alfred-live/src/audit.js (1)

65-68: A throwing sink will prevent subsequent sinks from receiving the event.

If any sink in the array throws during record(), the exception propagates and remaining sinks are skipped. Consider wrapping each call in a try/catch to ensure fan-out resilience.

♻️ Suggested fix

   record(event) {
     for (const sink of this.#sinks) {
-      sink?.record?.(event);
+      try {
+        sink?.record?.(event);
+      } catch {
+        // Swallow to avoid one sink breaking fan-out to remaining sinks.
+      }
     }
   }

alfred-live/src/auth.js (2)

56-63: Self-validation of the internally constructed provider is unreachable.

The provider object is constructed on lines 40–54 with a valid authorize function, so validateAuthProvider(provider) on line 56 will always return null. This block is dead code. If the intent is to validate external providers in the future, consider extracting this into a shared wrapAuthProvider(provider) helper at that time.

---

37-69: Passing a non-iterable, non-string, non-nullish value to tokens will throw at new Set(tokens).

Line 38 handles string and null/undefined, but a non-iterable value (e.g., 42, true) will throw TypeError: ... is not iterable. The JSDoc types this as Iterable<string>, so this is a caller contract issue, but if you want full defensive handling (matching the defensive style of the rest of this file), you could add a guard.

alfred-live/src/command-envelope.js (3)

158-182: authorizeCommand returns semantically different data shapes depending on the path.

When no auth provider is supplied, line 160 returns okResult({ allowed: true }) (i.e. { ok: true, data: { allowed: true } }). When an auth provider succeeds, it returns the provider's own Result<unknown>. Since the caller only inspects .ok and never reads .data, this is functionally harmless — but the phantom { allowed: true } data payload is misleading and could confuse future maintainers who expect it to be meaningful.

Consider returning okResult(null) or okResult(undefined) for the no-auth shortcut, consistent with recordAuditEvent's style at line 141.

♻️ Optional: normalize the no-auth return

 function authorizeCommand(auth, context) {
   if (!auth) {
-    return okResult({ allowed: true });
+    return okResult(null);
   }

---

194-200: Audit recording failure silently swallows the original command result.

If the result-phase audit recording fails (line 196), encodeAuditedResult returns an error envelope for the audit failure and discards resultEnvelope entirely. This means a command that succeeded will look like a failure to the caller if the audit sink throws.

This appears intentional for an "audit-first" design (consistent with the attempt-phase check at lines 440-442), but it's a strong guarantee that couples operational reliability to the audit sink. Worth a brief doc comment here so future readers understand the trade-off.

---

184-192: buildAuthContext is a field-by-field copy of preview.

This creates an identical object shape to preview. If the intent is API decoupling (so auth providers don't depend on internal preview shape), this is fine. Otherwise, consider simply returning { ...preview } to reduce surface area for drift.

♻️ Optional simplification

 function buildAuthContext(preview) {
-  return {
-    id: preview.id,
-    cmd: preview.cmd,
-    args: preview.args,
-    auth: preview.auth,
-    raw: preview.raw,
-  };
+  const { id, cmd, args, auth, raw } = preview;
+  return { id, cmd, args, auth, raw };
 }