@fuzdev/fuz_app 0.108.0 → 0.110.0

package/dist/auth/session_middleware.d.ts

@@ -35,7 +35,7 @@ export declare const clear_session_cookie: <T>(c: Context, options: SessionOptio
  *
  * @param keyring - key ring for cookie verification
  * @param options - session configuration
- * @mutates Hono context - sets `options.context_key` and may refresh or clear the session cookie
+ * @mutates Hono context - sets `options.context_key` and may clear the session cookie
  */
 export declare const create_session_middleware: <TIdentity>(keyring: Keyring, options: SessionOptions<TIdentity>) => MiddlewareHandler;
 /**

package/dist/auth/session_middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session_middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAGvD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACN,KAAK,cAAc,EAKnB,MAAM,qBAAqB,CAAC;AAQ7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD;;GAEG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,EACnC,GAAG,OAAO,EACV,SAAS,cAAc,CAAC,CAAC,CAAC,KACxB,MAAM,GAAG,SAEX,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,EACnC,GAAG,OAAO,EACV,OAAO,MAAM,EACb,SAAS,cAAc,CAAC,CAAC,CAAC,KACxB,IAOF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,cAAc,CAAC,CAAC,CAAC,KAAG,IAMhF,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,EAClD,SAAS,OAAO,EAChB,SAAS,cAAc,CAAC,SAAS,CAAC,KAChC,iBAgBF,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAChD,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,IAAI,EAAE,SAAS,CAAC;IAChB,2CAA2C;IAC3C,CAAC,EAAE,OAAO,CAAC;IACX,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,gCAAgC,KACvC,OAAO,CAAC,IAAI,CAad,CAAC"}
+{"version":3,"file":"session_middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAGvD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACN,KAAK,cAAc,EAKnB,MAAM,qBAAqB,CAAC;AAQ7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD;;GAEG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,EACnC,GAAG,OAAO,EACV,SAAS,cAAc,CAAC,CAAC,CAAC,KACxB,MAAM,GAAG,SAEX,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,EACnC,GAAG,OAAO,EACV,OAAO,MAAM,EACb,SAAS,cAAc,CAAC,CAAC,CAAC,KACxB,IAOF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,cAAc,CAAC,CAAC,CAAC,KAAG,IAMhF,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,EAClD,SAAS,OAAO,EAChB,SAAS,cAAc,CAAC,SAAS,CAAC,KAChC,iBAcF,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAChD,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,IAAI,EAAE,SAAS,CAAC;IAChB,2CAA2C;IAC3C,CAAC,EAAE,OAAO,CAAC;IACX,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,gCAAgC,KACvC,OAAO,CAAC,IAAI,CAad,CAAC"}

package/dist/auth/session_middleware.js

@@ -49,7 +49,7 @@ export const clear_session_cookie = (c, options) => {
  *
  * @param keyring - key ring for cookie verification
  * @param options - session configuration
- * @mutates Hono context - sets `options.context_key` and may refresh or clear the session cookie
+ * @mutates Hono context - sets `options.context_key` and may clear the session cookie
  */
 export const create_session_middleware = (keyring, options) => {
     return async (c, next) => {
@@ -60,9 +60,6 @@ export const create_session_middleware = (keyring, options) => {
         if (result.action === 'clear') {
             clear_session_cookie(c, options);
         }
-        else if (result.action === 'refresh' && result.new_signed_value) {
-            set_session_cookie(c, result.new_signed_value, options);
-        }
         await next();
     };
 };

