create-pmos 0.55.5 → 0.57.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-pmos",
-  "version": "0.55.5",
+  "version": "0.57.0",
   "description": "Scaffold the PMOS portable kit — run the PMOS product-management workflow (initiative → lane-fit spec → contract → build → three gates, with work-type lanes for features, research, maintenance, incidents, and content) entirely inside your own repo, with all state as git-versioned files. Includes `workflow-sweep`, which audits the state every board derives from and separates real defects from work you simply have not done. `create-pmos workspace` also installs + launches the local Terminal Workspace GUI. No database, no network, no telemetry.",
   "license": "MIT",
   "bin": {

package/payload/KIT-VERSION

@@ -1,3 +1,3 @@
-kernel-source: pmos@39b0c74
+kernel-source: pmos@d3d97f5
 assembled: 2026-10-06
 mode: vendor

package/payload/planning/evals/eval-calibration.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Eval calibration log"
 description: "Append-only record of every PM override of an evaluator verdict."
-generated: {by: process:create-pmos, at: "2026-10-06T10:22:39Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T11:08:49Z"}
 status: stable
 ---
 

package/payload/planning/okrs/health-budgets.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Health budgets"
 description: "Closed registry of health-budget anchors (D59), edited only by the PM."
-generated: {by: process:create-pmos, at: "2026-10-06T10:22:39Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T11:08:49Z"}
 status: stable
 ---
 

package/payload/state/discoveries.md

@@ -2,7 +2,7 @@
 type: Reference
 title: "Discoveries and friction log"
 description: "Append-only record of what runs discovered and where the process rubbed."
-generated: {by: process:create-pmos, at: "2026-10-06T10:22:39Z"}
+generated: {by: process:create-pmos, at: "2026-10-06T11:08:49Z"}
 status: stable
 ---
 

package/workspace/REMOTE.md

@@ -64,7 +64,7 @@ The steps below do the same thing by hand, from a PMOS checkout.
 
    Under those lines it prints the phone URL as a **QR code**, and the same URL as text (`http://100.x.y.z:7433/?token=<token>`). The token is shown only at startup and never logged again. A token you supply with `PMOS_TOKEN` is never printed, so that mode prints no QR code.
 
-3. **Open it from your phone.** Point the phone camera at the QR code and open the link. Or type the URL into the phone's browser. The server sets a sign-in cookie (7 days) and redirects to `http://100.x.y.z:7433/`, so the token does not stay in the address bar or the history.
+3. **Open it from your phone.** Point the phone camera at the QR code and open the link. Or type the URL into the phone's browser. The server sets a sign-in cookie (30 days) and redirects to `http://100.x.y.z:7433/`, so the token does not stay in the address bar or the history.
 
    If the phone has no valid cookie, it shows a **sign-in page**. Paste the token there. The field is a password field, so the phone's password manager can save it. This is also what you see after the cookie expires, or after a restart that generated a new token.
 
@@ -123,7 +123,40 @@ Two locks protect the workspace, and each one is enforced by the server:
 
 The Access check in the server is a **presence check**: it confirms that Access is in front, and it fails closed when you forget the Access application. It does not verify the assertion's signature, because that needs Cloudflare's signing keys fetched over the network, and the workspace makes no outbound requests (D79). The origin listens on loopback only, so the tunnel is the only way to reach it with the public hostname.
 
