@fuzdev/fuz_app 0.106.1 → 0.108.0

package/dist/auth/api_token_queries.d.ts

@@ -82,6 +82,10 @@ export declare const query_api_token_list_for_account: (deps: QueryDeps, account
  * `(account_id, credential_kind)` before count/evict/insert — see the matching
  * note on `query_session_enforce_limit`.
  *
+ * Ordering carries the same `id DESC` stability tie-breaker, with the same
+ * caveat, as `query_session_enforce_limit` — deterministic survivors under a
+ * `created_at` tie, not a guarantee that the row just inserted survives.
+ *
  * @param deps - query dependencies (must be transaction-scoped)
  * @param account_id - the account to enforce the limit for
  * @param max_tokens - maximum number of tokens to keep

package/dist/auth/api_token_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api_token_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/api_token_queries.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,KAAK,UAAU,EAAmD,MAAM,kBAAkB,CAAC;AAEpG,yEAAyE;AACzE,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IACnD,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,IAAI,MAAM,EACV,YAAY,MAAM,EAClB,MAAM,MAAM,EACZ,YAAY,MAAM,EAClB,OAAO,UAAU,EACjB,aAAa,IAAI,GAAG,IAAI,KACtB,OAAO,CAAC,QAAQ,CAelB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,wBAAwB,GACpC,MAAM,iBAAiB,EACvB,WAAW,MAAM,EACjB,IAAI,MAAM,GAAG,SAAS,EACtB,iBAAiB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,KAC/C,OAAO,CAAC,QAAQ,GAAG,SAAS,CAgC9B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uCAAuC,GACnD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kCAAkC,GAC9C,MAAM,SAAS,EACf,IAAI,MAAM,EACV,YAAY,MAAM,KAChB,OAAO,CAAC,OAAO,CAMjB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAM7C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,KAChB,OAAO,CAAC,MAAM,CAYhB,CAAC"}
+{"version":3,"file":"api_token_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/api_token_queries.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,KAAK,UAAU,EAAmD,MAAM,kBAAkB,CAAC;AAEpG,yEAAyE;AACzE,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IACnD,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,IAAI,MAAM,EACV,YAAY,MAAM,EAClB,MAAM,MAAM,EACZ,YAAY,MAAM,EAClB,OAAO,UAAU,EACjB,aAAa,IAAI,GAAG,IAAI,KACtB,OAAO,CAAC,QAAQ,CAelB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,wBAAwB,GACpC,MAAM,iBAAiB,EACvB,WAAW,MAAM,EACjB,IAAI,MAAM,GAAG,SAAS,EACtB,iBAAiB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,KAC/C,OAAO,CAAC,QAAQ,GAAG,SAAS,CAgC9B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uCAAuC,GACnD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kCAAkC,GAC9C,MAAM,SAAS,EACf,IAAI,MAAM,EACV,YAAY,MAAM,KAChB,OAAO,CAAC,OAAO,CAMjB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAM7C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,KAChB,OAAO,CAAC,MAAM,CAYhB,CAAC"}

package/dist/auth/api_token_queries.js

@@ -125,6 +125,10 @@ export const query_api_token_list_for_account = async (deps, account_id) => {
  * `(account_id, credential_kind)` before count/evict/insert — see the matching
  * note on `query_session_enforce_limit`.
  *
+ * Ordering carries the same `id DESC` stability tie-breaker, with the same
+ * caveat, as `query_session_enforce_limit` — deterministic survivors under a
+ * `created_at` tie, not a guarantee that the row just inserted survives.
+ *
  * @param deps - query dependencies (must be transaction-scoped)
  * @param account_id - the account to enforce the limit for
  * @param max_tokens - maximum number of tokens to keep
@@ -136,7 +140,7 @@ export const query_api_token_enforce_limit = async (deps, account_id, max_tokens
 		 WHERE id IN (
 		   SELECT id FROM api_token
 		   WHERE account_id = $1
-		   ORDER BY created_at DESC
+		   ORDER BY created_at DESC, id DESC
 		   OFFSET $2
 		 ) RETURNING id`, [account_id, max_tokens]);
     return rows.length;

package/dist/auth/audit_log_route_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_log_route_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_log_route_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGvD,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB;;kBAA0C,CAAC;AACxE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,+DAA+D;AAC/D,eAAO,MAAM,yBAAyB,UAAU,CAAC;AAEjD;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,GACxC,gBAAe,MAAkC,KAC/C,IAAI,CAAC,SAAS,EAAE,SAAS,CAQ1B,CAAC"}
+{"version":3,"file":"audit_log_route_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_log_route_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGvD,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB;;kBAA0C,CAAC;AACxE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,+DAA+D;AAC/D,eAAO,MAAM,yBAAyB,UAAU,CAAC;AAEjD;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,GACxC,gBAAe,MAAkC,KAC/C,IAAI,CAAC,SAAS,EAAE,SAAS,CAkB1B,CAAC"}