package/dist/auth/session_queries.d.ts

@@ -6,13 +6,17 @@
  *
  * @module
  */
-import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import type { QueryDeps } from '../db/query_deps.js';
 import type { AuthSession, SessionId } from './account_schema.js';
-/** Session lifetime in milliseconds (30 days). */
+/**
+ * Session lifetime in milliseconds (30 days).
+ *
+ * An **absolute** cap: `expires_at` is set once at mint and never extended —
+ * there is deliberately no touch/renewal query on either spine (a sliding
+ * window renews a leaked cookie forever; see `docs/security.md` §Session
+ * Security). The cookie's `SESSION_AGE_MAX` mirrors this value.
+ */
 export declare const AUTH_SESSION_LIFETIME_MS: number;
-/** Extend session when it has less than this remaining (1 day in ms). */
-export declare const AUTH_SESSION_EXTEND_THRESHOLD_MS: number;
 /**
  * Hash a session token to its storage key using blake3.
  *
@@ -46,16 +50,6 @@ export declare const query_create_session: (deps: QueryDeps, token_hash: string,
  * @param token_hash - blake3 hash of the session token
  */
 export declare const query_session_get_valid: (deps: QueryDeps, token_hash: string) => Promise<AuthSession | undefined>;
-/**
- * Update `last_seen_at` and optionally extend expiry for a session.
- *
- * Extends if less than `AUTH_SESSION_EXTEND_THRESHOLD_MS` remaining.
- *
- * @param deps - query dependencies
- * @param token_hash - blake3 hash of the session token
- * @mutates `auth_session` row - updates `last_seen_at` and conditionally `expires_at`
- */
-export declare const query_session_touch: (deps: QueryDeps, token_hash: string) => Promise<void>;
 /**
  * Revoke (delete) a session by its token hash, with no account scoping.
  *
@@ -137,9 +131,14 @@ export declare const query_session_enforce_limit: (deps: QueryDeps, account_id:
 /**
  * List all active sessions across all accounts with usernames.
  *
+ * Ordered by `created_at DESC` (newest session first), matching the
+ * per-account listing. `last_seen_at` is still selected for the wire shape
+ * but is decorative — nothing updates it post-mint (it always equals
+ * `created_at`); it is slated for removal on its own twin migration.
+ *
  * @param deps - query dependencies
  * @param limit - maximum entries to return
- * @returns active sessions joined with account usernames, newest activity first
+ * @returns active sessions joined with account usernames, newest first
  */
 export declare const query_session_list_all_active: (deps: QueryDeps, limit?: number) => Promise<Array<AuthSession & {
     username: string;
@@ -151,19 +150,4 @@ export declare const query_session_list_all_active: (deps: QueryDeps, limit?: nu
  * @mutates `auth_session` table - deletes every row past `expires_at`
  */
 export declare const query_session_cleanup_expired: (deps: QueryDeps) => Promise<number>;
-/**
- * Touch a session without blocking the caller.
- *
- * Errors are logged to console — session touching never breaks request flows.
- * Pass `pending_effects` (from `c.var.pending_effects`) to register
- * the promise for test flushing.
- *
- * @param deps - query dependencies
- * @param token_hash - blake3 hash of the session token
- * @param pending_effects - optional array to register the effect for later awaiting
- * @param log - the logger instance
- * @returns the settled promise (callers may ignore it — fire-and-forget semantics preserved)
- * @mutates `pending_effects` - pushes the in-flight settled promise when provided
- */
-export declare const session_touch_fire_and_forget: (deps: QueryDeps, token_hash: string, pending_effects: Array<Promise<void>> | undefined, log: Logger) => Promise<void>;
 //# sourceMappingURL=session_queries.d.ts.map

package/dist/auth/session_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAElE,kDAAkD;AAClD,eAAO,MAAM,wBAAwB,QAA2B,CAAC;AAEjE,yEAAyE;AACzE,eAAO,MAAM,gCAAgC,QAAsB,CAAC;AAEpE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,KAAG,SAElD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAAO,MAEzC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,EAClB,YAAY,IAAI,KACd,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,WAAW,GAAG,SAAS,CAKjC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAU,MAAM,SAAS,EAAE,YAAY,MAAM,KAAG,OAAO,CAAC,IAAI,CAY3F,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,IAAI,CAEd,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,KAChB,OAAO,CAAC,OAAO,CAMjB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAU,KACR,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAK5B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,2BAA2B,GACvC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAc,MAAM,KAClB,OAAO,CAAC,MAAM,CAYhB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,cAAW,KACT,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CASnD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,MAAM,CAKnF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,iBAAiB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACjD,KAAK,MAAM,KACT,OAAO,CAAC,IAAI,CAMd,CAAC"}
+{"version":3,"file":"session_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAA2B,CAAC;AAEjE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,KAAG,SAElD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAAO,MAEzC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,EAClB,YAAY,IAAI,KACd,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,WAAW,GAAG,SAAS,CAKjC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,IAAI,CAEd,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,KAChB,OAAO,CAAC,OAAO,CAMjB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAU,KACR,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAK5B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,2BAA2B,GACvC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAc,MAAM,KAClB,OAAO,CAAC,MAAM,CAYhB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,cAAW,KACT,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CASnD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,MAAM,CAKnF,CAAC"}

