create-feltdb 0.7.3 → 0.8.0

package/dist/cli.js

@@ -10,7 +10,7 @@ import readline from 'readline';
 import { spawn, spawnSync } from 'child_process';
 import { createProject } from './create.js';
 import { FELTDB_PACKAGE_VERSION } from './package-versions.js';
-import { configureManagedAccount } from './managed-account.js';
+import { configureManagedAccount, finalizeManagedProvisioning } from './managed-account.js';
 import { localFeltdbExecutable } from './development-handoff.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 function parseArgs(args) {
@@ -308,7 +308,7 @@ Learn more: https://github.com/rkendel1/feltdb`);
         await createProject({
             projectName,
             autoYes: shouldAutoYes,
-            templatesDir: path.join(__dirname, '../template'),
+            templatesDir: path.join(__dirname, 'template'),
             runtime: options.runtime,
             framework: options.framework,
             distributed: options.distributed,
@@ -331,9 +331,18 @@ Learn more: https://github.com/rkendel1/feltdb`);
         }
         console.log('\n✅ FeltDB application created successfully!\n');
         const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+        if (options.runtime === 'managed' && !shouldInstall) {
+            throw new Error('Managed provisioning requires dependency installation so the initial revision can be built, published, promoted, and verified. Remove --no-install.');
+        }
         if (shouldInstall) {
             console.log(`📦 Installing application, Studio${options.webllm ? ', and local WebLLM app builder' : ''} dependencies...\n`);
             await run(npm, ['install'], projectDir);
+            if (options.runtime === 'managed') {
+                console.log('\n☁️  Publishing and verifying the initial managed revision...\n');
+                await run(localFeltdbExecutable(projectDir), ['publish', '--yes', '--approve-destructive-changes'], projectDir);
+                const finalized = await finalizeManagedProvisioning({ projectDir });
+                console.log(`✓ Managed runtime verified at revision ${finalized.revisionId}`);
+            }
         }
         if (shouldStart) {
             if (!shouldInstall) {

package/dist/create.js

@@ -49,9 +49,12 @@ export async function createProject(options) {
             test: 'node --test',
             feltdb: 'feltdb',
             'feltdb:server': 'feltdb server',
-            'feltdb:connect': 'feltdb connect http://localhost:7700',
+            'feltdb:connect': 'feltdb connect',
             'feltdb:status': 'feltdb status',
             'feltdb:studio': 'feltdb studio',
+            'feltdb:publish': 'feltdb publish',
+            'feltdb:ai': 'feltdb ai',
+            'feltdb:sync': 'feltdb sync',
             'feltdb:validate': 'feltdb validate',
             'feltdb:diff': 'feltdb diff',
             'feltdb:deploy': 'feltdb deploy',
@@ -176,25 +179,26 @@ ${hasAgents ? `  agent WorkspaceAssistant {
             lib: ['ES2020', 'DOM'],
             declaration: true,
             outDir: './dist',
-            rootDir: './src',
+            rootDir: '.',
             strict: true,
             esModuleInterop: true,
             skipLibCheck: true,
             forceConsistentCasingInFileNames: true,
-            moduleResolution: 'node',
+            moduleResolution: 'bundler',
         },
-        include: ['src/**/*'],
+        include: framework === 'react' ? ['src/**/*', 'agents/**/*', 'capabilities/**/*', 'workflows/**/*'] : ['src/**/*'],
         exclude: ['node_modules'],
     };
     if (framework === 'react') {
         tsconfig.compilerOptions.jsx = 'react-jsx';
+        tsconfig.compilerOptions.types = ['vite/client'];
     }
     fs.writeFileSync(path.join(projectDir, 'tsconfig.json'), JSON.stringify(tsconfig, null, 2));
     // Create main application files
     const runtimeOptions = runtime === 'browser'
         ? "{ namespace: import.meta.env.VITE_FELTDB_NAMESPACE || '" + applicationName + "', browser: true }"
         : runtime === 'managed'
-            ? "{ namespace: import.meta.env.VITE_FELTDB_MANAGED_NAMESPACE || import.meta.env.VITE_FELTDB_NAMESPACE || '" + applicationName + "', server: { url: import.meta.env.VITE_FELTDB_MANAGED_URL || import.meta.env.VITE_FELTDB_URL || '', token: import.meta.env.VITE_FELTDB_MANAGED_API_KEY || import.meta.env.VITE_FELTDB_API_KEY || '' } }"
+            ? "{ namespace: '" + applicationName + "', server: { url: import.meta.env.VITE_FELTDB_MANAGED_URL || '', applicationId: import.meta.env.VITE_FELTDB_MANAGED_APPLICATION_ID, environment: 'production' } }"
             : runtime === 'self-hosted'
                 ? "{ namespace: import.meta.env.VITE_FELTDB_NAMESPACE || '" + applicationName + "', server: { url: import.meta.env.VITE_FELTDB_URL || 'http://localhost:7700', token: import.meta.env.VITE_FELTDB_API_KEY || '' } }"
                 : "{ namespace: import.meta.env.VITE_FELTDB_NAMESPACE || '" + applicationName + "', memory: true }";
@@ -365,7 +369,7 @@ async function logActivity(event: Omit<ActivityEvent, 'id' | 'timestamp'>): Prom
 `;
     fs.writeFileSync(path.join(srcDir, 'feltdb.ts'), feltdbTs);
     // Create a real local-inference agent for browser projects.
-    if (hasAgents && hasWebLLM) {
+    if (hasAgents && hasWebLLM && framework !== 'react') {
         const agentTs = `import { WebLLMProvider } from '@feltdb/webllm';
 import { db, reports } from '../../src/feltdb';
 
