@fuzdev/fuz_app 0.105.0 → 0.106.0

package/dist/auth/daemon_token_middleware.js

@@ -13,7 +13,8 @@ import { DEV } from 'esm-env';
 import {} from '../runtime/deps.js';
 import { write_file_atomic } from '../runtime/fs.js';
 import { get_app_dir } from '../cli/config.js';
-import { ACCOUNT_ID_KEY, AUTH_API_TOKEN_ID_KEY, CREDENTIAL_TYPE_KEY } from '../hono_context.js';
+import { ACCOUNT_ID_KEY, AUTH_API_TOKEN_ID_KEY, CREDENTIAL_TYPE_KEY, TOKEN_SCOPE_KEY } from '../hono_context.js';
+import { token_scope_full } from './token_scope.js';
 import { is_browser_context } from '../http/origin.js';
 import { query_role_grant_find_account_id_for_role } from './role_grant_queries.js';
 import { ROLE_KEEPER } from './role_schema.js';
@@ -232,6 +233,9 @@ export const create_daemon_token_middleware = (state, deps, log) => {
         }
         c.set(ACCOUNT_ID_KEY, state.keeper_account_id);
         c.set(CREDENTIAL_TYPE_KEY, 'daemon_token');
+        // Singular, filesystem-proved, keeper-bound — no minting step at which a
+        // narrowing could have been chosen.
+        c.set(TOKEN_SCOPE_KEY, token_scope_full());
         c.set(AUTH_API_TOKEN_ID_KEY, null);
         await next();
     };

package/dist/auth/migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AA+BH,OAAO,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtE,wDAAwD;AACxD,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,EAAE,aAAa,CAAC,MAAM,CAA8B,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,SAAS,CA0F5C,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,kBAG/B,CAAC"}
+{"version":3,"file":"migrations.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AA+BH,OAAO,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtE,wDAAwD;AACxD,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,EAAE,aAAa,CAAC,MAAM,CAA8B,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,SAAS,CA6H5C,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,kBAG/B,CAAC"}

package/dist/auth/migrations.js

@@ -153,6 +153,39 @@ export const auth_migrations = [
 				   ON role_grant (actor_id, role, scope_id)
 				   WHERE revoked_at IS NULL`);
         }
+    },
+    // v2: per-credential token scoping — `api_token.scope JSONB NOT NULL`.
+    //
+    // Name must match the Rust twin's migration byte for byte
+    // (`fuz_auth/src/migrations.rs`) or the `_testing_migration_tracker` parity
+    // gate fails and the swap-freely invariant breaks.
+    //
+    // Three statements, and the middle one is the whole compatibility story:
+    //
+    // 1. Add the column nullable, so the ALTER is instant on a populated table.
+    // 2. Backfill every pre-existing token as full authority, flagged
+    //    `grandfathered` — tokens minted before scoping existed keep working,
+    //    but the debt is a *value in the row*, not an absence. That distinction
+    //    is the point: it stays distinguishable from a deliberately minted full
+    //    token, so the list can label it and an operator can count what needs
+    //    re-minting.
+    // 3. `SET NOT NULL`, which is what makes "unscoped" unrepresentable from
+    //    here on. A missing scope is exactly the permissive default that made
+    //    the 2026-02 `scope` column a false promise; after this statement the
+    //    database cannot hold one.
+    //
+    // The backfilled literal is pinned by the Rust twin's migration test —
+    // `parse_token_scope` is fail-closed, so a drift between this literal and
+    // the parser stops every pre-scoping token loudly rather than widening it.
+    {
+        name: 'api_token_scope',
+        up: async (db) => {
+            await db.query('ALTER TABLE api_token ADD COLUMN IF NOT EXISTS scope JSONB');
+            await db.query(`UPDATE api_token
+				    SET scope = '{"version":1,"kind":"full","grandfathered":true}'::jsonb
+				  WHERE scope IS NULL`);
+            await db.query('ALTER TABLE api_token ALTER COLUMN scope SET NOT NULL');
+        }
     }
 ];
 /** Pre-composed migration namespace for auth tables. */

package/dist/auth/request_context.d.ts

@@ -38,6 +38,7 @@ import type { Context, MiddlewareHandler } from 'hono';
 import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import { type Account, type Actor, type RoleGrant } from './account_schema.js';
 import type { QueryDeps } from '../db/query_deps.js';
+import { type TokenSurface } from './token_scope.js';
 import type { RouteSpec } from '../http/route_spec.js';
 import { type RouteAuth } from '../http/auth_shape.js';
 import { ERROR_ACTOR_REQUIRED, ERROR_ACTOR_NOT_ON_ACCOUNT, ERROR_NO_ACTORS_ON_ACCOUNT, ERROR_ACCOUNT_VANISHED } from '../http/error_schemas.js';
@@ -229,6 +230,23 @@ export declare const resolve_acting_actor: (deps: QueryDeps, account_id: string,
  * @mutates Hono context - sets `ACCOUNT_ID_KEY`, `CREDENTIAL_TYPE_KEY`, `AUTH_SESSION_TOKEN_HASH_KEY`, and `AUTH_API_TOKEN_ID_KEY`
  */
 export declare const create_request_context_middleware: (deps: QueryDeps, log: Logger, session_context_key?: string) => MiddlewareHandler;
+/**
+ * Refuse a non-RPC spine surface to a narrowed token — **rule 3**, in one place.
+ *
+ * Called by every surface rule 3 covers: the bare-hash fact read, the audit SSE
+ * stream, and the WS upgrade (as pre-upgrade middleware, since
+ * `upgradeWebSocket`'s callback cannot produce a denial).
+ *
+ * An unset `TOKEN_SCOPE_KEY` is the anonymous caller, who holds no credential to
+ * narrow, so it passes. Sharing that branch is the point — hand-rolled per
+ * surface it is one `&&` from either refusing every anonymous read or admitting
+ * an authenticated caller whose middleware forgot to set the key.
+ *
+ * @param c - the request context, after the auth middleware chain
+ * @param surface - the surface being gated; names itself in the denial
+ * @returns the 403 to return, or `null` when the caller may proceed
+ */
+export declare const token_scope_surface_denial: (c: Context, surface: TokenSurface) => Response | null;
 /**
  * Middleware that requires authentication.
  *