package/dist/auth/session_queries.js

@@ -8,10 +8,15 @@
  */
 import { hash_blake3 } from '@fuzdev/fuz_util/hash_blake3.ts';
 import { generate_random_base64url } from '../crypto.js';
-/** Session lifetime in milliseconds (30 days). */
+/**
+ * Session lifetime in milliseconds (30 days).
+ *
+ * An **absolute** cap: `expires_at` is set once at mint and never extended —
+ * there is deliberately no touch/renewal query on either spine (a sliding
+ * window renews a leaked cookie forever; see `docs/security.md` §Session
+ * Security). The cookie's `SESSION_AGE_MAX` mirrors this value.
+ */
 export const AUTH_SESSION_LIFETIME_MS = 30 * 24 * 60 * 60 * 1000;
-/** Extend session when it has less than this remaining (1 day in ms). */
-export const AUTH_SESSION_EXTEND_THRESHOLD_MS = 24 * 60 * 60 * 1000;
 /**
  * Hash a session token to its storage key using blake3.
  *
@@ -57,25 +62,6 @@ export const query_create_session = async (deps, token_hash, account_id, expires
 export const query_session_get_valid = async (deps, token_hash) => {
     return deps.db.query_one(`SELECT * FROM auth_session WHERE id = $1 AND expires_at > NOW()`, [token_hash]);
 };
-/**
- * Update `last_seen_at` and optionally extend expiry for a session.
- *
- * Extends if less than `AUTH_SESSION_EXTEND_THRESHOLD_MS` remaining.
- *
- * @param deps - query dependencies
- * @param token_hash - blake3 hash of the session token
- * @mutates `auth_session` row - updates `last_seen_at` and conditionally `expires_at`
- */
-export const query_session_touch = async (deps, token_hash) => {
-    const new_expires = new Date(Date.now() + AUTH_SESSION_LIFETIME_MS);
-    await deps.db.query(`UPDATE auth_session
-		 SET last_seen_at = NOW(),
-		     expires_at = CASE
-		       WHEN expires_at - NOW() < INTERVAL '1 day' THEN $2::timestamptz
-		       ELSE expires_at
-		     END
-		 WHERE id = $1`, [token_hash, new_expires.toISOString()]);
-};
 /**
  * Revoke (delete) a session by its token hash, with no account scoping.
  *
@@ -176,16 +162,21 @@ export const query_session_enforce_limit = async (deps, account_id, max_sessions
 /**
  * List all active sessions across all accounts with usernames.
  *
+ * Ordered by `created_at DESC` (newest session first), matching the
+ * per-account listing. `last_seen_at` is still selected for the wire shape
+ * but is decorative — nothing updates it post-mint (it always equals
+ * `created_at`); it is slated for removal on its own twin migration.
+ *
  * @param deps - query dependencies
  * @param limit - maximum entries to return
- * @returns active sessions joined with account usernames, newest activity first
+ * @returns active sessions joined with account usernames, newest first
  */
 export const query_session_list_all_active = async (deps, limit = 200) => {
     return deps.db.query(`SELECT s.id, s.account_id, s.created_at, s.expires_at, s.last_seen_at, a.username
 		 FROM auth_session s
 		 JOIN account a ON a.id = s.account_id
 		 WHERE s.expires_at > NOW()
-		 ORDER BY s.last_seen_at DESC LIMIT $1`, [limit]);
+		 ORDER BY s.created_at DESC, s.id DESC LIMIT $1`, [limit]);
 };
 /**
  * Delete expired sessions.
@@ -197,24 +188,3 @@ export const query_session_cleanup_expired = async (deps) => {
     const rows = await deps.db.query(`DELETE FROM auth_session WHERE expires_at <= NOW() RETURNING id`);
     return rows.length;
 };
-/**
- * Touch a session without blocking the caller.
- *
- * Errors are logged to console — session touching never breaks request flows.
- * Pass `pending_effects` (from `c.var.pending_effects`) to register
- * the promise for test flushing.
- *
- * @param deps - query dependencies
- * @param token_hash - blake3 hash of the session token
- * @param pending_effects - optional array to register the effect for later awaiting
- * @param log - the logger instance
- * @returns the settled promise (callers may ignore it — fire-and-forget semantics preserved)
- * @mutates `pending_effects` - pushes the in-flight settled promise when provided
- */
-export const session_touch_fire_and_forget = (deps, token_hash, pending_effects, log) => {
-    const p = query_session_touch(deps, token_hash).catch((err) => {
-        log.error('Session touch failed:', err);
-    });
-    pending_effects?.push(p);
-    return p;
-};

package/dist/auth/token_lifetime.d.ts

@@ -0,0 +1,51 @@
+/**
+ * API token lifetime — the temporal axis of a minted credential.
+ *
+ * `lifetime` is **required** on `account_token_create`, mirroring `scope`:
+ * there is deliberately no default. A caller who wants a never-expiring token
+ * spells `{kind: 'eternal'}`, and the request records that they did — an
+ * omitted lifetime is a validation error upstream, not an eternal token.
+ * `expires_at IS NULL` therefore means "deliberately eternal", never "minted
+ * before the policy existed".
+ *
+ * Lifetime is deliberately **not** part of the scope document — `TokenScope`
+ * is strict on both spines and sits on the hot resolve path. The expiry lives
+ * in the indexed `api_token.expires_at` column where the SQL validation gate
+ * already enforces it (`expires_at IS NULL OR expires_at > NOW()`).
+ *
+ * A framework-level ceiling (`max_token_ttl_days`) is deferred until `fuzf`
+ * has an expiry story (an expiry-aware read + a 401 hint); see
+ * `docs/security.md` §API tokens.
+ *
+ * @module
+ */
+import { z } from 'zod';
+/**
+ * Upper bound on `ttl.days` — a sanity cap (100 years), not a policy ceiling.
+ * Shared with the Rust twin so out-of-range requests 400 identically on both
+ * spines.
+ */
+export declare const TOKEN_TTL_DAYS_MAX = 36500;
+/**
+ * Caller-provided lifetime for `account_token_create`.
+ *
+ * `eternal` mints a never-expiring token (`expires_at` NULL); `ttl` bounds it
+ * to `days` from mint time. `eternal` is deliberately the first variant so
+ * schema-driven test generators produce it by default.
+ */
+export declare const TokenLifetimeInput: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"eternal">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"ttl">;
+    days: z.ZodNumber;
+}, z.core.$strict>], "kind">;
+export type TokenLifetimeInput = z.infer<typeof TokenLifetimeInput>;
+/**
+ * Resolve a lifetime input to the `expires_at` value the mint query stores.
+ *
+ * @param lifetime - the validated lifetime input
+ * @param now - mint time (injectable for tests; defaults to the current time)
+ * @returns the expiry `Date`, or `null` for an eternal token
+ */
+export declare const token_lifetime_to_expires_at: (lifetime: TokenLifetimeInput, now?: Date) => Date | null;
+//# sourceMappingURL=token_lifetime.d.ts.map