-### Setup
+### The Online switch (recommended)
+
+With the Online switch, the workspace runs the tunnel itself, and Cloudflare Access is the only login. You do not need a start line, a second terminal or the workspace token on your phone (D89).
+
+How the switch protects the workspace:
+
+- On the public hostname, the server checks the `Cf-Access-Jwt-Assertion` header on every request and on every terminal connection. The assertion must be signed by your Cloudflare team's key, be for your Access application's audience tag, be in date, and be for the one email you allow. If any check fails, the server returns `403`.
+- To check the signature, the server gets your team's public keys from `https://<team>.cloudflareaccess.com/cdn-cgi/access/certs`. It does this only while Online is on, at most once an hour, plus once a minute at most for a new key. This is the only outbound request it makes for Online. It sends nothing of yours.
+- Only the computer that runs the workspace can change the switch or its settings. A phone can see the state but cannot change it.
+
+Do these steps one time:
+
+1. **Create the tunnel and its DNS record** on the computer that runs the workspace:
+
+   ```sh
+   brew install cloudflared            # or your platform's package
+   cloudflared tunnel login
+   cloudflared tunnel create pmos
+   cloudflared tunnel route dns pmos pmos.example.com
+   ```
+
+   Write `~/.cloudflared/config.yml` as in step 4 of the manual setup below, with your hostname.
+
+2. **Create the Access application.** In Cloudflare Zero Trust, go to **Access › Applications › Add an application › Self-hosted**. Set the subdomain and domain to your hostname. Add one policy: **Allow**, **Emails**, your email address. On the application's **Overview**, copy the **Application Audience (AUD) Tag**.
+
+3. **Optional: sign in with Google.** Go to **Settings › Authentication › Login methods › Add new › Google**, and follow the steps there to create a Google OAuth client. In the Access application's **Login methods**, select Google and turn on **Instant Auth**, so the login goes directly to Google.
+
+4. **Fill in the Online section.** In the workspace on that computer, open **Settings › Online**. Enter the public address, the tunnel name (`pmos`), your team domain (`<team>.cloudflareaccess.com`, shown under **Settings › Custom Pages** in Zero Trust), the AUD tag and your email. Then select **Turn on**.
+
+The status line shows when the tunnel runs. Open your hostname on the phone and sign in with Google or the email code. The workspace remembers the switch: if it restarts while Online is on, it goes online again. Select **Turn off** to stop the tunnel. The hostname then gets `403` at once. The tunnel's output is in `online-tunnel.log` in the workspace state folder.
+
+If `PMOS_PUBLIC_HOST` is set when the workspace starts, the switch is not available, and the manual setup below applies.
+
+### Setup by hand (`PMOS_PUBLIC_HOST`, with the token)
 
 1. **Pick the machine.** Use a machine that stays on: your desktop, or a small Linux VPS. Install the workspace there as usual, and sign in to your agent CLI in a workspace terminal.
 
@@ -162,7 +195,7 @@ The Access check in the server is a **presence check**: it confirms that Access
 
 6. **Start the tunnel:** `cloudflared tunnel run pmos`. To keep it running after a reboot, install it as a service (`sudo cloudflared service install`).
 
-7. **Open `https://pm-os.app/`.** Cloudflare asks for your login. The workspace then shows its sign-in page. Paste the token. The workspace sets a `Secure` session cookie for 7 days.
+7. **Open `https://pm-os.app/`.** Cloudflare asks for your login. The workspace then shows its sign-in page. Paste the token. The workspace sets a `Secure` session cookie for 30 days. Set the Access application's session duration to 1 month as well, so each device signs in about once a month.
 
 ### Check that it is closed
 
@@ -184,6 +217,8 @@ Run these from a machine that is **not** signed in to Access:
 - **`403` "the public host is only reachable through Cloudflare Access"** — the request reached the workspace without passing Access. Create the Access application for the hostname (Setup step 3).
 - **`403` "forbidden origin/host" on the public hostname** — `PMOS_PUBLIC_HOST` is not set, or it names another hostname, or the tunnel rewrites the `Host` header. Remove `httpHostHeader` from the tunnel's ingress rule.
 - **A local reverse proxy now gets `401`** — it adds a forwarding header, so its requests need the token. This is intended.
+- **`403` "your Cloudflare sign-in could not be verified for this workspace"** (Online switch) — check the AUD tag, the team domain and the email in **Settings › Online**. The email must be the one you sign in with. If the Online section says the keys did not load, check the team domain.
+- **Cloudflare error 1033** — the tunnel is not running. In **Settings › Online**, check the status line, and read `online-tunnel.log` in the workspace state folder. Another `cloudflared` for the same tunnel (for example a service you installed) also serves the hostname.
 
 - **"refusing to bind … only loopback or a Tailscale tailnet address (100.64.0.0/10) is permitted"** — you passed `PMOS_BIND_ADDR` (or `PMOS_TAILNET_IP`) that isn't loopback or tailnet. Use your real `tailscale ip -4` value.
 - **"no Tailscale tailnet address … was found"** — Tailscale isn't up on this machine. Run `tailscale up`, or set `PMOS_TAILNET_IP`.

