@fuzdev/fuz_app 0.109.0 → 0.110.1

package/dist/auth/deps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deps.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACvB,+DAA+D;IAC/D,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnD,2BAA2B;IAC3B,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,qBAAqB;IACrB,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,0CAA0C;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,yBAAyB;IACzB,EAAE,EAAE,EAAE,CAAC;IACP,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,KAAK,EAAE,YAAY,CAAC;IACpB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,SAAS,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAEnD;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IACjC,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,4DAA4D;IAC5D,KAAK,EAAE,YAAY,CAAC;CACpB"}
+{"version":3,"file":"deps.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACvB;;;;;;;OAOG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,qBAAqB;IACrB,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,0CAA0C;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,yBAAyB;IACzB,EAAE,EAAE,EAAE,CAAC;IACP,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,KAAK,EAAE,YAAY,CAAC;IACpB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,SAAS,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAEnD;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IACjC,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,4DAA4D;IAC5D,KAAK,EAAE,YAAY,CAAC;CACpB"}

package/dist/auth/middleware.js

@@ -35,7 +35,7 @@ export const create_auth_middleware_specs = async (deps, options) => {
         import('./bearer_auth.js')
     ]);
     const session_middleware = create_session_middleware(keyring, session_options);
-    const request_context_middleware = create_request_context_middleware(query_deps, deps.log);
+    const request_context_middleware = create_request_context_middleware(query_deps);
     const bearer_auth_middleware = create_bearer_auth_middleware(query_deps, deps.log);
     const specs = [
         {

package/dist/auth/request_context.d.ts

@@ -35,7 +35,6 @@
  * @module
  */
 import type { Context, MiddlewareHandler } from 'hono';
-import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import { type Account, type Actor, type RoleGrant } from './account_schema.js';
 import type { QueryDeps } from '../db/query_deps.js';
 import type { RouteSpec } from '../http/route_spec.js';
@@ -224,11 +223,10 @@ export declare const resolve_acting_actor: (deps: QueryDeps, account_id: string,
  * `require_auth` / `require_role` enforce.
  *
  * @param deps - query dependencies (pool-level db for middleware)
- * @param log - the logger instance
  * @param session_context_key - the Hono context key where session middleware stored the session token
  * @mutates Hono context - sets `ACCOUNT_ID_KEY`, `CREDENTIAL_TYPE_KEY`, `AUTH_SESSION_TOKEN_HASH_KEY`, and `AUTH_API_TOKEN_ID_KEY`
  */
-export declare const create_request_context_middleware: (deps: QueryDeps, log: Logger, session_context_key?: string) => MiddlewareHandler;
+export declare const create_request_context_middleware: (deps: QueryDeps, session_context_key?: string) => MiddlewareHandler;
 /**
  * Refuse a non-RPC surface to a narrowed token — rule 3, for callers that are
  * not route specs. Under the Rust twin's name