package/dist/auth/audit_log_route_schema.js

@@ -28,7 +28,17 @@ export const DEFAULT_AUDIT_STREAM_ROLE = 'admin';
 export const create_audit_log_route_shape = (required_role = DEFAULT_AUDIT_STREAM_ROLE) => ({
     method: 'GET',
     path: '/audit/stream',
-    auth: { account: 'required', actor: 'required', roles: [required_role] },
+    auth: {
+        account: 'required',
+        actor: 'required',
+        roles: [required_role],
+        // Rule 3 — a narrowed token holds no audit feed. Same reasoning as the
+        // WS upgrade: this is a long-lived server→client stream whose contents
+        // are decided by the account's role, not by any per-message scope
+        // check, so there is no point after open at which a narrowing could
+        // apply.
+        required_scope: 'surface:audit_stream'
+    },
     description: 'Subscribe to realtime audit log events',
     query: AuditStreamQuery,
     input: z.null(),

package/dist/auth/audit_log_routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_log_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_log_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAAuB,KAAK,SAAS,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAQ3E,yCAAyC;AACzC,MAAM,WAAW,oBAAoB;IACpC,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,MAAM,CAAC,EAAE;QACR,SAAS,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,EAAE,gBAAgB,KAAK,MAAM,IAAI,CAAC;QAC1F,GAAG,EAAE,MAAM,CAAC;KACZ,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,GAAI,UAAU,oBAAoB,KAAG,KAAK,CAAC,SAAS,CAiC5F,CAAC"}
+{"version":3,"file":"audit_log_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_log_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAAuB,KAAK,SAAS,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAI3E,yCAAyC;AACzC,MAAM,WAAW,oBAAoB;IACpC,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,MAAM,CAAC,EAAE;QACR,SAAS,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,EAAE,gBAAgB,KAAK,MAAM,IAAI,CAAC;QAC1F,GAAG,EAAE,MAAM,CAAC;KACZ,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,GAAI,UAAU,oBAAoB,KAAG,KAAK,CAAC,SAAS,CA4B5F,CAAC"}

package/dist/auth/audit_log_routes.js

@@ -13,7 +13,7 @@
  */
 import { create_audit_log_route_shape } from './audit_log_route_schema.js';
 import { create_sse_response } from '../realtime/sse.js';
-import { AUTH_SESSION_TOKEN_HASH_KEY, require_request_context, token_scope_surface_denial } from './request_context.js';
+import { AUTH_SESSION_TOKEN_HASH_KEY, require_request_context } from './request_context.js';
 import { AUDIT_LOG_CHANNEL } from '../realtime/sse_auth_guard.js';
 /**
  * Create the optional audit-log SSE route spec.
@@ -32,14 +32,9 @@ export const create_audit_log_route_specs = (options) => {
         {
             ...create_audit_log_route_shape(options.required_role),
             handler: (c) => {
-                // Rule 3 — a narrowed token holds no audit feed. Same reasoning as
-                // the WS upgrade: this is a long-lived server→client stream whose
-                // contents are decided by the account's role, not by any
-                // per-message scope check, so there is no point after open at
-                // which a narrowing could apply.
-                const denied = token_scope_surface_denial(c, 'audit_stream');
-                if (denied)
-                    return denied;
+                // Rule 3 is declared on the route shape's `auth.required_scope`,
+                // so a narrowed token is refused ahead of the role gate rather
+                // than here.
                 const ctx = require_request_context(c);
                 // scope = session hash (capped → tabs-per-session limit and
                 // session-specific `session_revoke` close). groups = [account_id]

