root 147b4f514c feat(cutover): Plan 8b — point void.hynesy.com at Void 2 (alpha.18) ...

CF Access multi-aud: CF_ACCESS_AUD now accepts a comma-separated
allow-list so requests through either the void.hynesy.com or
void2-app.hynesy.com CF Access app are honoured as owner. Fails
closed; unlisted auds rejected. Adds multi-aud test.

Void 1 (CT 301) becomes legacy but stays running untouched as an
instant rollback. -alpha tag kept pending owner sign-off.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-05 00:50:57 +10:00

..

capability.test.js

feat(auth): capability check — user/cron/worker allow; agents tiered allow/suggest/deny

2026-05-31 11:06:00 +10:00

cf_access.test.js

feat(cutover): Plan 8b — point void.hynesy.com at Void 2 (alpha.18)

2026-06-05 00:50:57 +10:00

owner.test.js

feat(auth): owner-only middleware for single-user bearer auth

2026-05-31 11:06:21 +10:00

safe_compare.test.js

fix(auth): constant-time owner-token comparison

2026-06-01 23:26:46 +10:00