everything-dev 2.0.0-rc.6 → 2.0.0-rc.8

package/README.md

@@ -7,7 +7,7 @@ A consolidated product package for building Module Federation apps with oRPC API
 - `everything-dev/types` - Zod schemas and TypeScript types
 - `everything-dev/config` - Config loading and resolution
 - `everything-dev/shared` - Shared dependency policy generation
-- `everything-dev/mf` - Module Federation runtime utilities
+- `everything-dev/federation` - Module Federation runtime utilities
 - `everything-dev/plugin` - Plugin authoring (re-exports from every-plugin)
 - `everything-dev/api` - API plugin loading and router stitching
 - `everything-dev/host` - Host server orchestration
@@ -42,7 +42,7 @@ everything-dev/shared (generate shared deps policy)
   ↓
 everything-dev/host (orchestrate)
   ├── everything-dev/api (load API plugins via MF)
-  └── everything-dev/mf (load UI remote via MF)
+  └── everything-dev/federation (load UI remote via MF)
 ```
 
 ## MF Manifest Standard

package/dist/api/auth-middleware.cjs

@@ -132,6 +132,18 @@ function createAuthMiddleware(builder, options) {
 		}
 		return next({ context: { apiKey: context.apiKey } });
 	});
+	const requirePermission = (resource, action, scope) => builder.middleware(async ({ context, next }, input) => {
+		let granted;
+		if (scope?.scope === "team") {
+			const teamId = scope.teamId?.(input);
+			granted = (context.organization?.teams?.find((t) => t.id === teamId))?.permissions?.[resource];
+		} else granted = context.permissions?.[resource];
+		if (!granted?.includes(action)) throw new _orpc_server.ORPCError("FORBIDDEN", {
+			message: `Requires permission: ${resource}:${action}`,
+			data: { requiredPermissions: [`${resource}:${action}`] }
+		});
+		return next({ context });
+	});
 	return {
 		requireAuth,
 		requireAuthOrApiKey,
@@ -139,7 +151,8 @@ function createAuthMiddleware(builder, options) {
 		requireAdmin,
 		requireOrganization,
 		requireOrgRole,
-		requireApiKey
+		requireApiKey,
+		requirePermission
 	};
 }
 function assertOrganizationApproval(organization) {

package/dist/api/auth-middleware.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth-middleware.cjs","names":["ORPCError"],"sources":["../../src/api/auth-middleware.ts"],"sourcesContent":["/**\n * Server-side auth middleware factory — framework home for the factory that\n * used to live as five near-identical copies (`api/src/lib/auth.ts` and each\n * plugin's `src/lib/auth.ts`). See citynode.app#207.\n *\n * Generic over the workspace's auth context (the generated `AuthPluginContext`\n * satisfies `AuthContextShape`), so each workspace imports the same factory and\n * passes its own context type for precise middleware narrowing:\n *\n *   const { requireAuth, requireAdmin, ... } = createAuthMiddleware<AuthContext>(builder);\n */\nimport type { DecoratedMiddleware } from \"@orpc/server\";\nimport { ORPCError } from \"@orpc/server\";\nimport type { z } from \"zod\";\n\n/** Structural minimum the middlewares read — the generated `AuthPluginContext` satisfies it. */\nexport interface AuthContextShape {\n  user?: { role?: string | null } | null;\n  userId?: string | null;\n  apiKey?: { permissions?: Record<string, string[]> | null } | null;\n  organization?: {\n    activeOrganizationId?: string | null;\n    member?: { id?: string | null; role?: string | null } | null;\n    organization?: { metadata?: Record<string, unknown> | null; status?: string } | null;\n  } | null;\n}\n\ntype OrgMetaType<TSchema extends z.ZodType | undefined> = TSchema extends z.ZodType\n  ? z.infer<TSchema>\n  : Record<string, unknown>;\n\nexport function createAuthMiddleware<\n  TContext extends AuthContextShape = AuthContextShape,\n  TOrgMetaSchema extends z.ZodType | undefined = undefined,\n>(builder: any, options?: { orgMetaSchema?: TOrgMetaSchema }) {\n  // TContext is used as-is (no intersection) so the narrowed middleware\n  // outputs stay exactly the workspace's own types when it passes its\n  // AuthPluginContext — the constraint only guarantees the guards can read\n  // the structural props.\n  type Ctx = TContext;\n  type TOrgMeta = OrgMetaType<TOrgMetaSchema>;\n  type UserMiddleware = DecoratedMiddleware<\n    Ctx,\n    { userId: string; user: NonNullable<Ctx[\"user\"]> },\n    any,\n    any,\n    any\n  >;\n  type OrgMiddleware = DecoratedMiddleware<\n    Ctx,\n    {\n      userId: string;\n      user: NonNullable<Ctx[\"user\"]>;\n      organization: NonNullable<Ctx[\"organization\"]> & {\n        activeOrganizationId: string;\n        organization:\n          | (NonNullable<NonNullable<Ctx[\"organization\"]>[\"organization\"]> & {\n              metadata: TOrgMeta | null;\n            })\n          | null;\n      };\n    },\n    any,\n    any,\n    any\n  >;\n  type MemberMiddleware = DecoratedMiddleware<\n    Ctx,\n    {\n      userId: string;\n      user: NonNullable<Ctx[\"user\"]>;\n      organization: NonNullable<Ctx[\"organization\"]> & {\n        activeOrganizationId: string;\n        member: NonNullable<NonNullable<Ctx[\"organization\"]>[\"member\"]>;\n        organization:\n          | (NonNullable<NonNullable<Ctx[\"organization\"]>[\"organization\"]> & {\n              metadata: TOrgMeta | null;\n            })\n          | null;\n      };\n    },\n    any,\n    any,\n    any\n  >;\n  type ApiKeyMiddleware = DecoratedMiddleware<\n    Ctx,\n    { apiKey: NonNullable<Ctx[\"apiKey\"]> },\n    any,\n    any,\n    any\n  >;\n\n  const requireAuth = builder.middleware(async ({ context, next }: { context: Ctx; next: any }) => {\n    if (!context.user || !context.userId) {\n      throw new ORPCError(\"UNAUTHORIZED\", {\n        message: \"Authentication required\",\n        data: { hint: \"Sign in to continue\" },\n      });\n    }\n    return next({ context: { userId: context.userId, user: context.user } });\n  }) as UserMiddleware;\n\n  const requireAuthOrApiKey = builder.middleware(\n    async ({ context, next }: { context: Ctx; next: any }) => {\n      if (!context.user && !context.userId && !context.apiKey) {\n        throw new ORPCError(\"UNAUTHORIZED\", {\n          message: \"Authentication required\",\n          data: { hint: \"Sign in or provide an API key\" },\n        });\n      }\n      return next({ context });\n    },\n  ) as DecoratedMiddleware<Ctx, Record<string, never>, any, any, any>;\n\n  const requireRole = <TRoles extends readonly string[]>(...roles: TRoles) =>\n    builder.middleware(async ({ context, next }: { context: Ctx; next: any }) => {\n      if (!context.user || !context.userId) {\n        throw new ORPCError(\"UNAUTHORIZED\", {\n          message: \"Authentication required\",\n          data: { authType: \"session\", hint: \"Sign in to continue\" },\n        });\n      }\n      const currentRole = context.user.role;\n      if (!currentRole || !roles.includes(currentRole)) {\n        throw new ORPCError(\"FORBIDDEN\", {\n          message: `Requires role: ${roles.join(\" or \")}`,\n          data: { requiredRoles: roles, currentRole },\n        });\n      }\n      return next({ context: { userId: context.userId, user: context.user } });\n    }) as UserMiddleware;\n\n  const requireAdmin = requireRole(\"admin\");\n\n  const requireOrganization = builder.middleware(\n    async ({ context, next }: { context: Ctx; next: any }) => {\n      if (!context.user || !context.userId) {\n        throw new ORPCError(\"UNAUTHORIZED\", {\n          message: \"Authentication required\",\n          data: { authType: \"session\", hint: \"Sign in to continue\" },\n        });\n      }\n      if (!context.organization?.activeOrganizationId) {\n        throw new ORPCError(\"FORBIDDEN\", {\n          message: \"Active organization required\",\n          data: { hint: \"Select or create an organization\" },\n        });\n      }\n      const org = context.organization;\n      assertOrganizationApproval(org.organization);\n      return next({\n        context: {\n          userId: context.userId,\n          user: context.user,\n          organization: {\n            ...org,\n            activeOrganizationId: org.activeOrganizationId,\n            organization: org.organization\n              ? {\n                  ...org.organization,\n                  metadata: parseOrgMetadata(org.organization.metadata, options?.orgMetaSchema),\n                }\n              : null,\n          },\n        },\n      });\n    },\n  ) as OrgMiddleware;\n\n  const requireOrgRole = <TRoles extends readonly string[]>(...roles: TRoles) =>\n    builder.middleware(async ({ context, next }: { context: Ctx; next: any }) => {\n      if (!context.user || !context.userId) {\n        throw new ORPCError(\"UNAUTHORIZED\", {\n          message: \"Authentication required\",\n          data: { authType: \"session\", hint: \"Sign in to continue\" },\n        });\n      }\n      if (!context.organization?.activeOrganizationId) {\n        throw new ORPCError(\"FORBIDDEN\", {\n          message: \"Active organization required\",\n          data: { hint: \"Select or create an organization\" },\n        });\n      }\n      const member = context.organization?.member;\n      if (!member?.id || !member?.role || !roles.includes(member.role)) {\n        throw new ORPCError(\"FORBIDDEN\", {\n          message: `Requires organization role: ${roles.join(\" or \")}`,\n          data: { requiredRoles: roles, currentRole: member?.role ?? null },\n        });\n      }\n      const org = context.organization;\n      assertOrganizationApproval(org.organization);\n      return next({\n        context: {\n          userId: context.userId,\n          user: context.user,\n          organization: {\n            ...org,\n            activeOrganizationId: org.activeOrganizationId,\n            member: { id: member.id, role: member.role },\n            organization: org.organization\n              ? {\n                  ...org.organization,\n                  metadata: parseOrgMetadata(org.organization.metadata, options?.orgMetaSchema),\n                }\n              : null,\n          },\n        },\n      });\n    }) as MemberMiddleware;\n\n  const requireApiKey = (requiredPermissions?: Record<string, string[]>) =>\n    builder.middleware(async ({ context, next }: { context: Ctx; next: any }) => {\n      if (!context.apiKey) {\n        throw new ORPCError(\"UNAUTHORIZED\", {\n          message: \"API key required\",\n          data: { authType: \"apiKey\", hint: \"Provide a valid API key via x-api-key header\" },\n        });\n      }\n      if (requiredPermissions) {\n        const keyPerms = context.apiKey.permissions ?? {};\n        for (const [resource, actions] of Object.entries(requiredPermissions)) {\n          const allowed = keyPerms[resource] ?? [];\n          const missing = actions.filter((a: string) => !allowed.includes(a));\n          if (missing.length > 0) {\n            throw new ORPCError(\"FORBIDDEN\", {\n              message: `API key lacks permission: ${resource}:${missing.join(\",\")}`,\n              data: { requiredPermissions, keyPermissions: keyPerms },\n            });\n          }\n        }\n      }\n      return next({ context: { apiKey: context.apiKey } });\n    }) as ApiKeyMiddleware;\n\n  return {\n    requireAuth,\n    requireAuthOrApiKey,\n    requireRole,\n    requireAdmin,\n    requireOrganization,\n    requireOrgRole,\n    requireApiKey,\n  };\n}\n\nfunction assertOrganizationApproval(\n  organization: NonNullable<AuthContextShape[\"organization\"]>[\"organization\"],\n) {\n  if (organization?.status && organization.status !