package/dist/auth/request_context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request_context.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/request_context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,KAAK,EAEV,KAAK,SAAS,EACd,MAAM,qBAAqB,CAAC;AAY7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAQrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAA+B,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAIN,oBAAoB,EACpB,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,EACtB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;CAC9B;AAED,0DAA0D;AAC1D,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,GAAG,OAAO,KAAG,cAAc,GAAG,IAEjE,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,GAAI,GAAG,OAAO,KAAG,cAQpD,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAoB,SAAQ,cAAc;IAC1D,KAAK,EAAE,KAAK,CAAC;CACb;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,QAAQ,GACpB,KAAK,cAAc,GAAG,IAAI,EAC1B,MAAM,MAAM,EACZ,MAAK,IAAiB,KACpB,OACoF,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,eAAe,GAC3B,KAAK,cAAc,GAAG,IAAI,EAC1B,MAAM,MAAM,EACZ,UAAU,MAAM,GAAG,IAAI,EACvB,MAAK,IAAiB,KACpB,OAKF,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,cAAc,GAAG,IAAI,EAC1B,OAAO,aAAa,CAAC,MAAM,CAAC,EAC5B,UAAU,MAAM,GAAG,IAAI,EACvB,MAAK,IAAiB,KACpB,OAMF,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAClC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,SAAS,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GACvF;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,iBAAiB,MAAM,GAAG,SAAS,KACjC,OAAO,CAAC,wBAAwB,CAclC,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iCAAiC,GAC7C,MAAM,SAAS,EACf,KAAK,MAAM,EACX,4BAAuC,KACrC,iBA8BF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,iBAK1B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,aAAa,CAAC,MAAM,CAAC,KAAG,iBAW3D,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,wBAAwB,GACpC,kBAAkB,aAAa,CAAC,MAAM,CAAC,KACrC,iBAiBF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,cAAc,EACnB,MAAM,SAAS,KACb,OAAO,CAAC,cAAc,CAQxB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,UAAU,MAAM,KACd,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAUpC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,cAAc,GAAG,IAAI,CAI/B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,wBAAwB,GACjC;IAAE,KAAK,EAAE,OAAO,oBAAoB,CAAC;IAAC,SAAS,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GACtF;IAAE,KAAK,EAAE,OAAO,0BAA0B,CAAA;CAAE,GAC5C;IAAE,KAAK,EAAE,OAAO,0BAA0B,CAAA;CAAE,GAC5C;IAAE,KAAK,EAAE,OAAO,sBAAsB,CAAA;CAAE,CAAC;AAE5C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,mBAAmB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,eAAe,EAAE,cAAc,GAAG,IAAI,CAAA;CAAE,GACpD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,IAAI,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,YAAY,MAAM,GAAG,IAAI,EACzB,MAAM,SAAS,EACf,cAAc,MAAM,GAAG,SAAS,KAC9B,OAAO,CAAC,mBAAmB,CAwC7B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,KACb,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAoB5D,CAAC"}
+{"version":3,"file":"request_context.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/request_context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,KAAK,EAEV,KAAK,SAAS,EACd,MAAM,qBAAqB,CAAC;AAY7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AASrD,OAAO,EAIN,KAAK,YAAY,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAA+B,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAIN,oBAAoB,EACpB,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,EACtB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;CAC9B;AAED,0DAA0D;AAC1D,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,GAAG,OAAO,KAAG,cAAc,GAAG,IAEjE,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,GAAI,GAAG,OAAO,KAAG,cAQpD,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAoB,SAAQ,cAAc;IAC1D,KAAK,EAAE,KAAK,CAAC;CACb;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,QAAQ,GACpB,KAAK,cAAc,GAAG,IAAI,EAC1B,MAAM,MAAM,EACZ,MAAK,IAAiB,KACpB,OACoF,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,eAAe,GAC3B,KAAK,cAAc,GAAG,IAAI,EAC1B,MAAM,MAAM,EACZ,UAAU,MAAM,GAAG,IAAI,EACvB,MAAK,IAAiB,KACpB,OAKF,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,cAAc,GAAG,IAAI,EAC1B,OAAO,aAAa,CAAC,MAAM,CAAC,EAC5B,UAAU,MAAM,GAAG,IAAI,EACvB,MAAK,IAAiB,KACpB,OAMF,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAClC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,SAAS,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GACvF;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,iBAAiB,MAAM,GAAG,SAAS,KACjC,OAAO,CAAC,wBAAwB,CAclC,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iCAAiC,GAC7C,MAAM,SAAS,EACf,KAAK,MAAM,EACX,4BAAuC,KACrC,iBAgCF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,0BAA0B,GAAI,GAAG,OAAO,EAAE,SAAS,YAAY,KAAG,QAAQ,GAAG,IAMzF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,iBAK1B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,aAAa,CAAC,MAAM,CAAC,KAAG,iBAW3D,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,wBAAwB,GACpC,kBAAkB,aAAa,CAAC,MAAM,CAAC,KACrC,iBAiBF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,cAAc,EACnB,MAAM,SAAS,KACb,OAAO,CAAC,cAAc,CAQxB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,UAAU,MAAM,KACd,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAUpC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,cAAc,GAAG,IAAI,CAI/B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,wBAAwB,GACjC;IAAE,KAAK,EAAE,OAAO,oBAAoB,CAAC;IAAC,SAAS,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GACtF;IAAE,KAAK,EAAE,OAAO,0BAA0B,CAAA;CAAE,GAC5C;IAAE,KAAK,EAAE,OAAO,0BAA0B,CAAA;CAAE,GAC5C;IAAE,KAAK,EAAE,OAAO,sBAAsB,CAAA;CAAE,CAAC;AAE5C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,mBAAmB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,eAAe,EAAE,cAAc,GAAG,IAAI,CAAA;CAAE,GACpD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,IAAI,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,YAAY,MAAM,GAAG,IAAI,EACzB,MAAM,SAAS,EACf,cAAc,MAAM,GAAG,SAAS,KAC9B,OAAO,CAAC,mBAAmB,CAwC7B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,KACb,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAoB5D,CAAC"}

