@fuzdev/fuz_app 0.108.0 → 0.110.0

package/dist/runtime/deps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deps.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;GAEG;AACH,MAAM,WAAW,UAAU;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IACjC,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,yCAAyC;IACzC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAC9C,mCAAmC;IACnC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACxC,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IAC1B,+DAA+D;IAC/D,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnD,8DAA8D;IAC9D,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,+DAA+D;IAC/D,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,qBAAqB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC3F,8FAA8F;IAC9F,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;CAClD;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,0BAA0B;IAC1B,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E,4BAA4B;IAC5B,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,6BAA6B;IAC7B,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,4BAA4B;IAC5B,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;;;;;;;;;;OAUG;IACH,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC5B;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;IACxE;;;;;OAKG;IACH,iBAAiB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrF;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B,kCAAkC;IAClC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B;;;;;;;OAOG;IACH,WAAW,EAAE,CACZ,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EACnB,OAAO,CAAC,EAAE,iBAAiB,KACvB,OAAO,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACzB,yDAAyD;IACzD,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,6BAA6B;IAC7B,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B,6BAA6B;IAC7B,YAAY,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,6CAA6C;IAC7C,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC3D;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,oCAAoC;IACpC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAChB,SACC,OAAO,EACP,UAAU,EACV,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,SAAS,EACT,YAAY,EACZ,WAAW,EACX,OAAO;IACR,qCAAqC;IACrC,OAAO,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC,qCAAqC;IACrC,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,qFAAqF;IACrF,mBAAmB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3E"}
+{"version":3,"file":"deps.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;GAEG;AACH,MAAM,WAAW,UAAU;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IACjC,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,yCAAyC;IACzC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAC9C,mCAAmC;IACnC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACxC,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAChC;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAChC;;;;;;;OAOG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IAC1B,+DAA+D;IAC/D,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnD,8DAA8D;IAC9D,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,+DAA+D;IAC/D,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,qBAAqB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC3F,8FAA8F;IAC9F,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;CAClD;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,sFAAsF;IACtF,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,6EAA6E;IAC7E,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9F,6BAA6B;IAC7B,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,4BAA4B;IAC5B,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;;;;;;;;;;OAUG;IACH,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC5B;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;IACxE;;;;;OAKG;IACH,iBAAiB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrF;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B,kCAAkC;IAClC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B;;;;;;;OAOG;IACH,WAAW,EAAE,CACZ,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EACnB,OAAO,CAAC,EAAE,iBAAiB,KACvB,OAAO,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACzB,yDAAyD;IACzD,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,6BAA6B;IAC7B,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B,6BAA6B;IAC7B,YAAY,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,6CAA6C;IAC7C,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC3D;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,oCAAoC;IACpC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAChB,SACC,OAAO,EACP,UAAU,EACV,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,SAAS,EACT,YAAY,EACZ,WAAW,EACX,OAAO;IACR,qCAAqC;IACrC,OAAO,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC,qCAAqC;IACrC,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,qFAAqF;IACrF,mBAAmB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3E"}

package/dist/runtime/fs.d.ts

@@ -3,15 +3,34 @@
  *
  * @module
  */
-import type { FsWriteDeps } from './deps.js';
+import type { FsRemoveDeps, FsWriteDeps } from './deps.js';
+/** Options for `write_file_atomic`. */
+export interface WriteFileAtomicOptions {
+    /**
+     * POSIX mode for the written file (e.g. `0o600` for secrets). Applied at
+     * temp-file creation, so the published file never exists with a laxer
+     * mode. Omitted = the runtime default (umask).
+     */
+    mode?: number;
+}
 /**
  * Write a file atomically via temp file + rename.
  *
- * Writes to `<path>.tmp` then renames over `path` so readers either see the
- * old contents or the full new contents — never a partial write.
+ * Writes to a unique `.{name}.tmp.{pid}.{counter}` sibling with exclusive
+ * create (`O_EXCL`), then renames over `path` so readers either see the old
+ * contents or the full new contents — never a partial write. The unique name
+ * + exclusive create are load-bearing for secret files: a fixed temp name
+ * would let a crash-leftover temp be reopened `O_TRUNC` with its old
+ * (possibly permissive) mode — `mode` only applies at creation — and the
+ * rename would publish that stale inode. Twin of the Rust spine's
+ * `fuz_sys::secure_file::write_secure_file` naming scheme.
  *
- * @mutates filesystem - creates `<path>.tmp` then renames it to `path`
+ * @param deps - write capabilities; pass `remove` too for best-effort temp cleanup on failure
+ * @param path - destination path
+ * @param content - full file content
+ * @param options - optional `mode` applied at creation
+ * @mutates filesystem - creates the unique temp file then renames it to `path`
  * @throws Error if `write_text_file` or `rename` rejects (permissions, disk full, cross-device rename, etc.)
  */
-export declare const write_file_atomic: (deps: Pick<FsWriteDeps, "write_text_file" | "rename">, path: string, content: string) => Promise<void>;
+export declare const write_file_atomic: (deps: Pick<FsWriteDeps, "write_text_file" | "rename"> & Partial<FsRemoveDeps>, path: string, content: string, options?: WriteFileAtomicOptions) => Promise<void>;
 //# sourceMappingURL=fs.d.ts.map