== \"active\") {\n    throw new ORPCError(\"FORBIDDEN\", {\n      message: \"Organization requires platform-admin approval\",\n    });\n  }\n}\n\nfunction parseOrgMetadata<TSchema extends z.ZodType | undefined>(\n  raw: Record<string, unknown> | null | undefined,\n  schema: TSchema | undefined,\n): OrgMetaType<TSchema> | null {\n  if (!raw) return null;\n  if (!schema) return raw as OrgMetaType<TSchema>;\n  const result = schema.safeParse(raw);\n  if (result.success) return result.data as OrgMetaType<TSchema>;\n  throw new ORPCError(\"INTERNAL_SERVER_ERROR\", {\n    message: \"Invalid organization metadata\",\n    data: { errors: result.error.issues },\n  });\n}\n"],"mappings":";;;;AA+BA,SAAgB,qBAGd,SAAc,SAA8C;CA2D5D,MAAM,cAAc,QAAQ,WAAW,OAAO,EAAE,SAAS,WAAwC;EAC/F,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,QAC5B,MAAM,IAAIA,uBAAU,gBAAgB;GAClC,SAAS;GACT,MAAM,EAAE,MAAM,sBAAsB;EACtC,CAAC;EAEH,OAAO,KAAK,EAAE,SAAS;GAAE,QAAQ,QAAQ;GAAQ,MAAM,QAAQ;EAAK,EAAE,CAAC;CACzE,CAAC;CAED,MAAM,sBAAsB,QAAQ,WAClC,OAAO,EAAE,SAAS,WAAwC;EACxD,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,UAAU,CAAC,QAAQ,QAC/C,MAAM,IAAIA,uBAAU,gBAAgB;GAClC,SAAS;GACT,MAAM,EAAE,MAAM,gCAAgC;EAChD,CAAC;EAEH,OAAO,KAAK,EAAE,QAAQ,CAAC;CACzB,CACF;CAEA,MAAM,eAAiD,GAAG,UACxD,QAAQ,WAAW,OAAO,EAAE,SAAS,WAAwC;EAC3E,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,QAC5B,MAAM,IAAIA,uBAAU,gBAAgB;GAClC,SAAS;GACT,MAAM;IAAE,UAAU;IAAW,MAAM;GAAsB;EAC3D,CAAC;EAEH,MAAM,cAAc,QAAQ,KAAK;EACjC,IAAI,CAAC,eAAe,CAAC,MAAM,SAAS,WAAW,GAC7C,MAAM,IAAIA,uBAAU,aAAa;GAC/B,SAAS,kBAAkB,MAAM,KAAK,MAAM;GAC5C,MAAM;IAAE,eAAe;IAAO;GAAY;EAC5C,CAAC;EAEH,OAAO,KAAK,EAAE,SAAS;GAAE,QAAQ,QAAQ;GAAQ,MAAM,QAAQ;EAAK,EAAE,CAAC;CACzE,CAAC;CAEH,MAAM,eAAe,YAAY,OAAO;CAExC,MAAM,sBAAsB,QAAQ,WAClC,OAAO,EAAE,SAAS,WAAwC;EACxD,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,QAC5B,MAAM,IAAIA,uBAAU,gBAAgB;GAClC,SAAS;GACT,MAAM;IAAE,UAAU;IAAW,MAAM;GAAsB;EAC3D,CAAC;EAEH,IAAI,CAAC,QAAQ,cAAc,sBACzB,MAAM,IAAIA,uBAAU,aAAa;GAC/B,SAAS;GACT,MAAM,EAAE,MAAM,mCAAmC;EACnD,CAAC;EAEH,MAAM,MAAM,QAAQ;EACpB,2BAA2B,IAAI,YAAY;EAC3C,OAAO,KAAK,EACV,SAAS;GACP,QAAQ,QAAQ;GAChB,MAAM,QAAQ;GACd,cAAc;IACZ,GAAG;IACH,sBAAsB,IAAI;IAC1B,cAAc,IAAI,eACd;KACE,GAAG,IAAI;KACP,UAAU,iBAAiB,IAAI,aAAa,UAAU,SAAS,aAAa;IAC9E,IACA;GACN;EACF,EACF,CAAC;CACH,CACF;CAEA,MAAM,kBAAoD,GAAG,UAC3D,QAAQ,WAAW,OAAO,EAAE,SAAS,WAAwC;EAC3E,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,QAC5B,MAAM,IAAIA,uBAAU,gBAAgB;GAClC,SAAS;GACT,MAAM;IAAE,UAAU;IAAW,MAAM;GAAsB;EAC3D,CAAC;EAEH,IAAI,CAAC,QAAQ,cAAc,sBACzB,MAAM,IAAIA,uBAAU,aAAa;GAC/B,SAAS;GACT,MAAM,EAAE,MAAM,mCAAmC;EACnD,CAAC;EAEH,MAAM,SAAS,QAAQ,cAAc;EACrC,IAAI,CAAC,QAAQ,MAAM,CAAC,QAAQ,QAAQ,CAAC,MAAM,SAAS,OAAO,IAAI,GAC7D,MAAM,IAAIA,uBAAU,aAAa;GAC/B,SAAS,+BAA+B,MAAM,KAAK,MAAM;GACzD,MAAM;IAAE,eAAe;IAAO,aAAa,QAAQ,QAAQ;GAAK;EAClE,CAAC;EAEH,MAAM,MAAM,QAAQ;EACpB,2BAA2B,IAAI,YAAY;EAC3C,OAAO,KAAK,EACV,SAAS;GACP,QAAQ,QAAQ;GAChB,MAAM,QAAQ;GACd,cAAc;IACZ,GAAG;IACH,sBAAsB,IAAI;IAC1B,QAAQ;KAAE,IAAI,OAAO;KAAI,MAAM,OAAO;IAAK;IAC3C,cAAc,IAAI,eACd;KACE,GAAG,IAAI;KACP,UAAU,iBAAiB,IAAI,aAAa,UAAU,SAAS,aAAa;IAC9E,IACA;GACN;EACF,EACF,CAAC;CACH,CAAC;CAEH,MAAM,iBAAiB,wBACrB,QAAQ,WAAW,OAAO,EAAE,SAAS,WAAwC;EAC3E,IAAI,CAAC,QAAQ,QACX,MAAM,IAAIA,uBAAU,gBAAgB;GAClC,SAAS;GACT,MAAM;IAAE,UAAU;IAAU,MAAM;GAA+C;EACnF,CAAC;EAEH,IAAI,qBAAqB;GACvB,MAAM,WAAW,QAAQ,OAAO,eAAe,CAAC;GAChD,KAAK,MAAM,CAAC,UAAU,YAAY,OAAO,QAAQ,mBAAmB,GAAG;IACrE,MAAM,UAAU,SAAS,aAAa,CAAC;IACvC,MAAM,UAAU,QAAQ,QAAQ,MAAc,CAAC,QAAQ,SAAS,CAAC,CAAC;IAClE,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAIA,uBAAU,aAAa;KAC/B,SAAS,6BAA6B,SAAS,GAAG,QAAQ,KAAK,GAAG;KAClE,MAAM;MAAE;MAAqB,gBAAgB;KAAS;IACxD,CAAC;GAEL;EACF;EACA,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,QAAQ,OAAO,EAAE,CAAC;CACrD,CAAC;CAEH,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;AAEA,SAAS,2BACP,cACA;CACA,IAAI,cAAc,UAAU,aAAa,WAAW,UAClD,MAAM,IAAIA,uBAAU,aAAa,EAC/B,SAAS,gDACX,CAAC;AAEL;AAEA,SAAS,iBACP,KACA,QAC6B;CAC7B,IAAI,CAAC,KAAK,OAAO;CACjB,IAAI,CAAC,QAAQ,OAAO;CACpB,MAAM,SAAS,OAAO,UAAU,GAAG;CACnC,IAAI,OAAO,SAAS,OAAO,OAAO;CAClC,MAAM,IAAIA,uBAAU,yBAAyB;EAC3C,SAAS;EACT,MAAM,EAAE,QAAQ,OAAO,MAAM,OAAO;CACtC,CAAC;AACH"}
+{"version":3,"file":"auth-middleware.cjs","names":["ORPCError"],"sources":["../../src/api/auth-middleware.ts"],"sourcesContent":["/**\n * Server-side auth middleware factory — framework home for the factory that\n * used to live as five near-identical copies (`api/src/lib/auth.ts` and each\n * plugin's `src/lib/auth.ts`). See citynode.app#207.\n *\n * Generic over the workspace's auth context (the generated `AuthPluginContext`\n * satisfies `AuthContextShape`), so each workspace imports the same factory and\n * passes its own context type for precise middleware narrowing:\n *\n *   const { requireAuth, requireAdmin, ... } = createAuthMiddleware<AuthContext>(builder);\n */\nimport type { DecoratedMiddleware } from \"@orpc/server\";\nimport { ORPCError } from \"@orpc/server\";\nimport type { z } from \"zod\";\n\n/** Structural minimum the middlewares read — the generated `AuthPluginContext` satisfies it. */\nexport interface AuthContextShape {\n  user?: { role?: string | null } | null;\n  userId?: string | null;\n  apiKey?: { permissions?: Record<string, string[]> | null } | null;\n  permissions?: Record<string, string[]> | null;\n  organization?: {\n    activeOrganizationId?: string | null;\n    member?: { id?: string | null; role?: string | null } | null;\n    organization?: { metadata?: Record<string, unknown> | null; status?: string } | null;\n    teams?: Array<{ id: string; permissions?: Record<string, string[]> }> | null;\n  } | null;\n}\n\ntype OrgMetaType<TSchema extends z.ZodType | undefined> = TSchema extends z.ZodType\n  ? z.infer<TSchema>\n  : Record<string, unknown>;\n\nexport function createAuthMiddleware<\n  TContext extends AuthContextShape = AuthContextShape,\n  TOrgMetaSchema extends z.ZodType | undefined = undefined,\n>(builder: any, options?: { orgMetaSchema?: TOrgMetaSchema }) {\n  // TContext is used as-is (no intersection) so the narrowed middleware\n  // outputs stay exactly the workspace's own types when it passes its\n  // AuthPluginContext — the constraint only guarantees the guards can read\n  // the structural props.\n  type Ctx = TContext;\n  type TOrgMeta = OrgMetaType<TOrgMetaSchema>;\n  type UserMiddleware = DecoratedMiddleware<\n    Ctx,\n    { userId: string; user: NonNullable<Ctx[\"user\"]> },\n    any,\n    any,\n    any\n  >;\n  type OrgMiddleware = DecoratedMiddleware<\n    Ctx,\n    {\n      userId: string;\n      user: NonNullable<Ctx[\"user\"]>;\n      organization: NonNullable<Ctx[\"organization\"]> & {\n        activeOrganizationId: string;\n        organization:\n          | (NonNullable<NonNullable<Ctx[\"organization\"]>[\"organization\"]> & {\n              metadata: TOrgMeta | null;\n            })\n          | null;\n      };\n    },\n    any,\n    any,\n    any\n  >;\n  type MemberMiddleware = DecoratedMiddleware<\n    Ctx,\n    {\n      userId: string;\n      user: NonNullable<Ctx[\"user\"]>;\n      organization: NonNullable<Ctx[\"organization\"]> & {\n        activeOrganizationId: string;\n        member: NonNullable<NonNullable<Ctx[\"organization\"]>[\"member\"]>;\n        organization:\n          | (NonNullable<NonNullable<Ctx[\"organization\"]>[\"organization\"]> & {\n              metadata: TOrgMeta | null;\n            })\n          | null;\n      };\n    },\n    any,\n    any,\n    any\n  >;\n  type ApiKeyMiddleware = DecoratedMiddleware<\n    Ctx,\n    { apiKey: NonNullable<Ctx[\"apiKey\"]> },\n    any,\n    any,\n    any\n  >;\n\n  const requireAuth = builder.middleware(async ({ context, next }: { context: Ctx; next: any }) => {\n    if (!context.user || !context.userId) {\n      throw new ORPCError(\"UNAUTHORIZED\", {\n        message: \"Authentication required\",\n        data: { hint: \"Sign in to continue\" },\n      });\n    }\n    return next({ context: { userId: context.userId, user: context.user } });\n  }) as UserMiddleware;\n\n  const requireAuthOrApiKey = builder.middleware(\n    async ({ context, next }: { context: Ctx; next: any }) => {\n      if (!context.user && !context.userId && !context.apiKey) {\n        throw new ORPCError(\"UNAUTHORIZED\", {\n          message: \"Authentication required\",\n          data: { hint: \"Sign in or provide an API key\" },\n        });\n      }\n      return next({ context });\n    },\n  ) as DecoratedMiddleware<Ctx, Record<string, never>, any, any, any>;\n\n  const requireRole = <TRoles extends readonly string[]>(...roles: TRoles) =>\n    builder.middleware(async ({ context, next }: { context: Ctx; next: any }) => {\n      if (!context.user || !context.userId) {\n        throw new ORPCError(\"UNAUTHORIZED\", {\n          message: \"Authentication required\",\n          data: { authType: \"session\", hint: \"Sign in to continue\" },\n        });\n      }\n      const currentRole = context.user.role;\n      if (!currentRole || !roles.includes(currentRole)) {\n        throw new ORPCError(\"FORBIDDEN\", {\n          message: `Requires role: ${roles.join(\" or \")}`,\n          data: { requiredRoles: roles, currentRole },\n        });\n      }\n      return next({ context: { userId: context.userId, user: context.user } });\n    }) as UserMiddleware;\n\n  const requireAdmin = requireRole(\"admin\");\n\n  const requireOrganization = builder.middleware(\n    async ({ context, next }: { context: Ctx; next: any }) => {\n      if (!context.user || !context.userId) {\n        throw new