@fuzdev/fuz_app 0.108.0 → 0.110.0

package/dist/auth/daemon_token_middleware.d.ts

@@ -1,8 +1,12 @@
 /**
- * Daemon token rotation, persistence, and middleware.
+ * Daemon token middleware — the credential **consumer**.
  *
- * Manages the lifecycle of filesystem-resident daemon tokens: writing to disk,
- * rotation on an interval, and HTTP middleware for authentication.
+ * Validates a presented `X-Daemon-Token` and resolves the keeper account.
+ * The producer half (rotation + file persistence) lives in
+ * `testing/daemon_token_rotation.ts` behind the dev-env guard: no production
+ * assembly mints daemon tokens — the credential's only remaining role is the
+ * cross-process test harness's keeper channel — mirroring the Rust spine,
+ * whose producer is confined to `fuz_testing`.
  *
  * Pure token primitives (schema, generation, validation) live in `auth/daemon_token.ts`.
  * See docs/identity.md for design rationale.
@@ -11,40 +15,8 @@
  */
 import type { MiddlewareHandler } from 'hono';
 import type { Logger } from '@fuzdev/fuz_util/log.ts';
-import { type FsWriteDeps, type FsRemoveDeps, type EnvDeps } from '../runtime/deps.js';
 import type { QueryDeps } from '../db/query_deps.js';
 import { type DaemonTokenState } from './daemon_token.js';
-/** Default rotation interval in milliseconds (30 seconds). */
-export declare const DEFAULT_ROTATION_INTERVAL_MS = 30000;
-/** Deps for writing the daemon token to disk. */
-export type DaemonTokenWriteDeps = Pick<EnvDeps, 'env_get'> & Pick<FsWriteDeps, 'mkdir' | 'write_text_file' | 'rename'> & {
-    /** Set file permissions. Optional — consumers provide when available (e.g. `Deno.chmod`). */
-    chmod?: (path: string, mode: number) => Promise<void>;
-};
-/**
- * Get the daemon token file path (`~/.{name}/run/daemon_token`).
- *
- * @param runtime - runtime with `env_get` capability
- * @param name - application name
- * @returns path to `daemon_token`, or `null` if `$HOME` is not set
- */
-export declare const get_daemon_token_path: (runtime: Pick<EnvDeps, "env_get">, name: string) => string | null;
-/**
- * Write the current token to disk atomically.
- *
- * Uses `write_file_atomic` (temp file + rename) and optionally sets mode 0600.
- *
- * On-disk format is JSON `{"token": "..."}` — the wrapper leaves room for
- * future fields (rotated_at, version) without changing every reader. Both
- * the TS cross-backend harness reader (`spawn_backend.read_daemon_token`)
- * and the Rust daemon-token writer match this shape.
- *
- * @param runtime - runtime with file write capabilities
- * @param token_path - path to write the token
- * @param token - the raw token string
- * @mutates filesystem - writes `token_path` atomically and `chmod 0600` when supported
- */
-export declare const write_daemon_token: (runtime: DaemonTokenWriteDeps, token_path: string, token: string) => Promise<void>;
 /**
  * Resolve the keeper account ID by querying for the account with an active
  * keeper role_grant.
@@ -61,40 +33,6 @@ export declare const write_daemon_token: (runtime: DaemonTokenWriteDeps, token_p
  * @returns the keeper account ID, or `null` if no keeper exists yet (pre-bootstrap)
  */
 export declare const resolve_keeper_account_id: (deps: QueryDeps) => Promise<string | null>;
-/** Options for daemon token rotation. */
-export interface DaemonTokenRotationOptions {
-    /**
-     * Absolute path the token file is written to. Caller computes from
-     * its own conventions — e.g. `get_daemon_token_path(runtime, app_name)`
-     * for the standard `~/.{name}/run/daemon_token` layout, or a path
-     * derived from `PUBLIC_<APP>_DIR` for cross-process test setups that
-     * isolate the app dir to a tmpdir.
-     */
-    token_path: string;
-    /** Rotation interval in ms. Default: `30000` (30s). */
-    rotation_interval_ms?: number;
-}
-/** Result of starting daemon token rotation. */
-export interface DaemonTokenRotation {
-    /** The mutable runtime state. Pass to `create_daemon_token_middleware`. */
-    state: DaemonTokenState;
-    /** Stop rotation, clean up the interval, and delete the token file. Call on graceful shutdown. */
-    stop: () => Promise<void>;
-}
-/**
- * Start daemon token rotation.
- *
- * Generates an initial token, writes it to disk, resolves the keeper account,
- * and sets up periodic rotation. Returns the mutable state object and a stop function.
- *
- * @param runtime - runtime with file and remove capabilities
- * @param deps - query dependencies for resolving keeper account
- * @param options - rotation configuration
- * @param log - the logger instance
- * @returns rotation state and stop function
- * @mutates filesystem - writes the token file on each rotation; `stop` removes it
- */
-export declare const start_daemon_token_rotation: (runtime: DaemonTokenWriteDeps & FsRemoveDeps, deps: QueryDeps, options: DaemonTokenRotationOptions, log: Logger) => Promise<DaemonTokenRotation>;
 /**
  * Create middleware that authenticates via daemon token.
  *