package/dist/auth/request_context.js

@@ -38,7 +38,8 @@ import { is_role_grant_active } from './account_schema.js';
 import { hash_session_token, session_touch_fire_and_forget, query_session_get_valid } from './session_queries.js';
 import { query_account_by_id, query_actor_by_id, query_active_actors_by_account } from './account_queries.js';
 import { query_role_grant_find_active_for_actor } from './role_grant_queries.js';
-import { ACCOUNT_ID_KEY, AUTH_API_TOKEN_ID_KEY, CREDENTIAL_TYPE_KEY, TEST_CONTEXT_PRESET_KEY } from '../hono_context.js';
+import { ACCOUNT_ID_KEY, AUTH_API_TOKEN_ID_KEY, CREDENTIAL_TYPE_KEY, TOKEN_SCOPE_KEY, TEST_CONTEXT_PRESET_KEY } from '../hono_context.js';
+import { token_scope_admits_non_rpc, token_scope_full, token_scope_surface_denied_body } from './token_scope.js';
 import { is_public_auth, needs_actor } from '../http/auth_shape.js';
 import { ERROR_AUTHENTICATION_REQUIRED, ERROR_INSUFFICIENT_PERMISSIONS, ERROR_CREDENTIAL_TYPE_REQUIRED, ERROR_ACTOR_REQUIRED, ERROR_ACTOR_NOT_ON_ACCOUNT, ERROR_NO_ACTORS_ON_ACCOUNT, ERROR_ACCOUNT_VANISHED } from '../http/error_schemas.js';
 /** Hono context variable name for the request context. */
@@ -230,12 +231,37 @@ export const create_request_context_middleware = (deps, log, session_context_key
         }
         c.set(ACCOUNT_ID_KEY, session.account_id);
         c.set(CREDENTIAL_TYPE_KEY, 'session');
+        // A session is full account authority by construction.
+        c.set(TOKEN_SCOPE_KEY, token_scope_full());
         c.set(AUTH_SESSION_TOKEN_HASH_KEY, token_hash);
         // Touch session (fire-and-forget, don't block the request)
         void session_touch_fire_and_forget(deps, token_hash, c.var.pending_effects, log);
         await next();
     };
 };
+/**
+ * Refuse a non-RPC spine surface to a narrowed token — **rule 3**, in one place.
+ *
+ * Called by every surface rule 3 covers: the bare-hash fact read, the audit SSE
+ * stream, and the WS upgrade (as pre-upgrade middleware, since
+ * `upgradeWebSocket`'s callback cannot produce a denial).
+ *
+ * An unset `TOKEN_SCOPE_KEY` is the anonymous caller, who holds no credential to
+ * narrow, so it passes. Sharing that branch is the point — hand-rolled per
+ * surface it is one `&&` from either refusing every anonymous read or admitting
+ * an authenticated caller whose middleware forgot to set the key.
+ *
+ * @param c - the request context, after the auth middleware chain
+ * @param surface - the surface being gated; names itself in the denial
+ * @returns the 403 to return, or `null` when the caller may proceed
+ */
+export const token_scope_surface_denial = (c, surface) => {
+    const scope = c.get(TOKEN_SCOPE_KEY);
+    if (scope && !token_scope_admits_non_rpc(scope)) {
+        return c.json(token_scope_surface_denied_body(surface), 403);
+    }
+    return null;
+};
 /**
  * Middleware that requires authentication.
  *

package/dist/auth/role_grant_offer_action_specs.d.ts

@@ -284,6 +284,17 @@ export declare const role_grant_offer_create_action_spec: {
     error_reasons: ("role_grant_offer_self_target" | "role_grant_offer_role_not_grantable" | "role_grant_offer_not_authorized" | "role_grant_offer_actor_account_mismatch")[];
     rate_limit: "account";
 };
+/**
+ * `credential_types: ['session']` — see `docs/security.md` §Credential-channel
+ * gating. The only offer verb that moves the *caller's own* authority:
+ * accepting a pending admin offer over a leaked API token is a privilege pivot
+ * in the same family the credential-lifecycle mutations are gated to prevent
+ * (the token is account-wide and non-expiring, and the resulting role_grant
+ * outlives revoking it). Consent inherently belongs to a human at a browser,
+ * and no automation accepts an offer on its own behalf. The sibling verbs stay
+ * ungated deliberately — `_create` is the offering side, and `_decline` /
+ * `_retract` destroy a pending offer and confer nothing.
+ */
 export declare const role_grant_offer_accept_action_spec: {
     method: string;
     kind: "request_response";
@@ -291,6 +302,7 @@ export declare const role_grant_offer_accept_action_spec: {
     auth: {
         account: "required";
         actor: "required";
+        credential_types: string[];
     };
     side_effects: true;
     input: z.ZodObject<{