package/dist/auth/auth_guard_resolver.d.ts

@@ -1,25 +1,35 @@
 /**
  * Auth guard resolver for the route spec system.
  *
- * Maps the four-axis `RouteAuth` (`account` / `actor` / `roles` /
- * `credential_types`) to two-phase middleware sets that
+ * Maps the five-axis `RouteAuth` (`account` / `actor` / `roles` /
+ * `credential_types` / `required_scope`) to two-phase middleware sets that
  * `apply_route_specs` weaves into the per-route pipeline:
  *
- * - `pre_validation` runs before input validation. `require_auth` lands
- *   here whenever `auth.account === 'required'` or `auth.actor ===
- *   'required'` (per registry-time invariant 3, `actor: 'required'`
- *   today implies a credential — accountless actors are out of scope
- *   for v1). Pre-validation 401 fires before any body parsing so
- *   unauthenticated callers never see route-shape information from
- *   parse failures.
- * - `post_authorization` runs after the dispatcher's authorization
- *   phase has populated `RequestContext`. `require_role(roles)` fires
- *   whenever `auth.roles?.length`. `require_credential_types(types)`
- *   fires whenever `auth.credential_types?.length`.
+ * - `pre_authorization` runs before the authorization phase, and holds every
+ *   gate that reads only what the auth middleware already set: `require_auth`
+ *   whenever `auth.account === 'required'` or `auth.actor === 'required'`
+ *   (per registry-time invariant 3, `actor: 'required'` today implies a
+ *   credential — accountless actors are out of scope for v1),
+ *   `require_credential_types(types)` whenever `auth.credential_types?.length`,
+ *   and the token-scope guard whenever `auth.required_scope` names a capability.
+ *   All three fire before any body parsing, so a caller they refuse never sees
+ *   route-shape information — and before the authorization phase, so a wrong
+ *   channel costs no actor resolution.
+ * - `post_authorization` runs after the dispatcher's authorization phase has
+ *   populated `RequestContext`, and holds the one gate that needs it:
+ *   `require_role(roles)`, whenever `auth.roles?.length`, reads
+ *   `c.var.request_context.role_grants`.
+ *
+ * The resulting order — credential presence, then credential type, then scope,
+ * then role — is the spine's canonical coarse-to-fine ordering, the same one
+ * `check_action_auth_post_authorization` runs for actions. A route declaring
+ * both a credential gate and a surface gate therefore answers with the
+ * coarser fact ("this channel may never call me") rather than the finer one
+ * ("your token is scoped"), on both dispatch surfaces alike.
  *
  * Public routes (`auth.account === 'none' && auth.actor === 'none'`)
  * yield empty guard arrays. `'optional'` axes contribute no
- * pre-validation 401; the authorization phase sets `RequestContext`
+ * pre-authorization 401; the authorization phase sets `RequestContext`
  * to whatever the credential supports and the post-authorization
  * gates decide whether the actor's role_grants / credential type match.
  *
@@ -29,16 +39,33 @@ import type { AuthGuardResolver } from '../http/route_spec.js';
 /**
  * Standard auth guard resolver for fuz_app.
  *
- * Reads each axis of the four-axis `RouteAuth` shape and emits the
- * corresponding middleware:
+ * Reads each axis of the `RouteAuth` shape and emits the corresponding
+ * middleware:
  *
- * - `account === 'required'` or `actor === 'required'` → pre-validation `require_auth`
+ * - `account === 'required'` or `actor === 'required'` → pre-authorization `require_auth`
+ * - `credential_types?.length` → pre-authorization `require_credential_types(types)`
+ * - `required_scope` → pre-authorization `require_token_scope(capability)`
  * - `roles?.length` → post-authorization `require_role(roles)` (multi-role any-of)
- * - `credential_types?.length` → post-authorization `require_credential_types(types)`
  *
- * Multiple post-authorization guards run in declaration order: credential
- * type check first (since failing it implies the request can never
- * resolve a usable identity), role check second.
+ * Guards run in declaration order, which is the coarse-to-fine order above:
+ * presence first (an anonymous caller holds neither a credential type nor a
+ * scope to check), then the channel, then the scope, then the role — the last
+ * being the only one that needs the resolved `RequestContext`.
+ *
+ * @throws Error if `auth.required_scope` is not a well-formed capability string
+ *   (via `require_token_scope`) — `RouteAuth` types it as a plain string to keep
+ *   `http/` free of an `auth/` import, so this is where the value is checked.
+ *   The check is on *shape*, not membership: the vocabulary is deliberately open
+ *   so a consumer can name its own surface, and a `surface:` name decides
+ *   nothing (rule 3 is all-or-nothing), so the closed set would only have been
+ *   a spelling check on a diagnostic string. fuz_app's own declarations are
+ *   pinned to the surfaces it actually mounts by the surface census.
+ * @throws Error if `auth.required_scope` sits on an unrestricted route
+ *   (`account: 'none' && actor: 'none'`). The same holder reaches that route
+ *   by dropping the credential, so the guard reads as a control and enforces
+ *   nothing — the shape `compile_action_registry` refuses on an `ActionSpec`
+ *   for the same reason. Extends `RouteAuth`'s leaf invariant, which the
+ *   route pipeline never parses.
  */
 export declare const fuz_auth_guard_resolver: AuthGuardResolver;
 //# sourceMappingURL=auth_guard_resolver.d.ts.map

