neotoma 0.21.0 → 0.21.4

package/dist/actions.d.ts

@@ -187,6 +187,24 @@ export declare function routeAcceptsAnonymousIssueSubmit(req: Pick<express.Reque
  * be resolved — prevents silent mis-attribution.
  */
 export declare function resolveGuestUserId(req: express.Request, principal: RoutePrincipal): Promise<string | null>;
+/**
+ * Helper to extract authenticated user_id from request.
+ * Supports: middleware-set user (Bearer / OAuth / dev-local / AAuth admission),
+ * session token, Ed25519 bearer.
+ *
+ * Stronger AAuth Admission plan: admitted AAuth callers carry
+ * `req.authenticatedUserId` resolved from the matching `agent_grant`'s
+ * owner. This helper applies the same `user_id` mismatch rules to them
+ * as to OAuth/Bearer — payload-driven user pivots are rejected. The
+ * local-dev override remains available only for the local dev user;
+ * AAuth admission can never resolve to that id, so admitted agents are
+ * structurally locked to their grant owner.
+ * @param req - Express request object
+ * @param providedUserId - Optional user_id from request body/query
+ * @returns Authenticated user_id
+ * @throws Error if not authenticated or user_id mismatch
+ */
+export declare function getAuthenticatedUserId(req: express.Request, providedUserId?: string): Promise<string>;
 type StoreRelationshipRef = {
     relationship_type: string;
     source_index?: number;

package/dist/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAuC9B,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AAarC,OAAO,EAGL,KAAK,aAAa,EAGnB,MAAM,4BAA4B,CAAC;AA4BpC,OAAO,EAQL,KAAK,sBAAsB,EAC5B,MAAM,4BAA4B,CAAC;AAkDpC,OAAO,EAGL,oBAAoB,EACrB,MAAM,8BAA8B,CAAC;AAWtC,OAAO,EAiCL,KAAK,wBAAwB,EAE9B,MAAM,4BAA4B,CAAC;AA8CpC,6FAA6F;AAC7F,wBAAgB,qBAAqB,IAAI,sBAAsB,GAAG,IAAI,CAErE;AAED,eAAO,MAAM,GAAG,6CAAY,CAAC;AA0wB7B,kFAAkF;AAClF,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMtE;AAoBD,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,OAAQ,CAAC;AAE9C;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMlE;AAID;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,OAAO,CAAC,QAAQ,EACrB,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAA;CAAE,GAC7F,IAAI,CA4IN;AAuBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CA+B1F;AAmCD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CA2B5D;AAGD;+EAC+E;AAC/E,eAAO,MAAM,gBAAgB,sBAA6B,CAAC;AAE3D;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,QAAc,CAAC;AAE3D;;;gEAGgE;AAChE,eAAO,MAAM,2BAA2B,QAAgB,CAAC;AAEzD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAKzE;AA4OD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,OAAO,CAAC,QAAQ,EACrB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAgBR;AAED,gGAAgG;AAChG,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,GAAG,SAAS,CAKhF;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CA2BhD;AAylDD,KAAK,aAAa,GAAG;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,KAAK,cAAc,GAAG,aAAa,GAAG,cAAc,CAAC;AA2CrD,4GAA4G;AAC5G,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAAG,OAAO,CAqBjG;AAED;;;;;;;;GAQG;AACH,wBAAgB,kCAAkC,CAChD,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAST;AAED,oHAAoH;AACpH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAWT;AAED,mGAAmG;AACnG,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAanE;AAoBD;;;;;;;;;;GAUG;AACH,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAIT;AAiHD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,SAAS,EAAE,cAAc,GACxB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoCxB;AAu+FD,KAAK,oBAAoB,GAAG;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAuDF,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,4BAA4B,EAAE,iBAAiB,CAAC;IAC3E,kFAAkF;IAClF,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACvC,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;;;;;;;;;;;;;;;;qBAu9BgB,MAAM;eACZ,MAAM;2BACM,MAAM;;;;;;cAtBnB,MAAM;iBACH,MAAM;2BACI,MAAM;qBACZ,MAAM;mBACR,MAAM;kBAIP,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;cAnC3B,MAAM;gBACJ,MAAM;2BACK,MAAM;qBACZ,MAAM;mBACR,MAAM;wBACD,MAAM;uBACP,MAAM;;;;;mBAhSV,MAAM;qBACJ,MAAM;wBACH,MAAM,GAAG,IAAI;2BACV,MAAM;;wBAET,MAAM;uBACP,MAAM,EAAE;wBACP,MAAM;uBACP,MAAM;;kBAxYX,MAAM;oBACJ,MAAM;yBACD,MAAM;4BACH,MAAM;2BACP,MAAM;;;kBAQf,MAAM;yBACC,MAAM;iCACE,MAAM;sCACD,MAAM;;+BA4Xb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;;;2BAwMlC,MAAM;0BACP,MAAM;0BACN,MAAM;;;;;;;;GA4e3B;AAwhHD,wBAAsB,eAAe;;;eAsQpC"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAuC9B,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AAarC,OAAO,EAGL,KAAK,aAAa,EAGnB,MAAM,4BAA4B,CAAC;AA4BpC,OAAO,EAQL,KAAK,sBAAsB,EAC5B,MAAM,4BAA4B,CAAC;AAkDpC,OAAO,EAGL,oBAAoB,EACrB,MAAM,8BAA8B,CAAC;AAWtC,OAAO,EAiCL,KAAK,wBAAwB,EAE9B,MAAM,4BAA4B,CAAC;AA8CpC,6FAA6F;AAC7F,wBAAgB,qBAAqB,IAAI,sBAAsB,GAAG,IAAI,CAErE;AAED,eAAO,MAAM,GAAG,6CAAY,CAAC;AA8yB7B,kFAAkF;AAClF,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMtE;AAoBD,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,OAAQ,CAAC;AAE9C;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMlE;AAID;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,OAAO,CAAC,QAAQ,EACrB,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAA;CAAE,GAC7F,IAAI,CA4IN;AAuBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CA+B1F;AAmCD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CA2B5D;AAGD;+EAC+E;AAC/E,eAAO,MAAM,gBAAgB,sBAA6B,CAAC;AAE3D;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,QAAc,CAAC;AAE3D;;;gEAGgE;AAChE,eAAO,MAAM,2BAA2B,QAAgB,CAAC;AAEzD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAKzE;AA4OD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,OAAO,CAAC,QAAQ,EACrB,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAgBR;AAED,gGAAgG;AAChG,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,GAAG,SAAS,CAKhF;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CA2BhD;AAylDD,KAAK,aAAa,GAAG;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,KAAK,cAAc,GAAG,aAAa,GAAG,cAAc,CAAC;AA2CrD,4GAA4G;AAC5G,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAAG,OAAO,CAqBjG;AAED;;;;;;;;GAQG;AACH,wBAAgB,kCAAkC,CAChD,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAST;AAED,oHAAoH;AACpH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAWT;AAED,mGAAmG;AACnG,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAanE;AAoBD;;;;;;;;;;GAUG;AACH,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAIT;AAiHD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,SAAS,EAAE,cAAc,GACxB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoCxB;AAwcD;;;;;;;;;;;;;;;;GAgBG;AAIH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,MAAM,CAAC,CA4CjB;AAmgFD,KAAK,oBAAoB,GAAG;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAuDF,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,4BAA4B,EAAE,iBAAiB,CAAC;IAC3E,kFAAkF;IAClF,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACvC,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;;;;;;;;;;;;;;;;qBAu9BgB,MAAM;eACZ,MAAM;2BACM,MAAM;;;;;;cAtBnB,MAAM;iBACH,MAAM;2BACI,MAAM;qBACZ,MAAM;mBACR,MAAM;kBAIP,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;cAnC3B,MAAM;gBACJ,MAAM;2BACK,MAAM;qBACZ,MAAM;mBACR,MAAM;wBACD,MAAM;uBACP,MAAM;;;;;mBAhSV,MAAM;qBACJ,MAAM;wBACH,MAAM,GAAG,IAAI;2BACV,MAAM;;wBAET,MAAM;uBACP,MAAM,EAAE;wBACP,MAAM;uBACP,MAAM;;kBAxYX,MAAM;oBACJ,MAAM;yBACD,MAAM;4BACH,MAAM;2BACP,MAAM;;;kBAQf,MAAM;yBACC,MAAM;iCACE,MAAM;sCACD,MAAM;;+BA4Xb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;;;2BAwMlC,MAAM;0BACP,MAAM;0BACN,MAAM;;;;;;;;GA4e3B;AAwhHD,wBAAsB,eAAe;;;eA+QpC"}

