@fuzdev/fuz_app 0.108.0 → 0.110.0

package/dist/testing/daemon_token_rotation.d.ts

@@ -0,0 +1,83 @@
+import './assert_dev_env.js';
+/**
+ * Daemon-token **producer** — rotation + file persistence, test-harness only.
+ *
+ * No production assembly mints daemon tokens: the credential's only remaining
+ * role is the cross-process test harness's keeper channel (`_testing_reset`
+ * etc.), so the producer lives here behind `assert_dev_env` where it cannot
+ * reach a production bundle. The *consumer* half — validating a presented
+ * `X-Daemon-Token` — stays in `auth/daemon_token_middleware.ts`, mirroring
+ * the Rust spine, whose producer is confined to `fuz_testing`.
+ *
+ * The token file is written atomically at mode `0600` via
+ * `write_file_atomic` (unique temp name + exclusive create), so it never
+ * exists group/other-readable — the old optional-`chmod` pattern let a
+ * default umask land it at `0644`.
+ *
+ * @module
+ */
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
+import type { EnvDeps, FsWriteDeps, FsRemoveDeps } from '../runtime/deps.js';
+import type { QueryDeps } from '../db/query_deps.js';
+import { type DaemonTokenState } from '../auth/daemon_token.js';
+/** Default rotation interval in milliseconds (30 seconds). */
+export declare const DEFAULT_ROTATION_INTERVAL_MS = 30000;
+/** Deps for writing the daemon token to disk. */
+export type DaemonTokenWriteDeps = Pick<EnvDeps, 'env_get'> & Pick<FsWriteDeps, 'mkdir' | 'write_text_file' | 'rename'>;
+/**
+ * Get the daemon token file path (`~/.{name}/run/daemon_token`).
+ *
+ * @param runtime - runtime with `env_get` capability
+ * @param name - application name
+ * @returns path to `daemon_token`, or `null` if `$HOME` is not set
+ */
+export declare const get_daemon_token_path: (runtime: Pick<EnvDeps, "env_get">, name: string) => string | null;
+/**
+ * Write the current token to disk atomically at mode `0600`.
+ *
+ * On-disk format is JSON `{"token": "..."}` — the wrapper leaves room for
+ * future fields (rotated_at, version) without changing every reader. Both
+ * the TS cross-backend harness reader (`spawn_backend.read_daemon_token`)
+ * and the Rust daemon-token writer match this shape.
+ *
+ * @param runtime - runtime with file write capabilities
+ * @param token_path - path to write the token
+ * @param token - the raw token string
+ * @mutates filesystem - writes `token_path` atomically at mode `0600`
+ */
+export declare const write_daemon_token: (runtime: DaemonTokenWriteDeps, token_path: string, token: string) => Promise<void>;
+/** Options for daemon token rotation. */
+export interface DaemonTokenRotationOptions {
+    /**
+     * Absolute path the token file is written to. Caller computes from
+     * its own conventions — e.g. `get_daemon_token_path(runtime, app_name)`
+     * for the standard `~/.{name}/run/daemon_token` layout, or a path
+     * derived from `PUBLIC_<APP>_DIR` for cross-process test setups that
+     * isolate the app dir to a tmpdir.
+     */
+    token_path: string;
+    /** Rotation interval in ms. Default: `30000` (30s). */
+    rotation_interval_ms?: number;
+}
+/** Result of starting daemon token rotation. */
+export interface DaemonTokenRotation {
+    /** The mutable runtime state. Pass to `create_daemon_token_middleware`. */
+    state: DaemonTokenState;
+    /** Stop rotation, clean up the interval, and delete the token file. Call on graceful shutdown. */
+    stop: () => Promise<void>;
+}
+/**
+ * Start daemon token rotation.
+ *
+ * Generates an initial token, writes it to disk, resolves the keeper account,
+ * and sets up periodic rotation. Returns the mutable state object and a stop function.
+ *
+ * @param runtime - runtime with file and remove capabilities
+ * @param deps - query dependencies for resolving keeper account
+ * @param options - rotation configuration
+ * @param log - the logger instance
+ * @returns rotation state and stop function
+ * @mutates filesystem - writes the token file on each rotation; `stop` removes it
+ */
+export declare const start_daemon_token_rotation: (runtime: DaemonTokenWriteDeps & FsRemoveDeps, deps: QueryDeps, options: DaemonTokenRotationOptions, log: Logger) => Promise<DaemonTokenRotation>;
+//# sourceMappingURL=daemon_token_rotation.d.ts.map

