@fuzdev/fuz_app 0.109.0 → 0.110.0

package/dist/auth/CLAUDE.md

@@ -16,7 +16,7 @@ documents the cross-cutting invariants that don't fit on any single symbol.
 
 ## AppDeps split
 
-- **Capabilities** — `AppDeps` — stateless, injectable per env: `stat`, `read_text_file`, `delete_file`, `keyring`, `password`, `db`, `log`, `audit`.
+- **Capabilities** — `AppDeps` — stateless, injectable per env: `read_secure_file` (hardened bootstrap-token read), `delete_file`, `keyring`, `password`, `db`, `log`, `audit`.
 - **Route caps** — `RouteFactoryDeps` — `Omit<AppDeps, 'db'>`; handlers get `db` via `RouteContext`.
 - **Action caps** — `ActionFactoryDeps` (`auth/deps.ts`) — the `{log, audit}` shape action factories take; `RouteFactoryDeps`/`AppDeps` satisfy it structurally (role-grant-offer adds `notification_sender?`). The two pure-read actor factories (`actor_lookup`/`actor_search`) take only `{log: Logger}`.
 - **Parameters** — `*Options` — static startup values, per-factory.
@@ -32,7 +32,7 @@ over the pool so rows persist when request transactions roll back. See root
 ### Crypto primitives (pure, I/O-free)
 
 - `auth/keyring.ts` — `Keyring`, `create_keyring`, `validate_keyring`, `create_validated_keyring`.
-- `auth/session_cookie.ts` — `SessionOptions<T>`, `parse_session`, `process_session_cookie`, `create_session_config`, `fuz_session_config`, `SESSION_AGE_MAX`, `SESSION_REFRESH_THRESHOLD_S`.
+- `auth/session_cookie.ts` — `SessionOptions<T>`, `parse_session`, `process_session_cookie` (`'none' | 'clear'` — no refresh action; the 30-day lifetime is an absolute cap signed once at mint), `create_session_config`, `fuz_session_config`, `SESSION_AGE_MAX`.
 - `auth/password.ts` — `Password`, `PasswordProvided`, `PasswordHashDeps`, `PASSWORD_LENGTH_MIN` (12, OWASP), `PASSWORD_LENGTH_MAX` (300).
 - `auth/password_argon2.ts` — `hash_password`, `verify_password`, `verify_dummy`, `argon2_password_deps`.
 - `auth/api_token.ts` — `API_TOKEN_PREFIX` (`secret_fuz_token_`), `hash_api_token`, `generate_api_token`.
@@ -61,6 +61,7 @@ Convention — `*_schema.ts` is Zod-only; `*_ddl.ts` holds DDL strings.
 - `auth/scope_kind_schema.ts` — `ScopeKindName`, `create_scope_kind_schema` (open registry, no builtins).
 - `auth/credential_type_schema.ts` — `CredentialTypeName`, `CREDENTIAL_TYPE_SESSION` / `_API_TOKEN` / `_DAEMON_TOKEN`, `create_credential_type_schema`.
 - `auth/grant_path_schema.ts` — `GrantPathName`, `GRANT_PATH_ADMIN` / `_SELF_SERVICE` / `_SYSTEM` / `_BOOTSTRAP`, `create_grant_path_schema`.
+- `auth/token_lifetime.ts` — the temporal axis of a minted token: `TokenLifetimeInput` (required union on `account_token_create` — `{kind:'eternal'}` or `{kind:'ttl', days}`), `token_lifetime_to_expires_at`, `TOKEN_TTL_DAYS_MAX`. No default — `expires_at IS NULL` always means "deliberately eternal".
 - `auth/token_scope.ts` — per-credential authority narrowing stored on `api_token.scope`: `TokenScope` / `TokenScopeInput` + constructors, `parse_stored_token_scope` (fail-closed), `token_scope_admits_method` / `_non_rpc`, and the `<section>:<id>` capability vocabulary `RouteAuth.required_scope` is written in (`parse_token_scope_capability`, `token_scope_admits_capability`, `token_scope_denied_body`, `TOKEN_SURFACES`). Not an open registry — see ../../../docs/security.md §Token scoping for why the identifier half is deliberately unregistered.
 - `auth/auth_ddl.ts` — `CREATE TABLE` / index / seed strings for the core identity tables.
 - `auth/audit_log_schema.ts` — `AUDIT_EVENT_TYPES` (27 builtins), `AuditEventType` / `AuditEventTypeName`, `audit_metadata_schemas`, `AuditLogEvent`, `AuditLogInput`, `AuditLogConfig`, `create_audit_log_config`.
@@ -80,7 +81,7 @@ All take `deps: QueryDeps = {db}` first; `query_validate_api_token` adds `log`.
 - `auth/actor_search_queries.ts` — case-insensitive prefix search on `actor.name`, scope-filtered when not admin.
 - `auth/role_grant_queries.ts` — idempotent create, IDOR-guarded revoke (with in-tx supersede), scope-aware lookup, role/account predicates, `query_role_grant_revoke_for_scope` parent-scope cascade.
 - `auth/role_grant_offer_queries.ts` — offer create/decline/retract/list/history/sweep, atomic `query_accept_offer` with sibling supersede; error classes `RoleGrantOfferSelfTargetError` / `_AlreadyTerminalError` / `_ExpiredError` / `_NotFoundError` / `_ActorAccountMismatchError` / `_ActorMismatchError`.
-- `auth/session_queries.ts` — server-side sessions (blake3-hashed), `query_session_revoke_by_hash_unscoped` (logout only), `query_session_enforce_limit` (transaction-required).
+- `auth/session_queries.ts` — server-side sessions (blake3-hashed), `query_session_revoke_by_hash_unscoped` (logout only), `query_session_enforce_limit` (transaction-required). No touch/renewal query — `expires_at` is an absolute cap set at mint (`AUTH_SESSION_LIFETIME_MS`), and `last_seen_at` is decorative pending its own removal migration.
 - `auth/api_token_queries.ts` — token validation with fire-and-forget usage tracking, IDOR-guarded revoke, `query_api_token_enforce_limit` (transaction-required).
 - `auth/invite_queries.ts` — invite create/find/claim/list/delete; `query_invite_claim_unscoped` (scoping enforced upstream by `_find_unclaimed_match_for_update`, which runs inside the signup tx with `FOR UPDATE` so find + claim are atomic).
 - `auth/app_settings_queries.ts` — load/update for the single-row settings table.
@@ -162,7 +163,7 @@ Everything else listed under §RPC action surfaces.
 - `auth/request_context.ts` — `RequestContext`, `resolve_acting_actor`, `build_request_context`, predicates (`has_role`, `has_scoped_role`, `has_any_scoped_role`), guards (`require_auth`, `require_role`, `require_credential_types`, `require_token_scope`), `token_scope_surface_denial` (the direct-call form, for surfaces that aren't route specs), `refresh_role_grants`.
 - `auth/session_middleware.ts` — `process_session_cookie` integration, `create_session_and_set_cookie` (shared by login / signup / bootstrap).
 - `auth/bearer_auth.ts` — soft-fail bearer middleware; rejects when `Origin` or `Referer` present (browser context).
-- `auth/daemon_token_middleware.ts` — `start_daemon_token_rotation` + `create_daemon_token_middleware(state, deps, log)` (atomic file write, soft-fail validation, keeper account resolution). Soft-fails — discards the credential (pass-through, no own 401/503) on **every** non-success path: browser context (`Origin`/`Referer` present), malformed/invalid token, and valid-token-but-no-keeper all `next()` through to the dispatcher's `credential_type_required` (403) gate, mirroring the bearer guard and the Rust spine's `resolve.rs`. Daemon tokens are loopback-only, so browser context never arises in practice — the discard is defense-in-depth.
+- `auth/daemon_token_middleware.ts` — `create_daemon_token_middleware(state, deps, log)` — the credential **consumer** only (soft-fail validation, keeper account resolution). The producer (`write_daemon_token` / `start_daemon_token_rotation`) lives in `testing/daemon_token_rotation.ts` behind the dev-env guard — no production assembly mints daemon tokens, mirroring the Rust spine's `fuz_testing`-confined producer. Soft-fails — discards the credential (pass-through, no own 401/503) on **every** non-success path: browser context (`Origin`/`Referer` present), malformed/invalid token, and valid-token-but-no-keeper all `next()` through to the dispatcher's `credential_type_required` (403) gate, mirroring the bearer guard and the Rust spine's `resolve.rs`. Daemon tokens are loopback-only, so browser context never arises in practice — the discard is defense-in-depth.
 