package/dist/actions.js

@@ -628,7 +628,14 @@ app.get("/.well-known/oauth-authorization-server", (req, res) => {
         token_endpoint_auth_methods_supported: ["none"],
     });
 });
-app.get("/.well-known/oauth-protected-resource", async (req, res) => {
+// Both the bare path and the resource-suffixed form are served (#2049).
+// RFC 9728 §3.1 locates a resource's metadata by appending the resource's own
+// path, so a client whose resource is `/mcp` probes
+// `/.well-known/oauth-protected-resource/mcp`. Express does not match that
+// against the bare route, so it previously fell through to the catch-all auth
+// guard and 401'd — the same bootstrap failure as the deadlock described below,
+// reached by a different path. Registering both makes either probe order work.
+app.get(["/.well-known/oauth-protected-resource", "/.well-known/oauth-protected-resource/mcp"], async (req, res) => {
     const forwardedProto = req.header("x-forwarded-proto")?.split(",")[0]?.trim();
     const forwardedHost = req.header("x-forwarded-host")?.split(",")[0]?.trim();
     const host = forwardedHost || req.header("host");
@@ -640,8 +647,18 @@ app.get("/.well-known/oauth-protected-resource", async (req, res) => {
         has_authorization: Boolean((req.headers["authorization"] || req.headers["Authorization"])),
         has_connection_id: Boolean(req.headers["x-connection-id"] || req.headers["X-Connection-Id"]),
     });
-    // oauth-repro pattern: return 401 on protected resource endpoint when unauthenticated
     // Validate X-Connection-Id here so Cursor gets consistent invalid_token signal (helps trigger Connect prompt)
+    //
+    // This document is NOT gated on authentication (#2049). RFC 9728 §3 makes
+    // protected-resource metadata the unauthenticated bootstrap entry point: its
+    // entire job is to tell a caller with no credentials where to obtain them. An
+    // earlier revision returned 401 here when neither Authorization nor
+    // X-Connection-Id was present, with a `WWW-Authenticate` naming THIS URL as
+    // the place to look — a self-referential deadlock. A client 401'd at /mcp
+    // follows the header here, is 401'd again pointing back here, and the login
+    // flow never starts, so no credential can resolve it. The sibling
+    // /.well-known/oauth-authorization-server was always public (RFC 8414 requires
+    // the same); that asymmetry was the bug, not the design.
     const authHeader = (req.headers["authorization"] || req.headers["Authorization"]);
     const connectionIdHeader = req.headers["x-connection-id"] || req.headers["X-Connection-Id"];
     // If X-Connection-Id is sent, validate it. Invalid/expired connection → 401 with error=invalid_token
@@ -660,17 +677,35 @@ app.get("/.well-known/oauth-protected-resource", async (req, res) => {
             });
         }
     }
-    if (!authHeader?.startsWith("Bearer ") && !connectionIdHeader) {
-        res.setHeader("WWW-Authenticate", `Bearer resource_metadata="${base}/.well-known/oauth-protected-resource"`);
-        return res.status(401).json({
-            error: "Unauthorized: Authentication required",
-        });
-    }
     res.setHeader("Content-Type", "application/json");
     res.json({
+        // RFC 9728 §3: `resource` is the identifier the client binds its token
+        // request to. Without it a client that validates the metadata document
+        // cannot confirm the document describes the resource it is trying to
+        // reach, and has to guess.