package/dist/auth/daemon_token_middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon_token_middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/daemon_token_middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAYvF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAKN,KAAK,gBAAgB,EACrB,MAAM,mBAAmB,CAAC;AAE3B,8DAA8D;AAC9D,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD,iDAAiD;AACjD,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,GAC1D,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,iBAAiB,GAAG,QAAQ,CAAC,GAAG;IAC3D,6FAA6F;IAC7F,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,EACjC,MAAM,MAAM,KACV,MAAM,GAAG,IAGX,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,kBAAkB,GAC9B,SAAS,oBAAoB,EAC7B,YAAY,MAAM,EAClB,OAAO,MAAM,KACX,OAAO,CAAC,IAAI,CAKd,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,yBAAyB,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAEtF,CAAC;AAEF,yCAAyC;AACzC,MAAM,WAAW,0BAA0B;IAC1C;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,gDAAgD;AAChD,MAAM,WAAW,mBAAmB;IACnC,2EAA2E;IAC3E,KAAK,EAAE,gBAAgB,CAAC;IACxB,kGAAkG;IAClG,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,2BAA2B,GACvC,SAAS,oBAAoB,GAAG,YAAY,EAC5C,MAAM,SAAS,EACf,SAAS,0BAA0B,EACnC,KAAK,MAAM,KACT,OAAO,CAAC,mBAAmB,CAqD7B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,eAAO,MAAM,8BAA8B,GAC1C,OAAO,gBAAgB,EACvB,MAAM,SAAS,EACf,KAAK,MAAM,KACT,iBA0EF,CAAC"}
+{"version":3,"file":"daemon_token_middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/daemon_token_middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAWtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAIN,KAAK,gBAAgB,EACrB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,yBAAyB,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAEtF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,eAAO,MAAM,8BAA8B,GAC1C,OAAO,gBAAgB,EACvB,MAAM,SAAS,EACf,KAAK,MAAM,KACT,iBA0EF,CAAC"}

package/dist/auth/daemon_token_middleware.js

@@ -1,8 +1,12 @@
 /**
- * Daemon token rotation, persistence, and middleware.
+ * Daemon token middleware — the credential **consumer**.
  *
- * Manages the lifecycle of filesystem-resident daemon tokens: writing to disk,
- * rotation on an interval, and HTTP middleware for authentication.
+ * Validates a presented `X-Daemon-Token` and resolves the keeper account.
+ * The producer half (rotation + file persistence) lives in
+ * `testing/daemon_token_rotation.ts` behind the dev-env guard: no production
+ * assembly mints daemon tokens — the credential's only remaining role is the
+ * cross-process test harness's keeper channel — mirroring the Rust spine,
+ * whose producer is confined to `fuz_testing`.
  *
  * Pure token primitives (schema, generation, validation) live in `auth/daemon_token.ts`.
  * See docs/identity.md for design rationale.
@@ -10,49 +14,12 @@
  * @module
  */
 import { DEV } from 'esm-env';
-import {} from '../runtime/deps.js';
-import { write_file_atomic } from '../runtime/fs.js';
-import { get_app_dir } from '../cli/config.js';
 import { ACCOUNT_ID_KEY, AUTH_API_TOKEN_ID_KEY, CREDENTIAL_TYPE_KEY, TOKEN_SCOPE_KEY } from '../hono_context.js';
 import { token_scope_full } from './token_scope.js';
 import { is_browser_context } from '../http/origin.js';
 import { query_role_grant_find_account_id_for_role } from './role_grant_queries.js';
 import { ROLE_KEEPER } from './role_schema.js';
-import { DaemonToken, DAEMON_TOKEN_HEADER, generate_daemon_token, validate_daemon_token } from './daemon_token.js';
-/** Default rotation interval in milliseconds (30 seconds). */
-export const DEFAULT_ROTATION_INTERVAL_MS = 30_000;
-/**
- * Get the daemon token file path (`~/.{name}/run/daemon_token`).
- *
- * @param runtime - runtime with `env_get` capability
- * @param name - application name
- * @returns path to `daemon_token`, or `null` if `$HOME` is not set
- */
-export const get_daemon_token_path = (runtime, name) => {
-    const app_dir = get_app_dir(runtime, name);
-    return app_dir ? `${app_dir}/run/daemon_token` : null;
-};
-/**
- * Write the current token to disk atomically.
- *
- * Uses `write_file_atomic` (temp file + rename) and optionally sets mode 0600.
- *
- * On-disk format is JSON `{"token": "..."}` — the wrapper leaves room for
- * future fields (rotated_at, version) without changing every reader. Both
- * the TS cross-backend harness reader (`spawn_backend.read_daemon_token`)
- * and the Rust daemon-token writer match this shape.
- *
- * @param runtime - runtime with file write capabilities
- * @param token_path - path to write the token
- * @param token - the raw token string
- * @mutates filesystem - writes `token_path` atomically and `chmod 0600` when supported
- */
-export const write_daemon_token = async (runtime, token_path, token) => {
-    await write_file_atomic(runtime, token_path, JSON.stringify({ token }) + '\n');
-    if (runtime.chmod) {
-        await runtime.chmod(token_path, 0o600);
-    }
-};
+import { DaemonToken, DAEMON_TOKEN_HEADER, validate_daemon_token } from './daemon_token.js';
 /**
  * Resolve the keeper account ID by querying for the account with an active
  * keeper role_grant.
@@ -71,69 +38,6 @@ export const write_daemon_token = async (runtime, token_path, token) => {
 export const resolve_keeper_account_id = async (deps) => {
     return query_role_grant_find_account_id_for_role(deps, ROLE_KEEPER);
 };
-/**
- * Start daemon token rotation.
- *
- * Generates an initial token, writes it to disk, resolves the keeper account,
- * and sets up periodic rotation. Returns the mutable state object and a stop function.
- *
- * @param runtime - runtime with file and remove capabilities
- * @param deps - query dependencies for resolving keeper account
- * @param options - rotation configuration
- * @param log - the logger instance
- * @returns rotation state and stop function
- * @mutates filesystem - writes the token file on each rotation; `stop` removes it
- */
-export const start_daemon_token_rotation = async (runtime, deps, options, log) => {
-    const { token_path, rotation_interval_ms = DEFAULT_ROTATION_INTERVAL_MS } = options;
-    // ensure parent directory exists
-    const last_slash = token_path.lastIndexOf('/');
-    if (last_slash > 0) {
-        await runtime.mkdir(token_path.slice(0, last_slash), { recursive: true });
-    }
-    // resolve keeper account (may be null pre-bootstrap; the middleware
-    // lazily refreshes on the first null hit to cover the
-    // rotation-starts-before-bootstrap case)
-    const keeper_account_id = await resolve_keeper_account_id(deps);
-    // generate initial token and write to disk
-    const initial_token = generate_daemon_token();
-    await write_daemon_token(runtime, token_path, initial_token);
-    const state = {
-        current_token: initial_token,
-        previous_token: null,
-        rotated_at: new Date(),
-        keeper_account_id
-    };
-    let writing = false;
-    const interval_id = setInterval(async () => {
-        if (writing)
-            return; // skip if previous rotation write still in progress
-        writing = true;
-        try {
-            const new_token = generate_daemon_token();
-            state.previous_token = state.current_token;
-            state.current_token = new_token;
-            state.rotated_at = new Date();
-            await write_daemon_token(runtime, token_path, new_token);
-        }
-        catch (err) {
-            log.error('Failed to write rotated token:', err);
-        }
-        finally {
-            writing = false;
-        }
-    }, rotation_interval_ms);
-    const stop = async () => {
-        clearInterval(interval_id);
-        try {
-            await runtime.remove(token_path);
-        }
-        catch {
-            // already removed or never written
-        }
-    };
-    return { state, stop };
-};
 /**
  * Create middleware that authenticates via daemon token.
  *