 See root ../../../CLAUDE.md §Middleware Ordering for canonical assembly
 order. The auth-specific invariants are described below in §Cross-cutting
@@ -638,7 +639,7 @@ Options: `roles?: RoleSchemaResult` (drives admin-grant-path lookup),
 - `account_session_list_action_spec` — read; input `z.void()`; output `{sessions}`.
 - `account_session_revoke_action_spec` — mutation; input `{session_id}`; output `{ok, revoked}`.
 - `account_session_revoke_all_action_spec` — mutation; input `z.void()`; output `{ok, count}`.
-- `account_token_create_action_spec` — mutation; input `{name?}`; output `{ok, token, id, name}`.
+- `account_token_create_action_spec` — mutation; input `{name?, scope, lifetime}` (both `scope` and `lifetime` required — default-deny at mint on both axes); output `{ok, token, id, name, expires_at}`.
 - `account_token_list_action_spec` — read; input `z.void()`; output `{tokens}`.
 - `account_token_revoke_action_spec` — mutation; input `{token_id}`; output `{ok, revoked}`.
 

package/dist/auth/account_action_specs.d.ts

@@ -55,6 +55,10 @@ export type SessionRevokeAllOutput = z.infer<typeof SessionRevokeAllOutput>;
  * reversal of the 2026-02 design, where the field existed but nothing depended
  * on it. Because `scope` has no default, the object as a whole no longer
  * carries `.prefault({})`.
+ *
+ * `lifetime` follows the same rule — a never-expiring token is
+ * `{kind: 'eternal'}`, spelled out, so `expires_at IS NULL` always means
+ * "deliberately eternal" (see `auth/token_lifetime.ts`).
  */
 export declare const TokenCreateInput: z.ZodObject<{
     name: z.ZodDefault<z.ZodString>;
@@ -64,6 +68,12 @@ export declare const TokenCreateInput: z.ZodObject<{
         kind: z.ZodLiteral<"methods">;
         methods: z.ZodArray<z.ZodString>;
     }, z.core.$strict>], "kind">;
+    lifetime: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"eternal">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"ttl">;
+        days: z.ZodNumber;
+    }, z.core.$strict>], "kind">;
 }, z.core.$strict>;
 export type TokenCreateInput = z.infer<typeof TokenCreateInput>;
 /** Output for `account_token_create`. `token` is returned exactly once. */
@@ -72,6 +82,7 @@ export declare const TokenCreateOutput: z.ZodObject<{
     token: z.ZodString;
     id: z.ZodString;
     name: z.ZodString;
+    expires_at: z.ZodNullable<z.ZodString>;
 }, z.core.$strict>;
 export type TokenCreateOutput = z.infer<typeof TokenCreateOutput>;
 /** Input for `account_token_list`. No parameters. */
@@ -210,12 +221,19 @@ export declare const account_token_create_action_spec: {
             kind: z.ZodLiteral<"methods">;
             methods: z.ZodArray<z.ZodString>;
         }, z.core.$strict>], "kind">;
+        lifetime: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"eternal">;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"ttl">;
+            days: z.ZodNumber;
+        }, z.core.$strict>], "kind">;
     }, z.core.$strict>;
     output: z.ZodObject<{
         ok: z.ZodLiteral<true>;
         token: z.ZodString;
         id: z.ZodString;
         name: z.ZodString;
+        expires_at: z.ZodNullable<z.ZodString>;
     }, z.core.$strict>;
     async: true;
     description: string;