package/dist/auth/token_lifetime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token_lifetime.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/token_lifetime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,QAAS,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB;;;;;4BAM7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAU,kBAAkB,EAC5B,MAAK,IAAiB,KACpB,IAAI,GAAG,IAGT,CAAC"}

package/dist/auth/token_lifetime.js

@@ -0,0 +1,54 @@
+/**
+ * API token lifetime — the temporal axis of a minted credential.
+ *
+ * `lifetime` is **required** on `account_token_create`, mirroring `scope`:
+ * there is deliberately no default. A caller who wants a never-expiring token
+ * spells `{kind: 'eternal'}`, and the request records that they did — an
+ * omitted lifetime is a validation error upstream, not an eternal token.
+ * `expires_at IS NULL` therefore means "deliberately eternal", never "minted
+ * before the policy existed".
+ *
+ * Lifetime is deliberately **not** part of the scope document — `TokenScope`
+ * is strict on both spines and sits on the hot resolve path. The expiry lives
+ * in the indexed `api_token.expires_at` column where the SQL validation gate
+ * already enforces it (`expires_at IS NULL OR expires_at > NOW()`).
+ *
+ * A framework-level ceiling (`max_token_ttl_days`) is deferred until `fuzf`
+ * has an expiry story (an expiry-aware read + a 401 hint); see
+ * `docs/security.md` §API tokens.
+ *
+ * @module
+ */
+import { z } from 'zod';
+/**
+ * Upper bound on `ttl.days` — a sanity cap (100 years), not a policy ceiling.
+ * Shared with the Rust twin so out-of-range requests 400 identically on both
+ * spines.
+ */
+export const TOKEN_TTL_DAYS_MAX = 36_500;
+/**
+ * Caller-provided lifetime for `account_token_create`.
+ *
+ * `eternal` mints a never-expiring token (`expires_at` NULL); `ttl` bounds it
+ * to `days` from mint time. `eternal` is deliberately the first variant so
+ * schema-driven test generators produce it by default.
+ */
+export const TokenLifetimeInput = z.discriminatedUnion('kind', [
+    z.strictObject({ kind: z.literal('eternal') }),
+    z.strictObject({
+        kind: z.literal('ttl'),
+        days: z.number().int().min(1).max(TOKEN_TTL_DAYS_MAX)
+    })
+]);
+/**
+ * Resolve a lifetime input to the `expires_at` value the mint query stores.
+ *
+ * @param lifetime - the validated lifetime input
+ * @param now - mint time (injectable for tests; defaults to the current time)
+ * @returns the expiry `Date`, or `null` for an eternal token
+ */
+export const token_lifetime_to_expires_at = (lifetime, now = new Date()) => {
+    if (lifetime.kind === 'eternal')
+        return null;
+    return new Date(now.getTime() + lifetime.days * 86_400_000);
+};

package/dist/db/CLAUDE.md

@@ -25,7 +25,7 @@ the code.
   `baseline`), `Migration` / `MigrationNamespace` / `MigrationError`.
 - `query_deps.ts` — `QueryDeps = {db}`, the first param to every `query_*`.
 - `assert_row.ts` — `assert_row(row, context)` for INSERT … RETURNING.
-- `pg_error.ts` — `is_pg_unique_violation` (Postgres `23505`).
+- `pg_error.ts` — `pg_error_code` (SQLSTATE extractor for `pg`/PGlite errors), `is_pg_unique_violation` (Postgres `23505`).
 - `sql_identifier.ts` — `assert_valid_sql_identifier`.
 - `status.ts` — CLI DB status utility.
 - `schema_ready.ts` — `/ready` deploy-gate core: `query_public_columns`
@@ -95,7 +95,8 @@ child_id`, fractional-index keyed): `query_cell_item_insert` (throws
 - **`cell_audit_queries.ts`** — `query_audit_log_list_by_cell`: matches
   `audit_log` rows whose `metadata` names the cell on any of six cell-domain
   keys (`cell_id` / `source_id` / `new_id` / `parent_id` / `child_id` /
-  `target_id`), bitmap-OR over the metadata GIN.
+  `target_id`), bitmap-OR over `idx_audit_log_metadata` (the `jsonb_path_ops`
+  GIN the `audit_log_metadata_gin_index` auth migration ships).
 