package/dist/testing/daemon_token_rotation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon_token_rotation.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/daemon_token_rotation.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG7E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGvF,8DAA8D;AAC9D,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD,iDAAiD;AACjD,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,GAC1D,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,iBAAiB,GAAG,QAAQ,CAAC,CAAC;AAE3D;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,EACjC,MAAM,MAAM,KACV,MAAM,GAAG,IAGX,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,GAC9B,SAAS,oBAAoB,EAC7B,YAAY,MAAM,EAClB,OAAO,MAAM,KACX,OAAO,CAAC,IAAI,CAId,CAAC;AAEF,yCAAyC;AACzC,MAAM,WAAW,0BAA0B;IAC1C;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,gDAAgD;AAChD,MAAM,WAAW,mBAAmB;IACnC,2EAA2E;IAC3E,KAAK,EAAE,gBAAgB,CAAC;IACxB,kGAAkG;IAClG,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,2BAA2B,GACvC,SAAS,oBAAoB,GAAG,YAAY,EAC5C,MAAM,SAAS,EACf,SAAS,0BAA0B,EACnC,KAAK,MAAM,KACT,OAAO,CAAC,mBAAmB,CAqD7B,CAAC"}

package/dist/testing/daemon_token_rotation.js

@@ -0,0 +1,99 @@
+import './assert_dev_env.js';
+import { write_file_atomic } from '../runtime/fs.js';
+import { get_app_dir } from '../cli/config.js';
+import { generate_daemon_token } from '../auth/daemon_token.js';
+import { resolve_keeper_account_id } from '../auth/daemon_token_middleware.js';
+/** Default rotation interval in milliseconds (30 seconds). */
+export const DEFAULT_ROTATION_INTERVAL_MS = 30_000;
+/**
+ * Get the daemon token file path (`~/.{name}/run/daemon_token`).
+ *
+ * @param runtime - runtime with `env_get` capability
+ * @param name - application name
+ * @returns path to `daemon_token`, or `null` if `$HOME` is not set
+ */
+export const get_daemon_token_path = (runtime, name) => {
+    const app_dir = get_app_dir(runtime, name);
+    return app_dir ? `${app_dir}/run/daemon_token` : null;
+};
+/**
+ * Write the current token to disk atomically at mode `0600`.
+ *
+ * On-disk format is JSON `{"token": "..."}` — the wrapper leaves room for
+ * future fields (rotated_at, version) without changing every reader. Both
+ * the TS cross-backend harness reader (`spawn_backend.read_daemon_token`)
+ * and the Rust daemon-token writer match this shape.
+ *
+ * @param runtime - runtime with file write capabilities
+ * @param token_path - path to write the token
+ * @param token - the raw token string
+ * @mutates filesystem - writes `token_path` atomically at mode `0600`
+ */
+export const write_daemon_token = async (runtime, token_path, token) => {
+    await write_file_atomic(runtime, token_path, JSON.stringify({ token }) + '\n', {
+        mode: 0o600
+    });
+};
+/**
+ * Start daemon token rotation.
+ *
+ * Generates an initial token, writes it to disk, resolves the keeper account,
+ * and sets up periodic rotation. Returns the mutable state object and a stop function.
+ *
+ * @param runtime - runtime with file and remove capabilities
+ * @param deps - query dependencies for resolving keeper account
+ * @param options - rotation configuration
+ * @param log - the logger instance
+ * @returns rotation state and stop function
+ * @mutates filesystem - writes the token file on each rotation; `stop` removes it
+ */
+export const start_daemon_token_rotation = async (runtime, deps, options, log) => {
+    const { token_path, rotation_interval_ms = DEFAULT_ROTATION_INTERVAL_MS } = options;
+    // ensure parent directory exists
+    const last_slash = token_path.lastIndexOf('/');
+    if (last_slash > 0) {
+        await runtime.mkdir(token_path.slice(0, last_slash), { recursive: true });
+    }
+    // resolve keeper account (may be null pre-bootstrap; the middleware
+    // lazily refreshes on the first null hit to cover the
+    // rotation-starts-before-bootstrap case)
+    const keeper_account_id = await resolve_keeper_account_id(deps);
+    // generate initial token and write to disk
+    const initial_token = generate_daemon_token();
+    await write_daemon_token(runtime, token_path, initial_token);
+    const state = {
+        current_token: initial_token,
+        previous_token: null,
+        rotated_at: new Date(),
+        keeper_account_id
+    };
+    let writing = false;
+    const interval_id = setInterval(async () => {
+        if (writing)
+            return; // skip if previous rotation write still in progress
+        writing = true;
+        try {
+            const new_token = generate_daemon_token();
+            state.previous_token = state.current_token;
+            state.current_token = new_token;
+            state.rotated_at = new Date();
+            await write_daemon_token(runtime, token_path, new_token);
+        }
+        catch (err) {
+            log.error('Failed to write rotated token:', err);
+        }
+        finally {
+            writing = false;
+        }
+    }, rotation_interval_ms);
+    const stop = async () => {
+        clearInterval(interval_id);
+        try {
+            await runtime.remove(token_path);
+        }
+        catch {
+            // already removed or never written
+        }
+    };
+    return { state, stop };
+};