package/dist/auth/role_grant_offer_action_specs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_grant_offer_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_grant_offer_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAU3E,oEAAoE;AACpE,eAAO,MAAM,kCAAkC,EAAG,8BAAuC,CAAC;AAC1F,kEAAkE;AAClE,eAAO,MAAM,+BAA+B,EAAG,2BAAoC,CAAC;AACpF,sDAAsD;AACtD,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAClF,wGAAwG;AACxG,eAAO,MAAM,gCAAgC,EAAG,4BAAqC,CAAC;AACtF,uIAAuI;AACvI,eAAO,MAAM,yCAAyC,EACrD,qCAA8C,CAAC;AAChD,gKAAgK;AAChK,eAAO,MAAM,qCAAqC,EAAG,iCAA0C,CAAC;AAChG,6FAA6F;AAC7F,eAAO,MAAM,qCAAqC,EAAG,iCAA0C,CAAC;AAChG,wHAAwH;AACxH,eAAO,MAAM,6CAA6C,EACzD,yCAAkD,CAAC;AAIpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;kBAoBpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,2CAA2C;AAC3C,eAAO,MAAM,yBAAyB;;;kBAGpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;;kBAQrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;kBAGrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,uGAAuG;AACvG,eAAO,MAAM,uBAAuB;;;mBAOvB,CAAC;AACd,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;;;kBAQ/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;mBAa1B,CAAC;AACd,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;kBAErC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;kBAIrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,0EAA0E;AAC1E,eAAO,MAAM,sBAAsB;;kBAA0C,CAAC;AAC9E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,0CAA0C;AAC1C,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;kBAA0D,CAAC;AAChG,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,6CAA6C;AAC7C,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;kBAA0D,CAAC;AACnG,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEtF,sCAAsC;AACtC,eAAO,MAAM,qBAAqB;;;kBAGhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;;;;kBAa/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,sCAAsC;AACtC,eAAO,MAAM,qBAAqB;;;kBAGhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkBX,CAAC;AAEtC,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiBX,CAAC;AAEtC,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;CAWZ,CAAC;AAEtC,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;CAWZ,CAAC;AAEtC,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWT,CAAC;AAEtC,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWZ,CAAC;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;CAaL,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;CAaL,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAAE,KAAK,CAAC,yBAAyB,CAS9E,CAAC"}
+{"version":3,"file":"role_grant_offer_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_grant_offer_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAU3E,oEAAoE;AACpE,eAAO,MAAM,kCAAkC,EAAG,8BAAuC,CAAC;AAC1F,kEAAkE;AAClE,eAAO,MAAM,+BAA+B,EAAG,2BAAoC,CAAC;AACpF,sDAAsD;AACtD,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAClF,wGAAwG;AACxG,eAAO,MAAM,gCAAgC,EAAG,4BAAqC,CAAC;AACtF,uIAAuI;AACvI,eAAO,MAAM,yCAAyC,EACrD,qCAA8C,CAAC;AAChD,gKAAgK;AAChK,eAAO,MAAM,qCAAqC,EAAG,iCAA0C,CAAC;AAChG,6FAA6F;AAC7F,eAAO,MAAM,qCAAqC,EAAG,iCAA0C,CAAC;AAChG,wHAAwH;AACxH,eAAO,MAAM,6CAA6C,EACzD,yCAAkD,CAAC;AAIpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;kBAoBpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,2CAA2C;AAC3C,eAAO,MAAM,yBAAyB;;;kBAGpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;;kBAQrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;kBAGrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,uGAAuG;AACvG,eAAO,MAAM,uBAAuB;;;mBAOvB,CAAC;AACd,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;;;kBAQ/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;mBAa1B,CAAC;AACd,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;kBAErC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;kBAIrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,0EAA0E;AAC1E,eAAO,MAAM,sBAAsB;;kBAA0C,CAAC;AAC9E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,0CAA0C;AAC1C,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;kBAA0D,CAAC;AAChG,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,6CAA6C;AAC7C,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;kBAA0D,CAAC;AACnG,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEtF,sCAAsC;AACtC,eAAO,MAAM,qBAAqB;;;kBAGhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;;;;kBAa/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,sCAAsC;AACtC,eAAO,MAAM,qBAAqB;;;kBAGhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkBX,CAAC;AAEtC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiBX,CAAC;AAEtC,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;CAWZ,CAAC;AAEtC,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;CAWZ,CAAC;AAEtC,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWT,CAAC;AAEtC,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWZ,CAAC;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;CAaL,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;CAaL,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAAE,KAAK,CAAC,yBAAyB,CAS9E,CAAC"}