package/dist/auth/auth_guard_resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth_guard_resolver.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/auth_guard_resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE/D;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,EAAE,iBAerC,CAAC"}
+{"version":3,"file":"auth_guard_resolver.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/auth_guard_resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AASH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,uBAAuB,EAAE,iBAuBrC,CAAC"}

package/dist/auth/auth_guard_resolver.js

@@ -1,56 +1,90 @@
 /**
  * Auth guard resolver for the route spec system.
  *
- * Maps the four-axis `RouteAuth` (`account` / `actor` / `roles` /
- * `credential_types`) to two-phase middleware sets that
+ * Maps the five-axis `RouteAuth` (`account` / `actor` / `roles` /
+ * `credential_types` / `required_scope`) to two-phase middleware sets that
  * `apply_route_specs` weaves into the per-route pipeline:
  *
- * - `pre_validation` runs before input validation. `require_auth` lands
- *   here whenever `auth.account === 'required'` or `auth.actor ===
- *   'required'` (per registry-time invariant 3, `actor: 'required'`
- *   today implies a credential — accountless actors are out of scope
- *   for v1). Pre-validation 401 fires before any body parsing so
- *   unauthenticated callers never see route-shape information from
- *   parse failures.
- * - `post_authorization` runs after the dispatcher's authorization
- *   phase has populated `RequestContext`. `require_role(roles)` fires
- *   whenever `auth.roles?.length`. `require_credential_types(types)`
- *   fires whenever `auth.credential_types?.length`.
+ * - `pre_authorization` runs before the authorization phase, and holds every
+ *   gate that reads only what the auth middleware already set: `require_auth`
+ *   whenever `auth.account === 'required'` or `auth.actor === 'required'`
+ *   (per registry-time invariant 3, `actor: 'required'` today implies a
+ *   credential — accountless actors are out of scope for v1),
+ *   `require_credential_types(types)` whenever `auth.credential_types?.length`,
+ *   and the token-scope guard whenever `auth.required_scope` names a capability.
+ *   All three fire before any body parsing, so a caller they refuse never sees
+ *   route-shape information — and before the authorization phase, so a wrong
+ *   channel costs no actor resolution.
+ * - `post_authorization` runs after the dispatcher's authorization phase has
+ *   populated `RequestContext`, and holds the one gate that needs it:
+ *   `require_role(roles)`, whenever `auth.roles?.length`, reads
+ *   `c.var.request_context.role_grants`.
+ *
+ * The resulting order — credential presence, then credential type, then scope,
+ * then role — is the spine's canonical coarse-to-fine ordering, the same one
+ * `check_action_auth_post_authorization` runs for actions. A route declaring
+ * both a credential gate and a surface gate therefore answers with the
+ * coarser fact ("this channel may never call me") rather than the finer one
+ * ("your token is scoped"), on both dispatch surfaces alike.
  *
  * Public routes (`auth.account === 'none' && auth.actor === 'none'`)
  * yield empty guard arrays. `'optional'` axes contribute no
- * pre-validation 401; the authorization phase sets `RequestContext`
+ * pre-authorization 401; the authorization phase sets `RequestContext`
  * to whatever the credential supports and the post-authorization
  * gates decide whether the actor's role_grants / credential type match.
  *
  * @module
  */
-import { require_auth, require_credential_types, require_role } from './request_context.js';
+import { require_auth, require_credential_types, require_role, require_token_scope } from './request_context.js';
+import { is_public_auth } from '../http/auth_shape.js';
 /**
  * Standard auth guard resolver for fuz_app.
  *
- * Reads each axis of the four-axis `RouteAuth` shape and emits the
- * corresponding middleware:
+ * Reads each axis of the `RouteAuth` shape and emits the corresponding
+ * middleware:
  *
- * - `account === 'required'` or `actor === 'required'` → pre-validation `require_auth`
+ * - `account === 'required'` or `actor === 'required'` → pre-authorization `require_auth`
+ * - `credential_types?.length` → pre-authorization `require_credential_types(types)`
+ * - `required_scope` → pre-authorization `require_token_scope(capability)`
  * - `roles?.length` → post-authorization `require_role(roles)` (multi-role any-of)
- * - `credential_types?.length` → post-authorization `require_credential_types(types)`
  *
- * Multiple post-authorization guards run in declaration order: credential
- * type check first (since failing it implies the request can never
- * resolve a usable identity), role check second.
+ * Guards run in declaration order, which is the coarse-to-fine order above:
+ * presence first (an anonymous caller holds neither a credential type nor a
+ * scope to check), then the channel, then the scope, then the role — the last
+ * being the only one that needs the resolved `RequestContext`.
+ *
+ * @throws Error if `auth.required_scope` is not a well-formed capability string
+ *   (via `require_token_scope`) — `RouteAuth` types it as a plain string to keep
+ *   `http/` free of an `auth/` import, so this is where the value is checked.
+ *   The check is on *shape*, not membership: the vocabulary is deliberately open
+ *   so a consumer can name its own surface, and a `surface:` name decides
+ *   nothing (rule 3 is all-or-nothing), so the closed set would only have been
+ *   a spelling check on a diagnostic string. fuz_app's own declarations are
+ *   pinned to the surfaces it actually mounts by the surface census.
+ * @throws Error if `auth.required_scope` sits on an unrestricted route
+ *   (`account: 'none' && actor: 'none'`). The same holder reaches that route
+ *   by dropping the credential, so the guard reads as a control and enforces
+ *   nothing — the shape `compile_action_registry` refuses on an `ActionSpec`
+ *   for the same reason. Extends `RouteAuth`'s leaf invariant, which the
+ *   route pipeline never parses.
  */
 export const fuz_auth_guard_resolver = (auth) => {
-    const pre_validation = [];
+    const pre_authorization = [];
     const post_authorization = [];
     if (auth.account === 'required' || auth.actor === 'required') {
-        pre_validation.push(require_auth);
+        pre_authorization.push(require_auth);
     }
     if (auth.credential_types?.length) {
-        post_authorization.push(require_credential_types(auth.credential_types));
+        pre_authorization.push(require_credential_types(auth.credential_types));
+    }
+    if (auth.required_scope !== undefined) {
+        if (is_public_auth(auth)) {
+            throw new Error(`auth.required_scope "${auth.required_scope}" on an unrestricted route (account: 'none', actor: 'none') — the same holder reaches it by dropping the credential, so the guard would enforce nothing. Gate the route on a credential, or drop the field.`);
+        }
+        pre_authorization.push(require_token_scope(auth.required_scope));
     }
     if (auth.roles?.length) {
         post_authorization.push(require_role(auth.roles));
     }
-    return { pre_validation, post_authorization };
+    return { pre_authorization, post_authorization };
 };