@@ -1185,6 +1189,17 @@ root.render(
 );
 `;
         fs.writeFileSync(path.join(srcDir, 'index.tsx'), indexTsx);
+        const canonicalTemplate = path.join(templatesDir, 'default-project');
+        if (fs.existsSync(canonicalTemplate)) {
+            fs.cpSync(path.join(canonicalTemplate, 'src'), srcDir, { recursive: true });
+            for (const directory of ['agents', 'capabilities', 'workflows']) {
+                fs.cpSync(path.join(canonicalTemplate, directory), path.join(projectDir, directory), { recursive: true });
+                fs.rmSync(path.join(feltdbDir, directory), { recursive: true, force: true });
+            }
+            fs.writeFileSync(path.join(projectDir, 'feltdb.flow'), fs.readFileSync(path.join(canonicalTemplate, 'feltdb.flow'), 'utf8').replace('app FeltDBStarter', `app ${appName}`));
+            const databasePath = path.join(srcDir, 'feltdb.ts');
+            fs.writeFileSync(databasePath, fs.readFileSync(databasePath, 'utf8').replace(/export const managedRuntime[\s\S]*?\n\} : \{ namespace: import\.meta\.env\.VITE_FELTDB_NAMESPACE \|\| 'feltdb-starter', browser: true \}\);/, `export const managedRuntime = ${runtime === 'managed'};\nexport const db = createFeltDB(${runtimeOptions});`));
+        }
     }
     else {
         // Create vanilla JS app
@@ -1219,8 +1234,7 @@ main().catch(console.error);
     const envExample = `# FeltDB Configuration
 # Copy this file to .env.local and update the values
 
-# API Key for authenticating with FeltDB servers
-# Leave empty for browser runtime; required for authenticated self-hosted and managed runtimes
+# API key for authenticated self-hosted browser access
 VITE_FELTDB_API_KEY=
 
 # FeltDB Server URL (self-hosted or managed runtime)
@@ -1228,11 +1242,10 @@ VITE_FELTDB_URL=http://localhost:7700
 
 # Managed example: https://runtime.your-app.feltdb.com
 VITE_FELTDB_MANAGED_URL=
-VITE_FELTDB_MANAGED_API_KEY=
-VITE_FELTDB_MANAGED_TENANT_ID=
 VITE_FELTDB_MANAGED_APPLICATION_ID=
-VITE_FELTDB_MANAGED_NAMESPACE=
-VITE_FELTDB_MANAGED_ENVIRONMENT=production
+# Server/control-plane only. Never rename with a VITE_ prefix.
+FELTDB_MANAGED_CONTROL_API_KEY=
+FELTDB_TOKEN=
 