package/dist/auth/account_action_specs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAW3E,6EAA6E;AAC7E,eAAO,MAAM,WAAW,WAAW,CAAC;AACpC,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,uDAAuD;AACvD,eAAO,MAAM,gBAAgB,WAAW,CAAC;AACzC,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,yCAAyC;AACzC,eAAO,MAAM,iBAAiB;;;;;;;;kBAE5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB;;kBAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,iFAAiF;AACjF,eAAO,MAAM,mBAAmB;;;kBAG9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAC9C,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,+CAA+C;AAC/C,eAAO,MAAM,sBAAsB;;;kBAGjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;kBAW3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,2EAA2E;AAC3E,eAAO,MAAM,iBAAiB;;;;;kBAK5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,qDAAqD;AACrD,eAAO,MAAM,cAAc,WAAW,CAAC;AACvC,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,4DAA4D;AAC5D,eAAO,MAAM,eAAe;;;;;;;;;;;kBAE1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,wCAAwC;AACxC,eAAO,MAAM,gBAAgB;;kBAE3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB;;;kBAG5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAIlE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;CAUF,CAAC;AAEtC,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;CAUR,CAAC;AAKtC,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;CAUV,CAAC;AAGtC,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;CAUd,CAAC;AAEtC;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWR,CAAC;AAEtC,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;CAUN,CAAC;AAGtC,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAUR,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,KAAK,CAAC,yBAAyB,CAQrE,CAAC"}
+{"version":3,"file":"account_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAW3E,6EAA6E;AAC7E,eAAO,MAAM,WAAW,WAAW,CAAC;AACpC,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,uDAAuD;AACvD,eAAO,MAAM,gBAAgB,WAAW,CAAC;AACzC,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,yCAAyC;AACzC,eAAO,MAAM,iBAAiB;;;;;;;;kBAE5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB;;kBAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,iFAAiF;AACjF,eAAO,MAAM,mBAAmB;;;kBAG9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,6DAA6D;AAC7D,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAC9C,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,+CAA+C;AAC/C,eAAO,MAAM,sBAAsB;;;kBAGjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;kBAgB3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,2EAA2E;AAC3E,eAAO,MAAM,iBAAiB;;;;;;kBAS5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,qDAAqD;AACrD,eAAO,MAAM,cAAc,WAAW,CAAC;AACvC,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,4DAA4D;AAC5D,eAAO,MAAM,eAAe;;;;;;;;;;;kBAE1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,wCAAwC;AACxC,eAAO,MAAM,gBAAgB;;kBAE3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB;;;kBAG5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAIlE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;CAUF,CAAC;AAEtC,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;CAUR,CAAC;AAKtC,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;CAUV,CAAC;AAGtC,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;CAUd,CAAC;AAEtC;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWR,CAAC;AAEtC,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;CAUN,CAAC;AAGtC,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAUR,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,KAAK,CAAC,yBAAyB,CAQrE,CAAC"}

package/dist/auth/account_action_specs.js

@@ -9,6 +9,7 @@
  */
 import { z } from 'zod';
 import { TokenScopeInput } from './token_scope.js';
+import { TokenLifetimeInput } from './token_lifetime.js';
 import { AuthSessionJson, ClientApiTokenJson, SessionAccountJson, SessionId } from './account_schema.js';
 import { ApiTokenId } from './api_token.js';
 // -- Input/output schemas ---------------------------------------------------
@@ -45,6 +46,10 @@ export const SessionRevokeAllOutput = z.strictObject({
  * reversal of the 2026-02 design, where the field existed but nothing depended
  * on it. Because `scope` has no default, the object as a whole no longer
  * carries `.prefault({})`.
+ *
+ * `lifetime` follows the same rule — a never-expiring token is
+ * `{kind: 'eternal'}`, spelled out, so `expires_at IS NULL` always means
+ * "deliberately eternal" (see `auth/token_lifetime.ts`).
  */
 export const TokenCreateInput = z.strictObject({
     name: z
@@ -55,6 +60,10 @@ export const TokenCreateInput = z.strictObject({
         description: "What the token may do. `{kind:'full'}` for full account authority, or " +
             "`{kind:'methods',methods:[…]}` to narrow it to named RPC methods — a " +
             'narrowed token is RPC-only and reaches no non-RPC surface.'
+    }),
+    lifetime: TokenLifetimeInput.meta({
+        description: "How long the token lives. `{kind:'eternal'}` never expires; " +
+            "`{kind:'ttl',days:N}` expires N days from mint."
     })
 });
 /** Output for `account_token_create`. `token` is returned exactly once. */
@@ -62,7 +71,11 @@ export const TokenCreateOutput = z.strictObject({
     ok: z.literal(true),
     token: z.string().meta({ description: 'Raw token — shown once, store securely.' }),
     id: ApiTokenId,
-    name: z.string()
+    name: z.string(),
+    expires_at: z
+        .string()
+        .nullable()
+        .meta({ description: 'ISO 8601 expiry, or `null` for an eternal token.' })
 });
 /** Input for `account_token_list`. No parameters. */
 export const TokenListInput = z.void();