package/dist/testing/integration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAsB7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAMhE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAkB1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAW,KAAK,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAG1D;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC9C;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;;;;;;OASG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,kEAAkE;IAClE,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;OAIG;IACH,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,mCAAmC,GAC/C,SAAS,8BAA8B,KACrC,IA86CF,CAAC"}
+{"version":3,"file":"integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAsB7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAMhE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAkB1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAW,KAAK,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAG1D;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC9C;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;;;;;;OASG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,kEAAkE;IAClE,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;OAIG;IACH,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,mCAAmC,GAC/C,SAAS,8BAA8B,KACrC,IA07CF,CAAC"}

package/dist/testing/integration.js

@@ -634,7 +634,11 @@ export const describe_standard_integration_tests = (options) => {
                     app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_token_create_action_spec,
-                    params: { name: 'test-revoke', scope: { kind: 'full' } },
+                    params: {
+                        name: 'test-revoke',
+                        scope: { kind: 'full' },
+                        lifetime: { kind: 'eternal' }
+                    },
                     headers: fixture.create_session_headers()
                 });
                 assert.ok(create_res.ok, 'account_token_create should succeed');
@@ -943,7 +947,11 @@ export const describe_standard_integration_tests = (options) => {
                     app: { request: unauthed },
                     path: rpc_path,
                     spec: account_token_create_action_spec,
-                    params: { name: 'unauth-probe', scope: { kind: 'full' } },
+                    params: {
+                        name: 'unauth-probe',
+                        scope: { kind: 'full' },
+                        lifetime: { kind: 'eternal' }
+                    },
                     headers: { host: 'localhost' }
                 });
                 assert.strictEqual(token_create.status, 401);
@@ -1039,7 +1047,11 @@ export const describe_standard_integration_tests = (options) => {
                     app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_token_create_action_spec,
-                    params: { name: 'test-token', scope: { kind: 'full' } },
+                    params: {
+                        name: 'test-token',
+                        scope: { kind: 'full' },
+                        lifetime: { kind: 'eternal' }
+                    },
                     headers: fixture.create_session_headers()
                 });
                 assert.ok(create_res.ok, 'account_token_create should succeed');

package/dist/testing/stubs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stubs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/stubs.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAa7B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAG3E,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAmB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAA+B,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAI9F;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,GAAG,GAAG,EAAE,OAAO,MAAM,KAAG,CAqBtD,CAAC;AAET;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,GAAG,GAAG,EAAE,QAAQ,MAAM,EAAE,YAAY,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,CAOxF,CAAC;AAET,iEAAiE;AACjE,eAAO,MAAM,IAAI,EAAE,GAAkC,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,QAAO,EAI/B,CAAC;AAEJ,gDAAgD;AAChD,eAAO,MAAM,YAAY,QAAO,QAAgC,CAAC;AAEjE,2CAA2C;AAC3C,eAAO,MAAM,OAAO,GAAU,IAAI,GAAG,EAAE,MAAM,GAAG,KAAG,OAAO,CAAC,IAAI,CAAW,CAAC;AAI3E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,QAAO,YAW3C,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,QAAO,WAUxC,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,aAAa,EAAE,OAS3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,QAAO,OAStC,CAAC;AAEH,2FAA2F;AAC3F,eAAO,MAAM,0BAA0B,GAAI,UAAU;IACpD,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAC/B,KAAG,KAAK,CAAC,cAAc,CAqBvB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,GAC1C,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,gBAsBF,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,+BAA+B;IAC/C,6DAA6D;IAC7D,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,qFAAqF;IACrF,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7F;;;;;;;;OAQG;IACH,YAAY,CAAC,EACZ,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAC5F,mFAAmF;IACnF,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/E;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,cAmDF,CAAC"}
+{"version":3,"file":"stubs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/stubs.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAa7B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAG3E,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAmB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAA+B,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAI9F;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,GAAG,GAAG,EAAE,OAAO,MAAM,KAAG,CAqBtD,CAAC;AAET;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,GAAG,GAAG,EAAE,QAAQ,MAAM,EAAE,YAAY,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,CAOxF,CAAC;AAET,iEAAiE;AACjE,eAAO,MAAM,IAAI,EAAE,GAAkC,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,QAAO,EAI/B,CAAC;AAEJ,gDAAgD;AAChD,eAAO,MAAM,YAAY,QAAO,QAAgC,CAAC;AAEjE,2CAA2C;AAC3C,eAAO,MAAM,OAAO,GAAU,IAAI,GAAG,EAAE,MAAM,GAAG,KAAG,OAAO,CAAC,IAAI,CAAW,CAAC;AAI3E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,QAAO,YAW3C,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,QAAO,WAUxC,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,aAAa,EAAE,OAQ3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,QAAO,OAUtC,CAAC;AAEH,2FAA2F;AAC3F,eAAO,MAAM,0BAA0B,GAAI,UAAU;IACpD,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAC/B,KAAG,KAAK,CAAC,cAAc,CAqBvB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,GAC1C,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,gBAsBF,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,+BAA+B;IAC/C,6DAA6D;IAC7D,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,qFAAqF;IACrF,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7F;;;;;;;;OAQG;IACH,YAAY,CAAC,EACZ,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAC5F,mFAAmF;IACnF,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/E;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,cAmDF,CAAC"}