 # Override the default self-hosted container image
 # By default the server image is built locally from the bundled source.
@@ -1371,7 +1384,7 @@ The self-hosted instance runs on \`http://localhost:7700\` by default.
 }
 \`\`\`
 
-Managed mode uses the same application API with a FeltDB-hosted endpoint. The CLI creates \`.env.local\` with \`VITE_FELTDB_MANAGED_URL\` and \`VITE_FELTDB_MANAGED_API_KEY\` after account setup. Studio uses that same connection for state, health, operations, and API-key administration.
+Managed mode uses the same application API with a FeltDB-hosted endpoint. The CLI writes only the public URL and application ID plus separate server-only publish and runtime credentials. Tenant, namespace, environment, and active revision are discovered deployment metadata under \`.feltdb/managed.json\`.
 
 ## Vector Search Status
 
@@ -1524,6 +1537,7 @@ build/
 *.log
 .DS_Store
 .feltdb/
+.feltdb-data/
 `;
     fs.writeFileSync(path.join(projectDir, '.gitignore'), gitignore);
     // Create README
@@ -1639,7 +1653,7 @@ FeltDB runs through a dedicated server with Docker Compose and persistent data v
 
 ### Managed Runtime
 
-FeltDB provides the runtime endpoint, durable storage, synchronization, and background workload infrastructure. The CLI configures \`VITE_FELTDB_MANAGED_URL\` and \`VITE_FELTDB_MANAGED_API_KEY\` in \`.env.local\`.
+FeltDB provides the runtime endpoint, durable storage, synchronization, and background workload infrastructure. The CLI configures the public \`VITE_FELTDB_MANAGED_*\` identity, separate server-only control and data-plane credentials, and the promoted revision in \`.env.local\`. The browser API-key value stays empty because browser users receive short-lived actor sessions.
 
 ## Configuration
 
@@ -1669,12 +1683,14 @@ Create a \`.env.local\` file (copy from \`.env.example\`):
 \`\`\`
 VITE_FELTDB_API_KEY=your_api_key_here
 VITE_FELTDB_URL=http://localhost:7700
-VITE_FELTDB_MANAGED_API_KEY=your_managed_api_key_here
 VITE_FELTDB_MANAGED_URL=https://api.feltdb.com
+VITE_FELTDB_MANAGED_APPLICATION_ID=your_application_id
+FELTDB_MANAGED_CONTROL_API_KEY=your_server_only_control_key
+FELTDB_TOKEN=your_server_only_application_data_key
 VITE_FELTDB_WEBSOCKET_URL=ws://localhost:7700
 \`\`\`
 
-These are required when connecting to an authenticated self-hosted or managed FeltDB instance.
+Never expose \`FELTDB_MANAGED_CONTROL_API_KEY\` or \`FELTDB_TOKEN\` through a \`VITE_\` variable. Managed browser access uses \`db.auth.signUp()\` and \`db.auth.signIn()\`; the active revision is discovered rather than configured.
 
 ## Development
 
@@ -1795,6 +1811,12 @@ If port 5173 is in use:
 MIT
 `;
     fs.writeFileSync(path.join(projectDir, 'README.md'), readme);
+    if (framework === 'react') {
+        const canonicalReadme = path.join(templatesDir, 'default-project', 'README.md');
+        if (fs.existsSync(canonicalReadme)) {
+            fs.writeFileSync(path.join(projectDir, 'README.md'), fs.readFileSync(canonicalReadme, 'utf8').replace('# My FeltDB App', `# ${applicationName}`));
+        }
+    }
     // Initialize Development Workspace
     // This creates .feltdb/workspace.json which enables all FeltDB-aware tools
     // (CLI, IDE, agents, browser extensions) to discover and connect to the