ORPCError(\"UNAUTHORIZED\", {\n          message: \"Authentication required\",\n          data: { authType: \"session\", hint: \"Sign in to continue\" },\n        });\n      }\n      if (!context.organization?.activeOrganizationId) {\n        throw new ORPCError(\"FORBIDDEN\", {\n          message: \"Active organization required\",\n          data: { hint: \"Select or create an organization\" },\n        });\n      }\n      const org = context.organization;\n      assertOrganizationApproval(org.organization);\n      return next({\n        context: {\n          userId: context.userId,\n          user: context.user,\n          organization: {\n            ...org,\n            activeOrganizationId: org.activeOrganizationId,\n            organization: org.organization\n              ? {\n                  ...org.organization,\n                  metadata: parseOrgMetadata(org.organization.metadata, options?.orgMetaSchema),\n                }\n              : null,\n          },\n        },\n      });\n    },\n  ) as OrgMiddleware;\n\n  const requireOrgRole = <TRoles extends readonly string[]>(...roles: TRoles) =>\n    builder.middleware(async ({ context, next }: { context: Ctx; next: any }) => {\n      if (!context.user || !context.userId) {\n        throw new ORPCError(\"UNAUTHORIZED\", {\n          message: \"Authentication required\",\n          data: { authType: \"session\", hint: \"Sign in to continue\" },\n        });\n      }\n      if (!context.organization?.activeOrganizationId) {\n        throw new ORPCError(\"FORBIDDEN\", {\n          message: \"Active organization required\",\n          data: { hint: \"Select or create an organization\" },\n        });\n      }\n      const member = context.organization?.member;\n      if (!member?.id || !member?.role || !roles.includes(member.role)) {\n        throw new ORPCError(\"FORBIDDEN\", {\n          message: `Requires organization role: ${roles.join(\" or \")}`,\n          data: { requiredRoles: roles, currentRole: member?.role ?? null },\n        });\n      }\n      const org = context.organization;\n      assertOrganizationApproval(org.organization);\n      return next({\n        context: {\n          userId: context.userId,\n          user: context.user,\n          organization: {\n            ...org,\n            activeOrganizationId: org.activeOrganizationId,\n            member: { id: member.id, role: member.role },\n            organization: org.organization\n              ? {\n                  ...org.organization,\n                  metadata: parseOrgMetadata(org.organization.metadata, options?.orgMetaSchema),\n                }\n              : null,\n          },\n        },\n      });\n    }) as MemberMiddleware;\n\n  const requireApiKey = (requiredPermissions?: Record<string, string[]>) =>\n    builder.middleware(async ({ context, next }: { context: Ctx; next: any }) => {\n      if (!context.apiKey) {\n        throw new ORPCError(\"UNAUTHORIZED\", {\n          message: \"API key required\",\n          data: { authType: \"apiKey\", hint: \"Provide a valid API key via x-api-key header\" },\n        });\n      }\n      if (requiredPermissions) {\n        const keyPerms = context.apiKey.permissions ?? {};\n        for (const [resource, actions] of Object.entries(requiredPermissions)) {\n          const allowed = keyPerms[resource] ?? [];\n          const missing = actions.filter((a: string) => !allowed.includes(a));\n          if (missing.length > 0) {\n            throw new ORPCError(\"FORBIDDEN\", {\n              message: `API key lacks permission: ${resource}:${missing.join(\",\")}`,\n              data: { requiredPermissions, keyPermissions: keyPerms },\n            });\n          }\n        }\n      }\n      return next({ context: { apiKey: context.apiKey } });\n    }) as ApiKeyMiddleware;\n\n  const requirePermission = (\n    resource: string,\n    action: string,\n    scope?: { scope?: \"organization\" | \"team\"; teamId?: (input: any) => string | undefined },\n  ) =>\n    builder.middleware(async ({ context, next }: { context: Ctx; next: any }, input: any) => {\n      let granted: string[] | undefined;\n      if (scope?.scope === \"team\") {\n        const teamId = scope.teamId?.(input);\n        const team = context.organization?.teams?.find((t) => t.id === teamId);\n        granted = team?.permissions?.[resource];\n      } else {\n        granted = context.permissions?.[resource];\n      }\n      if (!granted?.includes(action)) {\n        throw new ORPCError(\"FORBIDDEN\", {\n          message: `Requires permission: ${resource}:${action}`,\n          data: { requiredPermissions: [`${resource}:${action}`] },\n        });\n      }\n      return next({ context });\n    }) as DecoratedMiddleware<Ctx, Record<string, never>, any, any, any>;\n\n  return {\n    requireAuth,\n    requireAuthOrApiKey,\n    requireRole,\n    requireAdmin,\n    requireOrganization,\n    requireOrgRole,\n    requireApiKey,\n    requirePermission,\n  };\n}\n\nfunction assertOrganizationApproval(\n  organization: NonNullable<AuthContextShape[\"organization\"]>[\"organization\"],\n) {\n  if (organization?.status && organization.status !== \"active\") {\n    throw new ORPCError(\"FORBIDDEN\", {\n      message: \"Organization requires platform-admin approval\",\n    });\n  }\n}\n\nfunction parseOrgMetadata<TSchema extends z.ZodType | undefined>(\n  raw: Record<string, unknown> | null | undefined,\n  schema: TSchema | undefined,\n): OrgMetaType<TSchema> | null {\n  if (!raw) return null;\n  if (!schema) return raw as OrgMetaType<TSchema>;\n  const result = schema.safeParse(raw);\n  if (result.success) return result.data as OrgMetaType<TSchema>;\n  throw new ORPCError(\"INTERNAL_SERVER_ERROR\", {\n    message: \"Invalid organization metadata\",\n    data: { errors: result.error.issues },\n  });\n}\n"],"mappings":";;;;AAiCA,SAAgB,qBAGd,SAAc,SAA8C;CA2D5D,MAAM,cAAc,QAAQ,WAAW,OAAO,EAAE,SAAS,WAAwC;EAC/F,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,QAC5B,MAAM,IAAIA,uBAAU,gBAAgB;GAClC,SAAS;GACT,MAAM,EAAE,MAAM,sBAAsB;EACtC,CAAC;EAEH,OAAO,KAAK,EAAE,SAAS;GAAE,QAAQ,QAAQ;GAAQ,MAAM,QAAQ;EAAK,EAAE,CAAC;CACzE,CAAC;CAED,MAAM,sBAAsB,QAAQ,WAClC,OAAO,EAAE,SAAS,WAAwC;EACxD,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,UAAU,CAAC,QAAQ,QAC/C,MAAM,IAAIA,uBAAU,gBAAgB;GAClC,SAAS;GACT,MAAM,EAAE,MAAM,gCAAgC;EAChD,CAAC;EAEH,OAAO,KAAK,EAAE,QAAQ,CAAC;CACzB,CACF;CAEA,MAAM,eAAiD,GAAG,UACxD,QAAQ,WAAW,OAAO,EAAE,SAAS,WAAwC;EAC3E,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,QAC5B,MAAM,IAAIA,uBAAU,gBAAgB;GAClC,SAAS;GACT,MAAM;IAAE,UAAU;IAAW,MAAM;GAAsB;EAC3D,CAAC;EAEH,MAAM,cAAc,QAAQ,KAAK;EACjC,IAAI,CAAC,eAAe,CAAC,MAAM,SAAS,WAAW,GAC7C,MAAM,IAAIA,uBAAU,aAAa;GAC/B,SAAS,kBAAkB,MAAM,KAAK,MAAM;GAC5C,MAAM;IAAE,eAAe;IAAO;GAAY;EAC5C,CAAC;EAEH,OAAO,KAAK,EAAE,SAAS;GAAE,QAAQ,QAAQ;GAAQ,MAAM,QAAQ;EAAK,EAAE,CAAC;CACzE,CAAC;CAEH,MAAM,eAAe,YAAY,OAAO;CAExC,MAAM,sBAAsB,QAAQ,WAClC,OAAO,EAAE,SAAS,WAAwC;EACxD,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,QAC5B,MAAM,IAAIA,uBAAU,gBAAgB;GAClC,SAAS;GACT,MAAM;IAAE,UAAU;IAAW,MAAM;GAAsB;EAC3D,CAAC;EAEH,IAAI,CAAC,QAAQ,cAAc,sBACzB,MAAM,IAAIA,uBAAU,aAAa;GAC/B,SAAS;GACT,MAAM,EAAE,MAAM,mCAAmC;EACnD,CAAC;EAEH,MAAM,MAAM,QAAQ;EACpB,2BAA2B,IAAI,YAAY;EAC3C,OAAO,KAAK,EACV,SAAS;GACP,QAAQ,QAAQ;GAChB,MAAM,QAAQ;GACd,cAAc;IACZ,GAAG;IACH,sBAAsB,IAAI;IAC1B,cAAc,IAAI,eACd;KACE,GAAG,IAAI;KACP,UAAU,iBAAiB,IAAI,aAAa,UAAU,SAAS,aAAa;IAC9E,IACA;GACN;EACF,EACF,CAAC;CACH,CACF;CAEA,MAAM,kBAAoD,GAAG,UAC3D,QAAQ,WAAW,OAAO,EAAE,SAAS,WAAwC;EAC3E,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,QAC5B,MAAM,IAAIA,uBAAU,gBAAgB;GAClC,SAAS;GACT,MAAM;IAAE,UAAU;IAAW,MAAM;GAAsB;EAC3D,CAAC;EAEH,IAAI,CAAC,QAAQ,cAAc,sBACzB,MAAM,IAAIA,uBAAU,aAAa;GAC/B,SAAS;GACT,MAAM,EAAE,MAAM,mCAAmC;EACnD,CAAC;EAEH,MAAM,SAAS,QAAQ,cAAc;EACrC,IAAI,CAAC,QAAQ,MAAM,CAAC,QAAQ,QAAQ,CAAC,MAAM,SAAS,OAAO,IAAI,GAC7D,MAAM,IAAIA,uBAAU,aAAa;GAC/B,SAAS,+BAA+B,MAAM,KAAK,MAAM;GACzD,MAAM;IAAE,eAAe;IAAO,aAAa,QAAQ,QAAQ;GAAK;EAClE,CAAC;EAEH,MAAM,MAAM,QAAQ;EACpB,2BAA2B,IAAI,YAAY;EAC3C,OAAO,KAAK,EACV,SAAS;GACP,QAAQ,QAAQ;GAChB,MAAM,QAAQ;GACd,cAAc;IACZ,GAAG;IACH,sBAAsB,IAAI;IAC1B,QAAQ;KAAE,IAAI,OAAO;KAAI,MAAM,OAAO;IAAK;IAC3C,cAAc,IAAI,eACd;KACE,GAAG,IAAI;KACP,UAAU,iBAAiB,IAAI,aAAa,UAAU,SAAS,aAAa;IAC9E,IACA;GACN;EACF,EACF,CAAC;CACH,CAAC;CAEH,MAAM,iBAAiB,wBACrB,QAAQ,WAAW,OAAO,EAAE,SAAS,WAAwC;EAC3E,IAAI,CAAC,QAAQ,QACX,MAAM,IAAIA,uBAAU,gBAAgB;GAClC,SAAS;GACT,MAAM;IAAE,UAAU;IAAU,MAAM;GAA+C;EACnF,CAAC;EAEH,IAAI,qBAAqB;GACvB,MAAM,WAAW,QAAQ,OAAO,eAAe,CAAC;GAChD,KAAK,MAAM,CAAC,UAAU,YAAY,OAAO,QAAQ,mBAAmB,GAAG;IACrE,MAAM,UAAU,SAAS,aAAa,CAAC;IACvC,MAAM,UAAU,QAAQ,QAAQ,MAAc,CAAC,QAAQ,SAAS,CAAC,CAAC;IAClE,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAIA,uBAAU,aAAa;KAC/B,SAAS,6BAA6B,SAAS,GAAG,QAAQ,KAAK,GAAG;KAClE,MAAM;MAAE;MAAqB,gBAAgB;KAAS;IACxD,CAAC;GAEL;EACF;EACA,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,QAAQ,OAAO,EAAE,CAAC;CACrD,CAAC;CAEH,MAAM,qBACJ,UACA,QACA,UAEA,QAAQ,WAAW,OAAO,EAAE,SAAS,QAAqC,UAAe;EACvF,IAAI;EACJ,IAAI,OAAO,UAAU,QAAQ;GAC3B,MAAM,SAAS,MAAM,SAAS,KAAK;GAEnC,WADa,QAAQ,cAAc,OAAO,MAAM,MAAM,EAAE,OAAO,MAAM,EACvD,EAAE,cAAc;EAChC,OACE,UAAU,QAAQ,cAAc;EAElC,IAAI,CAAC,SAAS,SAAS,MAAM,GAC3B,MAAM,IAAIA,uBAAU,aAAa;GAC/B,SAAS,wBAAwB,SAAS,GAAG;GAC7C,MAAM,EAAE,qBAAqB,CAAC,GAAG,SAAS,GAAG,QAAQ,EAAE;EACzD,CAAC;EAEH,OAAO,KAAK,EAAE,QAAQ,CAAC;CACzB,CAAC;CAEH,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;AAEA,SAAS,2BACP,cACA;CACA,IAAI,cAAc,UAAU,aAAa,WAAW,UAClD,MAAM,IAAIA,uBAAU,aAAa,EAC/B,SAAS,gDACX,CAAC;AAEL;AAEA,SAAS,iBACP,KACA,QAC6B;CAC7B,IAAI,CAAC,KAAK,OAAO;CACjB,IAAI,CAAC,QAAQ,OAAO;CACpB,MAAM,SAAS,OAAO,UAAU,GAAG;CACnC,IAAI,OAAO,SAAS,OAAO,OAAO;CAClC,MAAM,IAAIA,uBAAU,yBAAyB;EAC3C,SAAS;EACT,MAAM,EAAE,QAAQ,OAAO,MAAM,OAAO;CACtC,CAAC;AACH"}

package/dist/api/auth-middleware.d.cts

@@ -10,6 +10,7 @@ interface AuthContextShape {
   apiKey?: {
     permissions?: Record<string, string[]> | null;
   } | null;
+  permissions?: Record<string, string[]> | null;
   organization?: {
     activeOrganizationId?: string | null;
     member?: {
@@ -20,6 +21,10 @@ interface AuthContextShape {
       metadata?: Record<string, unknown> | null;
       status?: string;
     } | null;
+    teams?: Array<{
+      id: string;
+      permissions?: Record<string, string[]>;
+    }> | null;
   } | null;
 }
 type OrgMetaType<TSchema extends z.ZodType | undefined> = TSchema extends z.ZodType ? z.infer<TSchema> : Record<string, unknown>;
@@ -63,6 +68,10 @@ declare function createAuthMiddleware<TContext extends AuthContextShape = AuthCo
   requireApiKey: (requiredPermissions?: Record<string, string[]>) => DecoratedMiddleware<TContext, {