package/dist/auth/deps.d.ts

@@ -12,7 +12,6 @@ import type { FactStore } from '@fuzdev/fuz_util/fact_store.ts';
 import type { Keyring } from './keyring.js';
 import type { PasswordHashDeps } from './password.js';
 import type { Db } from '../db/db.js';
-import type { StatResult } from '../runtime/deps.js';
 import type { AuditEmitter } from './audit_emitter.js';
 /**
  * Stateless capabilities bundle for fuz_app backends.
@@ -21,10 +20,15 @@ import type { AuditEmitter } from './audit_emitter.js';
  * Does not contain config (static values) or runtime state (mutable refs).
  */
 export interface AppDeps {
-    /** Get file/directory stats, or null if path doesn't exist. */
-    stat: (path: string) => Promise<StatResult | null>;
-    /** Read a file as text. */
-    read_text_file: (path: string) => Promise<string>;
+    /**
+     * Hardened secret-file read — used for the bootstrap token (the file that
+     * mints the keeper account). Production wiring passes the runtime's
+     * `read_secure_file` (`FsSecureReadDeps`), which rejects symlinks,
+     * group/other-accessible modes, and oversized files; both the boot-time
+     * availability probe and the request-time read go through this one
+     * capability so the probe can never be laxer than the read it gates.
+     */
+    read_secure_file: (path: string) => Promise<Uint8Array>;
     /** Delete a file. */
     delete_file: (path: string) => Promise<void>;
     /** HMAC-SHA256 cookie signing keyring. */

package/dist/auth/deps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deps.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACvB,+DAA+D;IAC/D,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnD,2BAA2B;IAC3B,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,qBAAqB;IACrB,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,0CAA0C;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,yBAAyB;IACzB,EAAE,EAAE,EAAE,CAAC;IACP,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,KAAK,EAAE,YAAY,CAAC;IACpB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,SAAS,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAEnD;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IACjC,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,4DAA4D;IAC5D,KAAK,EAAE,YAAY,CAAC;CACpB"}
+{"version":3,"file":"deps.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACvB;;;;;;;OAOG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,qBAAqB;IACrB,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,0CAA0C;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,yBAAyB;IACzB,EAAE,EAAE,EAAE,CAAC;IACP,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,KAAK,EAAE,YAAY,CAAC;IACpB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,SAAS,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAEnD;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IACjC,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,4DAA4D;IAC5D,KAAK,EAAE,YAAY,CAAC;CACpB"}

package/dist/auth/middleware.js

@@ -35,7 +35,7 @@ export const create_auth_middleware_specs = async (deps, options) => {
         import('./bearer_auth.js')
     ]);
     const session_middleware = create_session_middleware(keyring, session_options);
-    const request_context_middleware = create_request_context_middleware(query_deps, deps.log);
+    const request_context_middleware = create_request_context_middleware(query_deps);
     const bearer_auth_middleware = create_bearer_auth_middleware(query_deps, deps.log);
     const specs = [
         {

package/dist/auth/migrations.d.ts

@@ -37,6 +37,13 @@
  * DBs (no long-lived data) may still drop + re-bootstrap freely on a break —
  * the freeze is the contract for the deployed chain, not local iteration.
  *
+ * **Every entry is twinned on the Rust spine** (`fuz_auth/src/migrations.rs`),
+ * and the two names must match byte for byte: the `_testing_migration_tracker`
+ * parity gate compares the `(namespace, name, sequence)` rows both spines
+ * record, and a divergence there breaks the swap-freely invariant (a consumer
+ * pointing either implementation at one database). Append on both sides in the
+ * same change, so no entry below repeats the rule.
+ *
  * @module
  */
 import type { Migration, MigrationNamespace } from '../db/migrate.js';