package/dist/auth/account_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAsC,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC9F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAoBxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAwBnD,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACpC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC5C;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,iBAAiB,EACvB,UAAS,oBAAyB,KAChC,KAAK,CAAC,SAAS,CAqJjB,CAAC"}
+{"version":3,"file":"account_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAsC,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC9F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAqBxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAwBnD,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACpC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC5C;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,iBAAiB,EACvB,UAAS,oBAAyB,KAChC,KAAK,CAAC,SAAS,CAgKjB,CAAC"}

package/dist/auth/account_actions.js

@@ -27,6 +27,7 @@ import { to_session_account } from './account_schema.js';
 import { query_session_list_for_account, query_session_revoke_for_account, query_session_revoke_all_for_account } from './session_queries.js';
 import { query_api_token_enforce_limit, query_api_token_list_for_account, query_create_api_token, query_revoke_api_token_for_account } from './api_token_queries.js';
 import { parse_stored_token_scope, token_scope_from_input, token_scope_label } from './token_scope.js';
+import { token_lifetime_to_expires_at } from './token_lifetime.js';
 import { generate_api_token } from './api_token.js';
 import { DEFAULT_MAX_TOKENS } from './account_route_schema.js';
 import { account_verify_action_spec, account_session_list_action_spec, account_session_revoke_action_spec, account_session_revoke_all_action_spec, account_token_create_action_spec, account_token_list_action_spec, account_token_revoke_action_spec } from './account_action_specs.js';
@@ -102,7 +103,10 @@ export const create_account_actions = (deps, options = {}) => {
         // There is deliberately no permissive fallback here: an omitted scope is
         // a validation error upstream, not a full-authority token.
         const scope = token_scope_from_input(input.scope);
-        await query_create_api_token(ctx, id, ctx.auth.account.id, input.name, token_hash, scope);
+        // `input.lifetime` is required for the same reason — an omitted lifetime
+        // is a validation error, never an eternal token.
+        const expires_at = token_lifetime_to_expires_at(input.lifetime);
+        await query_create_api_token(ctx, id, ctx.auth.account.id, input.name, token_hash, scope, expires_at);
         if (max_tokens != null) {
             await query_api_token_enforce_limit(ctx, ctx.auth.account.id, max_tokens);
         }
@@ -116,7 +120,7 @@ export const create_account_actions = (deps, options = {}) => {
                 credential_type: ctx.credential_type ?? undefined
             }
         });
-        return { ok: true, token, id, name: input.name };
+        return { ok: true, token, id, name: input.name, expires_at: expires_at?.toISOString() ?? null };
     };
     const token_list_handler = async (_input, ctx) => {
         const rows = await query_api_token_list_for_account(ctx, ctx.auth.account.id);

package/dist/auth/bootstrap_account.d.ts

@@ -51,8 +51,13 @@ export interface BootstrapAccountDeps {
     db: Db;
     /** Path to the bootstrap token file on disk. */
     token_path: string;
-    /** Read a file's contents as a string. */
-    read_text_file: (path: string) => Promise<string>;
+    /**
+     * Hardened secret-file read (see `FsSecureReadDeps.read_secure_file`) —
+     * the token mints the keeper account, so a symlinked, group/other-readable,
+     * or oversized file must refuse rather than be honored. Throws on refusal;
+     * every throw reads as `TOKEN_FILE_MISSING` upstream.
+     */
+    read_secure_file: (path: string) => Promise<Uint8Array>;
     /** Delete a file. */
     delete_file: (path: string) => Promise<void>;
     /** Only hashing is needed — verification happens separately during login. */

package/dist/auth/bootstrap_account.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap_account.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/bootstrap_account.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACN,mBAAmB,EACnB,0BAA0B,EAC1B,wBAAwB,EACxB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGrE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,gDAAgD;AAChD,MAAM,WAAW,qBAAqB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,6DAA6D;AAC7D,MAAM,WAAW,uBAAuB;IACvC,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,SAAS,CAAA;KAAE,CAAC;IACrD,wFAAwF;IACxF,kBAAkB,EAAE,OAAO,CAAC;CAC5B;AAED,gCAAgC;AAChC,MAAM,MAAM,uBAAuB,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,0BAA0B,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,GACpE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,wBAAwB,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,GAClE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,mBAAmB,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AAEjE,qFAAqF;AACrF,MAAM,MAAM,sBAAsB,GAAG,uBAAuB,GAAG,uBAAuB,CAAC;AAEvF;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,EAAE,EAAE,EAAE,CAAC;IACP,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,qBAAqB;IACrB,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,6EAA6E;IAC7E,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;IAClD,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,oBAAoB,EAC1B,gBAAgB,MAAM,EACtB,OAAO,qBAAqB,KAC1B,OAAO,CAAC,sBAAsB,CAuEhC,CAAC"}
+{"version":3,"file":"bootstrap_account.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/bootstrap_account.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACN,mBAAmB,EACnB,0BAA0B,EAC1B,wBAAwB,EACxB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGrE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,gDAAgD;AAChD,MAAM,WAAW,qBAAqB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,6DAA6D;AAC7D,MAAM,WAAW,uBAAuB;IACvC,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,SAAS,CAAA;KAAE,CAAC;IACrD,wFAAwF;IACxF,kBAAkB,EAAE,OAAO,CAAC;CAC5B;AAED,gCAAgC;AAChC,MAAM,MAAM,uBAAuB,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,0BAA0B,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,GACpE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,wBAAwB,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,GAClE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,mBAAmB,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AAEjE,qFAAqF;AACrF,MAAM,MAAM,sBAAsB,GAAG,uBAAuB,GAAG,uBAAuB,CAAC;AAEvF;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,EAAE,EAAE,EAAE,CAAC;IACP,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,qBAAqB;IACrB,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,6EAA6E;IAC7E,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;IAClD,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,oBAAoB,EAC1B,gBAAgB,MAAM,EACtB,OAAO,qBAAqB,KAC1B,OAAO,CAAC,sBAAsB,CA2EhC,CAAC"}