package/dist/managed-account.js

@@ -1,5 +1,20 @@
 import fs from 'fs';
 import path from 'path';
+function loadEnvironment(file) {
+    const values = {};
+    for (const raw of fs.readFileSync(file, 'utf8').split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const separator = line.indexOf('=');
+        if (separator > 0)
+            values[line.slice(0, separator)] = line.slice(separator + 1);
+    }
+    return values;
+}
+function managedStateFile(projectDir) {
+    return path.join(projectDir, '.feltdb', 'managed.json');
+}
 async function responseJson(response, fallback) {
     const body = await response.json().catch(() => ({}));
     if (!response.ok)
@@ -43,26 +58,82 @@ export async function configureManagedAccount(options) {
     // Provision through the account origin that issued the human session. The
     // resulting key is still used against apiUrl, but setup must not require a
     // browser session to be trusted by every managed data-plane hostname.
-    const key = await responseJson(await request(`${sessionOrigin}/api/keys`, {
+    const controlKey = await responseJson(await request(`${sessionOrigin}/api/keys`, {
+        method: 'POST', headers,
+        body: JSON.stringify({
+            id: `${options.applicationName}-control`,
+            namespace: application.namespace || options.namespace,
+            application_id: application.id,
+            scopes: [
+                'application:read', 'application:write', 'application:revision:create',
+                'application:revision:read', 'application:revision:promote',
+                'application:environment:read', 'application:environment:write',
+            ],
+        }),
+    }), 'Could not create the managed control-plane key');
+    if (!controlKey.secret)
+        throw new Error('Managed key service did not return the control-plane credential');
+    const dataKey = await responseJson(await request(`${sessionOrigin}/api/keys`, {
         method: 'POST', headers,
         body: JSON.stringify({
-            id: `${options.applicationName}-cli`,
-            namespace: options.namespace,
-            scopes: ['state:read', 'state:write', 'events:read'],
+            id: `${options.applicationName}-runtime`,
+            namespace: application.namespace || options.namespace,
+            application_id: application.id,
+            scopes: [
+                'application:read', 'application:revision:read',
+                'state:read', 'state:write', 'events:read',
+                'workflows:run', 'agents:run', 'capabilities:run',
+            ],
         }),
-    }), 'Could not create the managed application key');
-    if (!key.secret)
-        throw new Error('Managed key service did not return an application secret');
+    }), 'Could not create the managed application data key');
+    if (!dataKey.secret)
+        throw new Error('Managed key service did not return the application data credential');
+    try {
+        await responseJson(await request(`${apiUrl}/api/applications/${encodeURIComponent(application.id)}/revisions`, {
+            headers: { Authorization: `Bearer ${controlKey.secret}` },
+        }), 'Managed control-plane credential was created but is not accepted by the managed API');
+    }
+    catch (error) {
+        await Promise.allSettled([controlKey.id, dataKey.id].filter(Boolean).map(id => request(`${sessionOrigin}/api/keys/${encodeURIComponent(id)}`, { method: 'DELETE', headers })));
+        throw error;
+    }
     const environment = [
         '# Generated by create-feltdb managed setup. Do not commit this file.',
         `VITE_FELTDB_MANAGED_URL=${apiUrl}`,
-        `VITE_FELTDB_MANAGED_API_KEY=${key.secret}`,
-        `VITE_FELTDB_MANAGED_TENANT_ID=${tenant.id}`,
         `VITE_FELTDB_MANAGED_APPLICATION_ID=${application.id}`,
-        `VITE_FELTDB_MANAGED_NAMESPACE=${application.namespace || options.namespace}`,
-        'VITE_FELTDB_MANAGED_ENVIRONMENT=production',
+        '# Control-plane credential. Never prefix this with VITE_ or expose it to browser code.',
+        `FELTDB_MANAGED_CONTROL_API_KEY=${controlKey.secret}`,
+        '# Server/deployment data-plane credential. Never prefix this with VITE_.',
+        `FELTDB_TOKEN=${dataKey.secret}`,
         '',
     ].join('\n');
     fs.writeFileSync(path.join(options.projectDir, '.env.local'), environment, { mode: 0o600 });
+    fs.mkdirSync(path.dirname(managedStateFile(options.projectDir)), { recursive: true });
+    fs.writeFileSync(managedStateFile(options.projectDir), `${JSON.stringify({
+        url: apiUrl,
+        tenantId: tenant.id,
+        applicationId: application.id,
+        namespace: application.namespace || options.namespace,
+        environment: 'production',
+    }, null, 2)}\n`, { mode: 0o600 });
     return { tenant, application, apiUrl };
 }
+export async function finalizeManagedProvisioning(options) {
+    const publishedFile = path.join(options.projectDir, '.feltdb', 'last-published.json');
+    if (!fs.existsSync(publishedFile))
+        throw new Error('Managed provisioning did not produce .feltdb/last-published.json');
+    const published = JSON.parse(fs.readFileSync(publishedFile, 'utf8'));
+    if (!published.revisionId)
+        throw new Error('Managed provisioning did not promote an application revision');
+    const environmentFile = path.join(options.projectDir, '.env.local');
+    const environment = loadEnvironment(environmentFile);
+    const managedFile = managedStateFile(options.projectDir);
+    const managed = JSON.parse(fs.readFileSync(managedFile, 'utf8'));
+    const request = options.fetchImpl || fetch;
+    const discovery = await responseJson(await request(`${managed.url}/v1/application?application_id=${encodeURIComponent(managed.applicationId)}&environment=${encodeURIComponent(managed.environment)}`, { headers: { Authorization: `Bearer ${environment.FELTDB_TOKEN}` } }), 'Managed application data credential is not accepted by the promoted runtime');
+    if (discovery.revision_id !== published.revisionId) {
+        throw new Error('Managed runtime revision does not match the revision promoted during provisioning');
+    }
+    fs.writeFileSync(managedFile, `${JSON.stringify({ ...managed, revisionId: published.revisionId }, null, 2)}\n`, { mode: 0o600 });
+    return { revisionId: published.revisionId };
+}