package/dist/auth/bearer_auth.d.ts

@@ -17,13 +17,12 @@
 import type { MiddlewareHandler } from 'hono';
 import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import type { QueryDeps } from '../db/query_deps.js';
-import { type RateLimiter } from '../rate_limiter.js';
 /**
  * Create middleware that authenticates via bearer token.
  *
  * Soft-fails for invalid, expired, or empty tokens — calls `next()` without
  * setting account identity, letting downstream auth enforcement (the RPC
- * dispatcher's pre-validation / post-authorization auth gates or
+ * dispatcher's pre-authorization / post-authorization auth gates or
  * `require_auth`) return a consistent JSON-RPC or route-level error. This
  * avoids leaking token-specific diagnostics
  * (`invalid_token`, `account_not_found`) that could aid enumeration attacks,
@@ -37,14 +36,18 @@ import { type RateLimiter } from '../rate_limiter.js';
  * (e.g. by session middleware). Acting-actor resolution + `RequestContext`
  * construction are deferred to the dispatcher's authorization phase.
  *
- * Rate limiting (429) is the only hard-fail — it's a throttling concern
- * independent of auth identity.
+ * There is deliberately **no rate limit on this path**, and no 429 — every
+ * failure soft-fails to "no credential". An API token is 32 bytes of CSPRNG
+ * output resolved by a blake3 hash lookup, so guessing is bounded by entropy,
+ * not by throttling; a limiter here would buy nothing measurable while costing
+ * availability (the check/record has to precede the async lookup to close its
+ * own TOCTOU window, so concurrent requests bearing a *valid* token race each
+ * other into a 429). The Rust spine never had one here; this is the converged
+ * shape. See `docs/security.md` §Why bearer auth is not rate limited.
  *
  * @param deps - query dependencies (pool-level db for middleware)
- * @param ip_rate_limiter - per-IP rate limiter for bearer token attempts (null to disable)
  * @param log - the logger instance
  * @mutates Hono context - sets `ACCOUNT_ID_KEY`, `CREDENTIAL_TYPE_KEY`, and `AUTH_API_TOKEN_ID_KEY` on success
- * @mutates `ip_rate_limiter` - records on attempt; resets on a valid token
  */
-export declare const create_bearer_auth_middleware: (deps: QueryDeps, ip_rate_limiter: RateLimiter | null, log: Logger) => MiddlewareHandler;
+export declare const create_bearer_auth_middleware: (deps: QueryDeps, log: Logger) => MiddlewareHandler;
 //# sourceMappingURL=bearer_auth.d.ts.map