package/dist/auth/migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AA+BH,OAAO,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtE,wDAAwD;AACxD,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,EAAE,aAAa,CAAC,MAAM,CAA8B,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,SAAS,CAuJ5C,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,kBAG/B,CAAC"}
+{"version":3,"file":"migrations.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AA+BH,OAAO,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtE,wDAAwD;AACxD,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,EAAE,aAAa,CAAC,MAAM,CAA8B,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,SAAS,CAmK5C,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,kBAG/B,CAAC"}

package/dist/auth/migrations.js

@@ -37,6 +37,13 @@
  * DBs (no long-lived data) may still drop + re-bootstrap freely on a break —
  * the freeze is the contract for the deployed chain, not local iteration.
  *
+ * **Every entry is twinned on the Rust spine** (`fuz_auth/src/migrations.rs`),
+ * and the two names must match byte for byte: the `_testing_migration_tracker`
+ * parity gate compares the `(namespace, name, sequence)` rows both spines
+ * record, and a divergence there breaks the swap-freely invariant (a consumer
+ * pointing either implementation at one database). Append on both sides in the
+ * same change, so no entry below repeats the rule.
+ *
  * @module
  */
 import { ACCOUNT_SCHEMA, ACCOUNT_EMAIL_INDEX, ACCOUNT_USERNAME_CI_INDEX, ACTOR_SCHEMA, ACTOR_INDEX, ACTOR_NAME_LOWER_INDEX, ROLE_GRANT_SCHEMA, ROLE_GRANT_INDEXES, AUTH_SESSION_SCHEMA, AUTH_SESSION_INDEXES, API_TOKEN_SCHEMA, API_TOKEN_INDEX, BOOTSTRAP_LOCK_SCHEMA, BOOTSTRAP_LOCK_SEED, INVITE_SCHEMA, INVITE_INDEXES, APP_SETTINGS_SCHEMA, APP_SETTINGS_SEED } from './auth_ddl.js';
@@ -156,10 +163,6 @@ export const auth_migrations = [
     },
     // v2: per-credential token scoping — `api_token.scope JSONB NOT NULL`.
     //
-    // Name must match the Rust twin's migration byte for byte
-    // (`fuz_auth/src/migrations.rs`) or the `_testing_migration_tracker` parity
-    // gate fails and the swap-freely invariant breaks.
-    //
     // Three statements, and the middle one is the whole compatibility story:
     //
     // 1. Add the column nullable, so the ALTER is instant on a populated table.
@@ -201,15 +204,29 @@ export const auth_migrations = [
     // would mean the two impls could silently disagree about which credential
     // answered; the constraint makes that unrepresentable instead of merely
     // improbable.
-    //
-    // The name must match the Rust twin's `api_token_hash_unique_index` byte for
-    // byte or the `_testing_migration_tracker` parity gate fails and the
-    // swap-freely invariant breaks.
     {
         name: 'api_token_hash_unique_index',
         up: async (db) => {
             await db.query('CREATE UNIQUE INDEX IF NOT EXISTS idx_api_token_hash ON api_token(token_hash)');
         }
+    },
+    // The GIN the per-cell audit timeline assumes.
+    //
+    // `full_auth_schema` ships only btree indexes (seq, account, event_type,
+    // targets), but `db/cell_audit_queries.ts` reconstructs the per-cell
+    // timeline by OR-ing `metadata @> '{...}'::jsonb` containment clauses —
+    // sequential scans without this index, degrading with audit volume.
+    //
+    // `jsonb_path_ops` rather than the default `jsonb_ops`: it serves exactly
+    // the `@>` containment operator these queries use, with a smaller, faster
+    // index. Server PG and PGlite honor the opclass; PG-compatible engines
+    // without operator classes parse and ignore it, serving `@>` from their
+    // generic GIN.
+    {
+        name: 'audit_log_metadata_gin_index',
+        up: async (db) => {
+            await db.query('CREATE INDEX IF NOT EXISTS idx_audit_log_metadata ON audit_log USING gin (metadata jsonb_path_ops)');
+        }
     }
 ];
 /** Pre-composed migration namespace for auth tables. */

package/dist/auth/request_context.d.ts

@@ -35,7 +35,6 @@
  * @module
  */
 import type { Context, MiddlewareHandler } from 'hono';
-import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import { type Account, type Actor, type RoleGrant } from './account_schema.js';
 import type { QueryDeps } from '../db/query_deps.js';
 import type { RouteSpec } from '../http/route_spec.js';
@@ -224,11 +223,10 @@ export declare const resolve_acting_actor: (deps: QueryDeps, account_id: string,
  * `require_auth` / `require_role` enforce.
  *
  * @param deps - query dependencies (pool-level db for middleware)
- * @param log - the logger instance
  * @param session_context_key - the Hono context key where session middleware stored the session token
  * @mutates Hono context - sets `ACCOUNT_ID_KEY`, `CREDENTIAL_TYPE_KEY`, `AUTH_SESSION_TOKEN_HASH_KEY`, and `AUTH_API_TOKEN_ID_KEY`
  */
-export declare const create_request_context_middleware: (deps: QueryDeps, log: Logger, session_context_key?: string) => MiddlewareHandler;
+export declare const create_request_context_middleware: (deps: QueryDeps, session_context_key?: string) => MiddlewareHandler;
 /**
  * Refuse a non-RPC surface to a narrowed token — rule 3, for callers that are
  * not route specs. Under the Rust twin's name