package/dist/runtime/fs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/fs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,IAAI,CAAC,WAAW,EAAE,iBAAiB,GAAG,QAAQ,CAAC,EACrD,MAAM,MAAM,EACZ,SAAS,MAAM,KACb,OAAO,CAAC,IAAI,CAId,CAAC"}
+{"version":3,"file":"fs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/fs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE3D,uCAAuC;AACvC,MAAM,WAAW,sBAAsB;IACtC;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAKD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,IAAI,CAAC,WAAW,EAAE,iBAAiB,GAAG,QAAQ,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,EAC7E,MAAM,MAAM,EACZ,SAAS,MAAM,EACf,UAAU,sBAAsB,KAC9B,OAAO,CAAC,IAAI,CAoBd,CAAC"}

package/dist/runtime/fs.js

@@ -3,17 +3,48 @@
  *
  * @module
  */
+import process from 'node:process';
+/** Per-process counter for unique temp names (concurrent same-path writes). */
+let temp_file_counter = 0;
 /**
  * Write a file atomically via temp file + rename.
  *
- * Writes to `<path>.tmp` then renames over `path` so readers either see the
- * old contents or the full new contents — never a partial write.
+ * Writes to a unique `.{name}.tmp.{pid}.{counter}` sibling with exclusive
+ * create (`O_EXCL`), then renames over `path` so readers either see the old
+ * contents or the full new contents — never a partial write. The unique name
+ * + exclusive create are load-bearing for secret files: a fixed temp name
+ * would let a crash-leftover temp be reopened `O_TRUNC` with its old
+ * (possibly permissive) mode — `mode` only applies at creation — and the
+ * rename would publish that stale inode. Twin of the Rust spine's
+ * `fuz_sys::secure_file::write_secure_file` naming scheme.
  *
- * @mutates filesystem - creates `<path>.tmp` then renames it to `path`
+ * @param deps - write capabilities; pass `remove` too for best-effort temp cleanup on failure
+ * @param path - destination path
+ * @param content - full file content
+ * @param options - optional `mode` applied at creation
+ * @mutates filesystem - creates the unique temp file then renames it to `path`
  * @throws Error if `write_text_file` or `rename` rejects (permissions, disk full, cross-device rename, etc.)
  */
-export const write_file_atomic = async (deps, path, content) => {
-    const temp_path = path + '.tmp';
-    await deps.write_text_file(temp_path, content);
-    await deps.rename(temp_path, path);
+export const write_file_atomic = async (deps, path, content, options) => {
+    const slash = path.lastIndexOf('/');
+    const dir = slash === -1 ? '' : path.slice(0, slash + 1);
+    const name = slash === -1 ? path : path.slice(slash + 1);
+    const temp_path = `${dir}.${name}.tmp.${process.pid}.${temp_file_counter++}`;
+    try {
+        await deps.write_text_file(temp_path, content, {
+            mode: options?.mode,
+            exclusive: true
+        });
+        await deps.rename(temp_path, path);
+    }
+    catch (err) {
+        // best-effort cleanup so a failed write doesn't strand the temp
+        try {
+            await deps.remove?.(temp_path);
+        }
+        catch {
+            // already gone or not removable — the original error wins
+        }
+        throw err;
+    }
 };

package/dist/runtime/mock.d.ts

@@ -18,6 +18,13 @@ export interface MockRuntime extends RuntimeDeps {
     mock_fs: Map<string, string>;
     /** Mock binary file system (path -> bytes). */
     mock_fs_bytes: Map<string, Uint8Array>;
+    /**
+     * Recorded POSIX modes (path -> mode), written by `write_text_file`'s
+     * `mode` option. A file with no recorded mode reads as `0o644` (the
+     * default-umask hazard) — so `read_secure_file` refuses it unless the
+     * writer asked for `0o600` explicitly, mirroring the real runtimes.
+     */
+    mock_fs_modes: Map<string, number>;
     /** Mock directories that exist. */
     mock_dirs: Set<string>;
     /** Exit calls recorded (exit codes). */