package/dist/testing/stubs.js

@@ -133,8 +133,7 @@ export const create_stub_audit_sse = () => {
 };
 /** Stub `AppDeps` for auth surface tests — throws on any method access. */
 export const stub_app_deps = {
-    stat: create_throwing_stub('stat'),
-    read_text_file: create_throwing_stub('read_text_file'),
+    read_secure_file: create_throwing_stub('read_secure_file'),
     delete_file: create_throwing_stub('delete_file'),
     keyring: create_throwing_stub('keyring'),
     password: create_throwing_stub('password'),
@@ -146,8 +145,9 @@ export const stub_app_deps = {
  * Create no-op `AppDeps` for auth surface testing.
  */
 export const create_stub_app_deps = () => ({
-    stat: async () => null,
-    read_text_file: async () => '',
+    read_secure_file: async (path) => {
+        throw new Error(`ENOENT: no such file or directory: ${path}`);
+    },
     delete_file: async (_path) => { },
     keyring: create_noop_stub('keyring'),
     password: create_noop_stub('password'),

package/dist/ui/AccountSessions.svelte

@@ -34,7 +34,6 @@
 	const columns: Array<DatatableColumn<AuthSessionJson>> = [
 		{ key: 'id', label: 'session', width: 140 },
 		{ key: 'created_at', label: 'created', width: 120 },
-		{ key: 'last_seen_at', label: 'last seen', width: 120 },
 		{ key: 'expires_at', label: 'expires', width: 120 },
 		{ key: 'account_id', label: '', width: 100 }
 	];
@@ -71,10 +70,6 @@
 					<span title={format_datetime_local(row.created_at)}>
 						{format_relative_time(row.created_at)}
 					</span>
-				{:else if column.key === 'last_seen_at'}
-					<span title={format_datetime_local(row.last_seen_at)}>
-						{format_relative_time(row.last_seen_at)}
-					</span>
 				{:else if column.key === 'expires_at'}
 					<span title={format_datetime_local(row.expires_at)}>
 						{format_relative_time(row.expires_at)}

package/dist/ui/AccountSessions.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AccountSessions.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AccountSessions.svelte"],"names":[],"mappings":"AAiHA,UAAU,kCAAkC,CAAC,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,OAAO,GAAG,EAAE,EAAE,QAAQ,GAAG,MAAM;IACpM,KAAK,OAAO,EAAE,OAAO,QAAQ,EAAE,2BAA2B,CAAC,KAAK,CAAC,GAAG,OAAO,QAAQ,EAAE,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG;QAAE,UAAU,CAAC,EAAE,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC;IACjK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,KAAK,CAAA;KAAC,GAAG,OAAO,GAAG;QAAE,IAAI,CAAC,EAAE,GAAG,CAAC;QAAC,GAAG,CAAC,EAAE,GAAG,CAAA;KAAE,CAAC;IACtG,YAAY,CAAC,EAAE,QAAQ,CAAC;CAC3B;AAKD,QAAA,MAAM,eAAe;;kBAA+E,CAAC;AACnF,KAAK,eAAe,GAAG,YAAY,CAAC,OAAO,eAAe,CAAC,CAAC;AAC9D,eAAe,eAAe,CAAC"}
+{"version":3,"file":"AccountSessions.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AccountSessions.svelte"],"names":[],"mappings":"AA4GA,UAAU,kCAAkC,CAAC,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,OAAO,GAAG,EAAE,EAAE,QAAQ,GAAG,MAAM;IACpM,KAAK,OAAO,EAAE,OAAO,QAAQ,EAAE,2BAA2B,CAAC,KAAK,CAAC,GAAG,OAAO,QAAQ,EAAE,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG;QAAE,UAAU,CAAC,EAAE,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC;IACjK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,KAAK,CAAA;KAAC,GAAG,OAAO,GAAG;QAAE,IAAI,CAAC,EAAE,GAAG,CAAC;QAAC,GAAG,CAAC,EAAE,GAAG,CAAA;KAAE,CAAC;IACtG,YAAY,CAAC,EAAE,QAAQ,CAAC;CAC3B;AAKD,QAAA,MAAM,eAAe;;kBAA+E,CAAC;AACnF,KAAK,eAAe,GAAG,YAAY,CAAC,OAAO,eAAe,CAAC,CAAC;AAC9D,eAAe,eAAe,CAAC"}