package/dist/auth/bootstrap_account.js

@@ -7,6 +7,7 @@
  * @module
  */
 import { timingSafeEqual } from 'node:crypto';
+import { to_error_message } from '@fuzdev/fuz_util/error.ts';
 import { ERROR_INVALID_TOKEN, ERROR_ALREADY_BOOTSTRAPPED, ERROR_TOKEN_FILE_MISSING } from '../http/error_schemas.js';
 import { ROLE_ADMIN, ROLE_KEEPER } from './role_schema.js';
 import { query_create_account_with_actor } from './account_queries.js';
@@ -33,13 +34,17 @@ import { query_create_role_grant } from './role_grant_queries.js';
  * @mutates filesystem - deletes the bootstrap token file after commit (reported via `token_file_deleted`)
  */
 export const bootstrap_account = async (deps, provided_token, input) => {
-    const { db, token_path, read_text_file, delete_file, password, log } = deps;
-    // 1. Read and verify token (non-destructive, before transaction)
+    const { db, token_path, read_secure_file, delete_file, password, log } = deps;
+    // 1. Read and verify token (non-destructive, before transaction). The
+    // secure read fails loud on a symlink / permissive mode / oversized file —
+    // every refusal masks as the same TOKEN_FILE_MISSING the wire always
+    // carried, with the specific reason logged for the operator.
     let expected_token;
     try {
-        expected_token = (await read_text_file(token_path)).trim();
+        expected_token = new TextDecoder().decode(await read_secure_file(token_path)).trim();
     }
-    catch {
+    catch (err) {
+        log.warn(`bootstrap token file rejected: ${to_error_message(err)}`);
         return { ok: false, error: ERROR_TOKEN_FILE_MISSING, status: 404 };
     }
     // Defense-in-depth: no .trim() on provided_token — tokens must match exactly.

package/dist/auth/bootstrap_routes.d.ts

@@ -14,7 +14,6 @@ import type { Db } from '../db/db.js';
 import { type RouteSpec } from '../http/route_spec.js';
 import { type RateLimiter } from '../rate_limiter.js';
 import type { RouteFactoryDeps } from './deps.js';
-import type { StatResult } from '../runtime/deps.js';
 /**
  * Bootstrap status — runtime state computed once at startup.
  */
@@ -54,8 +53,10 @@ export interface BootstrapRouteOptions {
  * Dependencies for checking bootstrap status at startup.
  */
 export interface CheckBootstrapStatusDeps {
-    stat: (path: string) => Promise<StatResult | null>;
-    db: Db;
+    /** Hardened secret-file read — the same capability the request-time read uses. */
+    read_secure_file: (path: string) => Promise<Uint8Array>;
+    /** Only the single-row `bootstrap_lock` read — narrower than the full `Db`. */
+    db: Pick<Db, 'query_one'>;
     log: Logger;
 }
 /**
@@ -63,9 +64,16 @@ export interface CheckBootstrapStatusDeps {
  *
  * Bootstrap is available when:
  * 1. A token path is configured
- * 2. The token file exists on disk
+ * 2. The token file passes the secure read (exists, not a symlink, mode
+ *    `0600`/`0400`, within the size cap)
  * 3. The `bootstrap_lock` table shows `bootstrapped = false`
  *
+ * The probe **reads through the same `read_secure_file` the request-time
+ * read uses**, so "bootstrap is available" and "the token file can actually
+ * be read" can't drift apart — an availability check laxer than the read it
+ * gates is the misconfiguration that reports green at boot and fails at
+ * request time. Twin of the Rust spine's `is_bootstrap_available`.
+ *
  * @param deps - filesystem and database access for the check
  * @param options - static configuration including `token_path`
  * @returns an object with `available` (boolean) and `token_path` (string | null)

package/dist/auth/bootstrap_routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/bootstrap_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAAqB,KAAK,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEzF,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAExE,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGrD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACrC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,8EAA8E;IAC9E,gBAAgB,EAAE,eAAe,CAAC;IAClC;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,uBAAuB,EAAE,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E;;;;;;;;;;OAUG;IACH,yBAAyB,EAAE,WAAW,GAAG,IAAI,CAAC;CAC9C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACxC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnD,EAAE,EAAE,EAAE,CAAC;IACP,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,wBAAwB,EAC9B,SAAS;IAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,KACpC,OAAO,CAAC,eAAe,CAwBzB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,gBAAgB,EACtB,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CAmHjB,CAAC"}
+{"version":3,"file":"bootstrap_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/bootstrap_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAAqB,KAAK,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEzF,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAExE,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAGlD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACrC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,8EAA8E;IAC9E,gBAAgB,EAAE,eAAe,CAAC;IAClC;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,uBAAuB,EAAE,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E;;;;;;;;;;OAUG;IACH,yBAAyB,EAAE,WAAW,GAAG,IAAI,CAAC;CAC9C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACxC,kFAAkF;IAClF,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,+EAA+E;IAC/E,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,wBAAwB,EAC9B,SAAS;IAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,KACpC,OAAO,CAAC,eAAe,CAyBzB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,gBAAgB,EACtB,SAAS,qBAAqB,KAC5B,KAAK,CAAC,SAAS,CAmHjB,CAAC"}