package/dist/package-versions.js

@@ -1,4 +1,4 @@
 // One release train keeps generated applications installable. The repository
 // validation script checks these values against every workspace manifest.
-export const FELTDB_PACKAGE_VERSION = '0.7.3';
+export const FELTDB_PACKAGE_VERSION = '0.8.0';
 export const feltdbPackageRange = `^${FELTDB_PACKAGE_VERSION}`;

package/dist/server-source/crates/feltdb/src/application.rs

@@ -132,7 +132,10 @@ pub struct CapabilityBinding {
     pub name: String,
     #[serde(default)]
     pub provider: Option<String>,
+    #[serde(default = "public_capability_visibility")]
+    pub visibility: String,
 }
+fn public_capability_visibility() -> String { "public".into() }
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 pub struct SecretReference {
     pub binding: String,
@@ -269,6 +272,9 @@ pub struct ApplicationManifest {
     pub agents: Vec<AgentDefinition>,
     #[serde(default)]
     pub capabilities: Vec<CapabilityBinding>,
+    /// Resolved, provider-neutral module semantic contracts. Secret values are forbidden.
+    #[serde(default)]
+    pub modules: Vec<serde_json::Value>,
     #[serde(default)]
     pub connections: Vec<ConnectionBinding>,
     #[serde(default)]
@@ -310,6 +316,7 @@ impl ApplicationManifest {
             schedules: vec![],
             agents: vec![],
             capabilities: vec![],
+            modules: vec![],
             connections: vec![],
             policies: vec![],
             ui: UiApplicationModel::default(),
@@ -368,7 +375,14 @@ pub struct ValidationReport {
 }
 
 fn is_valid_policy_subject(subject: &str) -> bool {
-    matches!(subject, "authenticated" | "owner" | "member")
+    subject.split('|').map(str::trim).all(|term| {
+        matches!(term, "authenticated" | "owner" | "member")
+            || term.strip_prefix("self(").and_then(|value| value.strip_suffix(')')).is_some_and(|field| {
+                let mut characters = field.chars();
+                characters.next().is_some_and(|value| value == '_' || value.is_ascii_alphabetic())
+                    && characters.all(|value| value == '_' || value.is_ascii_alphanumeric())
+            })
+    })
 }
 
