sporades 0.9.9 → 0.9.11

package/CHANGES.md

@@ -1,29 +1,12 @@
 # Changes
 
-## Unreleased - 2026-08-31
+## Unreleased - 2026-09-02
 
-Changes since v0.9.7.
-
-### 🚀 Features
-
-- Add purpose-bound reauthentication proofs (c4ddd032).
+Changes since v0.9.9.
 
 ### 📝 Documentation
 
-- Request Google signed reauthentication time (2fa291dc).
-- Verify OAuth reauthentication freshness (7a6c989a).
-- Persist and serialize email reauthentication (74ef1c50).
-- Harden email reauthentication contracts (a919df94).
-- Sweep expired proofs before guarded mutations (c888d70c).
-- Harden reauthentication lifecycle (c8189c58).
-- Bind reauthentication to active sessions (e692028f).
-
-### 🧪 Tests
-
-- Retire proofs during Session rotation (b1e25b48).
-- Harden reauthentication failure and ordering proof (8f933b91).
-- Require active User for proof consumption (465bf5a4).
-- Recheck OAuth authorization at callback (19c4159c).
+- Release Sporades 0.9.10 Human Security and Service Users (#22) (cf29ae7c).
 
 ## Unreleased - 2026-08-26
 

package/README.md

@@ -220,9 +220,10 @@ Sporades currently includes:
 - Runtime-owned auth with anonymous sessions, email auth, Google OAuth,
   Microsoft OpenID Connect, Sign in with Apple, Facebook Login, and
   local identity simulation for tests and agents.
-- User-owned named Access keys with Capsule-declared scopes, explicit Custom
-  endpoint and private-File opt-in, one-time secret disclosure, Session-only
-  owner management, durable Job provenance, and audited operator retirement.
+- Human- and Service-User-owned named Access keys with Capsule-declared scopes,
+  explicit Custom endpoint and private-File opt-in, one-time secret disclosure,
+  exact actor/credential provenance, Session-only management, durable Job
+  provenance, and audited operator retirement.
 - Runtime-owned current-user preferences exposed through `sporades/client`
   without app preference tables. Preferences follow the Sporades user identity,
   survive Anonymous account linking, and notify same-user connected clients when

package/bin/sporades-host-helper.js

@@ -309,7 +309,15 @@ var ACCESS_KEY_OPERATOR_ACTIONS = [
 ];
 var ACTIONS = new Set(ACCESS_KEY_OPERATOR_ACTIONS);
 var STATUSES = /* @__PURE__ */ new Set(["active", "expired", "revoked"]);
-var REVOCATION_CAUSES = /* @__PURE__ */ new Set(["owner", "operator", "password-reset", "owner-unlinked", "owner-deleted"]);
+var REVOCATION_CAUSES = /* @__PURE__ */ new Set([
+  "owner",
+  "operator",
+  "password-reset",
+  "owner-unlinked",
+  "owner-deleted",
+  "service-user-administrator",
+  "service-user-disabled"
+]);
 var ACCESS_KEY_OPERATOR_LIST_PAGE_LIMIT = 100;
 var JSON_STRING_MAX_BYTE_EXPANSION = 6;
 var ACCESS_KEY_OPERATOR_ENVELOPE_STRUCTURAL_HEADROOM = 8 * 1024 * 1024;
@@ -580,6 +588,9 @@ function capLogEnvelope(envelope, maxBytes) {
   capped.message = capped.message.slice(0, 256);
   return capped;
 }
+var serviceUserMutationAuthority = Object.freeze({ kind: "service-user-mutation-authority" });
+var MutationExecutionStorage = process.getBuiltinModule("node:async_hooks").AsyncLocalStorage;
+var mutationExecution = new MutationExecutionStorage();
 
 // src/cli/cli-support.ts
 function errorDetails(error) {
@@ -622,7 +633,7 @@ function writeEnvelope(result, failed = false) {
 }
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.9.9";
+var CLI_VERSION = "0.9.11";
 
 // src/cli/schedule-inspection-envelope.ts
 var SCHEDULE_DIAGNOSTIC_FIELDS = /* @__PURE__ */ new Set([