 ## Fact layer
 
@@ -155,6 +156,9 @@ auth_migration_ns (built-in, fuz_auth)
 
 ### Pre-stable migration policy
 
-Pre-stable: when an introducing migration needs to change shape, **rewrite
-the original in place** rather than appending a follow-up — consumers
-re-bootstrap dev DBs on upgrade. See ../../../docs/migrations.md.
+Scoped to the namespaces on this page (`fuz_cell` / `fuz_cell_history` /
+`fuz_facts`): each is a single `full_*_schema` entry, so when it needs to
+change shape, **rewrite the original in place** rather than appending a
+follow-up — consumers re-bootstrap dev DBs on upgrade. The `fuz_auth`
+namespace is the opposite — frozen and append-only, since consumers hold
+deployed databases on it. See ../../../docs/migrations.md §Schema stability.

package/dist/db/cell_audit_queries.d.ts

@@ -5,8 +5,10 @@
  * `new_id` (clone), `source_id` / `target_id` (cell_field events),
  * `parent_id` / `child_id` (cell_item events).
  *
- * Each `metadata @> '{...}'::jsonb` clause hits the existing GIN on
- * `audit_log.metadata`; Postgres bitmap-ORs the index scans together.
+ * Each `metadata @> '{...}'::jsonb` clause hits `idx_audit_log_metadata`
+ * (the `jsonb_path_ops` GIN on `audit_log.metadata`, shipped by the
+ * `audit_log_metadata_gin_index` migration); Postgres bitmap-ORs the index
+ * scans together.
  *
  * @module
  */

package/dist/db/cell_audit_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_audit_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_audit_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAoBnD,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,SAAS,EACf,SAAS,IAAI,EACb,SAAS,oBAAoB,KAC3B,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAwB9B,CAAC"}
+{"version":3,"file":"cell_audit_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_audit_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAoBnD,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,SAAS,EACf,SAAS,IAAI,EACb,SAAS,oBAAoB,KAC3B,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAwB9B,CAAC"}

package/dist/db/cell_audit_queries.js

@@ -5,8 +5,10 @@
  * `new_id` (clone), `source_id` / `target_id` (cell_field events),
  * `parent_id` / `child_id` (cell_item events).
  *
- * Each `metadata @> '{...}'::jsonb` clause hits the existing GIN on
- * `audit_log.metadata`; Postgres bitmap-ORs the index scans together.
+ * Each `metadata @> '{...}'::jsonb` clause hits `idx_audit_log_metadata`
+ * (the `jsonb_path_ops` GIN on `audit_log.metadata`, shipped by the
+ * `audit_log_metadata_gin_index` migration); Postgres bitmap-ORs the index
+ * scans together.
  *
  * @module
  */

package/dist/db/pg_error.d.ts

@@ -6,6 +6,18 @@
  *
  * @module
  */
+/**
+ * Extract the error-code string from a caught error, for SQLSTATE checks.
+ *
+ * Other error families also carry string `code`s (Node FS errors:
+ * `ENOENT`, `ENOSPC`, …) — compare the result against specific SQLSTATE
+ * values, never against truthiness.
+ *
+ * @param error - the caught error
+ * @returns the `code` string, or `null` when the value isn't an `Error`
+ * or carries no string `code`
+ */
+export declare const pg_error_code: (error: unknown) => string | null;
 /**
  * Check if an error is a PostgreSQL unique constraint violation (error code 23505).
  *

package/dist/db/pg_error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pg_error.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/pg_error.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,GAAI,OAAO,OAAO,KAAG,OACmC,CAAC"}
+{"version":3,"file":"pg_error.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/pg_error.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,GAAI,OAAO,OAAO,KAAG,MAAM,GAAG,IAGhD,CAAC;AAET;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,GAAI,OAAO,OAAO,KAAG,OAA2C,CAAC"}

package/dist/db/pg_error.js

@@ -6,10 +6,24 @@
  *
  * @module
  */
+/**
+ * Extract the error-code string from a caught error, for SQLSTATE checks.
+ *
+ * Other error families also carry string `code`s (Node FS errors:
+ * `ENOENT`, `ENOSPC`, …) — compare the result against specific SQLSTATE
+ * values, never against truthiness.
+ *
+ * @param error - the caught error
+ * @returns the `code` string, or `null` when the value isn't an `Error`
+ * or carries no string `code`
+ */
+export const pg_error_code = (error) => error instanceof Error && 'code' in error && typeof error.code === 'string'
+    ? error.code
+    : null;
 /**
  * Check if an error is a PostgreSQL unique constraint violation (error code 23505).
  *
  * @param error - the caught error
  * @returns `true` if the error is a unique constraint violation
  */
-export const is_pg_unique_violation = (error) => error instanceof Error && 'code' in error && error.code === '23505';
+export const is_pg_unique_violation = (error) => pg_error_code(error) === '23505';