+        resource: `${base}/mcp`,
         authorization_servers: [base],
     });
 });
+// OIDC discovery is not offered — return an explicit 404 rather than letting this
+// path fall through to the catch-all auth guard, which answers 401 (#2049).
+//
+// A 401 on a route that does not exist tells an OIDC-first client "this endpoint
+// is real, you are just unauthenticated", sending it into the same dead end the
+// protected-resource deadlock created: it retries against a document that will
+// never serve it. A 404 says "not offered here", which correctly makes the client
+// fall back to RFC 8414 /.well-known/oauth-authorization-server.
+//
+// Deliberately NOT a synthetic 200 alias of the OAuth authorization-server
+// metadata: that would advertise a second, parallel discovery contract Neotoma
+// does not actually implement. Revisit only if a real OIDC stack is scoped.
+app.get("/.well-known/openid-configuration", (_req, res) => {
+    res.status(404).json({
+        error: "not_found",
+        error_description: "This server does not offer OpenID Connect discovery. Use " +
+            "/.well-known/oauth-authorization-server (RFC 8414) instead.",
+    });
+});
 // AAuth resource server metadata. Exposed publicly so AAuth client libraries
 // can auto-configure issuer / supported algs / signature window without an
 // out-of-band conversation. Neotoma is verifier-only: it never hosts agent
@@ -3358,28 +3393,42 @@ app.use(async (req, res, next) => {
         });
     }
     const bearerToken = headerAuth.slice("Bearer ".length).trim();
-    // Try to validate as Ed25519 bearer token first
+    // Ed25519 bearer path.
+    //
+    // SECURITY (advisory 2026-08-07-ed25519-bearer-forged-key-auth-bypass):
+    // The bearer token IS a public key (base64url of 32 raw bytes). Possession
+    // of a public key must NEVER authenticate — anyone can present any public
+    // key. Two invariants close the prior forged-key bypass:
+    //
+    //   1. A valid request Signature is MANDATORY. It proves possession of the
+    //      corresponding private key. A request without a signature is rejected,
+    //      not silently accepted (the old `if (signature && req.body)` made the
+    //      check optional, so an unsigned forged key sailed through).
+    //   2. The key must map to a PRE-PROVISIONED userId. `ensurePublicKeyRegistered`
+    //      auto-registers any syntactically-valid 32-byte key, so its `true` return
+    //      means "well-formed", not "known". Only a key that was registered WITH a
+    //      userId (getUserIdFromBearerToken) is a real principal; a bare
+    //      auto-registered key resolves to `undefined` and must fall through to the
+    //      reject path — never to a caller-supplied `user_id` in getAuthenticatedUserId.
     const registered = ensurePublicKeyRegistered(bearerToken);
-    if (registered && isBearerTokenValid(bearerToken)) {
-        // Optional: Verify signature if provided
-        const { signature } = parseAuthHeader(headerAuth);
-        if (signature && req.body) {
-            const bodyString = typeof req.body === "string" ? req.body : JSON.stringify(req.body);
-            const isValid = verifyRequest(bodyString, signature, bearerToken);
-            if (!isValid) {
-                logWarn("AuthInvalidSignature", req);
-                return sendError(res, 403, "AUTH_INVALID", "Invalid request signature");
-            }
+    const registeredUserId = registered ? getUserIdFromBearerToken(bearerToken) : undefined;
+    const { signature: ed25519Signature } = parseAuthHeader(headerAuth);
+    if (registered && isBearerTokenValid(bearerToken) && registeredUserId && ed25519Signature) {
+        // Signature is required and must verify over the exact request body.