package/dist/auth/bootstrap_routes.js

@@ -19,22 +19,31 @@ import { ERROR_ALREADY_BOOTSTRAPPED, ERROR_TOKEN_FILE_MISSING } from '../http/er
  *
  * Bootstrap is available when:
  * 1. A token path is configured
- * 2. The token file exists on disk
+ * 2. The token file passes the secure read (exists, not a symlink, mode
+ *    `0600`/`0400`, within the size cap)
  * 3. The `bootstrap_lock` table shows `bootstrapped = false`
  *
+ * The probe **reads through the same `read_secure_file` the request-time
+ * read uses**, so "bootstrap is available" and "the token file can actually
+ * be read" can't drift apart — an availability check laxer than the read it
+ * gates is the misconfiguration that reports green at boot and fails at
+ * request time. Twin of the Rust spine's `is_bootstrap_available`.
+ *
  * @param deps - filesystem and database access for the check
  * @param options - static configuration including `token_path`
  * @returns an object with `available` (boolean) and `token_path` (string | null)
  */
 export const check_bootstrap_status = async (deps, options) => {
-    const { stat, db, log } = deps;
+    const { read_secure_file, db, log } = deps;
     const { token_path } = options;
     if (!token_path) {
         return { available: false, token_path: null };
     }
-    const token_stat = await stat(token_path);
-    if (token_stat === null) {
-        log.info('Bootstrap unavailable: token file not found');
+    try {
+        await read_secure_file(token_path);
+    }
+    catch (err) {
+        log.info(`Bootstrap unavailable: ${to_error_message(err)}`);
         return { available: false, token_path };
     }
     const lock_row = await db.query_one('SELECT bootstrapped FROM bootstrap_lock WHERE id = 1');
@@ -81,7 +90,7 @@ export const create_bootstrap_route_specs = (deps, options) => {
                 const result = await bootstrap_account({
                     db: route.db,
                     token_path,
-                    read_text_file: deps.read_text_file,
+                    read_secure_file: deps.read_secure_file,
                     delete_file: deps.delete_file,
                     password: deps.password,
                     log: deps.log

package/dist/auth/daemon_token_middleware.d.ts

@@ -1,8 +1,12 @@
 /**
- * Daemon token rotation, persistence, and middleware.
+ * Daemon token middleware — the credential **consumer**.
  *
- * Manages the lifecycle of filesystem-resident daemon tokens: writing to disk,
- * rotation on an interval, and HTTP middleware for authentication.
+ * Validates a presented `X-Daemon-Token` and resolves the keeper account.
+ * The producer half (rotation + file persistence) lives in
+ * `testing/daemon_token_rotation.ts` behind the dev-env guard: no production
+ * assembly mints daemon tokens — the credential's only remaining role is the
+ * cross-process test harness's keeper channel — mirroring the Rust spine,
+ * whose producer is confined to `fuz_testing`.
  *
  * Pure token primitives (schema, generation, validation) live in `auth/daemon_token.ts`.
  * See docs/identity.md for design rationale.
@@ -11,40 +15,8 @@
  */
 import type { MiddlewareHandler } from 'hono';
 import type { Logger } from '@fuzdev/fuz_util/log.ts';
-import { type FsWriteDeps, type FsRemoveDeps, type EnvDeps } from '../runtime/deps.js';
 import type { QueryDeps } from '../db/query_deps.js';
 import { type DaemonTokenState } from './daemon_token.js';
-/** Default rotation interval in milliseconds (30 seconds). */
-export declare const DEFAULT_ROTATION_INTERVAL_MS = 30000;
-/** Deps for writing the daemon token to disk. */
-export type DaemonTokenWriteDeps = Pick<EnvDeps, 'env_get'> & Pick<FsWriteDeps, 'mkdir' | 'write_text_file' | 'rename'> & {
-    /** Set file permissions. Optional — consumers provide when available (e.g. `Deno.chmod`). */
-    chmod?: (path: string, mode: number) => Promise<void>;
-};
-/**
- * Get the daemon token file path (`~/.{name}/run/daemon_token`).
- *
- * @param runtime - runtime with `env_get` capability
- * @param name - application name
- * @returns path to `daemon_token`, or `null` if `$HOME` is not set
- */
-export declare const get_daemon_token_path: (runtime: Pick<EnvDeps, "env_get">, name: string) => string | null;
-/**
- * Write the current token to disk atomically.
- *
- * Uses `write_file_atomic` (temp file + rename) and optionally sets mode 0600.
- *
- * On-disk format is JSON `{"token": "..."}` — the wrapper leaves room for
- * future fields (rotated_at, version) without changing every reader. Both
- * the TS cross-backend harness reader (`spawn_backend.read_daemon_token`)
- * and the Rust daemon-token writer match this shape.
- *
- * @param runtime - runtime with file write capabilities
- * @param token_path - path to write the token
- * @param token - the raw token string
- * @mutates filesystem - writes `token_path` atomically and `chmod 0600` when supported
- */
-export declare const write_daemon_token: (runtime: DaemonTokenWriteDeps, token_path: string, token: string) => Promise<void>;
 /**
  * Resolve the keeper account ID by querying for the account with an active
  * keeper role_grant.
@@ -61,40 +33,6 @@ export declare const write_daemon_token: (runtime: DaemonTokenWriteDeps, token_p
  * @returns the keeper account ID, or `null` if no keeper exists yet (pre-bootstrap)
  */
 export declare const resolve_keeper_account_id: (deps: QueryDeps) => Promise<string | null>;
-/** Options for daemon token rotation. */
-export interface DaemonTokenRotationOptions {
-    /**
-     * Absolute path the token file is written to. Caller computes from
-     * its own conventions — e.g. `get_daemon_token_path(runtime, app_name)`
-     * for the standard `~/.{name}/run/daemon_token` layout, or a path
-     * derived from `PUBLIC_<APP>_DIR` for cross-process test setups that
-     * isolate the app dir to a tmpdir.
-     */
-    token_path: string;
-    /** Rotation interval in ms. Default: `30000` (30s). */
-    rotation_interval_ms?: number;
-}
-/** Result of starting daemon token rotation. */
-export interface DaemonTokenRotation {
-    /** The mutable runtime state. Pass to `create_daemon_token_middleware`. */
-    state: DaemonTokenState;
-    /** Stop rotation, clean up the interval, and delete the token file. Call on graceful shutdown. */
-    stop: () => Promise<void>;
-}
-/**
- * Start daemon token rotation.
- *
- * Generates an initial token, writes it to disk, resolves the keeper account,
- * and sets up periodic rotation. Returns the mutable state object and a stop function.
- *
- * @param runtime - runtime with file and remove capabilities
- * @param deps - query dependencies for resolving keeper account
- * @param options - rotation configuration
- * @param log - the logger instance
- * @returns rotation state and stop function
- * @mutates filesystem - writes the token file on each rotation; `stop` removes it
- */
-export declare const start_daemon_token_rotation: (runtime: DaemonTokenWriteDeps & FsRemoveDeps, deps: QueryDeps, options: DaemonTokenRotationOptions, log: Logger) => Promise<DaemonTokenRotation>;
 /**
  * Create middleware that authenticates via daemon token.
  *

