch: originFormOnly(app.fetch),
@@ -12658,7 +13046,7 @@ function readAdminToken(env, dataDir) {
 	return value || void 0;
 }
 /** Per-process services for Agility calls: the `fetch` pinned to an instance's TLS (custom CA), limiters, breakers. */
-function nodeHostServices(logger) {
+function nodeHostServices(logger, options = {}) {
 	const fetches = /* @__PURE__ */ new Map();
 	return {
 		fetchFor(instance) {
@@ -12666,7 +13054,10 @@ function nodeHostServices(logger) {
 			const key = `${instance.id}|${caFile ?? ""}`;
 			let f = fetches.get(key);
 			if (f === void 0) {
-				f = createNodeFetch(caFile === void 0 ? {} : { caFile });
+				f = createNodeFetch({
+					...caFile === void 0 ? {} : { caFile },
+					...options.publicOnly === true ? { publicOnly: true } : {}
+				});
 				fetches.set(key, f);
 			}
 			return f;
@@ -12695,29 +13086,6 @@ function scheduleRevalidation(services, hours, logger) {
 		clearInterval(timer);
 	};
 }
-/**
-* Revalidates a credential after 3 consecutive `AB_AGILITY_AUTH` errors (a revoked token), at most once per 10 minutes
-* per credential, so a dead token is marked invalid instead of failing every call (P2-13, A10).
-*/
-function revalidateOnAuthErrors(services, logger, now = Date.now) {
-	const streaks = /* @__PURE__ */ new Map();
-	const last = /* @__PURE__ */ new Map();
-	return (credentialId, errorCode) => {
-		if (errorCode !== "AB_AGILITY_AUTH") {
-			streaks.delete(credentialId);
-			return;
-		}
-		const n = (streaks.get(credentialId) ?? 0) + 1;
-		streaks.set(credentialId, n);
-		if (n < 3 || now() - (last.get(credentialId) ?? 0) < 6e5) return;
-		last.set(credentialId, now());
-		streaks.delete(credentialId);
-		services.credentials.validate(credentialId).then((c) => logger.warn("credential revalidated after Agility refused it", {
-			credential: c.id,
-			status: c.validationStatus
-		})).catch((error) => logger.error("credential revalidation failed", { error: error.name }));
-	};
-}
 //#endregion
 //#region src/manage/client.ts
 /** The admin API in process over the local database (owner rights: the operator holds the database and the key). */
@@ -12751,7 +13119,11 @@ async function localClient(env, logger) {
 			keyring,
 			tools,
 			environment: config.environment,
-			validator: credentialValidator(nodeHostServices(logger))
+			validator: credentialValidator(nodeHostServices(logger, { publicOnly: config.privateAddresses === "refuse" })),
+			instanceUrls: {
+				httpLoopback: config.allowHttpInstances,
+				...config.privateAddresses === "refuse" ? { checkHost: checkPublicHost } : {}
+			}
 		}),
 		storage,
 		tools,
@@ -12761,7 +13133,8 @@ async function localClient(env, logger) {
 		clientIp: () => "local",
 		logger,
 		clock: systemClock,
-		via: "cli"
+		via: "cli",
+		keyring
 	});
 	return {
 		mode: "local",
@@ -12958,9 +13331,15 @@ const COMMANDS = [
 			name: "key-file",
 			kind: "string",
 			help: "Where to write it (default ~/.config/agility-bridge/master.key)"
+		}, {
+			name: "version",
+			kind: "string",
+			help: "Key version (default 1); a rotation needs one higher than the current key"
 		}],
 		async run(r, p) {
-			const path = createMasterKeyFile(typeof p.opts["key-file"] === "string" ? p.opts["key-file"] : defaultMasterKeyFile(r.env));
+			const version = p.opts["version"] === void 0 ? 1 : Number(p.opts["version"]);
+			if (!Number.isInteger(version) || version < 1 || version > 1e6) throw new ConfigError("--version is a whole number ≥ 1.");
+			const path = createMasterKeyFile(typeof p.opts["key-file"] === "string" ? p.opts["key-file"] : defaultMasterKeyFile(r.env), version);
 			r.out(JSON.stringify({ masterKeyFile: path }));
 			r.err(`agility-bridge: wrote a new master key to ${path}. Start the server with AB_MASTER_KEY_FILE=${path}, and back the file up away from the database (docs/guide/secrets.md).`);
 			return 0;
@@ -13485,8 +13864,11 @@ const COMMANDS = [
 	},
 	{
 		words: ["keys", "status"],
-		summary: "Credentials per master-key version (local)",
-		local: async ({ storage, keyring }) => keyStatus(storage, keyring)
+		summary: "Credentials per master-key version (owner)",
+		api: async () => ({
+			method: "GET",
+			path: "/keys"
+		})
 	},
 	{
 		words: ["keys", "rotate"],
@@ -13504,7 +13886,7 @@ const COMMANDS = [
 	},
 	{
 		words: ["keys", "retire"],
-		summary: "Retire a master-key version no credential uses any more (local)",
+		summary: "Retire a master-key version no credential uses any more (owner)",
 		args: [id("version", "Key version, e.g. 1")],
 		options: [{
 			name: "reason",
@@ -13512,14 +13894,14 @@ const COMMANDS = [
 			help: "Why, for the audit log",
 			required: true
 		}],
-		local: async ({ storage, keyring }, p) => {
+		api: async (_r, p) => {
 			const version = Number(p.args[0]);
 			if (!Number.isInteger(version) || version < 1) throw new ConfigError("The version is a whole number ≥ 1.");
-			await retireKeyVersion(storage, keyring, version, {
-				reason: String(p.opts["reason"]),
-				actor: { via: "cli" }
-			});
-			return { retired: version };
+			return {
+				method: "POST",
+				path: `/keys/${version}/retire`,
+				body: { reason: String(p.opts["reason"]) }
+			};
 		}
 	}
 ];