package/dist/runtime/mock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mock.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/mock.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAc,aAAa,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAI3F;;GAEG;AACH,MAAM,WAAW,WAAY,SAAQ,WAAW;IAC/C,kCAAkC;IAClC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,0CAA0C;IAC1C,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,+CAA+C;IAC/C,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACvC,mCAAmC;IACnC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACvB,wCAAwC;IACxC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1B,gGAAgG;IAChG,aAAa,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IACxF,sCAAsC;IACtC,qBAAqB,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;KAAE,CAAC,CAAC;IACnE,8BAA8B;IAC9B,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,4CAA4C;IAC5C,oBAAoB,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACjD,yCAAyC;IACzC,YAAY,EAAE,UAAU,GAAG,IAAI,CAAC;IAChC,4BAA4B;IAC5B,WAAW,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC;IAC1E,wDAAwD;IACxD,oBAAoB,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CAC5C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mBAAmB,GAAI,OAAM,KAAK,CAAC,MAAM,CAAM,KAAG,WAwR9D,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,WAAW,KAAG,IAazD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,SAAS,WAAW,EAAE,OAAO,MAAM,KAAG,IAEpE,CAAC;AAEF;;;;GAIG;AACH,qBAAa,aAAc,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,IAAI,EAAE,MAAM;CAKxB"}
+{"version":3,"file":"mock.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/mock.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAc,aAAa,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAK3F;;GAEG;AACH,MAAM,WAAW,WAAY,SAAQ,WAAW;IAC/C,kCAAkC;IAClC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,0CAA0C;IAC1C,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,+CAA+C;IAC/C,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACvC;;;;;OAKG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,mCAAmC;IACnC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACvB,wCAAwC;IACxC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1B,gGAAgG;IAChG,aAAa,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAAC,OAAO,CAAC,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IACxF,sCAAsC;IACtC,qBAAqB,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;KAAE,CAAC,CAAC;IACnE,8BAA8B;IAC9B,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,4CAA4C;IAC5C,oBAAoB,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACjD,yCAAyC;IACzC,YAAY,EAAE,UAAU,GAAG,IAAI,CAAC;IAChC,4BAA4B;IAC5B,WAAW,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC;IAC1E,wDAAwD;IACxD,oBAAoB,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CAC5C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mBAAmB,GAAI,OAAM,KAAK,CAAC,MAAM,CAAM,KAAG,WA8T9D,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,WAAW,KAAG,IAazD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,SAAS,WAAW,EAAE,OAAO,MAAM,KAAG,IAEpE,CAAC;AAEF;;;;GAIG;AACH,qBAAa,aAAc,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,IAAI,EAAE,MAAM;CAKxB"}

package/dist/runtime/mock.js

@@ -7,6 +7,7 @@
  *
  * @module
  */
+import { assert_secure_mode, assert_secure_size } from './secure_file.js';
 /**
  * Create a mock `RuntimeDeps` for testing.
  *
@@ -32,6 +33,7 @@ export const create_mock_runtime = (args = []) => {
     const mock_env = new Map();
     const mock_fs = new Map();
     const mock_fs_bytes = new Map();
+    const mock_fs_modes = new Map();
     const mock_dirs = new Set();
     const exit_calls = [];
     const command_calls = [];
@@ -46,6 +48,7 @@ export const create_mock_runtime = (args = []) => {
         mock_env,
         mock_fs,
         mock_fs_bytes,
+        mock_fs_modes,
         mock_dirs,
         exit_calls,
         command_calls,
@@ -122,6 +125,26 @@ export const create_mock_runtime = (args = []) => {
             error.code = 'ENOENT';
             throw error;
         },
+        read_secure_file: async (path) => {
+            let bytes = mock_fs_bytes.get(path);
+            if (bytes === undefined) {
+                const content = mock_fs.get(path);
+                if (content !== undefined)
+                    bytes = new TextEncoder().encode(content);
+            }
+            if (bytes === undefined) {
+                const error = new Error(`ENOENT: no such file or directory: ${path}`);
+                error.code = 'ENOENT';
+                throw error;
+            }
+            // A file written without an explicit mode reads as 0o644 — the
+            // default-umask hazard — so the secure read refuses it unless the
+            // writer asked for 0600, mirroring the real runtimes (simulated
+            // modes, so no platform gate).
+            assert_secure_mode(path, mock_fs_modes.get(path) ?? 0o644);
+            assert_secure_size(path, bytes.length);
+            return bytes;
+        },
         read_file_stream: async (path) => {
             let bytes = mock_fs_bytes.get(path);
             if (bytes === undefined) {
@@ -193,8 +216,15 @@ export const create_mock_runtime = (args = []) => {
             }
             return Array.from(seen).sort();
         },
-        write_text_file: async (path, content) => {
+        write_text_file: async (path, content, options) => {
+            if (options?.exclusive && (mock_fs.has(path) || mock_fs_bytes.has(path))) {
+                const error = new Error(`EEXIST: file already exists: ${path}`);
+                error.code = 'EEXIST';
+                throw error;
+            }
             mock_fs.set(path, content);
+            if (options?.mode !== undefined)
+                mock_fs_modes.set(path, options.mode);
         },
         write_file: async (path, data) => {
             mock_fs_bytes.set(path, data);
@@ -236,10 +266,20 @@ export const create_mock_runtime = (args = []) => {
                 mock_fs_bytes.set(new_path, bytes);
                 mock_fs_bytes.delete(old_path);
             }
+            // the inode's mode travels with the rename (POSIX semantics)
+            const mode = mock_fs_modes.get(old_path);
+            if (mode !== undefined) {
+                mock_fs_modes.set(new_path, mode);
+                mock_fs_modes.delete(old_path);
+            }
+            else {
+                mock_fs_modes.delete(new_path);
+            }
         },
         remove: async (path, options) => {
             mock_fs.delete(path);
             mock_fs_bytes.delete(path);
+            mock_fs_modes.delete(path);
             mock_dirs.delete(path);
             if (options?.recursive) {
                 const prefix = path.endsWith('/') ? path : path + '/';