package/dist/auth/request_context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request_context.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/request_context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,KAAK,EAEV,KAAK,SAAS,EACd,MAAM,qBAAqB,CAAC;AAY7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAgBrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAA6C,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElG,OAAO,EAIN,oBAAoB,EACpB,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,EACtB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;CAC9B;AAED,0DAA0D;AAC1D,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,GAAG,OAAO,KAAG,cAAc,GAAG,IAEjE,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,GAAI,GAAG,OAAO,KAAG,cAQpD,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAoB,SAAQ,cAAc;IAC1D,KAAK,EAAE,KAAK,CAAC;CACb;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,QAAQ,GACpB,KAAK,cAAc,GAAG,IAAI,EAC1B,MAAM,MAAM,EACZ,MAAK,IAAiB,KACpB,OACoF,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,eAAe,GAC3B,KAAK,cAAc,GAAG,IAAI,EAC1B,MAAM,MAAM,EACZ,UAAU,MAAM,GAAG,IAAI,EACvB,MAAK,IAAiB,KACpB,OAKF,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,cAAc,GAAG,IAAI,EAC1B,OAAO,aAAa,CAAC,MAAM,CAAC,EAC5B,UAAU,MAAM,GAAG,IAAI,EACvB,MAAK,IAAiB,KACpB,OAMF,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAClC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,SAAS,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GACvF;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,iBAAiB,MAAM,GAAG,SAAS,KACjC,OAAO,CAAC,wBAAwB,CAclC,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iCAAiC,GAC7C,MAAM,SAAS,EACf,KAAK,MAAM,EACX,4BAAuC,KACrC,iBAgCF,CAAC;AAuBF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,0BAA0B,GAAI,GAAG,OAAO,EAAE,YAAY,MAAM,KAAG,QAAQ,GAAG,IAChC,CAAC;AAExD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,GAAI,YAAY,MAAM,KAAG,iBAYxD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,iBAK1B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,aAAa,CAAC,MAAM,CAAC,KAAG,iBAW3D,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,wBAAwB,GACpC,kBAAkB,aAAa,CAAC,MAAM,CAAC,KACrC,iBAiBF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,cAAc,EACnB,MAAM,SAAS,KACb,OAAO,CAAC,cAAc,CAQxB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,UAAU,MAAM,KACd,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAUpC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,cAAc,GAAG,IAAI,CAI/B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,wBAAwB,GACjC;IAAE,KAAK,EAAE,OAAO,oBAAoB,CAAC;IAAC,SAAS,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GACtF;IAAE,KAAK,EAAE,OAAO,0BAA0B,CAAA;CAAE,GAC5C;IAAE,KAAK,EAAE,OAAO,0BAA0B,CAAA;CAAE,GAC5C;IAAE,KAAK,EAAE,OAAO,sBAAsB,CAAA;CAAE,CAAC;AAE5C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,mBAAmB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,eAAe,EAAE,cAAc,GAAG,IAAI,CAAA;CAAE,GACpD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,IAAI,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,YAAY,MAAM,GAAG,IAAI,EACzB,MAAM,SAAS,EACf,cAAc,MAAM,GAAG,SAAS,KAC9B,OAAO,CAAC,mBAAmB,CAwC7B,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,KACb,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAoB5D,CAAC"}
+{"version":3,"file":"request_context.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/request_context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAEvD,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,KAAK,EAEV,KAAK,SAAS,EACd,MAAM,qBAAqB,CAAC;AAQ7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAgBrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAA6C,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElG,OAAO,EAIN,oBAAoB,EACpB,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,EACtB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;CAC9B;AAED,0DAA0D;AAC1D,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,GAAG,OAAO,KAAG,cAAc,GAAG,IAEjE,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,GAAI,GAAG,OAAO,KAAG,cAQpD,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAoB,SAAQ,cAAc;IAC1D,KAAK,EAAE,KAAK,CAAC;CACb;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,QAAQ,GACpB,KAAK,cAAc,GAAG,IAAI,EAC1B,MAAM,MAAM,EACZ,MAAK,IAAiB,KACpB,OACoF,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,eAAe,GAC3B,KAAK,cAAc,GAAG,IAAI,EAC1B,MAAM,MAAM,EACZ,UAAU,MAAM,GAAG,IAAI,EACvB,MAAK,IAAiB,KACpB,OAKF,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,cAAc,GAAG,IAAI,EAC1B,OAAO,aAAa,CAAC,MAAM,CAAC,EAC5B,UAAU,MAAM,GAAG,IAAI,EACvB,MAAK,IAAiB,KACpB,OAMF,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAClC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,SAAS,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GACvF;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,iBAAiB,MAAM,GAAG,SAAS,KACjC,OAAO,CAAC,wBAAwB,CAclC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iCAAiC,GAC7C,MAAM,SAAS,EACf,4BAAuC,KACrC,iBA6BF,CAAC;AAuBF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,0BAA0B,GAAI,GAAG,OAAO,EAAE,YAAY,MAAM,KAAG,QAAQ,GAAG,IAChC,CAAC;AAExD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,GAAI,YAAY,MAAM,KAAG,iBAYxD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,iBAK1B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,aAAa,CAAC,MAAM,CAAC,KAAG,iBAW3D,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,wBAAwB,GACpC,kBAAkB,aAAa,CAAC,MAAM,CAAC,KACrC,iBAiBF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,cAAc,EACnB,MAAM,SAAS,KACb,OAAO,CAAC,cAAc,CAQxB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,UAAU,MAAM,KACd,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAUpC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,cAAc,GAAG,IAAI,CAI/B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,wBAAwB,GACjC;IAAE,KAAK,EAAE,OAAO,oBAAoB,CAAC;IAAC,SAAS,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GACtF;IAAE,KAAK,EAAE,OAAO,0BAA0B,CAAA;CAAE,GAC5C;IAAE,KAAK,EAAE,OAAO,0BAA0B,CAAA;CAAE,GAC5C;IAAE,KAAK,EAAE,OAAO,sBAAsB,CAAA;CAAE,CAAC;AAE5C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,mBAAmB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,eAAe,EAAE,cAAc,GAAG,IAAI,CAAA;CAAE,GACpD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,IAAI,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,YAAY,MAAM,GAAG,IAAI,EACzB,MAAM,SAAS,EACf,cAAc,MAAM,GAAG,SAAS,KAC9B,OAAO,CAAC,mBAAmB,CAwC7B,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,KACb,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAoB5D,CAAC"}