+        const bodyString = typeof req.body === "string" ? req.body : JSON.stringify(req.body ?? "");
+        if (!verifyRequest(bodyString, ed25519Signature, bearerToken)) {
+            logWarn("AuthInvalidSignature", req);
+            return sendError(res, 403, "AUTH_INVALID", "Invalid request signature");
         }
         // Attach public key to request for encryption service
         req.publicKey = getPublicKey(bearerToken);
         req.bearerToken = bearerToken;
-        // If this token was registered with a userId, set it so getAuthenticatedUserId works without query param
-        const registeredUserId = getUserIdFromBearerToken(bearerToken);
-        if (registeredUserId) {
-            stampUserPrincipal(req, registeredUserId);
-        }
-        logger.info(`[Auth] ${req.method} ${req.path} auth_method=ed25519_bearer user_id=${req.authenticatedUserId ?? "(from token)"}`);
+        // Bind the request to the pre-provisioned principal. The caller cannot
+        // override this via a `user_id` param — getAuthenticatedUserId keys off the
+        // stamped principal, and the Ed25519 fall-through that trusted a
+        // caller-supplied user_id has been removed.
+        stampUserPrincipal(req, registeredUserId);
+        logger.info(`[Auth] ${req.method} ${req.path} auth_method=ed25519_bearer user_id=${registeredUserId}`);
     }
     else {
         // Try to validate as session token
@@ -3484,7 +3533,10 @@ app.get("/me", async (req, res) => {
  * @returns Authenticated user_id
  * @throws Error if not authenticated or user_id mismatch
  */
-async function getAuthenticatedUserId(req, providedUserId) {
+// Exported for the security regression test that asserts the fail-closed
+// behaviour for unresolved Bearer principals
+// (advisory 2026-08-07-ed25519-bearer-forged-key-auth-bypass).
+export async function getAuthenticatedUserId(req, providedUserId) {
     const principal = requestPrincipal(req);
     if (principal?.kind === "guest") {
         throw new Error("Not authenticated - guest principal cannot resolve a user_id");
@@ -3510,16 +3562,17 @@ async function getAuthenticatedUserId(req, providedUserId) {
         }
         return authenticatedUserId;
     }
-    const headerAuth = req.headers.authorization || "";
-    if (!headerAuth.startsWith("Bearer ")) {
-        throw new Error("Not authenticated - missing Bearer token");
-    }
-    // Ed25519 bearer token - user_id must be provided
-    if (!providedUserId) {
-        throw new Error("user_id required when using Ed25519 bearer token");
-    }
-    // For Ed25519 tokens, we trust the provided user_id (token validation happens in middleware)
-    return providedUserId;
+    // No principal was resolved by the auth middleware. Fail closed.
+    //
+    // SECURITY (advisory 2026-08-07-ed25519-bearer-forged-key-auth-bypass):
+    // Previously this tail returned the caller-supplied `user_id` for any request
+    // carrying a Bearer header, on the assumption that "token validation happens
+    // in middleware". A forged public key was accepted by that middleware without
+    // proving possession of the private key, so this line handed an attacker the
+    // scope of their choice (e.g. the shared nil-UUID owner). A request that
+    // reaches here has NOT been authenticated to any principal — there is no
+    // trustworthy `user_id` to return, regardless of what the caller provided.
+    throw new Error("Not authenticated - no resolved principal for request");
 }
 /**
  * Helper to handle errors in API endpoints, including authentication errors
@@ -3583,6 +3636,24 @@ function handleApiError(req, res, error, defaultMessage, errorCode = "DB_QUERY_F
             .status(error.status)
             .json(buildErrorEnvelope(error.code, error.message, error.toErrorEnvelopeDetails()));
     }
+    // SECURITY (advisory 2026-08-07-sort-by-order-by-sql-injection): a rejected
+    // snapshot field name (sort_by / snapshot_filters) or an unsafe column
+    // reference caught by the sqlite adapter is a client input error, not a server
+    // fault — surface it as a 400 so it is not masked as a 500 DB_QUERY_FAILED, and
+    // so the negative test asserts a stable status. Matched by name to avoid a
+    // static import cycle with the dynamically-imported query module.