     apiKey: NonNullable<TContext["apiKey"]>;
   }, any, any, any>;
+  requirePermission: (resource: string, action: string, scope?: {
+    scope?: "organization" | "team";
+    teamId?: (input: any) => string | undefined;
+  }) => DecoratedMiddleware<TContext, Record<string, never>, any, any, any>;
 };
 //#endregion
 export { AuthContextShape, createAuthMiddleware };

package/dist/api/auth-middleware.d.mts

@@ -10,6 +10,7 @@ interface AuthContextShape {
   apiKey?: {
     permissions?: Record<string, string[]> | null;
   } | null;
+  permissions?: Record<string, string[]> | null;
   organization?: {
     activeOrganizationId?: string | null;
     member?: {
@@ -20,6 +21,10 @@ interface AuthContextShape {
       metadata?: Record<string, unknown> | null;
       status?: string;
     } | null;
+    teams?: Array<{
+      id: string;
+      permissions?: Record<string, string[]>;
+    }> | null;
   } | null;
 }
 type OrgMetaType<TSchema extends z.ZodType | undefined> = TSchema extends z.ZodType ? z.infer<TSchema> : Record<string, unknown>;
@@ -63,6 +68,10 @@ declare function createAuthMiddleware<TContext extends AuthContextShape = AuthCo
   requireApiKey: (requiredPermissions?: Record<string, string[]>) => DecoratedMiddleware<TContext, {
     apiKey: NonNullable<TContext["apiKey"]>;
   }, any, any, any>;
+  requirePermission: (resource: string, action: string, scope?: {
+    scope?: "organization" | "team";
+    teamId?: (input: any) => string | undefined;
+  }) => DecoratedMiddleware<TContext, Record<string, never>, any, any, any>;
 };
 //#endregion
 export { AuthContextShape, createAuthMiddleware };

package/dist/api/auth-middleware.mjs

@@ -131,6 +131,18 @@ function createAuthMiddleware(builder, options) {
 		}
 		return next({ context: { apiKey: context.apiKey } });
 	});
+	const requirePermission = (resource, action, scope) => builder.middleware(async ({ context, next }, input) => {
+		let granted;
+		if (scope?.scope === "team") {
+			const teamId = scope.teamId?.(input);
+			granted = (context.organization?.teams?.find((t) => t.id === teamId))?.permissions?.[resource];
+		} else granted = context.permissions?.[resource];
+		if (!granted?.includes(action)) throw new ORPCError("FORBIDDEN", {
+			message: `Requires permission: ${resource}:${action}`,
+			data: { requiredPermissions: [`${resource}:${action}`] }
+		});
+		return next({ context });
+	});
 	return {
 		requireAuth,
 		requireAuthOrApiKey,
@@ -138,7 +150,8 @@ function createAuthMiddleware(builder, options) {
 		requireAdmin,
 		requireOrganization,
 		requireOrgRole,
-		requireApiKey
+		requireApiKey,
+		requirePermission
 	};
 }
 function assertOrganizationApproval(organization) {

package/dist/api/auth-middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth-middleware.mjs","names":[],"sources":["../../src/api/auth-middleware.ts"],"sourcesContent":["/**\n * Server-side auth middleware factory — framework home for the factory that\n * used to live as five near-identical copies (`api/src/lib/auth.ts` and each\n * plugin's `src/lib/auth.ts`). See citynode.app#207.\n *\n * Generic over the workspace's auth context (the generated `AuthPluginContext`\n * satisfies `AuthContextShape`), so each workspace imports the same factory and\n * passes its own context type for precise middleware narrowing:\n *\n *   const { requireAuth, requireAdmin, ... } = createAuthMiddleware<AuthContext>(builder);\n */\nimport type { DecoratedMiddleware } from \"@orpc/server\";\nimport { ORPCError } from \"@orpc/server\";\nimport type { z } from \"zod\";\n\n/** Structural minimum the middlewares read — the generated `AuthPluginContext` satisfies it. */\nexport interface AuthContextShape {\n  user?: { role?: string | null } | null;\n  userId?: string | null;\n  apiKey?: { permissions?: Record<string, string[]> | null } | null;\n  organization?: {\n    activeOrganizationId?: string | null;\n    member?: { id?: string | null; role?: string | null } | null;\n    organization?: { metadata?: Record<string, unknown> | null; status?: string } | null;\n  } | null;\n}\n\ntype OrgMetaType<TSchema extends z.ZodType | undefined> = TSchema extends z.ZodType\n  ? z.infer<TSchema>\n  : Record<string, unknown>;\n\nexport function createAuthMiddleware<\n  TContext extends AuthContextShape = AuthContextShape,\n  TOrgMetaSchema extends z.ZodType | undefined = undefined,\n>(builder: any, options?: { orgMetaSchema?: TOrgMetaSchema }) {\n  // TContext is used as-is (no intersection) so the narrowed middleware\n  // outputs stay exactly the workspace's own types when it passes its\n  // AuthPluginContext — the constraint only guarantees the guards can read\n  // the structural props.\n  type Ctx = TContext;\n  type TOrgMeta = OrgMetaType<TOrgMetaSchema>;\n  type UserMiddleware = DecoratedMiddleware<\n    Ctx,\n    { userId: string; user: NonNullable<Ctx[\"user\"]> },\n    any,\n    any,\n    any\n  >;\n  type OrgMiddleware = DecoratedMiddleware<\n    Ctx,\n    {\n      userId: string;\n      user: NonNullable<Ctx[\"user\"]>;\n      organization: NonNullable<Ctx[\"organization\"]> & {\n        activeOrganizationId: string;\n        organization:\n          | (NonNullable<NonNullable<Ctx[\"organization\"]>[\"organization\"]> & {\n              metadata: TOrgMeta | null;\n            })\n          | null;\n      };\n    },\n    any,\n    any,\n    any\n  >;\n  type MemberMiddleware = DecoratedMiddleware<\n    Ctx,\n    {\n      userId: string;\n      user: NonNullable<Ctx[\"user\"]>;\n      organization: NonNullable<Ctx[\"organization\"]> & {\n        activeOrganizationId: string;\n        member: NonNullable<NonNullable<Ctx[\"organization\"]>[\"member\"]>;\n        organization:\n          | (NonNullable<NonNullable<Ctx[\"organization\"]>[\"organization\"]> & {\n              metadata: TOrgMeta | null;\n            })\n          | null;\n      };\n    },\n    any,\n    any,\n    any\n  >;\n  type ApiKeyMiddleware = DecoratedMiddleware<\n    Ctx,\n    { apiKey: NonNullable<Ctx[\"apiKey\"]> },\n    any,\n    any,\n    any\n  >;\n\n  const requireAuth = builder.middleware(async ({ context, next }: { context: Ctx; next: any }) => {\n    if (!context.user || !context.userId) {\n      throw new ORPCError(\"UNAUTHORIZED\", {\n        message: \"Authentication required\",\n        data: { hint: \"Sign in to continue\" },\n      });\n    }\n    return next({ context: { userId: context.userId, user: context.user } });\n  }) as UserMiddleware;\n\n  const requireAuthOrApiKey = builder.middleware(\n    async ({ context, next }: { context: Ctx; next: any }) => {\n      if (!context.user && !context.userId && !context.apiKey) {\n        throw new ORPCError(\"UNAUTHORIZED\", {\n          message: \"Authentication required\",\n          data: { hint: \"Sign in or provide an API key\" },\n        });\n      }\n      return next({ context });\n    },\n  ) as DecoratedMiddleware<Ctx, Record<string, never>, any, any, any>;\n\n  const requireRole = <TRoles extends readonly string[]>(...roles: TRoles) =>\n    builder.middleware(async ({ context, next }: { context: Ctx; next: any }) => {\n      if (!context.user || !context.userId) {\n        throw new ORPCError(\"UNAUTHORIZED\", {\n          message: \"Authentication required\",\n          data: { authType: \"session\", hint: \"Sign in to continue\" },\n        });\n      }\n      const currentRole = context.user.role;\n      if (!currentRole || !roles.includes(currentRole)) {\n        throw new ORPCError(\"FORBIDDEN\", {\n          message: `Requires role: ${roles.join(\" or \")}`,\n          data: { requiredRoles: roles, currentRole },\n        });\n      }\n      return next({ context: { userId: context.userId, user: context.user } });\n    }) as UserMiddleware;\n\n  const requireAdmin = requireRole(\"admin\");\n\n  const requireOrganization = builder.middleware(\n    async ({ context, next }: { context: Ctx; next: any }) => {\n      if (!context.user || !context.userId) {\n        throw new ORPCError(\"UNAUTHORIZED\", {\n          message: \"Authentication required\",\n          data: { authType: \"session\", hint: \"Sign in to continue\" },\n        });\n      }\n      if (!context.organization?.activeOrganizationId) {\n        throw new ORPCError(\"FORBIDDEN\", {\n          message: \"Active organization required\",\n          data: { hint: \"Select or create an organization\" },\n        });\n      }\n      const org = context.organization;\n      assertOrganizationApproval(org.organization);\n      return next({\n        context: {\n          userId: context.userId,\n          user: context.user,\n          organization: {\n            ...org,\n            activeOrganizationId: org.activeOrganizationId,\n            organization: org.organization\n              ? {\n                  ...org.organization,\n                  metadata: parseOrgMetadata(org.organization.metadata, options?.orgMetaSchema),\n                }\n              : null,\n          },\n        },\n      });\n    },\n  ) as OrgMiddleware;\n\n  const requireOrgRole = <TRoles extends readonly string[]>(...roles: TRoles) =>\n    builder.middleware(async ({ context, next }: { context: Ctx; next: any }) => {\n      if (!context.user || !context.userId) {\n        throw new ORPCError(\"UNAUTHORIZED\", {\n          message: \"Authentication required\",\n          data: { authType: \"session\", hint: \"Sign in to continue\" },\n        });\n      }\n      if (!context.organization?.activeOrganizationId) {\n        throw new ORPCError(\"FORBIDDEN\", {\n          message: \"Active organization required\",\n          data: { hint: \"Select or create an organization\" },\n        });\n      }\n      const member = context.organization?.member;\n      if (!member?.id || !member?.role || !roles.includes(member.role)) {\n        throw new ORPCError(\"FORBIDDEN\", {\n          message: `Requires organization role: ${roles.join(\" or \")}`,\n          data: { requiredRoles: roles, currentRole: member?.role ?? null },\n        });\n      }\n      const org = context.organization;\n      assertOrganizationApproval(org.organization);\n      return next({\n        context: {\n          userId: context.userId,\n          user: context.user,\n          organization: {\n            ...org,\n            activeOrganizationId: org.activeOrganizationId,\n            member: { id: member.id, role: member.role },\n            organization: org.organization\n              ? {\n                  ...org.organization,\n                  metadata: parseOrgMetadata(org.organization.metadata, options?.orgMetaSchema),\n                }\n              : null,\n          },\n        },\n      });\n    }) as MemberMiddleware;\n\n  const requireApiKey = (requiredPermissions?: Record<string, string[]>) =>\n    builder.middleware(async ({ context, next }: { context: Ctx; next: any }) => {\n      if (!context.apiKey) {\n        throw new ORPCError(\"UNAUTHORIZED\", {\n          message: \"API key required\",\n          data: { authType: \"apiKey\", hint: \"Provide a valid API key via x-api-key header\" },\n        });\n      }\n      if (requiredPermissions) {\n        const keyPerms = context.apiKey.permissions ?? {};\n        for (const [resource, actions] of Object.entries(requiredPermissions)) {\n          const allowed = keyPerms[resource] ?? [];\n          const missing = actions.filter((a: string) => !allowed.includes(a));\n          if (missing.length > 0) {\n            throw new ORPCError(\"FORBIDDEN\", {\n              message: `API key lacks permission: ${resource}:${missing.join(\",\")}`,\n              data: { requiredPermissions, keyPermissions: keyPerms },\n            });\n          }\n        }\n      }\n      return next({ context: { apiKey: context.apiKey } });\n    }) as ApiKeyMiddleware;\n\n  return {\n    requireAuth,\n    requireAuthOrApiKey,\n    requireRole,\n    requireAdmin,\n    requireOrganization,\n    requireOrgRole,\n    requireApiKey,\n  };\n}\n\nfunction assertOrganizationApproval(\n  organization: NonNullable<AuthContextShape[\"organization\"]>[\"organization\"],\n) {\n  if (organization?.status && organization.status !== \"active\") {\n    throw new ORPCError(\"FORBIDDEN\", {\n      message: \"Organization requires platform-admin approval\",\n    });\n  }\n}\n\nfunction parseOrgMetadata<TSchema extends z.ZodType | undefined>(\n  raw: Record<string, unknown> | null | undefined,\n  schema: TSchema | undefined,\n): OrgMetaType<TSchema> | null {\n  if (!raw) return null;\n  if (!schema) return raw as OrgMetaType<TSchema>;\n  const result = schema.safeParse(raw);\n  if (result.success) return result.data as OrgMetaType<TSchema>;\n  throw new ORPCError(\"INTERNAL_SERVER_ERROR\", {\n    message: \"Invalid organization metadata\",\n    data: { errors: result.error.issues },\n  });\n}\n"],"mappings":";;;AA+BA,SAAgB,qBAGd,SAAc,SAA8C;CA2D5D,MAAM,cAAc,QAAQ,WAAW,OAAO,EAAE,SAAS,WAAwC;EAC/F,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,QAC5B,MAAM,IAAI,UAAU,gBAAgB;GAClC,SAAS;GACT,MAAM,EAAE,MAAM,sBAAsB;EACtC,CAAC;EAEH,OAAO,KAAK,EAAE,SAAS;GAAE,QAAQ,QAAQ;GAAQ,MAAM,QAAQ;EAAK,EAAE,CAAC;CACzE,CAAC;CAED,MAAM,sBAAsB,QAAQ,WAClC,OAAO,EAAE,SAAS,WAAwC;EACxD,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,UAAU,CAAC,QAAQ,QAC/C,MAAM,IAAI,UAAU,gBAAgB;GAClC,SAAS;GACT,MAAM,EAAE,MAAM,gCAAgC;EAChD,CAAC;EAEH,OAAO,KAAK,EAAE,QAAQ,CAAC;CACzB,CACF;CAEA,MAAM,eAAiD,GAAG,UACxD,QAAQ,WAAW,OAAO,EAAE,SAAS,WAAwC;EAC3E,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,QAC5B,MAAM,IAAI,UAAU,gBAAgB;GAClC,SAAS;GACT,MAAM;IAAE,UAAU;IAAW,MAAM;GAAsB;EAC3D,CAAC;EAEH,MAAM,cAAc,QAAQ,KAAK;EACjC,IAAI,CAAC,eAAe,CAAC,MAAM,SAAS,WAAW,GAC7C,MAAM,IAAI,UAAU,aAAa;GAC/B,SAAS,kBAAkB,MAAM,KAAK,MAAM;GAC5C,MAAM;IAAE,eAAe;IAAO;GAAY;EAC5C,CAAC;EAEH,OAAO,KAAK,EAAE,SAAS;GAAE,QAAQ,QAAQ;GAAQ,MAAM,QAAQ;EAAK,EAAE,CAAC;CACzE,CAAC;CAEH,MAAM,eAAe,YAAY,OAAO;CAExC,MAAM,sBAAsB,QAAQ,WAClC,OAAO,EAAE,SAAS,WAAwC;EACxD,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,QAC5B,MAAM,IAAI,UAAU,gBAAgB;GAClC,SAAS;GACT,MAAM;IAAE,UAAU;IAAW,MAAM;GAAsB;EAC3D,CAAC;EAEH,IAAI,CAAC,QAAQ,cAAc,sBACzB,MAAM,IAAI,UAAU,aAAa;GAC/B,SAAS;GACT,MAAM,EAAE,MAAM,mCAAmC;EACnD,CAAC;EAEH,MAAM,MAAM,QAAQ;EACpB,2BAA2B,IAAI,YAAY;EAC3C,OAAO,KAAK,EACV,SAAS;GACP,QAAQ,QAAQ;GAChB,MAAM,QAAQ;GACd,cAAc;IACZ,GAAG;IACH,sBAAsB,IAAI;IAC1B,cAAc,IAAI,eACd;KACE,GAAG,IAAI;KACP,UAAU,iBAAiB,IAAI,aAAa,UAAU,SAAS,aAAa;IAC9E,IACA;GACN;EACF,EACF,CAAC;CACH,CACF;CAEA,MAAM,kBAAoD,GAAG,UAC3D,QAAQ,WAAW,OAAO,EAAE,SAAS,WAAwC;EAC3E,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,QAC5B,MAAM,IAAI,UAAU,gBAAgB;GAClC,SAAS;GACT,MAAM;IAAE,UAAU;IAAW,MAAM;GAAsB;EAC3D,CAAC;EAEH,IAAI,CAAC,QAAQ,cAAc,sBACzB,MAAM,IAAI,UAAU,aAAa;GAC/B,SAAS;GACT,MAAM,EAAE,MAAM,mCAAmC;EACnD,CAAC;EAEH,MAAM,SAAS,QAAQ,cAAc;EACrC,IAAI,CAAC,QAAQ,MAAM,CAAC,QAAQ,QAAQ,CAAC,MAAM,SAAS,OAAO,IAAI,GAC7D,MAAM,IAAI,UAAU,aAAa;GAC/B,SAAS,+BAA+B,MAAM,KAAK,MAAM;GACzD,MAAM;IAAE,eAAe;IAAO,aAAa,QAAQ,QAAQ;GAAK;EAClE,CAAC;EAEH,MAAM,MAAM,QAAQ;EACpB,2BAA2B,IAAI,YAAY;EAC3C,OAAO,KAAK,EACV,SAAS;GACP,QAAQ,QAAQ;GAChB,MAAM,QAAQ;GACd,cAAc;IACZ,GAAG;IACH,sBAAsB,IAAI;IAC1B,QAAQ;KAAE,IAAI,OAAO;KAAI,MAAM,OAAO;IAAK;IAC3C,cAAc,IAAI,eACd;KACE,GAAG,IAAI;KACP,UAAU,iBAAiB,IAAI,aAAa,UAAU,SAAS,aAAa;IAC9E,IACA;GACN;EACF,EACF,CAAC;CACH,CAAC;CAEH,MAAM,iBAAiB,wBACrB,QAAQ,WAAW,OAAO,EAAE,SAAS,WAAwC;EAC3E,IAAI,CAAC,QAAQ,QACX,MAAM,IAAI,UAAU,gBAAgB;GAClC,SAAS;GACT,MAAM;IAAE,UAAU;IAAU,MAAM;GAA+C;EACnF,CAAC;EAEH,IAAI,qBAAqB;GACvB,MAAM,WAAW,QAAQ,OAAO,eAAe,CAAC;GAChD,KAAK,MAAM,CAAC,UAAU,YAAY,OAAO,QAAQ,mBAAmB,GAAG;IACrE,MAAM,UAAU,SAAS,aAAa,CAAC;IACvC,MAAM,UAAU,QAAQ,QAAQ,MAAc,CAAC,QAAQ,SAAS,CAAC,CAAC;IAClE,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,UAAU,aAAa;KAC/B,SAAS,6BAA6B,SAAS,GAAG,QAAQ,KAAK,GAAG;KAClE,MAAM;MAAE;MAAqB,gBAAgB;KAAS;IACxD,CAAC;GAEL;EACF;EACA,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,QAAQ,OAAO,EAAE,CAAC;CACrD,CAAC;CAEH,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;AAEA,SAAS,2BACP,cACA;CACA,IAAI,cAAc,UAAU,aAAa,WAAW,UAClD,MAAM,IAAI,UAAU,aAAa,EAC/B,SAAS,gDACX,CAAC;AAEL;AAEA,SAAS,iBACP,KACA,QAC6B;CAC7B,IAAI,CAAC,KAAK,OAAO;CACjB,IAAI,CAAC,QAAQ,OAAO;CACpB,MAAM,SAAS,OAAO,UAAU,GAAG;CACnC,IAAI,OAAO,SAAS,OAAO,OAAO;CAClC,MAAM,IAAI,UAAU,yBAAyB;EAC3C,SAAS;EACT,MAAM,EAAE,QAAQ,OAAO,MAAM,OAAO;CACtC,CAAC;AACH"}
+{"version":3,"file":"auth-middleware.mjs","names":[],"sources":["../../src/api/auth-middleware.ts"],"sourcesContent":["/**\n * Server-side auth middleware factory — framework home for the factory that\n * used to live as five near-identical copies (`api/src/lib/auth.ts` and each\n * plugin's `src/lib/auth.ts`). See citynode.app#207.\n *\n * Generic over the workspace's auth context (the generated `AuthPluginContext`\n * satisfies `AuthContextShape`), so each workspace imports the same factory and\n * passes its own context type for precise middleware narrowing:\n *\n *   const { requireAuth, requireAdmin, ... } = createAuthMiddleware<AuthContext>(builder);\n */\nimport type { DecoratedMiddleware } from \"@orpc/server\";\nimport { ORPCError } from \"@orpc/server\";\nimport type { z } from \"zod\";\n\n/** Structural minimum the middlewares read — the generated `AuthPluginContext` satisfies it. */\nexport interface AuthContextShape {\n  user?: { role?: string | null } | null;\n  userId?: string | null;\n  apiKey?: { permissions?: Record<string, string[]> | null } | null;\n  permissions?: Record<string, string[]> | null;\n  organization?: {\n    activeOrganizationId?: string | null;\n    member?: { id?: string | null; role?: string | null } | null;\n    organization?: { metadata?: Record<string, unknown> | null; status?: string } | null;\n    teams?: Array<{ id: string; permissions?: Record<string, string[]> }> | null;\n  } | null;\n}\n\ntype OrgMetaType<TSchema extends z.ZodType | undefined> = TSchema extends z.ZodType\n  ? z.infer<TSchema>\n  : Record<string, unknown>;\n\nexport function createAuthMiddleware<\n  TContext extends AuthContextShape = AuthContextShape,\n  TOrgMetaSchema extends z.ZodType | undefined = undefined,\n>(builder: any, options?: { orgMetaSchema?: TOrgMetaSchema }) {\n  // TContext is used as-is (no intersection) so the narrowed middleware\n  // outputs stay exactly the workspace's own types when it passes its\n  // AuthPluginContext — the constraint only guarantees the guards can read\n  // the structural props.\n  type Ctx = TContext;\n  type TOrgMeta = OrgMetaType<TOrgMetaSchema>;\n  type UserMiddleware = DecoratedMiddleware<\n    Ctx,\n    { userId: string; user: NonNullable<Ctx[\"user\"]> },\n    any,\n    any,\n    any\n  >;\n  type OrgMiddleware = DecoratedMiddleware<\n    Ctx,\n    {\n      userId: string;\n      user: NonNullable<Ctx[\"user\"]>;\n      organization: NonNullable<Ctx[\"organization\"]> & {\n        activeOrganizationId: string;\n        organization:\n          | (NonNullable<NonNullable<Ctx[\"organization\"]>[\"organization\"]> & {\n              metadata: TOrgMeta | null;\n            })\n          | null;\n      };\n    },\n    any,\n    any,\n    any\n  >;\n  type MemberMiddleware = DecoratedMiddleware<\n    Ctx,\n    {\n      userId: string;\n      user: NonNullable<Ctx[\"user\"]>;\n      organization: NonNullable<Ctx[\"organization\"]> & {\n        activeOrganizationId: string;\n        member: NonNullable<NonNullable<Ctx[\"organization\"]>[\"member\"]>;\n        organization:\n          | (NonNullable<NonNullable<Ctx[\"organization\"]>[\"organization\"]> & {\n              metadata: TOrgMeta | null;\n            })\n          | null;\n      };\n    },\n    any,\n    any,\n    any\n  >;\n  type ApiKeyMiddleware = DecoratedMiddleware<\n    Ctx,\n    { apiKey: NonNullable<Ctx[\"apiKey\"]> },\n    any,\n    any,\n    any\n  >;\n\n  const requireAuth = builder.middleware(async ({ context, next }: { context: Ctx; next: any }) => {\n    if (!context.user || !context.userId) {\n      throw new ORPCError(\"UNAUTHORIZED\", {\n        message: \"Authentication required\",\n        data: { hint: \"Sign in to continue\" },\n      });\n    }\n    return next({ context: { userId: context.userId, user: context.user } });\n  }) as UserMiddleware;\n\n  const requireAuthOrApiKey = builder.middleware(\n    async ({ context, next }: { context: Ctx; next: any }) => {\n      if (!context.user && !context.userId && !context.apiKey) {\n        throw new ORPCError(\"UNAUTHORIZED\", {\n          message: \"Authentication required\",\n          data: { hint: \"Sign in or provide an API key\" },\n        });\n      }\n      return next({ context });\n    },\n  ) as DecoratedMiddleware<Ctx, Record<string, never>, any, any, any>;\n\n  const requireRole = <TRoles extends readonly string[]>(...roles: TRoles) =>\n    builder.middleware(async ({ context, next }: { context: Ctx; next: any }) => {\n      if (!context.user || !context.userId) {\n        throw new ORPCError(\"UNAUTHORIZED\", {\n          message: \"Authentication required\",\n          data: { authType: \"session\", hint: \"Sign in to continue\" },\n        });\n      }\n      const currentRole = context.user.role;\n      if (!currentRole || !roles.includes(currentRole)) {\n        throw new ORPCError(\"FORBIDDEN\", {\n          message: `Requires role: ${roles.join(\" or \")}`,\n          data: { requiredRoles: roles, currentRole },\n        });\n      }\n      return next({ context: { userId: context.userId, user: context.user } });\n    }) as UserMiddleware;\n\n  const requireAdmin = requireRole(\"admin\");\n\n  const requireOrganization = builder.middleware(\n    async ({ context, next }: { context: Ctx; next: any }) => {\n      if (!context.user || !context.userId) {\n        throw new ORPCError(\"UNAUTHORIZED\", {\n          message: \"Authentication required\",\n          data: { authType: \"session\", hint: \"Sign in to continue\" },\n        });\n      }\n      if (!context.organization?.activeOrganizationId) {\n        throw new ORPCError(\"FORBIDDEN\", {\n          message: \"Active organization required\",\n          data: { hint: \"Select or create an organization\" },\n        });\n      }\n      const org = context.organization;\n      assertOrganizationApproval(org.organization);\n      return next({\n        context: {\n          userId: context.userId,\n          user: context.user,\n          organization: {\n            ...org,\n            activeOrganizationId: org.activeOrganizationId,\n            organization: org.organization\n              ? {\n                  ...org.organization,\n                  metadata: parseOrgMetadata(org.organization.metadata, options?.orgMetaSchema),\n                }\n              : null,\n          },\n        },\n      });\n    },\n  ) as OrgMiddleware;\n\n  const requireOrgRole = <TRoles extends readonly string[]>(...roles: TRoles) =>\n    builder.middleware(async ({ context, next }: { context: Ctx; next: any }) => {\n      if (!context.user || !context.userId) {\n        throw new ORPCError(\"UNAUTHORIZED\", {\n          message: \"Authentication required\",\n          data: { authType: \"session\", hint: \"Sign in to continue\" },\n        });\n      }\n      if (!context.organization?.activeOrganizationId) {\n        throw new ORPCError(\"FORBIDDEN\", {\n          message: \"Active organization required\",\n          data: { hint: \"Select or create an organization\" },\n        });\n      }\n      const member = context.organization?.member;\n      if (!member?.id || !member?.role || !roles.includes(member.role)) {\n        throw new ORPCError(\"FORBIDDEN\", {\n          message: `Requires organization role: ${roles.join(\" or \")}`,\n          data: { requiredRoles: roles, currentRole: member?.role ?? null },\n        });\n      }\n      const org = context.organization;\n      assertOrganizationApproval(org.organization);\n      return next({\n        context: {\n          userId: context.userId,\n          user: context.user,\n          organization: {\n            ...org,\n            activeOrganizationId: org.activeOrganizationId,\n            member: { id: member.id, role: member.role },\n            organization: org.organization\n              ? {\n                  ...org.organization,\n                  metadata: parseOrgMetadata(org.organization.metadata, options?.orgMetaSchema),\n                }\n              : null,\n          },\n        },\n      });\n    }) as MemberMiddleware;\n\n  const requireApiKey = (requiredPermissions?: Record<string, string[]>) =>\n    builder.middleware(async ({ context, next }: { context: Ctx; next: any }) => {\n      if (!context.apiKey) {\n        throw new ORPCError(\"UNAUTHORIZED\", {\n          message: \"API key required\",\n          data: { authType: \"apiKey\", hint: \"Provide a valid API key via x-api-key header\" },\n        });\n      }\n      if (requiredPermissions) {\n        const keyPerms = context.apiKey.permissions ?? {};\n        for (const [resource, actions] of Object.entries(requiredPermissions)) {\n          const allowed = keyPerms[resource] ?? [];\n          const missing = actions.filter((a: string) => !allowed.includes(a));\n          if (missing.length > 0) {\n            throw new ORPCError(\"FORBIDDEN\", {\n              message: `API key lacks permission: ${resource}:${missing.join(\",\")}`,\n              data: { requiredPermissions, keyPermissions: keyPerms },\n            });\n          }\n        }\n      }\n      return next({ context: { apiKey: context.apiKey } });\n    }) as ApiKeyMiddleware;\n\n  const requirePermission = (\n    resource: string,\n    action: string,\n    scope?: { scope?: \"organization\" | \"team\"; teamId?: (input: any) => string | undefined },\n  ) =>\n    builder.middleware(async ({ context, next }: { context: Ctx; next: any }, input: any) => {\n      let granted: string[] | undefined;\n      if (scope?.scope === \"team\") {\n        const teamId = scope.teamId?.(input);\n        const team = context.organization?.teams?.find((t) => t.id === teamId);\n        granted = team?.permissions?.[resource];\n      } else {\n        granted = context.permissions?.[resource];\n      }\n      if (!granted?.includes(action)) {\n        throw new ORPCError(\"FORBIDDEN\", {\n          message: `Requires permission: ${resource}:${action}`,\n          data: { requiredPermissions: [`${resource}:${action}`] },\n        });\n      }\n      return next({ context });\n    }) as DecoratedMiddleware<Ctx, Record<string, never>, any, any, any>;\n\n  return {\n    requireAuth,\n    requireAuthOrApiKey,\n    requireRole,\n    requireAdmin,\n    requireOrganization,\n    requireOrgRole,\n    requireApiKey,\n    requirePermission,\n  };\n}\n\nfunction assertOrganizationApproval(\n  organization: NonNullable<AuthContextShape[\"organization\"]>[\"organization\"],\n) {\n  if (organization?.status && organization.status !== \"active\") {\n    throw new ORPCError(\"FORBIDDEN\", {\n      message: \"Organization requires platform-admin approval\",\n    });\n  }\n}\n\nfunction parseOrgMetadata<TSchema extends z.ZodType | undefined>(\n  raw: Record<string, unknown> | null | undefined,\n  schema: TSchema | undefined,\n): OrgMetaType<TSchema> | null {\n  if (!raw) return null;\n  if (!schema) return raw as OrgMetaType<TSchema>;\n  const result = schema.safeParse(raw);\n  if (result.success) return result.data as OrgMetaType<TSchema>;\n  throw new ORPCError(\"INTERNAL_SERVER_ERROR\", {\n    message: \"Invalid organization metadata\",\n    data: { errors: result.error.issues },\n  });\n}\n"],"mappings":";;;AAiCA,SAAgB,qBAGd,SAAc,SAA8C;CA2D5D,MAAM,cAAc,QAAQ,WAAW,OAAO,EAAE,SAAS,WAAwC;EAC/F,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,QAC5B,MAAM,IAAI,UAAU,gBAAgB;GAClC,SAAS;GACT,MAAM,EAAE,MAAM,sBAAsB;EACtC,CAAC;EAEH,OAAO,KAAK,EAAE,SAAS;GAAE,QAAQ,QAAQ;GAAQ,MAAM,QAAQ;EAAK,EAAE,CAAC;CACzE,CAAC;CAED,MAAM,sBAAsB,QAAQ,WAClC,OAAO,EAAE,SAAS,WAAwC;EACxD,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,UAAU,CAAC,QAAQ,QAC/C,MAAM,IAAI,UAAU,gBAAgB;GAClC,SAAS;GACT,MAAM,EAAE,MAAM,gCAAgC;EAChD,CAAC;EAEH,OAAO,KAAK,EAAE,QAAQ,CAAC;CACzB,CACF;CAEA,MAAM,eAAiD,GAAG,UACxD,QAAQ,WAAW,OAAO,EAAE,SAAS,WAAwC;EAC3E,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,QAC5B,MAAM,IAAI,UAAU,gBAAgB;GAClC,SAAS;GACT,MAAM;IAAE,UAAU;IAAW,MAAM;GAAsB;EAC3D,CAAC;EAEH,MAAM,cAAc,QAAQ,KAAK;EACjC,IAAI,CAAC,eAAe,CAAC,MAAM,SAAS,WAAW,GAC7C,MAAM,IAAI,UAAU,aAAa;GAC/B,SAAS,kBAAkB,MAAM,KAAK,MAAM;GAC5C,MAAM;IAAE,eAAe;IAAO;GAAY;EAC5C,CAAC;EAEH,OAAO,KAAK,EAAE,SAAS;GAAE,QAAQ,QAAQ;GAAQ,MAAM,QAAQ;EAAK,EAAE,CAAC;CACzE,CAAC;CAEH,MAAM,eAAe,YAAY,OAAO;CAExC,MAAM,sBAAsB,QAAQ,WAClC,OAAO,EAAE,SAAS,WAAwC;EACxD,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,QAC5B,MAAM,IAAI,UAAU,gBAAgB;GAClC,SAAS;GACT,MAAM;IAAE,UAAU;IAAW,MAAM;GAAsB;EAC3D,CAAC;EAEH,IAAI,CAAC,QAAQ,cAAc,sBACzB,MAAM,IAAI,UAAU,aAAa;GAC/B,SAAS;GACT,MAAM,EAAE,MAAM,mCAAmC;EACnD,CAAC;EAEH,MAAM,MAAM,QAAQ;EACpB,2BAA2B,IAAI,YAAY;EAC3C,OAAO,KAAK,EACV,SAAS;GACP,QAAQ,QAAQ;GAChB,MAAM,QAAQ;GACd,cAAc;IACZ,GAAG;IACH,sBAAsB,IAAI;IAC1B,cAAc,IAAI,eACd;KACE,GAAG,IAAI;KACP,UAAU,iBAAiB,IAAI,aAAa,UAAU,SAAS,aAAa;IAC9E,IACA;GACN;EACF,EACF,CAAC;CACH,CACF;CAEA,MAAM,kBAAoD,GAAG,UAC3D,QAAQ,WAAW,OAAO,EAAE,SAAS,WAAwC;EAC3E,IAAI,CAAC,QAAQ,QAAQ,CAAC,QAAQ,QAC5B,MAAM,IAAI,UAAU,gBAAgB;GAClC,SAAS;GACT,MAAM;IAAE,UAAU;IAAW,MAAM;GAAsB;EAC3D,CAAC;EAEH,IAAI,CAAC,QAAQ,cAAc,sBACzB,MAAM,IAAI,UAAU,aAAa;GAC/B,SAAS;GACT,MAAM,EAAE,MAAM,mCAAmC;EACnD,CAAC;EAEH,MAAM,SAAS,QAAQ,cAAc;EACrC,IAAI,CAAC,QAAQ,MAAM,CAAC,QAAQ,QAAQ,CAAC,MAAM,SAAS,OAAO,IAAI,GAC7D,MAAM,IAAI,UAAU,aAAa;GAC/B,SAAS,+BAA+B,MAAM,KAAK,MAAM;GACzD,MAAM;IAAE,eAAe;IAAO,aAAa,QAAQ,QAAQ;GAAK;EAClE,CAAC;EAEH,MAAM,MAAM,QAAQ;EACpB,2BAA2B,IAAI,YAAY;EAC3C,OAAO,KAAK,EACV,SAAS;GACP,QAAQ,QAAQ;GAChB,MAAM,QAAQ;GACd,cAAc;IACZ,GAAG;IACH,sBAAsB,IAAI;IAC1B,QAAQ;KAAE,IAAI,OAAO;KAAI,MAAM,OAAO;IAAK;IAC3C,cAAc,IAAI,eACd;KACE,GAAG,IAAI;KACP,UAAU,iBAAiB,IAAI,aAAa,UAAU,SAAS,aAAa;IAC9E,IACA;GACN;EACF,EACF,CAAC;CACH,CAAC;CAEH,MAAM,iBAAiB,wBACrB,QAAQ,WAAW,OAAO,EAAE,SAAS,WAAwC;EAC3E,IAAI,CAAC,QAAQ,QACX,MAAM,IAAI,UAAU,gBAAgB;GAClC,SAAS;GACT,MAAM;IAAE,UAAU;IAAU,MAAM;GAA+C;EACnF,CAAC;EAEH,IAAI,qBAAqB;GACvB,MAAM,WAAW,QAAQ,OAAO,eAAe,CAAC;GAChD,KAAK,MAAM,CAAC,UAAU,YAAY,OAAO,QAAQ,mBAAmB,GAAG;IACrE,MAAM,UAAU,SAAS,aAAa,CAAC;IACvC,MAAM,UAAU,QAAQ,QAAQ,MAAc,CAAC,QAAQ,SAAS,CAAC,CAAC;IAClE,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,UAAU,aAAa;KAC/B,SAAS,6BAA6B,SAAS,GAAG,QAAQ,KAAK,GAAG;KAClE,MAAM;MAAE;MAAqB,gBAAgB;KAAS;IACxD,CAAC;GAEL;EACF;EACA,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,QAAQ,OAAO,EAAE,CAAC;CACrD,CAAC;CAEH,MAAM,qBACJ,UACA,QACA,UAEA,QAAQ,WAAW,OAAO,EAAE,SAAS,QAAqC,UAAe;EACvF,IAAI;EACJ,IAAI,OAAO,UAAU,QAAQ;GAC3B,MAAM,SAAS,MAAM,SAAS,KAAK;GAEnC,WADa,QAAQ,cAAc,OAAO,MAAM,MAAM,EAAE,OAAO,MAAM,EACvD,EAAE,cAAc;EAChC,OACE,UAAU,QAAQ,cAAc;EAElC,IAAI,CAAC,SAAS,SAAS,MAAM,GAC3B,MAAM,IAAI,UAAU,aAAa;GAC/B,SAAS,wBAAwB,SAAS,GAAG;GAC7C,MAAM,EAAE,qBAAqB,CAAC,GAAG,SAAS,GAAG,QAAQ,EAAE;EACzD,CAAC;EAEH,OAAO,KAAK,EAAE,QAAQ,CAAC;CACzB,CAAC;CAEH,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF;AAEA,SAAS,2BACP,cACA;CACA,IAAI,cAAc,UAAU,aAAa,WAAW,UAClD,MAAM,IAAI,UAAU,aAAa,EAC/B,SAAS,gDACX,CAAC;AAEL;AAEA,SAAS,iBACP,KACA,QAC6B;CAC7B,IAAI,CAAC,KAAK,OAAO;CACjB,IAAI,CAAC,QAAQ,OAAO;CACpB,MAAM,SAAS,OAAO,UAAU,GAAG;CACnC,IAAI,OAAO,SAAS,OAAO,OAAO;CAClC,MAAM,IAAI,UAAU,yBAAyB;EAC3C,SAAS;EACT,MAAM,EAAE,QAAQ,OAAO,MAAM,OAAO;CACtC,CAAC;AACH"}

package/dist/build.cjs

@@ -6,9 +6,9 @@ const require_timing = require('./cli/timing.cjs');
 const require_workspace = require('./workspace.cjs');
 const require_shared_deps = require('./shared-deps.cjs');
 const require_string = require('./utils/string.cjs');