 fn unique(
@@ -540,6 +554,11 @@ pub fn validate_manifest(
         .iter()
         .map(|v| v.name.as_str())
         .collect();
+    for capability in &manifest.capabilities {
+        if !matches!(capability.visibility.as_str(), "public" | "agent" | "workflow" | "internal") {
+            issues.push(issue("semantic", format!("capabilities.{}.visibility", capability.name), "visibility must be public, agent, workflow, or internal"));
+        }
+    }
     let workflows: BTreeSet<_> = manifest.workflows.iter().map(|v| v.name.as_str()).collect();
     let queries: BTreeSet<_> = manifest.queries.iter().map(|v| v.name.as_str()).collect();
     let bindings: BTreeSet<_> = manifest
@@ -718,6 +737,11 @@ pub fn validate_manifest(
             }
         }
     }
+    for (index, module) in manifest.modules.iter().enumerate() {
+        if contains_plaintext_secret(module) || module.get("value").is_some() {
+            issues.push(issue("security", format!("modules.{index}"), "module contracts may declare secret requirements but never secret values"));
+        }
+    }
     for environment in &manifest.environments {
         if environment.configuration.iter().any(|(key, value)| {
             matches!(
@@ -853,6 +877,7 @@ fn sorted(mut manifest: ApplicationManifest) -> ApplicationManifest {
         agent.capabilities.sort();
     }
     sort_name!(manifest.capabilities);
+    manifest.modules.sort_by(|a, b| a.get("id").and_then(Value::as_str).cmp(&b.get("id").and_then(Value::as_str)));
     sort_name!(manifest.connections);
     sort_name!(manifest.policies);
     sort_name!(manifest.ui.bindings);
@@ -2468,6 +2493,21 @@ mod tests {
         );
     }
 
+    #[test]
+    fn policy_with_identity_and_membership_composition_is_valid() {
+        let mut manifest = ApplicationManifest::empty("tenant", "app", "test");
+        manifest.policies.push(PolicyDefinition {
+            name: "InvitationPolicy".into(),
+            resource: "Invitation".into(),
+            read: Some("self(user) | member".into()),
+            write: Some("member".into()),
+            capabilities: vec![],
+        });
+
+        let report = validate_manifest(&manifest, "tenant", "app", None);
+        assert!(report.valid, "composed identity policy should be valid: {:?}", report.issues);
+    }
+
     #[test]
     fn policy_with_invalid_subject_rejected() {
         let mut manifest = ApplicationManifest::empty("tenant", "app", "test");

package/dist/server-source/crates/feltdb/src/authority_failover.rs

@@ -283,6 +283,10 @@ pub enum AuthorityError {
         provided: FencingToken,
         current: FencingToken,
     },
+    QuorumUnavailable {
+        live: usize,
+        required: usize,
+    },
     Io(String),
 }
 
@@ -296,6 +300,12 @@ impl std::fmt::Display for AuthorityError {
             Self::StaleToken { provided, current } => {
                 write!(f, "stale token {provided}, current is {current}")
             }
+            Self::QuorumUnavailable { live, required } => {
+                write!(
+                    f,
+                    "authority quorum unavailable: {live} live, {required} required"
+                )
+            }
             Self::Io(msg) => write!(f, "authority store: {msg}"),
         }
     }
@@ -308,6 +318,20 @@ impl AuthorityStore {
         cluster_id: &str,
         local_node_id: &str,
         local_priority: u32,
+    ) -> Result<Self, AuthorityError> {
+        Self::open_with_failure_detector(path, cluster_id, local_node_id, local_priority, 1_000, 5)
+    }
+
+    /// Open with an explicitly configured failure detector. Production keeps
+    /// the conservative default above; process-level acceptance tests use a
+    /// shorter interval so failure is event-driven without multi-second sleeps.
+    pub fn open_with_failure_detector<P: AsRef<Path>>(
+        path: P,
+        cluster_id: &str,
+        local_node_id: &str,
+        local_priority: u32,
+        heartbeat_interval_ms: u64,
+        failure_threshold: u32,
     ) -> Result<Self, AuthorityError> {
         let path = path.as_ref().to_path_buf();
         let state = if path.exists() {
@@ -323,7 +347,7 @@ impl AuthorityStore {
         Ok(Self {
             path,
             state,
-            heartbeats: HeartbeatState::new(1000, 5), // 1s heartbeat, 5 missed = failure
+            heartbeats: HeartbeatState::new(heartbeat_interval_ms, failure_threshold),
         })
     }
 