package/dist/ui/AdminOverview.svelte

@@ -52,10 +52,13 @@
 
 	// sessions
 	const unique_users = $derived(new Set(sessions.sessions.map((s) => s.username)).size);
+	// newest session by mint time — sessions carry no activity signal
+	// (`last_seen_at` is decorative post-hard-cap; see `docs/security.md`
+	// §Session Security)
 	const most_recent = $derived(
 		sessions.sessions.length > 0
 			? sessions.sessions.reduce((a, b) =>
-					new Date(a.last_seen_at) > new Date(b.last_seen_at) ? a : b
+					new Date(a.created_at) > new Date(b.created_at) ? a : b
 				)
 			: null
 	);
@@ -146,10 +149,10 @@
 			</div>
 			{#if most_recent}
 				<div class="baseline-row gap_xs font_size_sm mt_sm">
-					<span class="text_50">last active:</span>
+					<span class="text_50">newest session:</span>
 					<strong>{most_recent.username}</strong>
-					<span class="text_50" title={format_datetime_local(most_recent.last_seen_at)}
-						>{format_relative_time(most_recent.last_seen_at)}</span
+					<span class="text_50" title={format_datetime_local(most_recent.created_at)}
+						>{format_relative_time(most_recent.created_at)}</span
 					>
 				</div>
 			{/if}

package/dist/ui/AdminOverview.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdminOverview.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminOverview.svelte"],"names":[],"mappings":"AA2UA,QAAA,MAAM,aAAa,2DAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}
+{"version":3,"file":"AdminOverview.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminOverview.svelte"],"names":[],"mappings":"AA8UA,QAAA,MAAM,aAAa,2DAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}

package/dist/ui/AdminSessions.svelte

@@ -26,7 +26,6 @@
 		{ key: 'username', label: 'user', width: 120 },
 		{ key: 'id', label: 'session', width: 130 },
 		{ key: 'created_at', label: 'created', width: 100 },
-		{ key: 'last_seen_at', label: 'last seen', width: 100 },
 		{ key: 'expires_at', label: 'expires', width: 100 },
 		{ key: 'account_id', label: '', width: 220 }
 	];
@@ -53,10 +52,6 @@
 					<span title={format_datetime_local(row.created_at)}>
 						{format_relative_time(row.created_at)}
 					</span>
-				{:else if column.key === 'last_seen_at'}
-					<span title={format_datetime_local(row.last_seen_at)}>
-						{format_relative_time(row.last_seen_at)}
-					</span>
 				{:else if column.key === 'expires_at'}
 					<span title={format_datetime_local(row.expires_at)}>
 						{format_relative_time(row.expires_at)}