package/workspace/guide/docs.md

@@ -0,0 +1,96 @@
+---
+type: Guide
+title: "Docs: is each document the same as its Google Docs and Confluence copy, and which version to use"
+timestamp: 2026-10-06
+---
+
+# Docs
+
+Open Docs from ⌘K (**Docs**) or press `g d`.
+
+Docs lists every document in the repository that has a copy in Google Docs or Confluence. For each copy, it shows whether the repository version (PMOS) or the copy is newer. You can then use one version over the other, one copy at a time.
+
+Nothing syncs by itself. A copy changes only when you press a button for that copy.
+
+## The list
+
+The copies are grouped by initiative. Copies of files that no initiative owns are under **Other**.
+
+**Needs you** shows the copies that are not the same. **All** shows every copy.
+
+Each copy is one line:
+
+- a status dot;
+- the document title, and a link that opens the copy in a new tab;
+- one sentence, for example "PMOS is newer · You, today 09:12";
+- at most one button.
+
+| Sentence | Means | Button |
+|---|---|---|
+| Same | The last compare found the same text, and neither side changed since. | none |
+| PMOS is newer | The repository file changed since the two sides last matched. The copy did not. | Use PMOS version |
+| Confluence is newer (or Google Docs) | The copy changed since the two sides last matched. The repository file did not. | Use Confluence version |
+| Edited on both sides | Both changed since the two sides last matched. | Choose… |
+| Not compared yet | No compare has read the copy. | none |
+| Can't open in Confluence | The compare could not read the copy. The reason is shown. | none |
+| Not found in Confluence | The copy is deleted or in the trash. | none |
+| Not in PMOS any more | The repository file is not there. | none |
+| Sync failed | The last sync of this copy wrote nothing. The reason is shown. | as before the sync |
+
+"by date" after a sentence means that the two sides have never matched. The newer modified date then decides.
+
+Frontmatter is not part of the text. A change to the frontmatter only does not change the sentence.
+
+## The details
+
+Click a line to see its details:
+
+- **PMOS**: the repository path and its last edit;
+- the copy: its address and its last edit;
+- a **Use … version** button for each side;
+- the first difference that the compare found, when it found one;
+- **Compare again** and **Stop tracking this copy**.
+
+**Stop tracking this copy** removes the link. The copy is not deleted. Press **Undo** in the message to link it again.
+
+## Use a version
+
+**Use PMOS version** writes the repository text to the copy. **Use Confluence version** (or Google Docs) writes the copy's text to the repository file.
+
+1. Press the button. The line says "Updating Confluence…" and a message shows **Undo**.
+2. To cancel, press **Undo** within five seconds. Nothing is changed.
+3. After five seconds, PMOS starts a session with the `doc-sync` skill. The session writes one side only, with your own Google Drive or Atlassian connector. If PMOS asks you to allow the write, allow it in the session.
+4. When the session finishes, the line says **Same**.
+
+A sync never creates, moves or deletes a page or a file. When the copy's text is written to the repository file, the file's frontmatter stays as it is. The session does not commit: use Sync in the bar to commit and push the change.
+
+## Compare
+
+PMOS cannot read Google Docs or Confluence itself. **↻** next to "Compared … ago" starts a session that reads every copy with your own connectors. The session reads only. The sentences change when it finishes.
+
+A compare runs only when you press it. There is no schedule. An edit to a repository file changes its sentence at once, without a compare.
+
+## Add a copy
+
+Type in **Find a document**. The search finds every markdown file in the repository by its title or path, also files that have no copy. A file with no copy shows **No copy** and **Add copy**.
+
+Press **Add copy**, paste the address of the Google Doc or Confluence page, and press Enter. A document can have one Google Doc and one Confluence page.
+
+A link that you add in an initiative's artifacts is the same link and shows here too.
+
+## From a terminal
+
+| Command | Does |
+|---|---|
+| `pmos docs list` | Each linked document and its signal per copy. `--attention` lists only what is not the same. |
+| `pmos docs find [words]` | The repository's markdown files that match, and their copies. |
+| `pmos docs link <file> <address>` | Links a repository file to a Google Doc or a Confluence page. |
+| `pmos docs unlink <file> google` | Removes the link (`google` or `confluence`). The copy is not touched. |
+| `pmos docs check-start` | Used by the compare session: opens a compare and lists what to read. |
+| `pmos docs record <check> --file <readings.json>` | Used by the compare session: records what it read. |
+| `pmos docs check-finish <check>` | Used by the compare session: closes the compare. |
+| `pmos docs sync-start <file> confluence --use pmos` | Used by the sync session: opens a sync of one copy (`--use copy` for the other direction). |
+| `pmos docs sync-finish <sync> --version <v>` | Used by the sync session: closes the sync. The two sides are now the same. |
+| `pmos docs sync-fail <sync> --reason "…"` | Used by the sync session: closes the sync. Nothing was written. |
+
+The session commands must name who read or wrote. In a workspace session that is the session. Outside the workspace, add `--by <profile>`.

package/workspace/guide/index.md

@@ -13,7 +13,7 @@ This guide describes the PMOS workspace as it works today. It ships with the app
 On a desktop the workspace is one frame. [Layout](layout.md) explains each part.
 