@@ -333,8 +357,8 @@ impl AuthorityStore {
             std::fs::create_dir_all(parent).map_err(|e| AuthorityError::Io(e.to_string()))?;
         }
         let temp = self.path.with_extension("tmp");
-        let bytes =
-            serde_json::to_vec_pretty(&self.state).map_err(|e| AuthorityError::Io(e.to_string()))?;
+        let bytes = serde_json::to_vec_pretty(&self.state)
+            .map_err(|e| AuthorityError::Io(e.to_string()))?;
         {
             use std::io::Write;
             let mut file =
@@ -416,7 +440,9 @@ impl AuthorityStore {
 
         let mut record =
             AuthorityRecord::new(self.state.local_node_id.clone(), new_token, previous);
-        record.acknowledgements.insert(self.state.local_node_id.clone());
+        record
+            .acknowledgements
+            .insert(self.state.local_node_id.clone());
 
         self.state.current_authority = Some(record);
         self.state.local_role = AuthorityRole::Authority;
@@ -512,6 +538,31 @@ impl AuthorityStore {
         Ok(())
     }
 
+    /// Validate an authoritative write against both its fencing term and a
+    /// live quorum. A partitioned former authority may not have observed the
+    /// replacement's newer token yet, so fencing alone is insufficient until
+    /// healing; expiry of its quorum evidence closes that split-brain window.
+    pub fn validate_quorum_write(
+        &self,
+        token: FencingToken,
+        required_quorum: usize,
+    ) -> Result<(), AuthorityError> {
+        self.validate_write(Some(token))?;
+        let live = 1 + self
+            .heartbeats
+            .last_seen
+            .keys()
+            .filter(|node_id| !self.heartbeats.is_failed(node_id))
+            .count();
+        if live < required_quorum {
+            return Err(AuthorityError::QuorumUnavailable {
+                live,
+                required: required_quorum,
+            });
+        }
+        Ok(())
+    }
+
     /// Step down from authority role (voluntary).
     pub fn step_down(&mut self) -> Result<(), AuthorityError> {
         if self.state.local_role == AuthorityRole::Authority {
@@ -746,13 +797,40 @@ mod tests {
         assert!(heartbeats.is_failed("A"));
     }
 
+    #[test]
+    fn partitioned_authority_loses_write_quorum() {
+        let dir = tempfile::tempdir().unwrap();
+        let mut store = AuthorityStore::open_with_failure_detector(
+            dir.path().join("authority.json"),
+            "test-cluster",
+            "A",
+            10,
+            1,
+            1,
+        )
+        .expect("open authority store");
+        let token = match store.claim_authority().expect("claim") {
+            ClaimResult::Granted { token } => token,
+            _ => panic!("authority claim was not granted"),
+        };
+        store.heartbeat("B");
+        assert!(store.validate_quorum_write(token, 2).is_ok());
+        store.heartbeats.last_seen.insert("B".to_string(), 0);
+        assert!(matches!(
+            store.validate_quorum_write(token, 2),
+            Err(AuthorityError::QuorumUnavailable {
+                live: 1,
+                required: 2
+            })
+        ));
+    }
+
     #[test]
     fn recovery_from_fenced() {
         let dir = tempfile::tempdir().unwrap();
         let path = dir.path().join("authority.json");
 
-        let mut store =
-            AuthorityStore::open(&path, "test-cluster", "A", 10).expect("open store");
+        let mut store = AuthorityStore::open(&path, "test-cluster", "A", 10).expect("open store");
         store.claim_authority().expect("claim");
 
         // Get fenced