package/dist/runtime/node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/node.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAWH,OAAO,KAAK,EAAE,WAAW,EAA6B,MAAM,WAAW,CAAC;AAExE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAC/B,OAAM,aAAa,CAAC,MAAM,CAAyB,KACjD,WAkMD,CAAC"}
+{"version":3,"file":"node.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/node.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAWH,OAAO,KAAK,EAAE,WAAW,EAA6B,MAAM,WAAW,CAAC;AAGxE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAC/B,OAAM,aAAa,CAAC,MAAM,CAAyB,KACjD,WAwMD,CAAC"}

package/dist/runtime/node.js

@@ -13,6 +13,7 @@ import { stat, mkdir, readFile, readdir, writeFile, rename, rm, open } from 'nod
 import process from 'node:process';
 import { Readable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
+import { load_secure_file_node } from './secure_file.js';
 /**
  * Create a `RuntimeDeps` backed by Node.js APIs.
  *
@@ -50,6 +51,7 @@ export const create_node_runtime = (args = process.argv.slice(2)) => ({
     },
     read_text_file: (path) => readFile(path, 'utf-8'),
     read_file: (path) => readFile(path).then((buf) => new Uint8Array(buf)),
+    read_secure_file: load_secure_file_node,
     // `Readable.toWeb` / `fromWeb` bridge Node streams to the web stream shape
     // the interface speaks. The casts cross Node's `stream/web` ReadableStream
     // and the global DOM `ReadableStream` (structurally identical here).
@@ -84,7 +86,11 @@ export const create_node_runtime = (args = process.argv.slice(2)) => ({
         }
     },
     readdir: (path) => readdir(path),
-    write_text_file: (path, content) => writeFile(path, content, 'utf-8'),
+    write_text_file: (path, content, options) => writeFile(path, content, {
+        encoding: 'utf-8',
+        mode: options?.mode,
+        flag: options?.exclusive ? 'wx' : 'w'
+    }),
     write_file: (path, data) => writeFile(path, data),
     rename: (old_path, new_path) => rename(old_path, new_path),
     fsync: async (path) => {

