4 Commits

Author	SHA1	Message	Date
lilleman	18dc4f3136	Refuse an emailless identity where the session is minted, and rows the upstream should not have sent	2026-09-02 18:24:56 +02:00
lilleman	dfb043c3bd	Read one gate everywhere, and check a declaration's gate in one pass	2026-09-02 12:32:51 +02:00
lilleman	be3bc2bdbb	Stability fixes: plugin-scoped contexts for owned pages, absent-href guard, checked locale mounts	2026-08-03 23:51:40 +02:00
lilleman	535902e69b	Split handleRequest into pipeline + internal route table; auth/OAuth2 endpoints become named handlers in src/auth/routes.ts	2026-07-02 13:05:54 +02:00