 1. **The top bar.** Repository ▾, the four places, search (⌘K), Sync when the repository is not in sync, and Settings.
-2. **The place.** One of Today, Initiatives, Board or Reports. It fills the screen under the bar.
+2. **The place.** One of Today, Initiatives, Board or Reports, or Docs (⌘K or `g d`). It fills the screen under the bar.
 3. **The detail.** The item you opened: an initiative with its status, next steps and artifacts, or the profiles. It opens beside the place and closes with ×.
 4. **The agent dock.** Terminals, documents, conversations and web pages. It is open on Today and a thin rail elsewhere.
 
@@ -26,6 +26,7 @@ On a desktop the workspace is one frame. [Layout](layout.md) explains each part.
 | The sessions of a repository, by initiative | The agent dock. ⌘K → **Branches and sessions** lists the branches. |
 | The items of an initiative | Board, or Breakdown in the initiative detail |
 | Run reports | Reports |
+| Whether a document is the same as its Google Docs or Confluence copy | Docs: ⌘K → **Docs**, or press `g d` |
 | Repositories, Profiles, New sessions (the default CLI and model), Validate consent, Theme | Settings |
 | Validate | Settings, under Validate consent: **Open Validate** |
 | A document, a decision record, a memory entry, a page of this guide | ⌘K, with its scope: Knowledge, Memory or Guide |
@@ -35,6 +36,7 @@ On a desktop the workspace is one frame. [Layout](layout.md) explains each part.
 ## Where to read next
 
 - [Start the workspace without a terminal](launcher.md): the PMOS app, the login item and `pmos launcher`.
+- [Docs](docs.md): whether each linked document is the same as, ahead of or behind its Google Docs and Confluence copy.
 - [Layout](layout.md): the frame, the keys and the rule for where a list or a detail opens.
 - [Statuses](statuses.md): what each status means, where it comes from, and what you can change.
 - [Initiatives and next steps](initiatives-and-next-steps.md): the detail, the next steps, and the artifacts.

package/workspace/guide/layout.md

@@ -25,12 +25,13 @@ Each place is drawn when its run is built. Until then the place says which run b
 
 ## Settings
 
-Settings holds settings only, in five sections:
+Settings holds settings only, in six sections:
 
 - **Repositories**: every registered repository. Press a repository to make it the current one. Press its ⋯ for **Rename** or **Remove from PMOS**. Each asks in a sheet, and a remove asks you to confirm. **Add repository** shows the scan of a folder before you add it.
 - **Profiles**: the Claude profiles a session can start with. They open in the detail.
 - **New sessions**: the default CLI and the default model for a new session in the dock.
 - **Validate consent**: the consent of the current repository. Turn it on or off here. **Open Validate** opens the Validate page as a tab.
+- **Online**: puts this workspace at your own address, such as `pmos.pm-os.app`, through a Cloudflare tunnel. Enter the public address, the tunnel name, your Cloudflare team domain, the Access audience (AUD) tag and your email, then press **Turn on**. The workspace runs the tunnel and remembers the switch when it restarts. On your phone, open the address and sign in with Cloudflare Access (Google or an email code). The workspace does not ask for its token there. Only the computer that runs the workspace can change this section. A phone sees whether it is on. [REMOTE.md](../REMOTE.md) has the one-time Cloudflare steps.
 - **Theme**: Dark or Light.
 
 Your work is never in Settings. It is in Today, Initiatives, Board and Reports.