package/dist/runtime/secure_file.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Hardened secret-file read — the TS twin of the Rust spine's
+ * `fuz_sys::secure_file::load_secure_file`.
+ *
+ * The file this guards is typically the highest-value credential on the host
+ * (the bootstrap token mints the keeper account), so the read fails loud
+ * rather than degrading: a symlink, a group/other-accessible mode, or an
+ * oversized file is refused, never returned. The deploy recipe places the
+ * token at `0600`, so the check ratifies the shape zap produces; a
+ * hand-placed `0644` file fails at boot instead of being read.
+ *
+ * The Node implementation lives here (`load_secure_file_node`, wired as
+ * `create_node_runtime().read_secure_file`); the Deno runtime implements the
+ * same contract over `Deno.open` in `runtime/deno.ts`, and the mock honors
+ * the mode/size checks over its in-memory map. All three refuse through the
+ * shared `assert_secure_mode` / `assert_secure_size` / `read_secure_bounded`
+ * helpers so the checks — and their operator-facing messages — can't drift
+ * between runtimes.
+ *
+ * @module
+ */
+/**
+ * Maximum size for secure files. Prevents DoS from unexpectedly large files;
+ * 4 KiB is generous for token/key material. Matches the Rust twin's
+ * `MAX_SECURE_FILE_SIZE`.
+ */
+export declare const MAX_SECURE_FILE_SIZE = 4096;
+/**
+ * Refuse any group/other-accessible mode (only `0600`/`0400` pass).
+ *
+ * Callers own the platform gating: the real runtimes skip the check where
+ * modes aren't meaningful (Node on Windows, a `null` Deno mode); the mock
+ * checks its simulated modes unconditionally.
+ *
+ * @throws Error naming the path, the offending mode, and the `chmod` fix
+ */
+export declare const assert_secure_mode: (path: string, mode: number) => void;
+/**
+ * Refuse a byte count over `MAX_SECURE_FILE_SIZE`.
+ *
+ * @throws Error naming the path, the size, and the cap
+ */
+export declare const assert_secure_size: (path: string, size: number) => void;
+/**
+ * Drain `read_chunk` into a cap-bounded buffer.
+ *
+ * Reads up to cap + 1 bytes so a file growing between stat and read is still
+ * caught (the stat-time size check alone races). `read_chunk` fills the given
+ * target from the file's current position and returns the bytes read
+ * (`null`/`0` = EOF) — the seam that lets the Node and Deno handle APIs share
+ * one loop.
+ *
+ * @throws Error when more than `MAX_SECURE_FILE_SIZE` bytes arrive
+ */
+export declare const read_secure_bounded: (path: string, read_chunk: (target: Uint8Array) => Promise<number | null>) => Promise<Uint8Array>;
+/**
+ * Read a secret file with fail-loud checks (Node implementation).
+ *
+ * - `O_NOFOLLOW` atomically rejects symlinks during open (no TOCTOU window)
+ * - the permission check runs on the open descriptor, not the path, so the
+ *   file can't be swapped between check and read — any group/other access
+ *   (not `0600`/`0400`) is refused
+ * - a size cap bounds the read; the read itself is limited to cap + 1 so a
+ *   file growing between stat and read is still caught
+ *
+ * @param path - path to the secret file
+ * @returns the file's bytes
+ * @throws Error on a missing file, symlink, permissive mode, oversized file, or I/O failure
+ */
+export declare const load_secure_file_node: (path: string) => Promise<Uint8Array>;
+//# sourceMappingURL=secure_file.d.ts.map

package/dist/runtime/secure_file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure_file.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/secure_file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAMH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAUzC;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG,IAM/D,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG,IAI/D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,MAAM,EACZ,YAAY,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,KACxD,OAAO,CAAC,UAAU,CAUpB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,GAAU,MAAM,MAAM,KAAG,OAAO,CAAC,UAAU,CAuB5E,CAAC"}