package/dist/dev/setup.d.ts

@@ -57,16 +57,12 @@ export interface SetupEnvOptions {
      * Replaces `^KEY=$` (empty value) patterns in the env file.
      */
     replacements?: Record<string, () => Promise<string>>;
-    /** Optional callback to set file permissions (e.g. `Deno.chmod`). */
-    set_permissions?: (path: string, mode: number) => Promise<void>;
     log?: SetupLogger;
 }
 /** Options for `setup_bootstrap_token`. */
 export interface SetupBootstrapTokenOptions {
     /** State directory override. Defaults to `~/.{app_name}`. */
     state_dir?: string;
-    /** Optional callback to set file/directory permissions. */
-    set_permissions?: (path: string, mode: number) => Promise<void>;
     log?: SetupLogger;
 }
 /** Options for `create_database`. */
@@ -119,9 +115,9 @@ export declare const read_env_var: (deps: Pick<FsReadDeps, "read_text_file">, en
  * @param deps - file read, write, and command capabilities
  * @param env_path - path for the env file (e.g. `.env.development`)
  * @param example_path - path to the example template
- * @param options - extra replacements, permissions, logger
+ * @param options - extra replacements, logger
  * @returns result indicating whether the file was created or updated
- * @mutates filesystem - writes `env_path` (creating from `example_path` if missing) and optionally chmods to `0o600`
+ * @mutates filesystem - writes `env_path` atomically at mode `0o600` (creating from `example_path` if missing)
  */
 export declare const setup_env_file: (deps: FsReadDeps & FsWriteDeps & CommandDeps, env_path: string, example_path: string, options?: SetupEnvOptions) => Promise<SetupEnvResult>;
 /**
@@ -132,9 +128,9 @@ export declare const setup_env_file: (deps: FsReadDeps & FsWriteDeps & CommandDe
  *
  * @param deps - file, command, and env capabilities
  * @param app_name - application name (used for default state directory)
- * @param options - state_dir override, permissions, logger
+ * @param options - state_dir override, logger
  * @returns result indicating whether a token was created
- * @mutates filesystem - creates state directory and writes the token file (optionally chmods to `0o700` / `0o600`)
+ * @mutates filesystem - creates the state directory (`0o700`) and writes the token file atomically at `0o600`
  */
 export declare const setup_bootstrap_token: (deps: FsReadDeps & FsWriteDeps & CommandDeps & EnvDeps, app_name: string, options?: SetupBootstrapTokenOptions) => Promise<SetupTokenResult>;
 /**
@@ -142,7 +138,7 @@ export declare const setup_bootstrap_token: (deps: FsReadDeps & FsWriteDeps & Co
  *
  * @param deps - file, command, env, and remove capabilities
  * @param app_name - application name
- * @param options - state_dir override, permissions, logger
+ * @param options - state_dir override, logger
  * @returns result from creating the new token
  * @mutates filesystem - removes the existing token file (if any) then writes a fresh one
  */