package/dist/auth/request_context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request_context.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/request_context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,KAAK,EAEV,KAAK,SAAS,EACd,MAAM,qBAAqB,CAAC;AAY7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAgBrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAA6C,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElG,OAAO,EAIN,oBAAoB,EACpB,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,EACtB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;CAC9B;AAED,0DAA0D;AAC1D,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,GAAG,OAAO,KAAG,cAAc,GAAG,IAEjE,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,GAAI,GAAG,OAAO,KAAG,cAQpD,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAoB,SAAQ,cAAc;IAC1D,KAAK,EAAE,KAAK,CAAC;CACb;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,QAAQ,GACpB,KAAK,cAAc,GAAG,IAAI,EAC1B,MAAM,MAAM,EACZ,MAAK,IAAiB,KACpB,OACoF,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,eAAe,GAC3B,KAAK,cAAc,GAAG,IAAI,EAC1B,MAAM,MAAM,EACZ,UAAU,MAAM,GAAG,IAAI,EACvB,MAAK,IAAiB,KACpB,OAKF,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,cAAc,GAAG,IAAI,EAC1B,OAAO,aAAa,CAAC,MAAM,CAAC,EAC5B,UAAU,MAAM,GAAG,IAAI,EACvB,MAAK,IAAiB,KACpB,OAMF,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAClC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,SAAS,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GACvF;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,iBAAiB,MAAM,GAAG,SAAS,KACjC,OAAO,CAAC,wBAAwB,CAclC,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,iCAAiC,GAC7C,MAAM,SAAS,EACf,KAAK,MAAM,EACX,4BAAuC,KACrC,iBAgCF,CAAC;AAuBF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,0BAA0B,GAAI,GAAG,OAAO,EAAE,YAAY,MAAM,KAAG,QAAQ,GAAG,IAChC,CAAC;AAExD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,GAAI,YAAY,MAAM,KAAG,iBAYxD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,iBAK1B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,aAAa,CAAC,MAAM,CAAC,KAAG,iBAW3D,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,wBAAwB,GACpC,kBAAkB,aAAa,CAAC,MAAM,CAAC,KACrC,iBAiBF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,cAAc,EACnB,MAAM,SAAS,KACb,OAAO,CAAC,cAAc,CAQxB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,UAAU,MAAM,KACd,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAUpC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,cAAc,GAAG,IAAI,CAI/B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,wBAAwB,GACjC;IAAE,KAAK,EAAE,OAAO,oBAAoB,CAAC;IAAC,SAAS,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GACtF;IAAE,KAAK,EAAE,OAAO,0BAA0B,CAAA;CAAE,GAC5C;IAAE,KAAK,EAAE,OAAO,0BAA0B,CAAA;CAAE,GAC5C;IAAE,KAAK,EAAE,OAAO,sBAAsB,CAAA;CAAE,CAAC;AAE5C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,mBAAmB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,eAAe,EAAE,cAAc,GAAG,IAAI,CAAA;CAAE,GACpD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,IAAI,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,YAAY,MAAM,GAAG,IAAI,EACzB,MAAM,SAAS,EACf,cAAc,MAAM,GAAG,SAAS,KAC9B,OAAO,CAAC,mBAAmB,CAwC7B,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,KACb,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAoB5D,CAAC"}
+{"version":3,"file":"request_context.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/request_context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAEvD,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,KAAK,EAEV,KAAK,SAAS,EACd,MAAM,qBAAqB,CAAC;AAQ7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAgBrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAA6C,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElG,OAAO,EAIN,oBAAoB,EACpB,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,EACtB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;CAC9B;AAED,0DAA0D;AAC1D,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,GAAG,OAAO,KAAG,cAAc,GAAG,IAEjE,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,GAAI,GAAG,OAAO,KAAG,cAQpD,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAoB,SAAQ,cAAc;IAC1D,KAAK,EAAE,KAAK,CAAC;CACb;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,QAAQ,GACpB,KAAK,cAAc,GAAG,IAAI,EAC1B,MAAM,MAAM,EACZ,MAAK,IAAiB,KACpB,OACoF,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,eAAe,GAC3B,KAAK,cAAc,GAAG,IAAI,EAC1B,MAAM,MAAM,EACZ,UAAU,MAAM,GAAG,IAAI,EACvB,MAAK,IAAiB,KACpB,OAKF,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,cAAc,GAAG,IAAI,EAC1B,OAAO,aAAa,CAAC,MAAM,CAAC,EAC5B,UAAU,MAAM,GAAG,IAAI,EACvB,MAAK,IAAiB,KACpB,OAMF,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAClC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,SAAS,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GACvF;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,iBAAiB,MAAM,GAAG,SAAS,KACjC,OAAO,CAAC,wBAAwB,CAclC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iCAAiC,GAC7C,MAAM,SAAS,EACf,4BAAuC,KACrC,iBA6BF,CAAC;AAuBF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,0BAA0B,GAAI,GAAG,OAAO,EAAE,YAAY,MAAM,KAAG,QAAQ,GAAG,IAChC,CAAC;AAExD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,GAAI,YAAY,MAAM,KAAG,iBAYxD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,iBAK1B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,aAAa,CAAC,MAAM,CAAC,KAAG,iBAW3D,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,wBAAwB,GACpC,kBAAkB,aAAa,CAAC,MAAM,CAAC,KACrC,iBAiBF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,cAAc,EACnB,MAAM,SAAS,KACb,OAAO,CAAC,cAAc,CAQxB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,UAAU,MAAM,KACd,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAUpC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,cAAc,GAAG,IAAI,CAI/B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,wBAAwB,GACjC;IAAE,KAAK,EAAE,OAAO,oBAAoB,CAAC;IAAC,SAAS,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GACtF;IAAE,KAAK,EAAE,OAAO,0BAA0B,CAAA;CAAE,GAC5C;IAAE,KAAK,EAAE,OAAO,0BAA0B,CAAA;CAAE,GAC5C;IAAE,KAAK,EAAE,OAAO,sBAAsB,CAAA;CAAE,CAAC;AAE5C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,mBAAmB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,eAAe,EAAE,cAAc,GAAG,IAAI,CAAA;CAAE,GACpD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,IAAI,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,YAAY,MAAM,GAAG,IAAI,EACzB,MAAM,SAAS,EACf,cAAc,MAAM,GAAG,SAAS,KAC9B,OAAO,CAAC,mBAAmB,CAwC7B,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,KACb,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAoB5D,CAAC"}