package/dist/auth/bearer_auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bearer_auth.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/bearer_auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAUtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGrD,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEpF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,iBAAiB,WAAW,GAAG,IAAI,EACnC,KAAK,MAAM,KACT,iBAoFF,CAAC"}
+{"version":3,"file":"bearer_auth.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/bearer_auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAUtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAIrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,6BAA6B,GAAI,MAAM,SAAS,EAAE,KAAK,MAAM,KAAG,iBAuE5E,CAAC"}

package/dist/auth/bearer_auth.js

@@ -20,13 +20,12 @@ import { parse_stored_token_scope, token_scope_full } from './token_scope.js';
 import { query_validate_api_token } from './api_token_queries.js';
 import { get_client_ip } from '../http/client_ip.js';
 import { is_browser_context } from '../http/origin.js';
-import { rate_limit_exceeded_response } from '../rate_limiter.js';
 /**
  * Create middleware that authenticates via bearer token.
  *
  * Soft-fails for invalid, expired, or empty tokens — calls `next()` without
  * setting account identity, letting downstream auth enforcement (the RPC
- * dispatcher's pre-validation / post-authorization auth gates or
+ * dispatcher's pre-authorization / post-authorization auth gates or
  * `require_auth`) return a consistent JSON-RPC or route-level error. This
  * avoids leaking token-specific diagnostics
  * (`invalid_token`, `account_not_found`) that could aid enumeration attacks,
@@ -40,16 +39,20 @@ import { rate_limit_exceeded_response } from '../rate_limiter.js';
  * (e.g. by session middleware). Acting-actor resolution + `RequestContext`
  * construction are deferred to the dispatcher's authorization phase.
  *
- * Rate limiting (429) is the only hard-fail — it's a throttling concern
- * independent of auth identity.
+ * There is deliberately **no rate limit on this path**, and no 429 — every
+ * failure soft-fails to "no credential". An API token is 32 bytes of CSPRNG
+ * output resolved by a blake3 hash lookup, so guessing is bounded by entropy,
+ * not by throttling; a limiter here would buy nothing measurable while costing
+ * availability (the check/record has to precede the async lookup to close its
+ * own TOCTOU window, so concurrent requests bearing a *valid* token race each
+ * other into a 429). The Rust spine never had one here; this is the converged
+ * shape. See `docs/security.md` §Why bearer auth is not rate limited.
  *
  * @param deps - query dependencies (pool-level db for middleware)
- * @param ip_rate_limiter - per-IP rate limiter for bearer token attempts (null to disable)
  * @param log - the logger instance
  * @mutates Hono context - sets `ACCOUNT_ID_KEY`, `CREDENTIAL_TYPE_KEY`, and `AUTH_API_TOKEN_ID_KEY` on success
- * @mutates `ip_rate_limiter` - records on attempt; resets on a valid token
  */
-export const create_bearer_auth_middleware = (deps, ip_rate_limiter, log) => {
+export const create_bearer_auth_middleware = (deps, log) => {
     return async (c, next) => {
         // Skip if an account is already authenticated (e.g. by session middleware)
         if (c.get(ACCOUNT_ID_KEY) != null) {
@@ -88,28 +91,16 @@ export const create_bearer_auth_middleware = (deps, ip_rate_limiter, log) => {
             await next();
             return;
         }
+        // `ip` feeds the token's `last_used_ip` bookkeeping, not a limiter.
         const ip = get_client_ip(c);
-        // Per-IP rate limit: record before async DB work to close the TOCTOU
-        // window where concurrent requests could all pass check() before any
-        // reaches record(). On valid token, reset the counter below.
-        if (ip_rate_limiter) {
-            const check = ip_rate_limiter.check(ip);
-            if (!check.allowed) {
-                return rate_limit_exceeded_response(c, check.retry_after);
-            }
-            ip_rate_limiter.record(ip);
-        }
         const api_token = await query_validate_api_token({ ...deps, log }, raw_token, ip, c.var.pending_effects);
         if (!api_token) {
-            // Invalid or expired token — soft-fail. Rate limit counter stays
-            // incremented (recorded above), correctly penalizing bad attempts.
+            // Invalid or expired token — soft-fail, indistinguishable from
+            // sending no credential at all.
             log.debug('bearer auth soft-fail: token not found or expired');
             await next();
             return;
         }
-        // Valid token — reset rate limit counter
-        if (ip_rate_limiter)
-            ip_rate_limiter.reset(ip);
         c.set(ACCOUNT_ID_KEY, api_token.account_id);
         c.set(CREDENTIAL_TYPE_KEY, 'api_token');
         c.set(AUTH_API_TOKEN_ID_KEY, api_token.id);