package/dist/auth/role_grant_offer_action_specs.js

@@ -211,11 +211,22 @@ export const role_grant_offer_create_action_spec = {
     ],
     rate_limit: 'account'
 };
+/**
+ * `credential_types: ['session']` — see `docs/security.md` §Credential-channel
+ * gating. The only offer verb that moves the *caller's own* authority:
+ * accepting a pending admin offer over a leaked API token is a privilege pivot
+ * in the same family the credential-lifecycle mutations are gated to prevent
+ * (the token is account-wide and non-expiring, and the resulting role_grant
+ * outlives revoking it). Consent inherently belongs to a human at a browser,
+ * and no automation accepts an offer on its own behalf. The sibling verbs stay
+ * ungated deliberately — `_create` is the offering side, and `_decline` /
+ * `_retract` destroy a pending offer and confer nothing.
+ */
 export const role_grant_offer_accept_action_spec = {
     method: 'role_grant_offer_accept',
     kind: 'request_response',
     initiator: 'frontend',
-    auth: { account: 'required', actor: 'required' },
+    auth: { account: 'required', actor: 'required', credential_types: ['session'] },
     side_effects: true,
     input: RoleGrantOfferAcceptInput,
     output: RoleGrantOfferAcceptOutput,

package/dist/auth/self_service_role_action_specs.d.ts

@@ -35,6 +35,12 @@ export type SelfServiceRoleSetOutput = z.infer<typeof SelfServiceRoleSetOutput>;
  * `role_grant_create` or `role_grant_revoke` audit row with
  * `self_service: true`. Without the cap, a caller could flap the role in
  * a loop to inflate the audit log and obscure other activity.
+ *
+ * `credential_types: ['session']` — see `docs/security.md` §Credential-channel
+ * gating. Self-toggling a role moves the caller's own authority, the same
+ * privilege-pivot shape as `role_grant_offer_accept`. The verb exists to serve
+ * a UI affordance, so the bearer channel buys nothing and a leaked
+ * account-wide token self-granting an eligible role is what the gate refuses.
  */
 export declare const self_service_role_set_action_spec: {
     method: string;
@@ -43,6 +49,7 @@ export declare const self_service_role_set_action_spec: {
     auth: {
         account: "required";
         actor: "required";
+        credential_types: string[];
     };
     side_effects: true;
     input: z.ZodObject<{

package/dist/auth/self_service_role_action_specs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"self_service_role_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/self_service_role_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAI3E,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,EAAG,gCAAyC,CAAC;AAE9F,yCAAyC;AACzC,eAAO,MAAM,uBAAuB;;;;kBAOlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;kBAInC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;CAYT,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,EAAE,aAAa,CAAC,yBAAyB,CAEvF,CAAC"}
+{"version":3,"file":"self_service_role_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/self_service_role_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAI3E,0FAA0F;AAC1F,eAAO,MAAM,oCAAoC,EAAG,gCAAyC,CAAC;AAE9F,yCAAyC;AACzC,eAAO,MAAM,uBAAuB;;;;kBAOlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;kBAInC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;CAYT,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,EAAE,aAAa,CAAC,yBAAyB,CAEvF,CAAC"}

package/dist/auth/self_service_role_action_specs.js

@@ -36,12 +36,18 @@ export const SelfServiceRoleSetOutput = z.strictObject({
  * `role_grant_create` or `role_grant_revoke` audit row with
  * `self_service: true`. Without the cap, a caller could flap the role in
  * a loop to inflate the audit log and obscure other activity.
+ *
+ * `credential_types: ['session']` — see `docs/security.md` §Credential-channel
+ * gating. Self-toggling a role moves the caller's own authority, the same
+ * privilege-pivot shape as `role_grant_offer_accept`. The verb exists to serve
+ * a UI affordance, so the bearer channel buys nothing and a leaked
+ * account-wide token self-granting an eligible role is what the gate refuses.
  */
 export const self_service_role_set_action_spec = {
     method: 'self_service_role_set',
     kind: 'request_response',
     initiator: 'frontend',
-    auth: { account: 'required', actor: 'required' },
+    auth: { account: 'required', actor: 'required', credential_types: ['session'] },
     side_effects: true,
     input: SelfServiceRoleSetInput,
     output: SelfServiceRoleSetOutput,