package/dist/auth/request_context.js

@@ -35,7 +35,7 @@
  * @module
  */
 import { is_role_grant_active } from './account_schema.js';
-import { hash_session_token, session_touch_fire_and_forget, query_session_get_valid } from './session_queries.js';
+import { hash_session_token, query_session_get_valid } from './session_queries.js';
 import { query_account_by_id, query_actor_by_id, query_active_actors_by_account } from './account_queries.js';
 import { query_role_grant_find_active_for_actor } from './role_grant_queries.js';
 import { ACCOUNT_ID_KEY, AUTH_API_TOKEN_ID_KEY, CREDENTIAL_TYPE_KEY, TOKEN_SCOPE_KEY, TEST_CONTEXT_PRESET_KEY } from '../hono_context.js';
@@ -208,11 +208,10 @@ export const resolve_acting_actor = async (deps, account_id, acting_actor_id) =>
  * `require_auth` / `require_role` enforce.
  *
  * @param deps - query dependencies (pool-level db for middleware)
- * @param log - the logger instance
  * @param session_context_key - the Hono context key where session middleware stored the session token
  * @mutates Hono context - sets `ACCOUNT_ID_KEY`, `CREDENTIAL_TYPE_KEY`, `AUTH_SESSION_TOKEN_HASH_KEY`, and `AUTH_API_TOKEN_ID_KEY`
  */
-export const create_request_context_middleware = (deps, log, session_context_key = 'auth_session_id') => {
+export const create_request_context_middleware = (deps, session_context_key = 'auth_session_id') => {
     return async (c, next) => {
         c.set(REQUEST_CONTEXT_KEY, null);
         c.set(ACCOUNT_ID_KEY, null);
@@ -235,8 +234,6 @@ export const create_request_context_middleware = (deps, log, session_context_key
         // A session is full account authority by construction.
         c.set(TOKEN_SCOPE_KEY, token_scope_full());
         c.set(AUTH_SESSION_TOKEN_HASH_KEY, token_hash);
-        // Touch session (fire-and-forget, don't block the request)
-        void session_touch_fire_and_forget(deps, token_hash, c.var.pending_effects, log);
         await next();
     };
 };