package/dist/auth/bootstrap_routes.d.ts

@@ -37,8 +37,18 @@ export interface BootstrapRouteOptions {
      * Use for app-specific post-bootstrap work like generating API tokens.
      */
     on_bootstrap?: (result: BootstrapAccountSuccess, c: Context) => Promise<void>;
-    /** Rate limiter for bootstrap attempts (per-IP). Pass `null` to disable. */
-    ip_rate_limiter: RateLimiter | null;
+    /**
+     * Rate limiter for bootstrap attempts, keyed by client IP. Pass `null` to
+     * disable. Its own instance, not login's: bootstrap is one-shot and its
+     * bucket is never refunded on success (see `RateLimiter.reset`), so a
+     * fumbled token would otherwise leave the operator's *login* budget nearly
+     * spent on a deployment where their new account is the only one that
+     * exists. The Rust spine rate-limits bootstrap not at all (the token is
+     * 32 bytes of CSPRNG compared in constant time); this is the tighter side
+     * of that divergence, kept because the token also sits in a file whose
+     * read path an operator can misconfigure.
+     */
+    bootstrap_ip_rate_limiter: RateLimiter | null;
 }
 /**
  * Dependencies for checking bootstrap status at startup.

package/dist/auth/bootstrap_routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/bootstrap_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAAqB,KAAK,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEzF,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAExE,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGrD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACrC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,8EAA8E;IAC9E,gBAAgB,EAAE,eAAe,CAAC;IAClC;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,uBAAuB,EAAE,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,4EAA4E;IAC5E,eAAe,EAAE,WAAW,GAAG,IAAI,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACxC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnD,EAAE,EAAE,EAAE,CAAC;IACP,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,wBAAwB,EAC9B,SAAS;IAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,KACpC,OAAO,CAAC,eAAe,CAwBzB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,gBAAgB,EACtB,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CAmGjB,CAAC"}
+{"version":3,"file":"bootstrap_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/bootstrap_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAAqB,KAAK,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEzF,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAExE,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGrD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACrC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,8EAA8E;IAC9E,gBAAgB,EAAE,eAAe,CAAC;IAClC;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,uBAAuB,EAAE,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E;;;;;;;;;;OAUG;IACH,yBAAyB,EAAE,WAAW,GAAG,IAAI,CAAC;CAC9C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACxC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnD,EAAE,EAAE,EAAE,CAAC;IACP,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,wBAAwB,EAC9B,SAAS;IAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,KACpC,OAAO,CAAC,eAAe,CAwBzB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,gBAAgB,EACtB,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CA0GjB,CAAC"}

package/dist/auth/bootstrap_routes.js

@@ -54,7 +54,7 @@ export const check_bootstrap_status = async (deps, options) => {
  */
 export const create_bootstrap_route_specs = (deps, options) => {
     const { keyring } = deps;
-    const { session_options, bootstrap_status, on_bootstrap, ip_rate_limiter } = options;
+    const { session_options, bootstrap_status, on_bootstrap, bootstrap_ip_rate_limiter } = options;
     const { token_path } = bootstrap_status;
     return [
         {
@@ -68,9 +68,9 @@ export const create_bootstrap_route_specs = (deps, options) => {
                     return c.json({ error: ERROR_ALREADY_BOOTSTRAPPED }, 403);
                 }
                 // Per-IP rate limit check (before any token/DB work)
-                const ip = ip_rate_limiter ? get_client_ip(c) : null;
-                if (ip_rate_limiter && ip) {
-                    const check = ip_rate_limiter.check(ip);
+                const ip = bootstrap_ip_rate_limiter ? get_client_ip(c) : null;
+                if (bootstrap_ip_rate_limiter && ip) {
+                    const check = bootstrap_ip_rate_limiter.check(ip);
                     if (!check.allowed) {
                         return rate_limit_exceeded_response(c, check.retry_after);
                     }
@@ -87,8 +87,8 @@ export const create_bootstrap_route_specs = (deps, options) => {
                     log: deps.log
                 }, input.token, input);
                 if (!result.ok) {
-                    if (ip_rate_limiter && ip)
-                        ip_rate_limiter.record(ip);
+                    if (bootstrap_ip_rate_limiter && ip)
+                        bootstrap_ip_rate_limiter.record(ip);
                     deps.audit.emit(route, {
                         event_type: 'bootstrap',
                         outcome: 'failure',
@@ -97,9 +97,15 @@ export const create_bootstrap_route_specs = (deps, options) => {
                     });
                     return c.json({ error: result.error }, result.status);
                 }
-                // Successful bootstrap — update state immediately
-                if (ip_rate_limiter && ip)
-                    ip_rate_limiter.reset(ip);
+                // Successful bootstrap — update state immediately. Nothing is
+                // reset: bootstrap has no account-grain bucket to forgive (it
+                // predates any account), and the IP bucket is never refunded on
+                // success (see `RateLimiter.reset`). So this is the one auth
+                // surface where a success clears nothing at all. Bootstrap is
+                // one-shot, so at most `max_attempts - 1` residual entries
+                // survive — and they sit on this route's own limiter, not
+                // login's, so a fumbled token can't spend the operator's login
+                // budget on a deployment where their account is the only one.
                 bootstrap_status.available = false;
                 await create_session_and_set_cookie({
                     keyring,