package/dist/auth/token_scope.d.ts

@@ -0,0 +1,155 @@
+/**
+ * `TokenScope` — the per-credential authority narrowing stored on
+ * `api_token.scope`.
+ *
+ * Twin of the Rust spine's `fuz_auth::token_scope`. The stored document is the
+ * wire contract; both spines read the same `api_token.scope` JSONB, so the
+ * `kind` strings, the field names, and the version constant must match exactly.
+ *
+ * ## The whole vocabulary
+ *
+ * Two variants, and three rules:
+ *
+ * 1. **`full` must be spelled at mint.** `account_token_create` takes a required
+ *    `scope`, the column is `NOT NULL`, and session / daemon-token credentials
+ *    resolve to `full` by construction. There is no absent state — which is the
+ *    whole point. The 2026-02 `scope` column stored `full` / `read` / `write`
+ *    and nothing enforced them; the reason that was worse than nothing is that
+ *    the absent/unenforced case was indistinguishable from a decision.
+ * 2. **`methods` denies every method it does not list.** An empty list is legal
+ *    and renders the token inert for RPC — unlike an empty `credential_types`
+ *    allowlist, which is rejected because it renders an *action* unreachable.
+ * 3. **A narrowed token is RPC-only.** `methods` denies every non-RPC spine
+ *    surface outright — the db-admin browser, the bare-hash fact read, the
+ *    audit SSE stream, and the WS upgrade. See `token_scope_admits_non_rpc`.
+ *
+ * @module
+ */
+import { z } from 'zod';
+/** Current `TokenScope` document version. Must match the Rust `TOKEN_SCOPE_VERSION`. */
+export declare const TOKEN_SCOPE_VERSION = 1;
+/**
+ * Serialized-document cap. Matches the Rust `MAX_TOKEN_SCOPE_BYTES` and
+ * fuz_forge's `MAX_POLICY_BYTES`.
+ */
+export declare const MAX_TOKEN_SCOPE_BYTES: number;
+/**
+ * The stored `api_token.scope` document.
+ *
+ * `grandfathered` is a fact about the *row* — the `api_token_scope` migration
+ * wrote it; no minter chose it — that only the token list cares about. The
+ * enforcement path never branches on it, which is what stops "grandfathered"
+ * from becoming a third authority level.
+ *
+ * Strict on both arms so a v2 document carrying a grant arm a v1 reader doesn't
+ * understand is refused rather than parsed as permissively-narrower-than-stored.
+ * The discriminated union also refuses the contradiction
+ * `{kind: 'full', methods: [...]}`.
+ */
+export declare const TokenScope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"full">;
+    grandfathered: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>, z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<"methods">;
+    methods: z.ZodArray<z.ZodString>;
+    grandfathered: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>], "kind">;
+export type TokenScope = z.infer<typeof TokenScope>;
+/**
+ * The `scope` input accepted by `account_token_create` — the stored shape minus
+ * the row-owned fields.
+ *
+ * A minter cannot set `version` or `grandfathered`: the first is stamped by
+ * `token_scope_full` / `token_scope_methods`, and the second is the migration's
+ * mark for tokens that predate scoping. Letting a caller forge `grandfathered`
+ * would turn a tracked debt into a laundered one.
+ */
+export declare const TokenScopeInput: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"full">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"methods">;
+    methods: z.ZodArray<z.ZodString>;
+}, z.core.$strict>], "kind">;
+export type TokenScopeInput = z.infer<typeof TokenScopeInput>;
+/** A deliberately-minted full-authority scope. */
+export declare const token_scope_full: () => TokenScope;
+/** A narrowed scope over `methods`. */
+export declare const token_scope_methods: (methods: Array<string>) => TokenScope;
+/** Build the stored scope from a mint-time input. */
+export declare const token_scope_from_input: (input: TokenScopeInput) => TokenScope;
+/**
+ * Does `scope` admit dispatching `method`?
+ *
+ * Consulted by `perform_action` between the credential gate and the role gate.
+ */
+export declare const token_scope_admits_method: (scope: TokenScope, method: string) => boolean;
+/**
+ * Does `scope` admit a non-RPC spine surface?
+ *
+ * **Rule 3, and it is the load-bearing one.** A method-name allowlist alone
+ * would have been a false promise: the db-admin browser serves paginated rows of
+ * any `public` table (including `account.password_hash`, `auth_session`, and
+ * `api_token`) plus row `DELETE`, gated on a global role a bearer credential
+ * satisfies. A token whose UI badge read "scoped to `cell_get`" could still
+ * delete an account row.
+ *
+ * So a narrowed token reaches no non-RPC surface at all. Strictly more
+ * restrictive than naming each surface, no vocabulary to maintain, and one
+ * sentence a user can hold: *a scoped token is RPC-only*.
+ */
+export declare const token_scope_admits_non_rpc: (scope: TokenScope) => boolean;
+/** Surfaces gated by rule 3. Capability strings match the Rust `TokenSurface`. */
+export declare const TOKEN_SURFACE_CAPABILITIES: {
+    readonly db_admin: "surface:db_admin";
+    readonly fact_bare: "surface:fact_bare";
+    readonly audit_stream: "surface:audit_stream";
+    readonly ws_upgrade: "surface:ws_upgrade";
+};
+export type TokenSurface = keyof typeof TOKEN_SURFACE_CAPABILITIES;
+/**
+ * Build the flat denial body a non-RPC surface returns when a narrowed token
+ * reaches it: `{error: 'token_scope_required', required_scope: 'surface:<name>'}`
+ * at 403.
+ *
+ * One shape for every surface, matching the Rust
+ * `token_scope_surface_denied_response`. These are REST-ish routes whose
+ * sibling denials are already flat, so the JSON-RPC envelope stays with the
+ * dispatcher's per-method gate and stops there.
+ */
+export declare const token_scope_surface_denied_body: (surface: TokenSurface) => {
+    error: "token_scope_required";
+    required_scope: string;
+};
+/** Stable label for the token list / UI. */
+export declare const token_scope_label: (scope: TokenScope) => string;
+/**
+ * Parse a stored document, enforcing the size cap and the schema.
+ *
+ * **Fail-closed**: returns `null` on an unreadable document, and every caller on
+ * the enforcement path treats `null` as "refuse the credential" rather than
+ * "allow everything". fuz_forge's hydrate path deliberately widens on a DB blip
+ * — safe there only because a role gate still applies. Here the scope *is* the
+ * gate, so widening on a parse failure would hand a narrowed token full
+ * authority exactly when something is already wrong.
+ */
+export declare const parse_token_scope: (raw: string) => TokenScope | null;
+/**
+ * Serialize for storage, enforcing the size cap.
+ *
+ * Throws on an over-cap document — the mint path maps that to a 400, matching
+ * the Rust side's `TokenScopeError::TooLarge`.
+ */
+export declare const serialize_token_scope: (scope: TokenScope) => string;
+/**
+ * Read a stored `api_token.scope` value back into a `TokenScope`, or `null`
+ * when the document is unreadable.
+ *
+ * The DB driver may hand `scope` back already-parsed (JSONB → object) or as
+ * text depending on backend, so both are normalized here rather than at each
+ * call site. Lives here rather than beside the queries so the pure scope module
+ * owns every parse — and so mocking the query module doesn't drag this along.
+ */
+export declare const parse_stored_token_scope: (value: unknown) => TokenScope | null;
+//# sourceMappingURL=token_scope.d.ts.map