package/dist/runtime/secure_file.js

@@ -0,0 +1,125 @@
+/**
+ * Hardened secret-file read — the TS twin of the Rust spine's
+ * `fuz_sys::secure_file::load_secure_file`.
+ *
+ * The file this guards is typically the highest-value credential on the host
+ * (the bootstrap token mints the keeper account), so the read fails loud
+ * rather than degrading: a symlink, a group/other-accessible mode, or an
+ * oversized file is refused, never returned. The deploy recipe places the
+ * token at `0600`, so the check ratifies the shape zap produces; a
+ * hand-placed `0644` file fails at boot instead of being read.
+ *
+ * The Node implementation lives here (`load_secure_file_node`, wired as
+ * `create_node_runtime().read_secure_file`); the Deno runtime implements the
+ * same contract over `Deno.open` in `runtime/deno.ts`, and the mock honors
+ * the mode/size checks over its in-memory map. All three refuse through the
+ * shared `assert_secure_mode` / `assert_secure_size` / `read_secure_bounded`
+ * helpers so the checks — and their operator-facing messages — can't drift
+ * between runtimes.
+ *
+ * @module
+ */
+import { constants } from 'node:fs';
+import { open } from 'node:fs/promises';
+import process from 'node:process';
+/**
+ * Maximum size for secure files. Prevents DoS from unexpectedly large files;
+ * 4 KiB is generous for token/key material. Matches the Rust twin's
+ * `MAX_SECURE_FILE_SIZE`.
+ */
+export const MAX_SECURE_FILE_SIZE = 4096;
+/**
+ * Whether POSIX file modes are meaningful on this platform. On Windows Node
+ * synthesizes modes (always group/other-readable), so enforcing the check
+ * would refuse every file; the Rust twin is Unix-only and never faces this.
+ * The mock runtime checks unconditionally — its modes are simulated.
+ */
+const modes_apply = process.platform !== 'win32';
+/**
+ * Refuse any group/other-accessible mode (only `0600`/`0400` pass).
+ *
+ * Callers own the platform gating: the real runtimes skip the check where
+ * modes aren't meaningful (Node on Windows, a `null` Deno mode); the mock
+ * checks its simulated modes unconditionally.
+ *
+ * @throws Error naming the path, the offending mode, and the `chmod` fix
+ */
+export const assert_secure_mode = (path, mode) => {
+    if ((mode & 0o077) !== 0) {
+        throw new Error(`insecure permissions on ${path}: ${(mode & 0o777).toString(8)} (expected 0600) — fix with: chmod 600 ${path}`);
+    }
+};
+/**
+ * Refuse a byte count over `MAX_SECURE_FILE_SIZE`.
+ *
+ * @throws Error naming the path, the size, and the cap
+ */
+export const assert_secure_size = (path, size) => {
+    if (size > MAX_SECURE_FILE_SIZE) {
+        throw new Error(`secure file too large: ${path} (${size} bytes, max ${MAX_SECURE_FILE_SIZE})`);
+    }
+};
+/**
+ * Drain `read_chunk` into a cap-bounded buffer.
+ *
+ * Reads up to cap + 1 bytes so a file growing between stat and read is still
+ * caught (the stat-time size check alone races). `read_chunk` fills the given
+ * target from the file's current position and returns the bytes read
+ * (`null`/`0` = EOF) — the seam that lets the Node and Deno handle APIs share
+ * one loop.
+ *
+ * @throws Error when more than `MAX_SECURE_FILE_SIZE` bytes arrive
+ */
+export const read_secure_bounded = async (path, read_chunk) => {
+    const buffer = new Uint8Array(MAX_SECURE_FILE_SIZE + 1);
+    let total = 0;
+    while (total < buffer.length) {
+        const n = await read_chunk(buffer.subarray(total));
+        if (n === null || n === 0)
+            break;
+        total += n;
+    }
+    assert_secure_size(path, total);
+    return buffer.subarray(0, total);
+};
+/**
+ * Read a secret file with fail-loud checks (Node implementation).
+ *
+ * - `O_NOFOLLOW` atomically rejects symlinks during open (no TOCTOU window)
+ * - the permission check runs on the open descriptor, not the path, so the
+ *   file can't be swapped between check and read — any group/other access
+ *   (not `0600`/`0400`) is refused
+ * - a size cap bounds the read; the read itself is limited to cap + 1 so a
+ *   file growing between stat and read is still caught
+ *
+ * @param path - path to the secret file
+ * @returns the file's bytes
+ * @throws Error on a missing file, symlink, permissive mode, oversized file, or I/O failure
+ */
+export const load_secure_file_node = async (path) => {
+    let handle;
+    try {
+        handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    }
+    catch (err) {
+        // ELOOP means the path was a symlink (O_NOFOLLOW refused it).
+        if (err.code === 'ELOOP') {
+            throw new Error(`secure file is a symlink: ${path}`);
+        }
+        throw err;
+    }
+    try {
+        const s = await handle.stat();
+        if (modes_apply)
+            assert_secure_mode(path, s.mode);
+        assert_secure_size(path, s.size);
+        // `position: null` reads sequentially from the handle's own cursor.
+        return await read_secure_bounded(path, async (target) => {
+            const { bytesRead } = await handle.read(target, 0, target.length, null);
+            return bytesRead;
+        });
+    }
+    finally {
+        await handle.close();
+    }
+};

package/dist/server/app_backend.d.ts

@@ -16,7 +16,6 @@ import { type AuditEmitter } from '../auth/audit_emitter.js';
 import type { DbType, Db } from '../db/db.js';
 import type { Keyring } from '../auth/keyring.js';
 import type { PasswordHashDeps } from '../auth/password.js';
-import type { StatResult } from '../runtime/deps.js';
 import { type MigrationNamespace, type MigrationResult } from '../db/migrate.js';
 /**
  * Result of `create_app_backend()` — database metadata + deps bundle.
@@ -83,10 +82,12 @@ export declare const default_audit_factory: AuditFactory;
  * (e.g., tx uses `runtime.exit(1)` on invalid keys).
  */
 export interface CreateAppBackendOptions {
-    /** Get file/directory stats, or null if path doesn't exist. */
-    stat: (path: string) => Promise<StatResult | null>;
-    /** Read a file as text. */
-    read_text_file: (path: string) => Promise<string>;
+    /**
+     * Hardened secret-file read for the bootstrap token — pass the runtime's
+     * `read_secure_file` (see `FsSecureReadDeps`). Rejects symlinks,
+     * group/other-accessible modes, and oversized files.
+     */
+    read_secure_file: (path: string) => Promise<Uint8Array>;
     /** Delete a file. */
     delete_file: (path: string) => Promise<void>;
     /** Database connection URL (`postgres://`, `file://`, or `memory://`). */