+    if (error instanceof Error &&
+        (error.name === "InvalidSnapshotFieldError" ||
+            error.message.startsWith("Unsafe column reference rejected:"))) {
+        // Log the full message (with the rejected value) server-side for debugging,
+        // but do NOT echo the caller-supplied field string back in the response —
+        // reflecting rejected input, even sanitized, is needless. Return a generic
+        // detail that names the constraint. (Vanellus review, PR #2129, non-blocking.)
+        logWarn(logContext || "InvalidQueryField", req, { detail: error.message });
+        return res.status(400).json(buildErrorEnvelope("INVALID_QUERY_FIELD", "Invalid query field name.", {
+            detail: "Query field names (sort_by / snapshot_filters keys) must be bare identifiers matching ^[A-Za-z_][A-Za-z0-9_]*$.",
+        }));
+    }
     logError(logContext || "APIError", req, error);
     // SECURITY: do not echo raw Error.message to clients in production; SQLite /
     // filesystem errors frequently leak paths and schema. In development we keep
@@ -9609,6 +9680,15 @@ export async function startHTTPServer() {
     catch (err) {
         logger.warn(`[Plans] failed to seed plan schema: ${err.message}`);
     }
+    // Seed `agent_session` + `session_transcript` schemas (transcript ingest).
+    try {
+        const { seedSessionSchemas } = await import("./services/sessions/seed_schema.js");
+        await seedSessionSchemas();
+        logger.info("[Sessions] agent_session + session_transcript schemas seeded");
+    }
+    catch (err) {
+        logger.warn(`[Sessions] failed to seed session schemas: ${err.message}`);
+    }
     // Seed `skill` schema (harness-mirrored skills, slash-command palette).
     try {
         const { seedSkillSchema } = await import("./services/skills/seed_schema.js");
@@ -9775,6 +9855,42 @@ export async function startHTTPServer() {
 // Only auto-start if not disabled AND if this is the main module
 const isMainModule = import.meta.url === `file://${process.argv[1]}`;
 if (process.env.NEOTOMA_ACTIONS_DISABLE_AUTOSTART !== "1" && isMainModule) {
+    // Exit diagnostics. A long-running server should never reach `beforeExit`:
+    // that event only fires when the event loop has drained, i.e. nothing is
+    // left holding the process open. In production this happened silently and
+    // repeatedly — the process exited with code 0 every ~12 minutes with no
+    // error and no signal, and because the exit was CLEAN the platform read it
+    // as success and declined to restart, turning it into an outage
+    // (neotoma#2094).
+    //
+    // Logging the active resources at that moment names what the loop was (and
+    // was no longer) waiting on, which is the one piece of evidence needed to
+    // find the handle that stops holding the server up. `exit` is logged too so
+    // the code and reason are attributable even when the cause is external.
+    process.on("beforeExit", (code) => {
+        let resources = [];
+        try {
+            const getResources = process
+                .getActiveResourcesInfo;
+            if (typeof getResources === "function")
+                resources = getResources.call(process);
+        }
+        catch {
+            /* diagnostics must never themselves throw */
+        }
+        console.error(`[neotoma] beforeExit code=${code} — event loop drained; a long-running ` +
+            `server should not reach here. activeResources=${JSON.stringify(resources)} ` +
+            `uptime=${process.uptime().toFixed(1)}s`);
+    });
+    process.on("exit", (code) => {
+        console.error(`[neotoma] exit code=${code} uptime=${process.uptime().toFixed(1)}s`);
+    });
+    for (const sig of ["SIGTERM", "SIGINT", "SIGHUP"]) {
+        process.on(sig, () => {
+            console.error(`[neotoma] received ${sig} uptime=${process.uptime().toFixed(1)}s`);
+            process.exit(0);
+        });
+    }
     startHTTPServer().catch((err) => {
         console.error("Failed to start HTTP server:", err);
         process.exit(1);