package/dist/auth/token_scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token_scope.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/token_scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;;GAGG;AACH,eAAO,MAAM,qBAAqB,QAAW,CAAC;AAE9C;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,UAAU;;;;;;;;;4BAYrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;;4BAG1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,kDAAkD;AAClD,eAAO,MAAM,gBAAgB,QAAO,UAGlC,CAAC;AAEH,uCAAuC;AACvC,eAAO,MAAM,mBAAmB,GAAI,SAAS,KAAK,CAAC,MAAM,CAAC,KAAG,UAI3D,CAAC;AAEH,qDAAqD;AACrD,eAAO,MAAM,sBAAsB,GAAI,OAAO,eAAe,KAAG,UACgB,CAAC;AAEjF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,GAAI,OAAO,UAAU,EAAE,QAAQ,MAAM,KAAG,OACtB,CAAC;AAEzD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,GAAI,OAAO,UAAU,KAAG,OAAgC,CAAC;AAEhG,kFAAkF;AAClF,eAAO,MAAM,0BAA0B;;;;;CAK7B,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,0BAA0B,CAAC;AAEnE;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,GAC3C,SAAS,YAAY,KACnB;IAAE,KAAK,EAAE,sBAAsB,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAGxD,CAAC;AAEH,4CAA4C;AAC5C,eAAO,MAAM,iBAAiB,GAAI,OAAO,UAAU,KAAG,MAGrD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,KAAG,UAAU,GAAG,IAU5D,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GAAI,OAAO,UAAU,KAAG,MAQzD,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,GAAI,OAAO,OAAO,KAAG,UAAU,GAAG,IAQtE,CAAC"}