package/dist/ui/AdminSessions.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdminSessions.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminSessions.svelte"],"names":[],"mappings":"AAkGA,UAAU,kCAAkC,CAAC,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,OAAO,GAAG,EAAE,EAAE,QAAQ,GAAG,MAAM;IACpM,KAAK,OAAO,EAAE,OAAO,QAAQ,EAAE,2BAA2B,CAAC,KAAK,CAAC,GAAG,OAAO,QAAQ,EAAE,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG;QAAE,UAAU,CAAC,EAAE,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC;IACjK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,KAAK,CAAA;KAAC,GAAG,OAAO,GAAG;QAAE,IAAI,CAAC,EAAE,GAAG,CAAC;QAAC,GAAG,CAAC,EAAE,GAAG,CAAA;KAAE,CAAC;IACtG,YAAY,CAAC,EAAE,QAAQ,CAAC;CAC3B;AAKD,QAAA,MAAM,aAAa;;kBAA+E,CAAC;AACjF,KAAK,aAAa,GAAG,YAAY,CAAC,OAAO,aAAa,CAAC,CAAC;AAC1D,eAAe,aAAa,CAAC"}
+{"version":3,"file":"AdminSessions.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminSessions.svelte"],"names":[],"mappings":"AA6FA,UAAU,kCAAkC,CAAC,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,OAAO,GAAG,EAAE,EAAE,QAAQ,GAAG,MAAM;IACpM,KAAK,OAAO,EAAE,OAAO,QAAQ,EAAE,2BAA2B,CAAC,KAAK,CAAC,GAAG,OAAO,QAAQ,EAAE,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG;QAAE,UAAU,CAAC,EAAE,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC;IACjK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,KAAK,CAAA;KAAC,GAAG,OAAO,GAAG;QAAE,IAAI,CAAC,EAAE,GAAG,CAAC;QAAC,GAAG,CAAC,EAAE,GAAG,CAAA;KAAE,CAAC;IACtG,YAAY,CAAC,EAAE,QAAQ,CAAC;CAC3B;AAKD,QAAA,MAAM,aAAa;;kBAA+E,CAAC;AACjF,KAAK,aAAa,GAAG,YAAY,CAAC,OAAO,aAAa,CAAC,CAAC;AAC1D,eAAe,aAAa,CAAC"}

package/dist/ui/CLAUDE.md

@@ -244,9 +244,13 @@ destructive actions.
 - `table_state.svelte.ts` — `TableState`. Paginated DB browser state.
   Holds one `AsyncSlot` (`list`) + payload fields (`table_name`,
   `columns`, `rows`, `total`, `offset`, `limit` capped by
-  `TABLE_LIMIT_MAX = 1000`, `primary_key`). Derived
-  `showing_start`/`showing_end`/`has_prev`/`has_next`. Methods:
-  `fetch`, `go_prev`/`go_next`, `delete_row`. `delete_row` uses
+  `http/db_routes.ts`'s `DB_TABLE_ROWS_LIMIT_MAX`, `primary_key`,
+  `deletable`). Derived
+  `showing_start`/`showing_end`/`has_prev`/`has_next`, plus
+  `can_delete` (`deletable && primary_key !== null`) — gate the
+  delete affordance on that, not on `primary_key`, or a
+  policy-excluded table shows a button that only ever refuses.
+  Methods: `fetch`, `go_prev`/`go_next`, `delete_row`. `delete_row` uses
   plain try/catch + scalar `deleting` / `delete_error` fields (no
   slot — error must survive past `list.run()` retries).
 - `form_state.svelte.ts` — `FormState`. Enter-advance between
@@ -421,4 +425,5 @@ format_scope, global_label)` helper — `global_label = null` renders no
   - `format_value(value)` — table-cell stringifier (NULL / undefined /
     JSON / primitive).
   - `format_audit_metadata(event_type, metadata)` — event-type-
-    specific metadata summary (switch across every `AuditEventType`).
+    specific metadata summary (bespoke cases for the common event types,
+    JSON-stringified fallback for the rest).

package/dist/ui/table_state.svelte.d.ts

@@ -40,9 +40,7 @@
  * @module
  */
 import { AsyncSlot } from './async_slot.svelte.js';
-import type { ColumnInfo } from '../http/db_routes.js';
-/** Maximum number of rows that can be fetched in a single page. */
-export declare const TABLE_LIMIT_MAX = 1000;
+import { type ColumnInfo } from '../http/db_routes.js';
 export declare class TableState {
     readonly list: AsyncSlot<void, string>;
     table_name: string;
@@ -52,15 +50,30 @@ export declare class TableState {
     offset: number;
     limit: number;
     primary_key: string | null;
+    /**
+     * Whether the server will accept a row `DELETE` on this table. False for a
+     * table with no single-column primary key *and* for one the server excludes
+     * by policy (the audit trail, singleton bookkeeping rows), which `primary_key`
+     * alone can't distinguish — it reports the key shape, not the policy.
+     */
+    deletable: boolean;
     deleting: string | null;
     delete_error: string | null;
+    /**
+     * Whether to offer a delete affordance at all. Gate rendering on this rather
+     * than on `primary_key`, or a policy-excluded table shows a button whose only
+     * outcome is a `table_not_deletable` refusal.
+     */
+    readonly can_delete: boolean;
     readonly showing_start: number;
     readonly showing_end: number;
     readonly has_prev: boolean;
     readonly has_next: boolean;
     /**
      * Fetch a page of rows for `table_name` from `GET /api/db/tables/{table_name}`.
-     * `limit` is clamped to `[1, TABLE_LIMIT_MAX]`.
+     * `limit` is clamped to `[1, DB_TABLE_ROWS_LIMIT_MAX]` — the same bounds
+     * the route 400s on, single-sourced so the client guard can't drift into
+     * sending a request the server refuses.
      *
      * @mutates `this`
      */
@@ -72,7 +85,7 @@ export declare class TableState {
      * Optimistically drops it from `rows` and decrements `total` on success;
      * surfaces server errors on `delete_error`.
      *
-     * @returns `true` when the row was removed; `false` on missing primary key or server error
+     * @returns `true` when the row was removed; `false` when the table isn't deletable or the server refused
      * @mutates `this`
      */
     delete_row(row: Record<string, unknown>): Promise<boolean>;