package/dist/dev/setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/dev/setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACX,WAAW,EACX,aAAa,EACb,OAAO,EACP,UAAU,EACV,YAAY,EACZ,WAAW,EACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AASrD;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1B,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,2CAA2C;AAC3C,eAAO,MAAM,oBAAoB,EAAE,WAIlC,CAAC;AAEF,kCAAkC;AAClC,MAAM,WAAW,cAAc;IAC9B,6DAA6D;IAC7D,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAC;IACjB,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;CACb;AAED,yCAAyC;AACzC,MAAM,WAAW,gBAAgB;IAChC,kEAAkE;IAClE,OAAO,EAAE,OAAO,CAAC;IACjB,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,kCAAkC;AAClC,MAAM,WAAW,aAAa;IAC7B,+CAA+C;IAC/C,KAAK,EAAE,OAAO,CAAC;IACf,wEAAwE;IACxE,OAAO,EAAE,OAAO,CAAC;IACjB,0CAA0C;IAC1C,OAAO,EAAE,UAAU,GAAG,QAAQ,GAAG,MAAM,CAAC;CACxC;AAED,oCAAoC;AACpC,MAAM,WAAW,eAAe;IAC/B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,qEAAqE;IACrE,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAED,2CAA2C;AAC3C,MAAM,WAAW,0BAA0B;IAC1C,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAED,qCAAqC;AACrC,MAAM,WAAW,qBAAqB;IACrC,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAED,oCAAoC;AACpC,MAAM,WAAW,oBAAoB;IACpC,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAID;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,IAQpD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAAU,MAAM,WAAW,KAAG,OAAO,CAAC,MAAM,CAI3E,CAAC;AAIF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,YAAY,GACxB,MAAM,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,EACxC,UAAU,MAAM,EAChB,MAAM,MAAM,KACV,OAAO,CAAC,MAAM,GAAG,SAAS,CAG5B,CAAC;AAIF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,UAAU,GAAG,WAAW,GAAG,WAAW,EAC5C,UAAU,MAAM,EAChB,cAAc,MAAM,EACpB,UAAU,eAAe,KACvB,OAAO,CAAC,cAAc,CAiDxB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,UAAU,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,EACtD,UAAU,MAAM,EAChB,UAAU,0BAA0B,KAClC,OAAO,CAAC,gBAAgB,CA0B1B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,UAAU,GAAG,WAAW,GAAG,YAAY,GAAG,WAAW,GAAG,OAAO,EACrE,UAAU,MAAM,EAChB,UAAU,0BAA0B,KAClC,OAAO,CAAC,gBAAgB,CAoB1B,CAAC;AAIF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,GAC3B,MAAM,WAAW,EACjB,SAAS,MAAM,EACf,UAAU,qBAAqB,KAC7B,OAAO,CAAC,aAAa,CAgBvB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,WAAW,GAAG,UAAU,GAAG,YAAY,EAC7C,cAAc,MAAM,EACpB,UAAU,oBAAoB,KAC5B,OAAO,CAAC,aAAa,CA8CvB,CAAC;AAIF,mCAAmC;AACnC,MAAM,WAAW,mBAAmB;IACnC,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9B;AAED,oCAAoC;AACpC,MAAM,WAAW,oBAAoB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,OAAO,EAAE,OAAO,CAAC;CACjB;AAED,2CAA2C;AAC3C,MAAM,WAAW,kBAAmB,SAAQ,SAAS;IACpD,oEAAoE;IACpE,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACrD;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,GAC5B,MAAM,kBAAkB,EACxB,OAAO,mBAAmB,EAC1B,UAAU;IAAE,GAAG,CAAC,EAAE,WAAW,CAAA;CAAE,KAC7B,OAAO,CAAC,oBAAoB,CAwC9B,CAAC"}
+{"version":3,"file":"setup.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/dev/setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACX,WAAW,EACX,aAAa,EACb,OAAO,EACP,UAAU,EACV,YAAY,EACZ,WAAW,EACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAUrD;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1B,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,2CAA2C;AAC3C,eAAO,MAAM,oBAAoB,EAAE,WAIlC,CAAC;AAEF,kCAAkC;AAClC,MAAM,WAAW,cAAc;IAC9B,6DAA6D;IAC7D,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAC;IACjB,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;CACb;AAED,yCAAyC;AACzC,MAAM,WAAW,gBAAgB;IAChC,kEAAkE;IAClE,OAAO,EAAE,OAAO,CAAC;IACjB,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,kCAAkC;AAClC,MAAM,WAAW,aAAa;IAC7B,+CAA+C;IAC/C,KAAK,EAAE,OAAO,CAAC;IACf,wEAAwE;IACxE,OAAO,EAAE,OAAO,CAAC;IACjB,0CAA0C;IAC1C,OAAO,EAAE,UAAU,GAAG,QAAQ,GAAG,MAAM,CAAC;CACxC;AAED,oCAAoC;AACpC,MAAM,WAAW,eAAe;IAC/B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAED,2CAA2C;AAC3C,MAAM,WAAW,0BAA0B;IAC1C,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAED,qCAAqC;AACrC,MAAM,WAAW,qBAAqB;IACrC,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAED,oCAAoC;AACpC,MAAM,WAAW,oBAAoB;IACpC,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,WAAW,CAAC;CAClB;AAID;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,IAQpD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAAU,MAAM,WAAW,KAAG,OAAO,CAAC,MAAM,CAI3E,CAAC;AAIF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,YAAY,GACxB,MAAM,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,EACxC,UAAU,MAAM,EAChB,MAAM,MAAM,KACV,OAAO,CAAC,MAAM,GAAG,SAAS,CAG5B,CAAC;AAIF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,UAAU,GAAG,WAAW,GAAG,WAAW,EAC5C,UAAU,MAAM,EAChB,cAAc,MAAM,EACpB,UAAU,eAAe,KACvB,OAAO,CAAC,cAAc,CAiDxB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,UAAU,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,EACtD,UAAU,MAAM,EAChB,UAAU,0BAA0B,KAClC,OAAO,CAAC,gBAAgB,CA2B1B,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,UAAU,GAAG,WAAW,GAAG,YAAY,GAAG,WAAW,GAAG,OAAO,EACrE,UAAU,MAAM,EAChB,UAAU,0BAA0B,KAClC,OAAO,CAAC,gBAAgB,CAmB1B,CAAC;AAIF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,GAC3B,MAAM,WAAW,EACjB,SAAS,MAAM,EACf,UAAU,qBAAqB,KAC7B,OAAO,CAAC,aAAa,CAgBvB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,WAAW,GAAG,UAAU,GAAG,YAAY,EAC7C,cAAc,MAAM,EACpB,UAAU,oBAAoB,KAC5B,OAAO,CAAC,aAAa,CA8CvB,CAAC;AAIF,mCAAmC;AACnC,MAAM,WAAW,mBAAmB;IACnC,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9B;AAED,oCAAoC;AACpC,MAAM,WAAW,oBAAoB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,OAAO,EAAE,OAAO,CAAC;CACjB;AAED,2CAA2C;AAC3C,MAAM,WAAW,kBAAmB,SAAQ,SAAS;IACpD,oEAAoE;IACpE,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACrD;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,GAC5B,MAAM,kBAAkB,EACxB,OAAO,mBAAmB,EAC1B,UAAU;IAAE,GAAG,CAAC,EAAE,WAAW,CAAA;CAAE,KAC7B,OAAO,CAAC,oBAAoB,CAwC9B,CAAC"}