+let node_fs_promises = require("node:fs/promises");
 let node_process = require("node:process");
 node_process = require_runtime.__toESM(node_process, 1);
-let node_fs_promises = require("node:fs/promises");
 
 //#region src/build.ts
 const buildCommands = {

package/dist/build.mjs

@@ -5,8 +5,8 @@ import { formatDuration } from "./cli/timing.mjs";
 import { ensureFreshDeps, findWorkspaceRoot } from "./workspace.mjs";
 import { syncResolvedSharedDeps } from "./shared-deps.mjs";
 import { padRight } from "./utils/string.mjs";
-import process from "node:process";
 import { access, readFile } from "node:fs/promises";
+import process from "node:process";
 
 //#region src/build.ts
 const buildCommands = {

package/dist/bundle-cache.cjs

@@ -34,7 +34,7 @@ function bundleCachePath(url, input) {
 	const match = /^\/bundles\/([^/]+)\/([^/]+)\/(.+)$/.exec(parsed.pathname);
 	if (!match) return null;
 	const [, account, gateway, rest] = match;
-	if (!rest || rest.endsWith("/")) return null;
+	if (!account || !gateway || !rest || rest.endsWith("/")) return null;
 	let decoded;
 	try {
 		decoded = decodeURIComponent(rest);

package/dist/bundle-cache.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"bundle-cache.cjs","names":["path","readFile","mkdir","createHash","writeFile","rename"],"sources":["../src/bundle-cache.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { mkdir, readFile, rename, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\n\n/**\n * Bundle disk cache (ADR 0011 amendment — foreign-namespace resilience):\n * the child tier loads base workspaces from foreign origins; this cache\n * keeps the last-known-good bytes so an origin outage degrades to stale\n * serving instead of a hard failure. One cache root, two entrances: the\n * host's `/bundles/*` proxy handler (browser traffic) and the CLI fetch\n * adapter (boot-time outbound). Keyed exactly like the staged layout —\n * `<account>/<gateway>/<rest>` — but a separate root from BOS_BUNDLE_DIR:\n * cached bytes are a resilience artifact, never a deployment (plan 043 —\n * never point a runtime's BOS_BUNDLE_DIR at another runtime's layout).\n */\n\nexport function bundleCacheRoot(input?: { cacheDir?: string }): string {\n  return path.resolve(input?.cacheDir ?? process.env.BOS_BUNDLE_CACHE_DIR ?? joinDefault());\n}\n\nfunction joinDefault(): string {\n  return path.join(process.cwd(), \".bos\", \"bundle-cache\");\n}\n\nexport function bundleCachePath(url: string, input?: { cacheDir?: string }): string | null {\n  let parsed: URL;\n  try {\n    parsed = new URL(url);\n  } catch {\n    return null;\n  }\n  if (parsed.protocol !== \"https:\" && parsed.protocol !== \"http:\") return null;\n  const match = /^\\/bundles\\/([^/]+)\\/([^/]+)\\/(.+)$/.exec(parsed.pathname);\n  if (!match) return null;\n  const [, account, gateway, rest] = match;\n  if (!rest || rest.endsWith(\"/\")) return null;\n  let decoded: string;\n  try {\n    decoded = decodeURIComponent(rest);\n  } catch {\n    return null;\n  }\n  const root = path.resolve(bundleCacheRoot(input));\n  const filePath = path.resolve(root, account, gateway, decoded);\n  if (!filePath.startsWith(root + path.sep)) return null;\n  return filePath;\n}\n\nexport async function readBundleCache(\n  url: string,\n  input?: { cacheDir?: string },\n): Promise<Uint8Array | null> {\n  const filePath = bundleCachePath(url, input);\n  if (!filePath) return null;\n  try {\n    return new Uint8Array(await readFile(filePath));\n  } catch {\n    return null;\n  }\n}\n\nexport async function writeBundleCache(\n  url: string,\n  bytes: Uint8Array,\n  input?: { cacheDir?: string },\n): Promise<void> {\n  const filePath = bundleCachePath(url, input);\n  if (!filePath) return;\n  try {\n    await mkdir(path.dirname(filePath), { recursive: true });\n    const tmp = `${filePath}.${process.pid}.${createHash(\"sha256\").update(bytes).digest(\"hex\").slice(0, 8)}.tmp`;\n    await writeFile(tmp, bytes);\n    await rename(tmp, filePath);\n  } catch {\n    // cache writes are best-effort — never fail the serving path\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAgBA,SAAgB,gBAAgB,OAAuC;CACrE,OAAOA,kBAAK,QAAQ,OAAO,YAAY,QAAQ,IAAI,wBAAwB,YAAY,CAAC;AAC1F;AAEA,SAAS,cAAsB;CAC7B,OAAOA,kBAAK,KAAK,QAAQ,IAAI,GAAG,QAAQ,cAAc;AACxD;AAEA,SAAgB,gBAAgB,KAAa,OAA8C;CACzF,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,GAAG;CACtB,QAAQ;EACN,OAAO;CACT;CACA,IAAI,OAAO,aAAa,YAAY,OAAO,aAAa,SAAS,OAAO;CACxE,MAAM,QAAQ,sCAAsC,KAAK,OAAO,QAAQ;CACxE,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,GAAG,SAAS,SAAS,QAAQ;CACnC,IAAI,CAAC,QAAQ,KAAK,SAAS,GAAG,GAAG,OAAO;CACxC,IAAI;CACJ,IAAI;EACF,UAAU,mBAAmB,IAAI;CACnC,QAAQ;EACN,OAAO;CACT;CACA,MAAM,OAAOA,kBAAK,QAAQ,gBAAgB,KAAK,CAAC;CAChD,MAAM,WAAWA,kBAAK,QAAQ,MAAM,SAAS,SAAS,OAAO;CAC7D,IAAI,CAAC,SAAS,WAAW,OAAOA,kBAAK,GAAG,GAAG,OAAO;CAClD,OAAO;AACT;AAEA,eAAsB,gBACpB,KACA,OAC4B;CAC5B,MAAM,WAAW,gBAAgB,KAAK,KAAK;CAC3C,IAAI,CAAC,UAAU,OAAO;CACtB,IAAI;EACF,OAAO,IAAI,WAAW,UAAMC,2BAAS,QAAQ,CAAC;CAChD,QAAQ;EACN,OAAO;CACT;AACF;AAEA,eAAsB,iBACpB,KACA,OACA,OACe;CACf,MAAM,WAAW,gBAAgB,KAAK,KAAK;CAC3C,IAAI,CAAC,UAAU;CACf,IAAI;EACF,UAAMC,wBAAMF,kBAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;EACvD,MAAM,MAAM,GAAG,SAAS,GAAG,QAAQ,IAAI,OAAGG,wBAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;EACvG,UAAMC,4BAAU,KAAK,KAAK;EAC1B,UAAMC,yBAAO,KAAK,QAAQ;CAC5B,QAAQ,CAER;AACF"}
+{"version":3,"file":"bundle-cache.cjs","names":["path","readFile","mkdir","createHash","writeFile","rename"],"sources":["../src/bundle-cache.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { mkdir, readFile, rename, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\n\n/**\n * Bundle disk cache (ADR 0011 amendment — foreign-namespace resilience):\n * the child tier loads base workspaces from foreign origins; this cache\n * keeps the last-known-good bytes so an origin outage degrades to stale\n * serving instead of a hard failure. One cache root, two entrances: the\n * host's `/bundles/*` proxy handler (browser traffic) and the CLI fetch\n * adapter (boot-time outbound). Keyed exactly like the staged layout —\n * `<account>/<gateway>/<rest>` — but a separate root from BOS_BUNDLE_DIR:\n * cached bytes are a resilience artifact, never a deployment (plan 043 —\n * never point a runtime's BOS_BUNDLE_DIR at another runtime's layout).\n */\n\nexport function bundleCacheRoot(input?: { cacheDir?: string }): string {\n  return path.resolve(input?.cacheDir ?? process.env.BOS_BUNDLE_CACHE_DIR ?? joinDefault());\n}\n\nfunction joinDefault(): string {\n  return path.join(process.cwd(), \".bos\", \"bundle-cache\");\n}\n\nexport function bundleCachePath(url: string, input?: { cacheDir?: string }): string | null {\n  let parsed: URL;\n  try {\n    parsed = new URL(url);\n  } catch {\n    return null;\n  }\n  if (parsed.protocol !== \"https:\" && parsed.protocol !== \"http:\") return null;\n  const match = /^\\/bundles\\/([^/]+)\\/([^/]+)\\/(.+)$/.exec(parsed.pathname);\n  if (!match) return null;\n  const [, account, gateway, rest] = match;\n  if (!account || !gateway || !rest || rest.endsWith(\"/\")) return null;\n  let decoded: string;\n  try {\n    decoded = decodeURIComponent(rest);\n  } catch {\n    return null;\n  }\n  const root = path.resolve(bundleCacheRoot(input));\n  const filePath = path.resolve(root, account, gateway, decoded);\n  if (!filePath.startsWith(root + path.sep)) return null;\n  return filePath;\n}\n\nexport async function readBundleCache(\n  url: string,\n  input?: { cacheDir?: string },\n): Promise<Uint8Array | null> {\n  const filePath = bundleCachePath(url, input);\n  if (!filePath) return null;\n  try {\n    return new Uint8Array(await readFile(filePath));\n  } catch {\n    return null;\n  }\n}\n\nexport async function writeBundleCache(\n  url: string,\n  bytes: Uint8Array,\n  input?: { cacheDir?: string },\n): Promise<void> {\n  const filePath = bundleCachePath(url, input);\n  if (!filePath) return;\n  try {\n    await mkdir(path.dirname(filePath), { recursive: true });\n    const tmp = `${filePath}.${process.pid}.${createHash(\"sha256\").update(bytes).digest(\"hex\").slice(0, 8)}.tmp`;\n    await writeFile(tmp, bytes);\n    await rename(tmp, filePath);\n  } catch {\n    // cache writes are best-effort — never fail the serving path\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAgBA,SAAgB,gBAAgB,OAAuC;CACrE,OAAOA,kBAAK,QAAQ,OAAO,YAAY,QAAQ,IAAI,wBAAwB,YAAY,CAAC;AAC1F;AAEA,SAAS,cAAsB;CAC7B,OAAOA,kBAAK,KAAK,QAAQ,IAAI,GAAG,QAAQ,cAAc;AACxD;AAEA,SAAgB,gBAAgB,KAAa,OAA8C;CACzF,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,GAAG;CACtB,QAAQ;EACN,OAAO;CACT;CACA,IAAI,OAAO,aAAa,YAAY,OAAO,aAAa,SAAS,OAAO;CACxE,MAAM,QAAQ,sCAAsC,KAAK,OAAO,QAAQ;CACxE,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,GAAG,SAAS,SAAS,QAAQ;CACnC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,QAAQ,KAAK,SAAS,GAAG,GAAG,OAAO;CAChE,IAAI;CACJ,IAAI;EACF,UAAU,mBAAmB,IAAI;CACnC,QAAQ;EACN,OAAO;CACT;CACA,MAAM,OAAOA,kBAAK,QAAQ,gBAAgB,KAAK,CAAC;CAChD,MAAM,WAAWA,kBAAK,QAAQ,MAAM,SAAS,SAAS,OAAO;CAC7D,IAAI,CAAC,SAAS,WAAW,OAAOA,kBAAK,GAAG,GAAG,OAAO;CAClD,OAAO;AACT;AAEA,eAAsB,gBACpB,KACA,OAC4B;CAC5B,MAAM,WAAW,gBAAgB,KAAK,KAAK;CAC3C,IAAI,CAAC,UAAU,OAAO;CACtB,IAAI;EACF,OAAO,IAAI,WAAW,UAAMC,2BAAS,QAAQ,CAAC;CAChD,QAAQ;EACN,OAAO;CACT;AACF;AAEA,eAAsB,iBACpB,KACA,OACA,OACe;CACf,MAAM,WAAW,gBAAgB,KAAK,KAAK;CAC3C,IAAI,CAAC,UAAU;CACf,IAAI;EACF,UAAMC,wBAAMF,kBAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;EACvD,MAAM,MAAM,GAAG,SAAS,GAAG,QAAQ,IAAI,OAAGG,wBAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;EACvG,UAAMC,4BAAU,KAAK,KAAK;EAC1B,UAAMC,yBAAO,KAAK,QAAQ;CAC5B,QAAQ,CAER;AACF"}

package/dist/bundle-cache.mjs

@@ -31,7 +31,7 @@ function bundleCachePath(url, input) {
 	const match = /^\/bundles\/([^/]+)\/([^/]+)\/(.+)$/.exec(parsed.pathname);
 	if (!match) return null;
 	const [, account, gateway, rest] = match;
-	if (!rest || rest.endsWith("/")) return null;
+	if (!account || !gateway || !rest || rest.endsWith("/")) return null;
 	let decoded;
 	try {
 		decoded = decodeURIComponent(rest);

