fix(token): address review findings from #319 (DAR vetting, accept-leg auth, JSON parity) - #321

Merged

zheli merged 6 commits into

mainfrom

fix/token-dar-review-followups

Aug 19, 2026

Commits on Aug 19, 2026

refactor(splice): add AllRoleNames as the single fan-out role source
zheli
committed
a31313d
refactor(token): probe DAR vetting via the admin API through shared darops
zheli
committed
63f5a7f
fix(token): keep the auth token on the accept-leg connection
zheli
committed
8f40088
feat(token): expose vetted_roles on both token create JSON surfaces
zheli
committed
26350e9
docs: record the corrected vetting claim and the vetted_roles field
zheli
committed
113af01
fix(token): claim "known" where only ListKnownPackages was checked
zheli
committed
4ba3b55