package/dist/auth/daemon_token_middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon_token_middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/daemon_token_middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAYvF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAKN,KAAK,gBAAgB,EACrB,MAAM,mBAAmB,CAAC;AAE3B,8DAA8D;AAC9D,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD,iDAAiD;AACjD,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,GAC1D,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,iBAAiB,GAAG,QAAQ,CAAC,GAAG;IAC3D,6FAA6F;IAC7F,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,EACjC,MAAM,MAAM,KACV,MAAM,GAAG,IAGX,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,kBAAkB,GAC9B,SAAS,oBAAoB,EAC7B,YAAY,MAAM,EAClB,OAAO,MAAM,KACX,OAAO,CAAC,IAAI,CAKd,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,yBAAyB,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAEtF,CAAC;AAEF,yCAAyC;AACzC,MAAM,WAAW,0BAA0B;IAC1C;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,gDAAgD;AAChD,MAAM,WAAW,mBAAmB;IACnC,2EAA2E;IAC3E,KAAK,EAAE,gBAAgB,CAAC;IACxB,kGAAkG;IAClG,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,2BAA2B,GACvC,SAAS,oBAAoB,GAAG,YAAY,EAC5C,MAAM,SAAS,EACf,SAAS,0BAA0B,EACnC,KAAK,MAAM,KACT,OAAO,CAAC,mBAAmB,CAqD7B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,eAAO,MAAM,8BAA8B,GAC1C,OAAO,gBAAgB,EACvB,MAAM,SAAS,EACf,KAAK,MAAM,KACT,iBA0EF,CAAC"}
+{"version":3,"file":"daemon_token_middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/daemon_token_middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAWtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAIN,KAAK,gBAAgB,EACrB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,yBAAyB,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAEtF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,eAAO,MAAM,8BAA8B,GAC1C,OAAO,gBAAgB,EACvB,MAAM,SAAS,EACf,KAAK,MAAM,KACT,iBA0EF,CAAC"}