package/dist/bundle-cache.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"bundle-cache.mjs","names":[],"sources":["../src/bundle-cache.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { mkdir, readFile, rename, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\n\n/**\n * Bundle disk cache (ADR 0011 amendment — foreign-namespace resilience):\n * the child tier loads base workspaces from foreign origins; this cache\n * keeps the last-known-good bytes so an origin outage degrades to stale\n * serving instead of a hard failure. One cache root, two entrances: the\n * host's `/bundles/*` proxy handler (browser traffic) and the CLI fetch\n * adapter (boot-time outbound). Keyed exactly like the staged layout —\n * `<account>/<gateway>/<rest>` — but a separate root from BOS_BUNDLE_DIR:\n * cached bytes are a resilience artifact, never a deployment (plan 043 —\n * never point a runtime's BOS_BUNDLE_DIR at another runtime's layout).\n */\n\nexport function bundleCacheRoot(input?: { cacheDir?: string }): string {\n  return path.resolve(input?.cacheDir ?? process.env.BOS_BUNDLE_CACHE_DIR ?? joinDefault());\n}\n\nfunction joinDefault(): string {\n  return path.join(process.cwd(), \".bos\", \"bundle-cache\");\n}\n\nexport function bundleCachePath(url: string, input?: { cacheDir?: string }): string | null {\n  let parsed: URL;\n  try {\n    parsed = new URL(url);\n  } catch {\n    return null;\n  }\n  if (parsed.protocol !== \"https:\" && parsed.protocol !== \"http:\") return null;\n  const match = /^\\/bundles\\/([^/]+)\\/([^/]+)\\/(.+)$/.exec(parsed.pathname);\n  if (!match) return null;\n  const [, account, gateway, rest] = match;\n  if (!rest || rest.endsWith(\"/\")) return null;\n  let decoded: string;\n  try {\n    decoded = decodeURIComponent(rest);\n  } catch {\n    return null;\n  }\n  const root = path.resolve(bundleCacheRoot(input));\n  const filePath = path.resolve(root, account, gateway, decoded);\n  if (!filePath.startsWith(root + path.sep)) return null;\n  return filePath;\n}\n\nexport async function readBundleCache(\n  url: string,\n  input?: { cacheDir?: string },\n): Promise<Uint8Array | null> {\n  const filePath = bundleCachePath(url, input);\n  if (!filePath) return null;\n  try {\n    return new Uint8Array(await readFile(filePath));\n  } catch {\n    return null;\n  }\n}\n\nexport async function writeBundleCache(\n  url: string,\n  bytes: Uint8Array,\n  input?: { cacheDir?: string },\n): Promise<void> {\n  const filePath = bundleCachePath(url, input);\n  if (!filePath) return;\n  try {\n    await mkdir(path.dirname(filePath), { recursive: true });\n    const tmp = `${filePath}.${process.pid}.${createHash(\"sha256\").update(bytes).digest(\"hex\").slice(0, 8)}.tmp`;\n    await writeFile(tmp, bytes);\n    await rename(tmp, filePath);\n  } catch {\n    // cache writes are best-effort — never fail the serving path\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAgBA,SAAgB,gBAAgB,OAAuC;CACrE,OAAO,KAAK,QAAQ,OAAO,YAAY,QAAQ,IAAI,wBAAwB,YAAY,CAAC;AAC1F;AAEA,SAAS,cAAsB;CAC7B,OAAO,KAAK,KAAK,QAAQ,IAAI,GAAG,QAAQ,cAAc;AACxD;AAEA,SAAgB,gBAAgB,KAAa,OAA8C;CACzF,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,GAAG;CACtB,QAAQ;EACN,OAAO;CACT;CACA,IAAI,OAAO,aAAa,YAAY,OAAO,aAAa,SAAS,OAAO;CACxE,MAAM,QAAQ,sCAAsC,KAAK,OAAO,QAAQ;CACxE,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,GAAG,SAAS,SAAS,QAAQ;CACnC,IAAI,CAAC,QAAQ,KAAK,SAAS,GAAG,GAAG,OAAO;CACxC,IAAI;CACJ,IAAI;EACF,UAAU,mBAAmB,IAAI;CACnC,QAAQ;EACN,OAAO;CACT;CACA,MAAM,OAAO,KAAK,QAAQ,gBAAgB,KAAK,CAAC;CAChD,MAAM,WAAW,KAAK,QAAQ,MAAM,SAAS,SAAS,OAAO;CAC7D,IAAI,CAAC,SAAS,WAAW,OAAO,KAAK,GAAG,GAAG,OAAO;CAClD,OAAO;AACT;AAEA,eAAsB,gBACpB,KACA,OAC4B;CAC5B,MAAM,WAAW,gBAAgB,KAAK,KAAK;CAC3C,IAAI,CAAC,UAAU,OAAO;CACtB,IAAI;EACF,OAAO,IAAI,WAAW,MAAM,SAAS,QAAQ,CAAC;CAChD,QAAQ;EACN,OAAO;CACT;AACF;AAEA,eAAsB,iBACpB,KACA,OACA,OACe;CACf,MAAM,WAAW,gBAAgB,KAAK,KAAK;CAC3C,IAAI,CAAC,UAAU;CACf,IAAI;EACF,MAAM,MAAM,KAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;EACvD,MAAM,MAAM,GAAG,SAAS,GAAG,QAAQ,IAAI,GAAG,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;EACvG,MAAM,UAAU,KAAK,KAAK;EAC1B,MAAM,OAAO,KAAK,QAAQ;CAC5B,QAAQ,CAER;AACF"}
+{"version":3,"file":"bundle-cache.mjs","names":[],"sources":["../src/bundle-cache.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { mkdir, readFile, rename, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\n\n/**\n * Bundle disk cache (ADR 0011 amendment — foreign-namespace resilience):\n * the child tier loads base workspaces from foreign origins; this cache\n * keeps the last-known-good bytes so an origin outage degrades to stale\n * serving instead of a hard failure. One cache root, two entrances: the\n * host's `/bundles/*` proxy handler (browser traffic) and the CLI fetch\n * adapter (boot-time outbound). Keyed exactly like the staged layout —\n * `<account>/<gateway>/<rest>` — but a separate root from BOS_BUNDLE_DIR:\n * cached bytes are a resilience artifact, never a deployment (plan 043 —\n * never point a runtime's BOS_BUNDLE_DIR at another runtime's layout).\n */\n\nexport function bundleCacheRoot(input?: { cacheDir?: string }): string {\n  return path.resolve(input?.cacheDir ?? process.env.BOS_BUNDLE_CACHE_DIR ?? joinDefault());\n}\n\nfunction joinDefault(): string {\n  return path.join(process.cwd(), \".bos\", \"bundle-cache\");\n}\n\nexport function bundleCachePath(url: string, input?: { cacheDir?: string }): string | null {\n  let parsed: URL;\n  try {\n    parsed = new URL(url);\n  } catch {\n    return null;\n  }\n  if (parsed.protocol !== \"https:\" && parsed.protocol !== \"http:\") return null;\n  const match = /^\\/bundles\\/([^/]+)\\/([^/]+)\\/(.+)$/.exec(parsed.pathname);\n  if (!match) return null;\n  const [, account, gateway, rest] = match;\n  if (!account || !gateway || !rest || rest.endsWith(\"/\")) return null;\n  let decoded: string;\n  try {\n    decoded = decodeURIComponent(rest);\n  } catch {\n    return null;\n  }\n  const root = path.resolve(bundleCacheRoot(input));\n  const filePath = path.resolve(root, account, gateway, decoded);\n  if (!filePath.startsWith(root + path.sep)) return null;\n  return filePath;\n}\n\nexport async function readBundleCache(\n  url: string,\n  input?: { cacheDir?: string },\n): Promise<Uint8Array | null> {\n  const filePath = bundleCachePath(url, input);\n  if (!filePath) return null;\n  try {\n    return new Uint8Array(await readFile(filePath));\n  } catch {\n    return null;\n  }\n}\n\nexport async function writeBundleCache(\n  url: string,\n  bytes: Uint8Array,\n  input?: { cacheDir?: string },\n): Promise<void> {\n  const filePath = bundleCachePath(url, input);\n  if (!filePath) return;\n  try {\n    await mkdir(path.dirname(filePath), { recursive: true });\n    const tmp = `${filePath}.${process.pid}.${createHash(\"sha256\").update(bytes).digest(\"hex\").slice(0, 8)}.tmp`;\n    await writeFile(tmp, bytes);\n    await rename(tmp, filePath);\n  } catch {\n    // cache writes are best-effort — never fail the serving path\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAgBA,SAAgB,gBAAgB,OAAuC;CACrE,OAAO,KAAK,QAAQ,OAAO,YAAY,QAAQ,IAAI,wBAAwB,YAAY,CAAC;AAC1F;AAEA,SAAS,cAAsB;CAC7B,OAAO,KAAK,KAAK,QAAQ,IAAI,GAAG,QAAQ,cAAc;AACxD;AAEA,SAAgB,gBAAgB,KAAa,OAA8C;CACzF,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,GAAG;CACtB,QAAQ;EACN,OAAO;CACT;CACA,IAAI,OAAO,aAAa,YAAY,OAAO,aAAa,SAAS,OAAO;CACxE,MAAM,QAAQ,sCAAsC,KAAK,OAAO,QAAQ;CACxE,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,GAAG,SAAS,SAAS,QAAQ;CACnC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,QAAQ,KAAK,SAAS,GAAG,GAAG,OAAO;CAChE,IAAI;CACJ,IAAI;EACF,UAAU,mBAAmB,IAAI;CACnC,QAAQ;EACN,OAAO;CACT;CACA,MAAM,OAAO,KAAK,QAAQ,gBAAgB,KAAK,CAAC;CAChD,MAAM,WAAW,KAAK,QAAQ,MAAM,SAAS,SAAS,OAAO;CAC7D,IAAI,CAAC,SAAS,WAAW,OAAO,KAAK,GAAG,GAAG,OAAO;CAClD,OAAO;AACT;AAEA,eAAsB,gBACpB,KACA,OAC4B;CAC5B,MAAM,WAAW,gBAAgB,KAAK,KAAK;CAC3C,IAAI,CAAC,UAAU,OAAO;CACtB,IAAI;EACF,OAAO,IAAI,WAAW,MAAM,SAAS,QAAQ,CAAC;CAChD,QAAQ;EACN,OAAO;CACT;AACF;AAEA,eAAsB,iBACpB,KACA,OACA,OACe;CACf,MAAM,WAAW,gBAAgB,KAAK,KAAK;CAC3C,IAAI,CAAC,UAAU;CACf,IAAI;EACF,MAAM,MAAM,KAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;EACvD,MAAM,MAAM,GAAG,SAAS,GAAG,QAAQ,IAAI,GAAG,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;EACvG,MAAM,UAAU,KAAK,KAAK;EAC1B,MAAM,OAAO,KAAK,QAAQ;CAC5B,QAAQ,CAER;AACF"}

package/dist/cli/init.cjs

@@ -1264,10 +1264,12 @@ The host exposes several surfaces for programmatic agent access:
 
 ### Authentication for agents
 
-1. Sign in with your NEAR wallet (SIWN) at the website.
+Every surface requires a session or API key — anonymous requests get \`401\` (including MCP \`tools/list\`).
+
+1. Sign in with your NEAR wallet (SIWN) at the website — or run \`bos login\` from a machine with a browser.
 2. Navigate to **Settings → API Keys** at \`/settings/api-keys\`.
-3. Create a new key — the full secret (\`edk_...\`) is shown once. Copy it immediately.
-4. Pass it on every request: \`x-api-key: edk_your_key_here\`
+3. Create a new key — the full secret (\`api_...\`) is shown once. Copy it immediately.
+4. Pass it on every request: \`x-api-key: api_your_key_here\`
 
 ### Architecture note: remotes are code bundles
 
@@ -1351,12 +1353,12 @@ function buildChildLlmsTxt(title) {
 
 ## Auth
 
-Authenticate to the API using an API key:
+Authenticate to the API using an API key (every surface — REST, RPC, MCP — requires a session or key; anonymous requests get \`401\`):
 
-1. Sign in with your NEAR wallet (SIWN) at the website.
+1. Sign in with your NEAR wallet (SIWN) at the website — or run \`bos login\` from a machine with a browser.
 2. Go to **Settings → API Keys** at \`/settings/api-keys\`.
-3. Create a key — the full secret (\`edk_...\`) is shown once.
-4. Pass it on every request: \`x-api-key: edk_your_key_here\`
+3. Create a key — the full secret (\`api_...\`) is shown once.
+4. Pass it on every request: \`x-api-key: api_your_key_here\`
 
 The \`x-api-key\` header works for \`/api/*\` (REST), \`/api/rpc/*\` (oRPC), and \`/api/mcp\` (MCP).
 
@@ -1387,12 +1389,22 @@ Transport: Streamable HTTP (stateless). Connect your MCP client to \`{origin}/ap
 
 ### Authentication
 
-Use an **API key**:
+Every API surface (REST, RPC, MCP) requires a session or an API key — anonymous
+requests get \`401\`. Use an **API key**:
 
 1. Sign in with your NEAR wallet at the website (SIWN).
 2. Navigate to **Settings → API Keys** at \`/settings/api-keys\`.
-3. Create a key — the full secret (\`edk_...\`) is shown once.
-4. Pass it on every request: \`x-api-key: edk_your_key_here\`
+3. Create a key — the full secret (\`api_...\`) is shown once.
+4. Pass it on every request: \`x-api-key: api_your_key_here\`
+
+Or from a machine with a browser: \`bos login\` — one approval, and the CLI
+persists an API key in \`.bos/session.json\` for headless use.
+
+### Deep dive
+
+The full API/auth skill is served by this app at
+\`{origin}/skills/everything-dev/talk-to-the-app/SKILL.md\` (MCP, REST, RPC,
+API keys, troubleshooting refusals).
 
 ### REST / OpenAPI