package/dist/auth/request_context.js

@@ -35,7 +35,7 @@
  * @module
  */
 import { is_role_grant_active } from './account_schema.js';
-import { hash_session_token, session_touch_fire_and_forget, query_session_get_valid } from './session_queries.js';
+import { hash_session_token, query_session_get_valid } from './session_queries.js';
 import { query_account_by_id, query_actor_by_id, query_active_actors_by_account } from './account_queries.js';
 import { query_role_grant_find_active_for_actor } from './role_grant_queries.js';
 import { ACCOUNT_ID_KEY, AUTH_API_TOKEN_ID_KEY, CREDENTIAL_TYPE_KEY, TOKEN_SCOPE_KEY, TEST_CONTEXT_PRESET_KEY } from '../hono_context.js';
@@ -208,11 +208,10 @@ export const resolve_acting_actor = async (deps, account_id, acting_actor_id) =>
  * `require_auth` / `require_role` enforce.
  *
  * @param deps - query dependencies (pool-level db for middleware)
- * @param log - the logger instance
  * @param session_context_key - the Hono context key where session middleware stored the session token
  * @mutates Hono context - sets `ACCOUNT_ID_KEY`, `CREDENTIAL_TYPE_KEY`, `AUTH_SESSION_TOKEN_HASH_KEY`, and `AUTH_API_TOKEN_ID_KEY`
  */
-export const create_request_context_middleware = (deps, log, session_context_key = 'auth_session_id') => {
+export const create_request_context_middleware = (deps, session_context_key = 'auth_session_id') => {
     return async (c, next) => {
         c.set(REQUEST_CONTEXT_KEY, null);
         c.set(ACCOUNT_ID_KEY, null);
@@ -235,8 +234,6 @@ export const create_request_context_middleware = (deps, log, session_context_key
         // A session is full account authority by construction.
         c.set(TOKEN_SCOPE_KEY, token_scope_full());
         c.set(AUTH_SESSION_TOKEN_HASH_KEY, token_hash);
-        // Touch session (fire-and-forget, don't block the request)
-        void session_touch_fire_and_forget(deps, token_hash, c.var.pending_effects, log);
         await next();
     };
 };

package/dist/auth/session_cookie.d.ts

@@ -10,16 +10,15 @@
  * @module
  */
 import type { Keyring } from './keyring.js';
-/** Cookie max age in seconds (30 days — aligned with AUTH_SESSION_LIFETIME_MS). */
-export declare const SESSION_AGE_MAX: number;
 /**
- * Threshold (seconds) at which `process_session_cookie` re-signs a still-valid
- * cookie to extend its embedded expiration. Mirrors the DB-side
- * `AUTH_SESSION_EXTEND_THRESHOLD_MS` so a continuously-active user's cookie
- * stays in sync with their server-side session lifetime. Set
- * `SessionOptions.refresh_threshold_seconds = 0` to disable.
+ * Cookie max age in seconds (30 days — aligned with AUTH_SESSION_LIFETIME_MS).
+ *
+ * This is an **absolute** session lifetime: the cookie is signed once at
+ * mint (`expires_at = mint + max_age`) and never re-signed, matching the DB
+ * row's fixed `expires_at`. There is deliberately no sliding renewal on
+ * either leg — see `docs/security.md` §Session Security.
  */
-export declare const SESSION_REFRESH_THRESHOLD_S: number;
+export declare const SESSION_AGE_MAX: number;
 /**
  * Cookie options for session cookies.
  */
@@ -91,14 +90,6 @@ export interface SessionOptions<TIdentity> {
      * cannot carry `maxAge` so the two values can't drift.
      */
     max_age?: number;
-    /**
-     * Threshold (seconds) for expiration-based cookie refresh. When a parsed
-     * cookie's `expires_at - now <= refresh_threshold_seconds`,
-     * `process_session_cookie` returns `action: 'refresh'` with a freshly-signed
-     * value (extending the embedded expiration by `max_age`). Defaults to
-     * `SESSION_REFRESH_THRESHOLD_S` (1 day). Set to `0` to disable.
-     */
-    refresh_threshold_seconds?: number;
     cookie_options?: Partial<Omit<SessionCookieOptions, 'maxAge'>>;
     /** Encode identity into the cookie payload (before the `:expires_at` suffix). */
     encode_identity: (identity: TIdentity) => string;
@@ -111,26 +102,14 @@ export interface SessionOptions<TIdentity> {
 export interface ParsedSession<TIdentity> {
     /** The decoded identity. */
     identity: TIdentity;
-    /** True if verified with a non-primary key (needs re-signing). */
-    should_refresh_signature: boolean;
-    /**
-     * True if the embedded `expires_at` is within
-     * `options.refresh_threshold_seconds` of `now`. Signals that the cookie is
-     * valid but should be re-signed to extend its lifetime — mirrors
-     * `query_session_touch`'s DB-side extension so the cookie and server
-     * session don't drift. Always false when the threshold is `0`.
-     */
-    should_refresh_expiration: boolean;
-    /** Index of the key that verified the signature. */
+    /** Index of the key that verified the signature (0 = primary). */
     key_index: number;
 }
 /**
  * Parse a signed session cookie value.
  *
  * The signed value format is `${encode(identity)}:${expires_at}`.
- * Tries all keys in order to support key rotation. The result's
- * `should_refresh_expiration` flag fires when the cookie is within
- * `options.refresh_threshold_seconds` of `expires_at`.
+ * Tries all keys in order to support key rotation.
  *
  * @param signed_value - the raw cookie value (signed)
  * @param keyring - key ring for verification
@@ -159,9 +138,7 @@ export interface ProcessSessionResult<TIdentity> {
     /** Whether the session is valid. */
     valid: boolean;
     /** Action the adapter should take. */
-    action: 'none' | 'clear' | 'refresh';
-    /** New signed value when action is 'refresh'. */
-    new_signed_value?: string;
+    action: 'none' | 'clear';
     /** The decoded identity if the cookie was valid. */
     identity?: TIdentity;
 }
@@ -181,9 +158,14 @@ export declare const fuz_session_config: SessionOptions<string>;
 /**
  * Process a session cookie and determine what action to take.
  *
- * `action: 'refresh'` fires on key rotation **or** impending expiration
- * (within `options.refresh_threshold_seconds`); both produce a freshly-signed
- * `new_signed_value`.
+ * There is deliberately no refresh action: any re-sign computes a fresh
+ * `now + max_age` expiry, extending the cookie past the DB row's fixed
+ * `expires_at` — the holder would go silently anonymous while carrying a
+ * self-perpetuating cookie. The absolute lifetime is one signing at mint,
+ * on both legs, matching the Rust spine. A cookie signed by a retired
+ * (non-primary) key keeps verifying until the key leaves the keyring;
+ * retired keys are safe to drop after `SESSION_AGE_MAX` (see
+ * `docs/security.md` §Cookie Key Rotation).
  *
  * @param signed_value - the raw cookie value (may be undefined)
  * @param keyring - key ring for verification and signing