package/workspace/lib/access-jwt.js

@@ -0,0 +1,66 @@
+'use strict';
+/* access-jwt.js — checks a Cloudflare Access assertion (workspace-online-mode, D89).
+ *
+ * Cloudflare Access adds `Cf-Access-Jwt-Assertion` to every request it lets through to the origin: a JSON Web
+ * Token signed RS256 with one of the team's keys. While Online is on, a request to the public hostname passes
+ * on this token instead of the workspace token, so every check below must hold or the request is refused:
+ *
+ *   - three base64url parts, a JSON header and payload;
+ *   - header.alg is RS256 (never `none`, never HMAC) and header.kid names a key the caller holds;
+ *   - the RSA-SHA256 signature over `<header>.<payload>` verifies with that key;
+ *   - iss is `https://<team domain>`;
+ *   - aud (a string or a list) includes the configured audience tag;
+ *   - exp is in the future and nbf (when present) is not, with 60 seconds of clock skew;
+ *   - email is the one allowed address (compared without case).
+ *
+ * Pure: no I/O and no clock of its own (`now` is passed in, in seconds). The keys come from lib/access-keys.js.
+ * Nothing here logs the token, a claim or a key (D08); a refusal carries a short reason for tests and the
+ * status line, never the token.
+ */
+const crypto = require('crypto');
+
+const SKEW = 60;   // seconds
+
+function b64urlJson(part) {
+  try { return JSON.parse(Buffer.from(String(part), 'base64url').toString('utf8')); } catch { return null; }
+}
+
+/** Split a compact JWT. Returns null for anything that is not three non-empty base64url parts with JSON in the first two. */
+function parse(token) {
+  if (typeof token !== 'string' || token.length > 16384) return null;
+  const parts = token.split('.');
+  if (parts.length !== 3 || parts.some((p) => !p || !/^[A-Za-z0-9_-]+$/.test(p))) return null;
+  const header = b64urlJson(parts[0]);
+  const payload = b64urlJson(parts[1]);
+  if (!header || typeof header !== 'object' || !payload || typeof payload !== 'object') return null;
+  return { header, payload, signingInput: parts[0] + '.' + parts[1], signature: Buffer.from(parts[2], 'base64url') };
+}
+
+/**
+ * verify(token, { keyFor, teamDomain, audience, email, now }) → { ok: true, email } | { ok: false, reason, kid? }
+ *   keyFor(kid) → a crypto KeyObject or null. A refusal for an unknown key carries `kid`, so the caller can
+ *   refetch the key set once and try again.
+ */
+function verify(token, { keyFor, teamDomain, audience, email, now } = {}) {
+  const t = parse(token);
+  if (!t) return { ok: false, reason: 'malformed' };
+  if (t.header.alg !== 'RS256') return { ok: false, reason: 'algorithm' };
+  const kid = typeof t.header.kid === 'string' ? t.header.kid : '';
+  const key = kid && typeof keyFor === 'function' ? keyFor(kid) : null;
+  if (!key) return { ok: false, reason: 'unknown key', kid };
+  let good = false;
+  try { good = crypto.verify('RSA-SHA256', Buffer.from(t.signingInput), key, t.signature); } catch { good = false; }
+  if (!good) return { ok: false, reason: 'signature' };
+  const p = t.payload;
+  if (!teamDomain || p.iss !== 'https://' + teamDomain) return { ok: false, reason: 'issuer' };
+  const auds = Array.isArray(p.aud) ? p.aud : [p.aud];
+  if (!audience || !auds.includes(audience)) return { ok: false, reason: 'audience' };
+  const n = Number(now);
+  if (typeof p.exp !== 'number' || !(p.exp + SKEW > n)) return { ok: false, reason: 'expired' };
+  if (p.nbf != null && (typeof p.nbf !== 'number' || p.nbf - SKEW > n)) return { ok: false, reason: 'not yet valid' };
+  const who = typeof p.email === 'string' ? p.email.trim().toLowerCase() : '';
+  if (!email || !who || who !== String(email).trim().toLowerCase()) return { ok: false, reason: 'email' };
+  return { ok: true, email: who };
+}
+
+module.exports = { verify, parse, SKEW };