package/dist/auth/middleware.d.ts

@@ -9,7 +9,6 @@
 import type { SessionOptions } from './session_cookie.js';
 import type { AppDeps } from './deps.js';
 import type { DaemonTokenState } from './daemon_token.js';
-import type { RateLimiter } from '../rate_limiter.js';
 import type { MiddlewareSpec } from '../http/middleware_spec.js';
 /**
  * Per-factory configuration for the standard auth middleware stack.
@@ -21,8 +20,6 @@ export interface AuthMiddlewareOptions {
     path?: string;
     /** Daemon token state for keeper auth. Omit to disable daemon token middleware. */
     daemon_token_state?: DaemonTokenState;
-    /** Rate limiter for bearer token auth attempts (per-IP). Pass `null` to disable. */
-    bearer_ip_rate_limiter: RateLimiter | null;
 }
 /**
  * Create the auth middleware stack.

package/dist/auth/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAGjE;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;IACtC,oFAAoF;IACpF,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;CAC3C;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAgF/B,CAAC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAGjE;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;CACtC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAuE/B,CAAC"}

package/dist/auth/middleware.js

@@ -6,7 +6,7 @@
  *
  * @module
  */
-import { ApiError, RateLimitError } from '../http/error_schemas.js';
+import { ApiError } from '../http/error_schemas.js';
 /**
  * Create the auth middleware stack.
  *
@@ -21,7 +21,7 @@ import { ApiError, RateLimitError } from '../http/error_schemas.js';
  */
 export const create_auth_middleware_specs = async (deps, options) => {
     const { keyring, db } = deps;
-    const { allowed_origins, session_options, path = '/api/*', daemon_token_state, bearer_ip_rate_limiter } = options;
+    const { allowed_origins, session_options, path = '/api/*', daemon_token_state } = options;
     const query_deps = { db };
     // Dynamic imports preserve the bundle-split for type-only consumers of
     // this module (`MiddlewareSpec`, `AuthMiddlewareOptions`, etc.). The
@@ -36,7 +36,7 @@ export const create_auth_middleware_specs = async (deps, options) => {
     ]);
     const session_middleware = create_session_middleware(keyring, session_options);
     const request_context_middleware = create_request_context_middleware(query_deps, deps.log);
-    const bearer_auth_middleware = create_bearer_auth_middleware(query_deps, bearer_ip_rate_limiter, deps.log);
+    const bearer_auth_middleware = create_bearer_auth_middleware(query_deps, deps.log);
     const specs = [
         {
             name: 'origin',
@@ -50,13 +50,14 @@ export const create_auth_middleware_specs = async (deps, options) => {
             name: 'bearer_auth',
             path,
             handler: bearer_auth_middleware,
-            // Bearer middleware soft-fails for invalid/expired tokens (calls next()
-            // without setting context). Only 429 is a hard-fail from this layer.
-            // Auth enforcement (401/403) happens downstream — the RPC dispatcher's
-            // pre-validation / post-authorization auth gates, or `require_auth` /
-            // `require_role` on REST — producing consistent JSON-RPC or
-            // route-level errors.
-            errors: { 429: RateLimitError }
+            // Soft-fails on every non-success path — browser context, malformed,
+            // invalid, and expired tokens all `next()` through without setting
+            // context. The layer returns no error response of its own (it carries
+            // no rate limiter, so not even a 429). Auth enforcement (401/403)
+            // happens downstream — the RPC dispatcher's pre-authorization /
+            // post-authorization auth gates, or `require_auth` / `require_role` on
+            // REST — producing consistent JSON-RPC or route-level errors.
+            errors: {}
         }
     ];
     if (daemon_token_state) {

package/dist/auth/migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AA+BH,OAAO,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtE,wDAAwD;AACxD,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,EAAE,aAAa,CAAC,MAAM,CAA8B,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,SAAS,CA6H5C,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,kBAG/B,CAAC"}
+{"version":3,"file":"migrations.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AA+BH,OAAO,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtE,wDAAwD;AACxD,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,EAAE,aAAa,CAAC,MAAM,CAA8B,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,SAAS,CAuJ5C,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,kBAG/B,CAAC"}