package/dist/auth/session_cookie.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session_cookie.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_cookie.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C,mFAAmF;AACnF,eAAO,MAAM,eAAe,QAAoB,CAAC;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,QAAe,CAAC;AAQxD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,oBAMpC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,WAAW,cAAc,CAAC,SAAS;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,cAAc,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/D,iFAAiF;IACjF,eAAe,EAAE,CAAC,QAAQ,EAAE,SAAS,KAAK,MAAM,CAAC;IACjD,mEAAmE;IACnE,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,GAAG,IAAI,CAAC;CACvD;AAED;;GAEG;AACH,MAAM,WAAW,aAAa,CAAC,SAAS;IACvC,4BAA4B;IAC5B,QAAQ,EAAE,SAAS,CAAC;IACpB,kEAAkE;IAClE,wBAAwB,EAAE,OAAO,CAAC;IAClC;;;;;;OAMG;IACH,yBAAyB,EAAE,OAAO,CAAC;IACnC,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,aAAa,GAAU,SAAS,EAC5C,cAAc,MAAM,GAAG,SAAS,EAChC,SAAS,OAAO,EAChB,SAAS,cAAc,CAAC,SAAS,CAAC,EAClC,cAAc,MAAM,KAClB,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,IAAI,GAAG,SAAS,CAoCrD,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B,GAAU,SAAS,EAC1D,SAAS,OAAO,EAChB,UAAU,SAAS,EACnB,SAAS,cAAc,CAAC,SAAS,CAAC,EAClC,cAAc,MAAM,KAClB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAoB,CAAC,SAAS;IAC9C,oCAAoC;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,sCAAsC;IACtC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IACrC,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,EAAE,SAAS,CAAC;CACrB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,GAAI,aAAa,MAAM,KAAG,cAAc,CAAC,MAAM,CAK/E,CAAC;AAEH,iDAAiD;AACjD,eAAO,MAAM,kBAAkB,EAAE,cAAc,CAAC,MAAM,CAAwC,CAAC;AAE/F;;;;;;;;;;;;GAYG;AAEH,eAAO,MAAM,sBAAsB,GAAU,SAAS,EACrD,cAAc,MAAM,GAAG,SAAS,EAChC,SAAS,OAAO,EAChB,SAAS,cAAc,CAAC,SAAS,CAAC,EAClC,cAAc,MAAM,KAClB,OAAO,CAAC,oBAAoB,CAAC,SAAS,CAAC,CA8BzC,CAAC"}
+{"version":3,"file":"session_cookie.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_cookie.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,QAAoB,CAAC;AAQjD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,oBAMpC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,WAAW,cAAc,CAAC,SAAS;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/D,iFAAiF;IACjF,eAAe,EAAE,CAAC,QAAQ,EAAE,SAAS,KAAK,MAAM,CAAC;IACjD,mEAAmE;IACnE,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,GAAG,IAAI,CAAC;CACvD;AAED;;GAEG;AACH,MAAM,WAAW,aAAa,CAAC,SAAS;IACvC,4BAA4B;IAC5B,QAAQ,EAAE,SAAS,CAAC;IACpB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,aAAa,GAAU,SAAS,EAC5C,cAAc,MAAM,GAAG,SAAS,EAChC,SAAS,OAAO,EAChB,SAAS,cAAc,CAAC,SAAS,CAAC,EAClC,cAAc,MAAM,KAClB,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,IAAI,GAAG,SAAS,CA+BrD,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B,GAAU,SAAS,EAC1D,SAAS,OAAO,EAChB,UAAU,SAAS,EACnB,SAAS,cAAc,CAAC,SAAS,CAAC,EAClC,cAAc,MAAM,KAClB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAoB,CAAC,SAAS;IAC9C,oCAAoC;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,sCAAsC;IACtC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,SAAS,CAAC;CACrB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,GAAI,aAAa,MAAM,KAAG,cAAc,CAAC,MAAM,CAK/E,CAAC;AAEH,iDAAiD;AACjD,eAAO,MAAM,kBAAkB,EAAE,cAAc,CAAC,MAAM,CAAwC,CAAC;AAE/F;;;;;;;;;;;;;;;;;GAiBG;AAEH,eAAO,MAAM,sBAAsB,GAAU,SAAS,EACrD,cAAc,MAAM,GAAG,SAAS,EAChC,SAAS,OAAO,EAChB,SAAS,cAAc,CAAC,SAAS,CAAC,EAClC,cAAc,MAAM,KAClB,OAAO,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAgBzC,CAAC"}