package/dist/auth/token_scope.js

@@ -0,0 +1,190 @@
+/**
+ * `TokenScope` — the per-credential authority narrowing stored on
+ * `api_token.scope`.
+ *
+ * Twin of the Rust spine's `fuz_auth::token_scope`. The stored document is the
+ * wire contract; both spines read the same `api_token.scope` JSONB, so the
+ * `kind` strings, the field names, and the version constant must match exactly.
+ *
+ * ## The whole vocabulary
+ *
+ * Two variants, and three rules:
+ *
+ * 1. **`full` must be spelled at mint.** `account_token_create` takes a required
+ *    `scope`, the column is `NOT NULL`, and session / daemon-token credentials
+ *    resolve to `full` by construction. There is no absent state — which is the
+ *    whole point. The 2026-02 `scope` column stored `full` / `read` / `write`
+ *    and nothing enforced them; the reason that was worse than nothing is that
+ *    the absent/unenforced case was indistinguishable from a decision.
+ * 2. **`methods` denies every method it does not list.** An empty list is legal
+ *    and renders the token inert for RPC — unlike an empty `credential_types`
+ *    allowlist, which is rejected because it renders an *action* unreachable.
+ * 3. **A narrowed token is RPC-only.** `methods` denies every non-RPC spine
+ *    surface outright — the db-admin browser, the bare-hash fact read, the
+ *    audit SSE stream, and the WS upgrade. See `token_scope_admits_non_rpc`.
+ *
+ * @module
+ */
+import { z } from 'zod';
+/** Current `TokenScope` document version. Must match the Rust `TOKEN_SCOPE_VERSION`. */
+export const TOKEN_SCOPE_VERSION = 1;
+/**
+ * Serialized-document cap. Matches the Rust `MAX_TOKEN_SCOPE_BYTES` and
+ * fuz_forge's `MAX_POLICY_BYTES`.
+ */
+export const MAX_TOKEN_SCOPE_BYTES = 4 * 1024;
+/**
+ * The stored `api_token.scope` document.
+ *
+ * `grandfathered` is a fact about the *row* — the `api_token_scope` migration
+ * wrote it; no minter chose it — that only the token list cares about. The
+ * enforcement path never branches on it, which is what stops "grandfathered"
+ * from becoming a third authority level.
+ *
+ * Strict on both arms so a v2 document carrying a grant arm a v1 reader doesn't
+ * understand is refused rather than parsed as permissively-narrower-than-stored.
+ * The discriminated union also refuses the contradiction
+ * `{kind: 'full', methods: [...]}`.
+ */
+export const TokenScope = z.discriminatedUnion('kind', [
+    z.strictObject({
+        version: z.literal(TOKEN_SCOPE_VERSION),
+        kind: z.literal('full'),
+        grandfathered: z.boolean().optional()
+    }),
+    z.strictObject({
+        version: z.literal(TOKEN_SCOPE_VERSION),
+        kind: z.literal('methods'),
+        methods: z.array(z.string()),
+        grandfathered: z.boolean().optional()
+    })
+]);
+/**
+ * The `scope` input accepted by `account_token_create` — the stored shape minus
+ * the row-owned fields.
+ *
+ * A minter cannot set `version` or `grandfathered`: the first is stamped by
+ * `token_scope_full` / `token_scope_methods`, and the second is the migration's
+ * mark for tokens that predate scoping. Letting a caller forge `grandfathered`
+ * would turn a tracked debt into a laundered one.
+ */
+export const TokenScopeInput = z.discriminatedUnion('kind', [
+    z.strictObject({ kind: z.literal('full') }),
+    z.strictObject({ kind: z.literal('methods'), methods: z.array(z.string()) })
+]);
+/** A deliberately-minted full-authority scope. */
+export const token_scope_full = () => ({
+    version: TOKEN_SCOPE_VERSION,
+    kind: 'full'
+});
+/** A narrowed scope over `methods`. */
+export const token_scope_methods = (methods) => ({
+    version: TOKEN_SCOPE_VERSION,
+    kind: 'methods',
+    methods
+});
+/** Build the stored scope from a mint-time input. */
+export const token_scope_from_input = (input) => input.kind === 'full' ? token_scope_full() : token_scope_methods(input.methods);
+/**
+ * Does `scope` admit dispatching `method`?
+ *
+ * Consulted by `perform_action` between the credential gate and the role gate.
+ */
+export const token_scope_admits_method = (scope, method) => scope.kind === 'full' || scope.methods.includes(method);
+/**
+ * Does `scope` admit a non-RPC spine surface?
+ *
+ * **Rule 3, and it is the load-bearing one.** A method-name allowlist alone
+ * would have been a false promise: the db-admin browser serves paginated rows of
+ * any `public` table (including `account.password_hash`, `auth_session`, and
+ * `api_token`) plus row `DELETE`, gated on a global role a bearer credential
+ * satisfies. A token whose UI badge read "scoped to `cell_get`" could still
+ * delete an account row.
+ *
+ * So a narrowed token reaches no non-RPC surface at all. Strictly more
+ * restrictive than naming each surface, no vocabulary to maintain, and one
+ * sentence a user can hold: *a scoped token is RPC-only*.
+ */
+export const token_scope_admits_non_rpc = (scope) => scope.kind === 'full';
+/** Surfaces gated by rule 3. Capability strings match the Rust `TokenSurface`. */
+export const TOKEN_SURFACE_CAPABILITIES = {
+    db_admin: 'surface:db_admin',
+    fact_bare: 'surface:fact_bare',
+    audit_stream: 'surface:audit_stream',
+    ws_upgrade: 'surface:ws_upgrade'
+};
+/**
+ * Build the flat denial body a non-RPC surface returns when a narrowed token
+ * reaches it: `{error: 'token_scope_required', required_scope: 'surface:<name>'}`
+ * at 403.
+ *
+ * One shape for every surface, matching the Rust
+ * `token_scope_surface_denied_response`. These are REST-ish routes whose
+ * sibling denials are already flat, so the JSON-RPC envelope stays with the
+ * dispatcher's per-method gate and stops there.
+ */
+export const token_scope_surface_denied_body = (surface) => ({
+    error: 'token_scope_required',
+    required_scope: TOKEN_SURFACE_CAPABILITIES[surface]
+});
+/** Stable label for the token list / UI. */
+export const token_scope_label = (scope) => {
+    if (scope.kind === 'full')
+        return scope.grandfathered ? 'full (grandfathered)' : 'full';
+    return `${scope.methods.length} methods`;
+};
+/**
+ * Parse a stored document, enforcing the size cap and the schema.
+ *
+ * **Fail-closed**: returns `null` on an unreadable document, and every caller on
+ * the enforcement path treats `null` as "refuse the credential" rather than
+ * "allow everything". fuz_forge's hydrate path deliberately widens on a DB blip
+ * — safe there only because a role gate still applies. Here the scope *is* the
+ * gate, so widening on a parse failure would hand a narrowed token full
+ * authority exactly when something is already wrong.
+ */
+export const parse_token_scope = (raw) => {
+    if (raw.length > MAX_TOKEN_SCOPE_BYTES)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    const parsed = TokenScope.safeParse(value);
+    return parsed.success ? parsed.data : null;
+};
+/**
+ * Serialize for storage, enforcing the size cap.
+ *
+ * Throws on an over-cap document — the mint path maps that to a 400, matching
+ * the Rust side's `TokenScopeError::TooLarge`.
+ */
+export const serialize_token_scope = (scope) => {
+    const json = JSON.stringify(scope);
+    if (json.length > MAX_TOKEN_SCOPE_BYTES) {
+        throw new Error(`token scope document is ${json.length} bytes, exceeding the ${MAX_TOKEN_SCOPE_BYTES} byte cap`);
+    }
+    return json;
+};
+/**
+ * Read a stored `api_token.scope` value back into a `TokenScope`, or `null`
+ * when the document is unreadable.
+ *
+ * The DB driver may hand `scope` back already-parsed (JSONB → object) or as
+ * text depending on backend, so both are normalized here rather than at each
+ * call site. Lives here rather than beside the queries so the pure scope module
+ * owns every parse — and so mocking the query module doesn't drag this along.
+ */
+export const parse_stored_token_scope = (value) => {
+    if (typeof value === 'string')
+        return parse_token_scope(value);
+    // `JSON.stringify(undefined)` returns `undefined`, not a string — so a row
+    // missing the column entirely must be caught here rather than reaching
+    // `parse_token_scope` and throwing on `.length`. Absent is *unreadable*,
+    // which is fail-closed: the caller refuses the credential.
+    const json = JSON.stringify(value);
+    return json === undefined ? null : parse_token_scope(json);
+};

package/dist/db/CLAUDE.md

@@ -135,7 +135,7 @@ DO NOTHING`), `_put_fact_refs`, `_get_fact` / `_get_fact_meta` / `_has_fact`
 - **`fact_store_errors.ts`** — `PayloadTooLargeError` / `StorageFullError` (+
   `is_enospc_error`) thrown by `put_stream`, for a consumer route's 413 / 507.
 - The read-side fetcher + write/serve plumbing also live under `server/`
-  (`file_fact_fetcher.ts`, `fact_write.ts`, `serve_fact_route.ts`).
+  (`file_fact_fetcher.ts`, `serve_fact_route.ts`).
 
 ### Migration namespace order