package/workspace/lib/access-keys.js

@@ -0,0 +1,104 @@
+'use strict';
+/* access-keys.js — the team's public signing keys for Cloudflare Access (workspace-online-mode, D89).
+ *
+ * THE ONE NETWORK CALL OF D89. This module, and no other file, may GET
+ *   https://<team>.cloudflareaccess.com/cdn-cgi/access/certs
+ * where <team>.cloudflareaccess.com is the PM's configured team domain. The request carries no body, no
+ * cookie and no credential, and the answer is Cloudflare's PUBLIC key set. no-network.test.js names this
+ * file as the second exception beside D79's lib/typesafe.js.
+ *
+ * When it fetches (createStore):
+ *   - only when asked: the server asks only while Online is on (D89 rule 1);
+ *   - a key set older than an hour is refreshed on the next request that needs a key;
+ *   - a key id the store does not hold triggers one refetch, at most once a minute;
+ *   - a failed fetch keeps the keys already held. With none held, every lookup returns null and the guard
+ *     refuses (fail closed).
+ * Keys are held in memory only. Nothing here logs a key, a response or a header (D08).
+ */
+const crypto = require('crypto');
+const https = require('https');
+
+const TEAM_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.cloudflareaccess\.com$/;
+const REFRESH_MS = 60 * 60 * 1000;
+const MISS_MS = 60 * 1000;
+const TIMEOUT_MS = 5000;
+const MAX_BYTES = 64 * 1024;
+
+function validTeamDomain(d) { return typeof d === 'string' && TEAM_RE.test(d); }
+function certsUrl(teamDomain) { return 'https://' + teamDomain + '/cdn-cgi/access/certs'; }
+
+/** GET the key set. Resolves with the parsed JSON, rejects on any failure. Refuses any host but a team domain. */
+function fetchCerts(teamDomain) {
+  return new Promise((resolve, reject) => {
+    if (!validTeamDomain(teamDomain)) return reject(new Error('not a cloudflareaccess.com team domain'));
+    const req = https.get(certsUrl(teamDomain), { headers: { accept: 'application/json' }, timeout: TIMEOUT_MS }, (res) => {
+      if (res.statusCode !== 200) { res.resume(); return reject(new Error('status ' + res.statusCode)); }
+      let size = 0; const chunks = [];
+      res.on('data', (c) => { size += c.length; if (size > MAX_BYTES) { req.destroy(); reject(new Error('too large')); } else chunks.push(c); });
+      res.on('end', () => { try { resolve(JSON.parse(Buffer.concat(chunks).toString('utf8'))); } catch { reject(new Error('not JSON')); } });
+    });
+    req.on('timeout', () => req.destroy(new Error('timeout')));
+    req.on('error', reject);
+  });
+}
+
+/** A JWKS object → Map(kid → KeyObject). RSA keys only; anything unreadable is skipped. */
+function keysFromJwks(jwks) {
+  const out = new Map();
+  for (const k of (jwks && Array.isArray(jwks.keys) ? jwks.keys : [])) {
+    if (!k || k.kty !== 'RSA' || typeof k.kid !== 'string' || !k.n || !k.e) continue;
+    try { out.set(k.kid, crypto.createPublicKey({ key: { kty: 'RSA', n: k.n, e: k.e }, format: 'jwk' })); } catch { /* skip */ }
+  }
+  return out;
+}
+
+/**
+ * createStore({ teamDomain, fetch = fetchCerts, clock = Date.now }) → {
+ *   keyFor(kid)       the KeyObject held for kid, or null (sync; what access-jwt.verify calls)
+ *   ensure()          Promise: refresh when the set is missing or older than an hour
+ *   refetchFor(kid)   Promise<boolean>: one refetch for an unknown kid, at most once a minute; true when kid is now held
+ *   status()          { keys, fetchedAt, lastError } — counts and times only, never a key
+ * }
+ */
+function createStore({ teamDomain, fetch = fetchCerts, clock = Date.now } = {}) {
+  let keys = new Map();
+  let fetchedAt = 0;
+  let lastTry = 0;
+  let lastError = null;
+  let inflight = null;
+
+  function load() {
+    if (inflight) return inflight;
+    lastTry = clock();
+    inflight = Promise.resolve()
+      .then(() => fetch(teamDomain))
+      .then((jwks) => {
+        const next = keysFromJwks(jwks);
+        if (!next.size) throw new Error('no usable keys');
+        keys = next; fetchedAt = clock(); lastError = null;
+      })
+      .catch((e) => { lastError = String((e && e.message) || 'fetch failed'); })
+      .finally(() => { inflight = null; });
+    return inflight;
+  }
+  return {
+    keyFor: (kid) => keys.get(kid) || null,
+    ensure() {
+      if (inflight) return inflight;     // a request that arrives during the first fetch waits for it
+      const now = clock();
+      if (keys.size && now - fetchedAt < REFRESH_MS) return Promise.resolve();
+      if (lastTry && now - lastTry < MISS_MS) return Promise.resolve();   // a failing fetch is retried at most once a minute
+      return load();
+    },
+    async refetchFor(kid) {
+      if (inflight) await inflight;
+      if (keys.has(kid)) return true;
+      if (clock() - lastTry < MISS_MS) return false;
+      await load();
+      return keys.has(kid);
+    },
+    status: () => ({ keys: keys.size, fetchedAt: fetchedAt || null, lastError }),
+  };
+}
+
+module.exports = { createStore, fetchCerts, keysFromJwks, validTeamDomain, certsUrl, REFRESH_MS, MISS_MS };