package/dist/dev/setup.js

@@ -9,6 +9,7 @@
  * @module
  */
 import { load_env_file } from '../env/dotenv.js';
+import { write_file_atomic } from '../runtime/fs.js';
 import { query_account_by_username, query_actors_by_account, query_create_account_with_actor } from '../auth/account_queries.js';
 import { query_create_role_grant } from '../auth/role_grant_queries.js';
 /** Default logger using bracket format. */
@@ -77,13 +78,12 @@ export const read_env_var = async (deps, env_path, name) => {
  * @param deps - file read, write, and command capabilities
  * @param env_path - path for the env file (e.g. `.env.development`)
  * @param example_path - path to the example template
- * @param options - extra replacements, permissions, logger
+ * @param options - extra replacements, logger
  * @returns result indicating whether the file was created or updated
- * @mutates filesystem - writes `env_path` (creating from `example_path` if missing) and optionally chmods to `0o600`
+ * @mutates filesystem - writes `env_path` atomically at mode `0o600` (creating from `example_path` if missing)
  */
 export const setup_env_file = async (deps, env_path, example_path, options) => {
     const log = options?.log ?? default_setup_logger;
-    const set_permissions = options?.set_permissions;
     // build the full replacement map (SECRET_FUZ_COOKIE_KEYS + extras)
     const replacements = {
         SECRET_FUZ_COOKIE_KEYS: () => generate_random_key(deps),
@@ -104,9 +104,10 @@ export const setup_env_file = async (deps, env_path, example_path, options) => {
             }
         }
         if (changed) {
-            await deps.write_text_file(env_path, content);
-            if (set_permissions)
-                await set_permissions(env_path, 0o600);
+            // Atomic replace at 0600 — the backfill just wrote secrets into the
+            // file, so publishing a fresh owner-only inode also repairs a
+            // hand-made permissive .env in the same step the old chmod covered.
+            await write_file_atomic(deps, env_path, content, { mode: 0o600 });
         }
         else {
             log.skip(`${env_path} already configured`);
@@ -122,9 +123,7 @@ export const setup_env_file = async (deps, env_path, example_path, options) => {
             content = content.replace(pattern, `${key}=${value}`);
         }
     }
-    await deps.write_text_file(env_path, content);
-    if (set_permissions)
-        await set_permissions(env_path, 0o600);
+    await write_file_atomic(deps, env_path, content, { mode: 0o600 });
     log.ok(`Created ${env_path} with generated secrets`);
     return { created: true, updated: true, path: env_path };
 };
@@ -136,13 +135,12 @@ export const setup_env_file = async (deps, env_path, example_path, options) => {
  *
  * @param deps - file, command, and env capabilities
  * @param app_name - application name (used for default state directory)
- * @param options - state_dir override, permissions, logger
+ * @param options - state_dir override, logger
  * @returns result indicating whether a token was created
- * @mutates filesystem - creates state directory and writes the token file (optionally chmods to `0o700` / `0o600`)
+ * @mutates filesystem - creates the state directory (`0o700`) and writes the token file atomically at `0o600`
  */
 export const setup_bootstrap_token = async (deps, app_name, options) => {
     const log = options?.log ?? default_setup_logger;
-    const set_permissions = options?.set_permissions;
     const home = deps.env_get('HOME');
     if (!home) {
         log.skip('$HOME not set, skipping bootstrap token');
@@ -155,13 +153,13 @@ export const setup_bootstrap_token = async (deps, app_name, options) => {
         log.skip(`~/.${app_name}/secret_bootstrap_token already exists`);
         return { created: false, token_path };
     }
-    await deps.mkdir(state_dir, { recursive: true });
-    if (set_permissions)
-        await set_permissions(state_dir, 0o700);
+    // Modes apply at creation — an already-existing state dir keeps its mode.
+    // The token itself is always freshly created here (the stat above skipped
+    // existing files), so its 0600 holds unconditionally; the server-side
+    // `read_secure_file` refuses anything laxer at read time.
+    await deps.mkdir(state_dir, { recursive: true, mode: 0o700 });
     const key = await generate_random_key(deps);
-    await deps.write_text_file(token_path, key + '\n');
-    if (set_permissions)
-        await set_permissions(token_path, 0o600);
+    await write_file_atomic(deps, token_path, key + '\n', { mode: 0o600 });
     log.ok(`Created ~/.${app_name}/secret_bootstrap_token (one-shot, deleted after first use)`);
     return { created: true, token_path };
 };
@@ -170,13 +168,12 @@ export const setup_bootstrap_token = async (deps, app_name, options) => {
  *
  * @param deps - file, command, env, and remove capabilities
  * @param app_name - application name
- * @param options - state_dir override, permissions, logger
+ * @param options - state_dir override, logger
  * @returns result from creating the new token
  * @mutates filesystem - removes the existing token file (if any) then writes a fresh one
  */
 export const reset_bootstrap_token = async (deps, app_name, options) => {
     const log = options?.log ?? default_setup_logger;
-    const set_permissions = options?.set_permissions;
     const home = deps.env_get('HOME');
     if (!home) {
         log.skip('$HOME not set');
@@ -189,7 +186,7 @@ export const reset_bootstrap_token = async (deps, app_name, options) => {
         await deps.remove(token_path);
         log.ok('Removed existing bootstrap token');
     }
-    return setup_bootstrap_token(deps, app_name, { state_dir, set_permissions, log });
+    return setup_bootstrap_token(deps, app_name, { state_dir, log });
 };
 // === Database helpers ===
 /**