package/dist/server/app_backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app_backend.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/app_backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAwB,KAAK,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAkB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAIjG;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,oIAAoI;IACpI,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC3D,iEAAiE;IACjE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE;IAAE,EAAE,EAAE,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,KAAK,YAAY,CAAC;AAE7E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,EAAE,YACF,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACvC,+DAA+D;IAC/D,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnD,2BAA2B;IAC3B,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,qBAAqB;IACrB,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,iFAAiF;IACjF,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;;;;;;;OAkBG;IACH,aAAa,EAAE,YAAY,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,oBAAoB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CACzD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,GAAU,SAAS,uBAAuB,KAAG,OAAO,CAAC,UAAU,CAmD7F,CAAC"}
+{"version":3,"file":"app_backend.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/app_backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAwB,KAAK,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAkB,KAAK,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAIjG;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,oIAAoI;IACpI,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAC3D,iEAAiE;IACjE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE;IAAE,EAAE,EAAE,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,KAAK,YAAY,CAAC;AAE7E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,EAAE,YACF,CAAC;AAEnC;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACvC;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,qBAAqB;IACrB,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,iFAAiF;IACjF,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;;;;;;;OAkBG;IACH,aAAa,EAAE,YAAY,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,oBAAoB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CACzD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,GAAU,SAAS,uBAAuB,KAAG,OAAO,CAAC,UAAU,CAiD7F,CAAC"}

package/dist/server/app_backend.js

@@ -39,7 +39,7 @@ export const default_audit_factory = ({ db, log }) => create_audit_emitter({ db,
  * @throws Error if `migration_namespaces` contains a namespace in `reserved_migration_namespaces`
  */
 export const create_app_backend = async (options) => {
-    const { database_url, keyring, password, stat, read_text_file, delete_file, audit_factory } = options;
+    const { database_url, keyring, password, read_secure_file, delete_file, audit_factory } = options;
     const log = options.log ?? new Logger('server');
     const { db, close, db_type, db_name } = await create_db(database_url);
     // Everything after `create_db` can throw — reserved-namespace check,
@@ -69,8 +69,7 @@ export const create_app_backend = async (options) => {
                 keyring,
                 password,
                 db,
-                stat,
-                read_text_file,
+                read_secure_file,
                 delete_file,
                 log,
                 audit

package/dist/testing/CLAUDE.md

@@ -32,7 +32,7 @@ time (never runtime), where a throwing guard would break `vite build`.
 - `stub_handler()` — fresh `Response('stub')`.
 - `stub_mw` — pass-through middleware (`async (_c, next) => next()`).
 - `stub_app_deps` — frozen `AppDeps`, every capability throwing, `audit` a no-op `AuditEmitter` from `create_test_audit_emitter`.
-- `create_stub_app_deps()` — factory: fresh `AppDeps` with no-op FS/keyring/password, a `create_noop_stub` DB, silent `Logger`, no-op `audit`.
+- `create_stub_app_deps()` — factory: fresh `AppDeps` with no-op keyring/password/`delete_file`, a `read_secure_file` that throws ENOENT (the no-token-file state), a `create_noop_stub` DB, silent `Logger`, no-op `audit`.
 - `create_test_audit_emitter()` — no-op `AuditEmitter`; `emit` / `emit_role_grant_target` no-op, `emit_pool` resolves immediately, `notify` no-op, `add_listener` throws (use `create_recording_audit_emitter` for a listener-accepting emitter), `listener_count` returns 0.
 - `create_stub_audit_sse()` — no-op `AuditLogSse` for surface-test wiring without booting real SSE. `subscribe` returns a no-op cleanup; `on_audit_event` no-op; `registry` is a fresh `SubscriberRegistry` (live `.size` / `.close_*` for registry-state tests, isolated per call). For real SSE plumbing build via `create_audit_log_sse` against `create_test_app`.
 - `create_stub_api_middleware({include_daemon_token?})` — stub `MiddlewareSpec[]` matching `create_auth_middleware_specs`'s output (origin/session/request_context/bearer_auth, optional daemon_token) for surface generation without booting real auth. See `auth/CLAUDE.md` §Middleware for the real stack.
@@ -1397,6 +1397,41 @@ in-process `auth/origin_parity.db.test.ts` + the cross-process
 Rust spine returned a plain-text body — now converged to the canonical TS
 `{error: "forbidden_origin"}` via `fuz_http::forbidden_origin_response()`.
 