package/dist/auth/session_cookie.js

@@ -9,16 +9,15 @@
  *
  * @module
  */
-/** Cookie max age in seconds (30 days — aligned with AUTH_SESSION_LIFETIME_MS). */
-export const SESSION_AGE_MAX = 60 * 60 * 24 * 30;
 /**
- * Threshold (seconds) at which `process_session_cookie` re-signs a still-valid
- * cookie to extend its embedded expiration. Mirrors the DB-side
- * `AUTH_SESSION_EXTEND_THRESHOLD_MS` so a continuously-active user's cookie
- * stays in sync with their server-side session lifetime. Set
- * `SessionOptions.refresh_threshold_seconds = 0` to disable.
+ * Cookie max age in seconds (30 days — aligned with AUTH_SESSION_LIFETIME_MS).
+ *
+ * This is an **absolute** session lifetime: the cookie is signed once at
+ * mint (`expires_at = mint + max_age`) and never re-signed, matching the DB
+ * row's fixed `expires_at`. There is deliberately no sliding renewal on
+ * either leg — see `docs/security.md` §Session Security.
  */
-export const SESSION_REFRESH_THRESHOLD_S = 60 * 60 * 24;
+export const SESSION_AGE_MAX = 60 * 60 * 24 * 30;
 /** Separator between identity payload and expires_at in signed value. */
 const VALUE_SEPARATOR = ':';
 /** Strict integer matcher for the embedded `expires_at` field. */
@@ -42,9 +41,7 @@ export const session_cookie_options = {
  * Parse a signed session cookie value.
  *
  * The signed value format is `${encode(identity)}:${expires_at}`.
- * Tries all keys in order to support key rotation. The result's
- * `should_refresh_expiration` flag fires when the cookie is within
- * `options.refresh_threshold_seconds` of `expires_at`.
+ * Tries all keys in order to support key rotation.
  *
  * @param signed_value - the raw cookie value (signed)
  * @param keyring - key ring for verification
@@ -79,12 +76,8 @@ export const parse_session = async (signed_value, keyring, options, now_seconds)
     const now = now_seconds ?? Math.floor(Date.now() / 1000);
     if (expires_at <= now)
         return null;
-    const refresh_threshold = options.refresh_threshold_seconds ?? SESSION_REFRESH_THRESHOLD_S;
-    const should_refresh_expiration = refresh_threshold > 0 && expires_at - now <= refresh_threshold;
     return {
         identity,
-        should_refresh_signature: result.key_index > 0,
-        should_refresh_expiration,
         key_index: result.key_index
     };
 };
@@ -128,9 +121,14 @@ export const fuz_session_config = create_session_config('fuz_session');
 /**
  * Process a session cookie and determine what action to take.
  *
- * `action: 'refresh'` fires on key rotation **or** impending expiration
- * (within `options.refresh_threshold_seconds`); both produce a freshly-signed
- * `new_signed_value`.
+ * There is deliberately no refresh action: any re-sign computes a fresh
+ * `now + max_age` expiry, extending the cookie past the DB row's fixed
+ * `expires_at` — the holder would go silently anonymous while carrying a
+ * self-perpetuating cookie. The absolute lifetime is one signing at mint,
+ * on both legs, matching the Rust spine. A cookie signed by a retired
+ * (non-primary) key keeps verifying until the key leaves the keyring;
+ * retired keys are safe to drop after `SESSION_AGE_MAX` (see
+ * `docs/security.md` §Cookie Key Rotation).
  *
  * @param signed_value - the raw cookie value (may be undefined)
  * @param keyring - key ring for verification and signing
@@ -149,13 +147,5 @@ export const process_session_cookie = async (signed_value, keyring, options, now
         // Invalid cookie - should be cleared
         return { valid: false, action: 'clear' };
     }
-    // Valid session — re-sign if the verifying key isn't primary OR if the
-    // embedded expiration is approaching the threshold. The latter mirrors
-    // `query_session_touch`'s DB-side extension so a continuously-active user's
-    // cookie doesn't hard-expire while their server session is still alive.
-    if (parsed.should_refresh_signature || parsed.should_refresh_expiration) {
-        const new_signed_value = await create_session_cookie_value(keyring, parsed.identity, options, now);
-        return { valid: true, action: 'refresh', new_signed_value, identity: parsed.identity };
-    }
     return { valid: true, action: 'none', identity: parsed.identity };
 };