package/dist/ui/table_state.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"table_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/table_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAIH,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAGnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,mEAAmE;AACnE,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC,qBAAa,UAAU;IACtB,QAAQ,CAAC,IAAI,0BAAyB;IAEtC,UAAU,EAAE,MAAM,CAAkB;IACpC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAkB;IAC5C,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAkB;IACtD,KAAK,SAAiB;IACtB,MAAM,SAAiB;IACvB,KAAK,SAAmB;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC9C,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC3C,YAAY,EAAE,MAAM,GAAG,IAAI,CAAoB;IAG/C,QAAQ,CAAC,aAAa,SAAoD;IAC1E,QAAQ,CAAC,WAAW,SAAkE;IACtF,QAAQ,CAAC,QAAQ,UAA6B;IAC9C,QAAQ,CAAC,QAAQ,UAAmD;IAEpE;;;;;OAKG;IACG,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,SAAI,EAAE,KAAK,SAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBvE,OAAO,IAAI,IAAI;IAIf,OAAO,IAAI,IAAI;IAIf;;;;;;;OAOG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;CAoChE"}
+{"version":3,"file":"table_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/table_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAIH,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAGnD,OAAO,EAGN,KAAK,UAAU,EACf,MAAM,sBAAsB,CAAC;AAE9B,qBAAa,UAAU;IACtB,QAAQ,CAAC,IAAI,0BAAyB;IAEtC,UAAU,EAAE,MAAM,CAAkB;IACpC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAkB;IAC5C,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAkB;IACtD,KAAK,SAAiB;IACtB,MAAM,SAAiB;IACvB,KAAK,SAA2C;IAChD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC9C;;;;;OAKG;IACH,SAAS,UAAqB;IAC9B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC3C,YAAY,EAAE,MAAM,GAAG,IAAI,CAAoB;IAE/C;;;;OAIG;IACH,QAAQ,CAAC,UAAU,UAAyD;IAG5E,QAAQ,CAAC,aAAa,SAAoD;IAC1E,QAAQ,CAAC,WAAW,SAAkE;IACtF,QAAQ,CAAC,QAAQ,UAA6B;IAC9C,QAAQ,CAAC,QAAQ,UAAmD;IAEpE;;;;;;;OAOG;IACG,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,SAAI,EAAE,KAAK,SAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBvE,OAAO,IAAI,IAAI;IAIf,OAAO,IAAI,IAAI;IAIf;;;;;;;OAOG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;CAoChE"}