+### Query-string shape parity — `cross_backend/query_shape.ts`
+
+`describe_query_shape_cross_tests({setup_test, capabilities, rpc_path?})` —
+the imperative duplicate-key / unknown-key / phase-order query-semantics
+suite over the three spine surfaces that read a query:
+`GET /api/account/status` (no query schema — duplicated `acting` first-wins,
+unknown keys ignored, anonymous junk query → 401 never a query 400), the
+JSON-RPC GET endpoint (`method` / `id` / `params` first-wins — a last-wins
+reader dispatches a different method per backend on the same request), and
+`GET /api/facts/:hash` (gated on `capabilities.fact_serving`; strict schema —
+unknown key / malformed `acting` → 400 `invalid_query_params` **before** the
+401 guard, duplicated `acting` first-wins). Imperative because duplicated
+query keys can't be expressed through the structured RPC helpers. Pinned
+after the Rust spine's derived-serde `Query` extractors were converged onto
+`fuz_http`'s `query_first` / `assert_known_query_keys` (a pre-handler
+"duplicate field" 400 is an anonymously observable backend fingerprint).
+Cross-process only — the per-surface in-process TS pins live beside each
+module's own tests (`account_status.test.ts`, `action_rpc.test.ts`,
+`serve_fact_route.db.test.ts`); fuz_app's own wiring is
+`cross_backend/query_shape.cross.test.ts`.
+
+### API-token lifetime parity — `cross_backend/token_lifetime.ts`
+
+`describe_token_lifetime_cross_tests({setup_test, rpc_path?})` — the
+imperative round-trip on `account_token_create`'s required `lifetime` union:
+a `{kind:'ttl', days}` mint returns and stores a bounded `expires_at`
+(create output + `account_token_list` read-back), `{kind:'eternal'}` stores
+NULL, and an omitted or out-of-range lifetime 400s identically on both
+spines. Exists because the action-manifest parity gate captures no param
+schemas while the Rust spine hand-parses params — a spine that silently
+dropped the field would answer the same mint with a 200 and an eternal
+token; only the stored-state read-back catches it. Ungated (mint + list are
+on every spine's standard surface). Runs both legs
+(`token_lifetime_parity.db.test.ts` + `token_lifetime.cross.test.ts`).
+
 ### Readiness probe parity — `cross_backend/ready.ts`
 
 `describe_ready_cross_tests({setup_test, capabilities, ready_path?})` — the

package/dist/testing/admin_integration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin_integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/admin_integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAgC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAW3E,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAkB1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,0BAA0B,CAAC;AAEvE;;GAEG;AACH,MAAM,WAAW,mCAAmC;IACnD;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,uCAAuC;IACvC,YAAY,EAAE,mBAAmB,CAAC;IAClC,uFAAuF;IACvF,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,4GAA4G;IAC5G,KAAK,EAAE,gBAAgB,CAAC;IACxB;;;OAGG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAiBD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yCAAyC,GACrD,SAAS,mCAAmC,KAC1C,IAm3BF,CAAC"}
+{"version":3,"file":"admin_integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/admin_integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAgC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAc,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAW3E,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAkB1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,0BAA0B,CAAC;AAEvE;;GAEG;AACH,MAAM,WAAW,mCAAmC;IACnD;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;OAIG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,uCAAuC;IACvC,YAAY,EAAE,mBAAmB,CAAC;IAClC,uFAAuF;IACvF,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,4GAA4G;IAC5G,KAAK,EAAE,gBAAgB,CAAC;IACxB;;;OAGG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAiBD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yCAAyC,GACrD,SAAS,mCAAmC,KAC1C,IA23BF,CAAC"}

package/dist/testing/admin_integration.js

@@ -594,7 +594,11 @@ export const describe_standard_admin_integration_tests = (options) => {
                     app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_token_create_action_spec,
-                    params: { name: 'audit-test-token', scope: { kind: 'full' } },
+                    params: {
+                        name: 'audit-test-token',
+                        scope: { kind: 'full' },
+                        lifetime: { kind: 'eternal' }
+                    },
                     headers: fixture.create_session_headers()
                 });
                 assert.ok(token_res.ok, `account_token_create failed: ${token_res.ok ? '' : JSON.stringify(token_res.error)}`);
@@ -721,7 +725,11 @@ export const describe_standard_admin_integration_tests = (options) => {
                     app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_token_create_action_spec,
-                    params: { name: 'admin-b-token', scope: { kind: 'full' } },
+                    params: {
+                        name: 'admin-b-token',
+                        scope: { kind: 'full' },
+                        lifetime: { kind: 'eternal' }
+                    },
                     headers: create_headers(admin_b.session_cookie)
                 });
                 assert.ok(token_res.ok, `account_token_create failed: ${token_res.ok ? '' : JSON.stringify(token_res.error)}`);