package/dist/auth/daemon_token_middleware.js

@@ -1,8 +1,12 @@
 /**
- * Daemon token rotation, persistence, and middleware.
+ * Daemon token middleware — the credential **consumer**.
  *
- * Manages the lifecycle of filesystem-resident daemon tokens: writing to disk,
- * rotation on an interval, and HTTP middleware for authentication.
+ * Validates a presented `X-Daemon-Token` and resolves the keeper account.
+ * The producer half (rotation + file persistence) lives in
+ * `testing/daemon_token_rotation.ts` behind the dev-env guard: no production
+ * assembly mints daemon tokens — the credential's only remaining role is the
+ * cross-process test harness's keeper channel — mirroring the Rust spine,
+ * whose producer is confined to `fuz_testing`.
  *
  * Pure token primitives (schema, generation, validation) live in `auth/daemon_token.ts`.
  * See docs/identity.md for design rationale.
@@ -10,49 +14,12 @@
  * @module
  */
 import { DEV } from 'esm-env';
-import {} from '../runtime/deps.js';
-import { write_file_atomic } from '../runtime/fs.js';
-import { get_app_dir } from '../cli/config.js';
 import { ACCOUNT_ID_KEY, AUTH_API_TOKEN_ID_KEY, CREDENTIAL_TYPE_KEY, TOKEN_SCOPE_KEY } from '../hono_context.js';
 import { token_scope_full } from './token_scope.js';
 import { is_browser_context } from '../http/origin.js';
 import { query_role_grant_find_account_id_for_role } from './role_grant_queries.js';
 import { ROLE_KEEPER } from './role_schema.js';
-import { DaemonToken, DAEMON_TOKEN_HEADER, generate_daemon_token, validate_daemon_token } from './daemon_token.js';
-/** Default rotation interval in milliseconds (30 seconds). */
-export const DEFAULT_ROTATION_INTERVAL_MS = 30_000;
-/**
- * Get the daemon token file path (`~/.{name}/run/daemon_token`).
- *
- * @param runtime - runtime with `env_get` capability
- * @param name - application name
- * @returns path to `daemon_token`, or `null` if `$HOME` is not set
- */
-export const get_daemon_token_path = (runtime, name) => {
-    const app_dir = get_app_dir(runtime, name);
-    return app_dir ? `${app_dir}/run/daemon_token` : null;
-};
-/**
- * Write the current token to disk atomically.
- *
- * Uses `write_file_atomic` (temp file + rename) and optionally sets mode 0600.
- *
- * On-disk format is JSON `{"token": "..."}` — the wrapper leaves room for
- * future fields (rotated_at, version) without changing every reader. Both
- * the TS cross-backend harness reader (`spawn_backend.read_daemon_token`)
- * and the Rust daemon-token writer match this shape.
- *
- * @param runtime - runtime with file write capabilities
- * @param token_path - path to write the token
- * @param token - the raw token string
- * @mutates filesystem - writes `token_path` atomically and `chmod 0600` when supported
- */
-export const write_daemon_token = async (runtime, token_path, token) => {
-    await write_file_atomic(runtime, token_path, JSON.stringify({ token }) + '\n');
-    if (runtime.chmod) {
-        await runtime.chmod(token_path, 0o600);
-    }
-};
+import { DaemonToken, DAEMON_TOKEN_HEADER, validate_daemon_token } from './daemon_token.js';
 /**
  * Resolve the keeper account ID by querying for the account with an active
  * keeper role_grant.
@@ -71,69 +38,6 @@ export const write_daemon_token = async (runtime, token_path, token) => {
 export const resolve_keeper_account_id = async (deps) => {
     return query_role_grant_find_account_id_for_role(deps, ROLE_KEEPER);
 };
-/**
- * Start daemon token rotation.
- *
- * Generates an initial token, writes it to disk, resolves the keeper account,
- * and sets up periodic rotation. Returns the mutable state object and a stop function.
- *
- * @param runtime - runtime with file and remove capabilities
- * @param deps - query dependencies for resolving keeper account
- * @param options - rotation configuration
- * @param log - the logger instance
- * @returns rotation state and stop function
- * @mutates filesystem - writes the token file on each rotation; `stop` removes it
- */
-export const start_daemon_token_rotation = async (runtime, deps, options, log) => {
-    const { token_path, rotation_interval_ms = DEFAULT_ROTATION_INTERVAL_MS } = options;
-    // ensure parent directory exists
-    const last_slash = token_path.lastIndexOf('/');
-    if (last_slash > 0) {
-        await runtime.mkdir(token_path.slice(0, last_slash), { recursive: true });
-    }
-    // resolve keeper account (may be null pre-bootstrap; the middleware
-    // lazily refreshes on the first null hit to cover the
-    // rotation-starts-before-bootstrap case)
-    const keeper_account_id = await resolve_keeper_account_id(deps);
-    // generate initial token and write to disk
-    const initial_token = generate_daemon_token();
-    await write_daemon_token(runtime, token_path, initial_token);
-    const state = {
-        current_token: initial_token,
-        previous_token: null,
-        rotated_at: new Date(),
-        keeper_account_id
-    };
-    let writing = false;
-    const interval_id = setInterval(async () => {
-        if (writing)
-            return; // skip if previous rotation write still in progress
-        writing = true;
-        try {
-            const new_token = generate_daemon_token();
-            state.previous_token = state.current_token;
-            state.current_token = new_token;
-            state.rotated_at = new Date();
-            await write_daemon_token(runtime, token_path, new_token);
-        }
-        catch (err) {
-            log.error('Failed to write rotated token:', err);
-        }
-        finally {
-            writing = false;
-        }
-    }, rotation_interval_ms);
-    const stop = async () => {
-        clearInterval(interval_id);
-        try {
-            await runtime.remove(token_path);
-        }
-        catch {
-            // already removed or never written
-        }
-    };
-    return { state, stop };
-};
 /**
  * Create middleware that authenticates via daemon token.
  *

package/dist/auth/deps.d.ts

@@ -12,7 +12,6 @@ import type { FactStore } from '@fuzdev/fuz_util/fact_store.ts';
 import type { Keyring } from './keyring.js';
 import type { PasswordHashDeps } from './password.js';
 import type { Db } from '../db/db.js';
-import type { StatResult } from '../runtime/deps.js';
 import type { AuditEmitter } from './audit_emitter.js';
 /**
  * Stateless capabilities bundle for fuz_app backends.
@@ -21,10 +20,15 @@ import type { AuditEmitter } from './audit_emitter.js';
  * Does not contain config (static values) or runtime state (mutable refs).
  */
 export interface AppDeps {
-    /** Get file/directory stats, or null if path doesn't exist. */
-    stat: (path: string) => Promise<StatResult | null>;
-    /** Read a file as text. */
-    read_text_file: (path: string) => Promise<string>;
+    /**
+     * Hardened secret-file read — used for the bootstrap token (the file that
+     * mints the keeper account). Production wiring passes the runtime's
+     * `read_secure_file` (`FsSecureReadDeps`), which rejects symlinks,
+     * group/other-accessible modes, and oversized files; both the boot-time
+     * availability probe and the request-time read go through this one
+     * capability so the probe can never be laxer than the read it gates.
+     */
+    read_secure_file: (path: string) => Promise<Uint8Array>;
     /** Delete a file. */
     delete_file: (path: string) => Promise<void>;
     /** HMAC-SHA256 cookie signing keyring. */