package/dist/ui/table_state.svelte.js

@@ -43,8 +43,7 @@ import { to_error_message } from '@fuzdev/fuz_util/error.ts';
 import { AsyncSlot } from './async_slot.svelte.js';
 import { parse_response_error, ui_fetch } from './ui_fetch.js';
 import { format_value } from './ui_format.js';
-/** Maximum number of rows that can be fetched in a single page. */
-export const TABLE_LIMIT_MAX = 1000;
+import { DB_TABLE_ROWS_DEFAULT_LIMIT, DB_TABLE_ROWS_LIMIT_MAX } from '../http/db_routes.js';
 export class TableState {
     list = new AsyncSlot();
     table_name = $state.raw('');
@@ -52,10 +51,23 @@ export class TableState {
     rows = $state.raw([]);
     total = $state.raw(0);
     offset = $state.raw(0);
-    limit = $state.raw(100);
+    limit = $state.raw(DB_TABLE_ROWS_DEFAULT_LIMIT);
     primary_key = $state.raw(null);
+    /**
+     * Whether the server will accept a row `DELETE` on this table. False for a
+     * table with no single-column primary key *and* for one the server excludes
+     * by policy (the audit trail, singleton bookkeeping rows), which `primary_key`
+     * alone can't distinguish — it reports the key shape, not the policy.
+     */
+    deletable = $state.raw(false);
     deleting = $state.raw(null);
     delete_error = $state.raw(null);
+    /**
+     * Whether to offer a delete affordance at all. Gate rendering on this rather
+     * than on `primary_key`, or a policy-excluded table shows a button whose only
+     * outcome is a `table_not_deletable` refusal.
+     */
+    can_delete = $derived(this.deletable && this.primary_key !== null);
     // Pagination computed values
     showing_start = $derived(this.total === 0 ? 0 : this.offset + 1);
     showing_end = $derived(Math.min(this.offset + this.rows.length, this.total));
@@ -63,14 +75,16 @@ export class TableState {
     has_next = $derived(this.offset + this.limit < this.total);
     /**
      * Fetch a page of rows for `table_name` from `GET /api/db/tables/{table_name}`.
-     * `limit` is clamped to `[1, TABLE_LIMIT_MAX]`.
+     * `limit` is clamped to `[1, DB_TABLE_ROWS_LIMIT_MAX]` — the same bounds
+     * the route 400s on, single-sourced so the client guard can't drift into
+     * sending a request the server refuses.
      *
      * @mutates `this`
      */
     async fetch(table_name, offset = 0, limit = 100) {
         this.table_name = table_name;
         this.offset = offset;
-        this.limit = Math.max(1, Math.min(TABLE_LIMIT_MAX, limit));
+        this.limit = Math.max(1, Math.min(DB_TABLE_ROWS_LIMIT_MAX, limit));
         await this.list.run(async () => {
             const response = await ui_fetch(`/api/db/tables/${table_name}?offset=${this.offset}&limit=${this.limit}`);
             if (!response.ok) {
@@ -81,6 +95,7 @@ export class TableState {
             this.rows = data.rows ?? [];
             this.total = data.total ?? 0;
             this.primary_key = data.primary_key ?? null;
+            this.deletable = data.deletable ?? false;
         });
     }
     go_prev() {
@@ -94,11 +109,11 @@ export class TableState {
      * Optimistically drops it from `rows` and decrements `total` on success;
      * surfaces server errors on `delete_error`.
      *
-     * @returns `true` when the row was removed; `false` on missing primary key or server error
+     * @returns `true` when the row was removed; `false` when the table isn't deletable or the server refused
      * @mutates `this`
      */
     async delete_row(row) {
-        if (!this.primary_key)
+        if (!this.can_delete || !this.primary_key)
             return false;
         const pk_value = row[this.primary_key];
         if (pk_value === null || pk_value === undefined)

package/dist/ui/ui_format.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ui_format.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/ui_format.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAChC,WAAW,MAAM,GAAG,MAAM,GAAG,IAAI,EACjC,MAAK,MAAmB,KACtB,MA2BF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,IAAI,MAAM,KAAG,MAY1C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,EAAE,YAAY,MAAM,EAAE,kBAAe,KAAG,MAOlF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,MAAmC,CAAC;AAEjF;;GAEG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,OAAO,KAAG,MAS7C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,WAAW,MAAM,GAAG,MAAM,GAAG,IAAI,KAAG,MAOzE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GACjC,YAAY,MAAM,EAClB,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,KACtC,MAyDF,CAAC"}
+{"version":3,"file":"ui_format.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/ui_format.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAChC,WAAW,MAAM,GAAG,MAAM,GAAG,IAAI,EACjC,MAAK,MAAmB,KACtB,MA2BF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,IAAI,MAAM,KAAG,MAY1C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,EAAE,YAAY,MAAM,EAAE,kBAAe,KAAG,MAOlF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,MAAmC,CAAC;AAEjF;;GAEG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,OAAO,KAAG,MAS7C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,WAAW,MAAM,GAAG,MAAM,GAAG,IAAI,KAAG,MAOzE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GACjC,YAAY,MAAM,EAClB,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,KACtC,MAgEF,CAAC"}

package/dist/ui/ui_format.js

@@ -178,6 +178,10 @@ export const format_audit_metadata = (event_type, metadata) => {
             return metadata.setting
                 ? `${metadata.setting}: ${JSON.stringify(metadata.old_value)} → ${JSON.stringify(metadata.new_value)}`
                 : '';
+        case 'db_admin_row_delete':
+            return metadata.table
+                ? `${metadata.table}.${metadata.pk_column}: ${truncate_middle(metadata.id, 12)}`
+                : '';
         default:
             return JSON.stringify(metadata);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.108.0",
+  "version": "0.110.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",