package/dist/auth/session_cookie.d.ts

@@ -10,16 +10,15 @@
  * @module
  */
 import type { Keyring } from './keyring.js';
-/** Cookie max age in seconds (30 days — aligned with AUTH_SESSION_LIFETIME_MS). */
-export declare const SESSION_AGE_MAX: number;
 /**
- * Threshold (seconds) at which `process_session_cookie` re-signs a still-valid
- * cookie to extend its embedded expiration. Mirrors the DB-side
- * `AUTH_SESSION_EXTEND_THRESHOLD_MS` so a continuously-active user's cookie
- * stays in sync with their server-side session lifetime. Set
- * `SessionOptions.refresh_threshold_seconds = 0` to disable.
+ * Cookie max age in seconds (30 days — aligned with AUTH_SESSION_LIFETIME_MS).
+ *
+ * This is an **absolute** session lifetime: the cookie is signed once at
+ * mint (`expires_at = mint + max_age`) and never re-signed, matching the DB
+ * row's fixed `expires_at`. There is deliberately no sliding renewal on
+ * either leg — see `docs/security.md` §Session Security.
  */
-export declare const SESSION_REFRESH_THRESHOLD_S: number;
+export declare const SESSION_AGE_MAX: number;
 /**
  * Cookie options for session cookies.
  */
@@ -91,14 +90,6 @@ export interface SessionOptions<TIdentity> {
      * cannot carry `maxAge` so the two values can't drift.
      */
     max_age?: number;
-    /**
-     * Threshold (seconds) for expiration-based cookie refresh. When a parsed
-     * cookie's `expires_at - now <= refresh_threshold_seconds`,
-     * `process_session_cookie` returns `action: 'refresh'` with a freshly-signed
-     * value (extending the embedded expiration by `max_age`). Defaults to
-     * `SESSION_REFRESH_THRESHOLD_S` (1 day). Set to `0` to disable.
-     */
-    refresh_threshold_seconds?: number;
     cookie_options?: Partial<Omit<SessionCookieOptions, 'maxAge'>>;
     /** Encode identity into the cookie payload (before the `:expires_at` suffix). */
     encode_identity: (identity: TIdentity) => string;
@@ -111,26 +102,14 @@ export interface SessionOptions<TIdentity> {
 export interface ParsedSession<TIdentity> {
     /** The decoded identity. */
     identity: TIdentity;
-    /** True if verified with a non-primary key (needs re-signing). */
-    should_refresh_signature: boolean;
-    /**
-     * True if the embedded `expires_at` is within
-     * `options.refresh_threshold_seconds` of `now`. Signals that the cookie is
-     * valid but should be re-signed to extend its lifetime — mirrors
-     * `query_session_touch`'s DB-side extension so the cookie and server
-     * session don't drift. Always false when the threshold is `0`.
-     */
-    should_refresh_expiration: boolean;
-    /** Index of the key that verified the signature. */
+    /** Index of the key that verified the signature (0 = primary). */
     key_index: number;
 }
 /**
  * Parse a signed session cookie value.
  *
  * The signed value format is `${encode(identity)}:${expires_at}`.
- * Tries all keys in order to support key rotation. The result's
- * `should_refresh_expiration` flag fires when the cookie is within
- * `options.refresh_threshold_seconds` of `expires_at`.
+ * Tries all keys in order to support key rotation.
  *
  * @param signed_value - the raw cookie value (signed)
  * @param keyring - key ring for verification
@@ -159,9 +138,7 @@ export interface ProcessSessionResult<TIdentity> {
     /** Whether the session is valid. */
     valid: boolean;
     /** Action the adapter should take. */
-    action: 'none' | 'clear' | 'refresh';
-    /** New signed value when action is 'refresh'. */
-    new_signed_value?: string;
+    action: 'none' | 'clear';
     /** The decoded identity if the cookie was valid. */
     identity?: TIdentity;
 }
@@ -181,9 +158,14 @@ export declare const fuz_session_config: SessionOptions<string>;
 /**
  * Process a session cookie and determine what action to take.
  *
- * `action: 'refresh'` fires on key rotation **or** impending expiration
- * (within `options.refresh_threshold_seconds`); both produce a freshly-signed
- * `new_signed_value`.
+ * There is deliberately no refresh action: any re-sign computes a fresh
+ * `now + max_age` expiry, extending the cookie past the DB row's fixed
+ * `expires_at` — the holder would go silently anonymous while carrying a
+ * self-perpetuating cookie. The absolute lifetime is one signing at mint,
+ * on both legs, matching the Rust spine. A cookie signed by a retired
+ * (non-primary) key keeps verifying until the key leaves the keyring;
+ * retired keys are safe to drop after `SESSION_AGE_MAX` (see
+ * `docs/security.md` §Cookie Key Rotation).
  *
  * @param signed_value - the raw cookie value (may be undefined)
  * @param keyring - key ring for verification and signing

package/dist/auth/session_cookie.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session_cookie.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_cookie.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C,mFAAmF;AACnF,eAAO,MAAM,eAAe,QAAoB,CAAC;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,QAAe,CAAC;AAQxD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,oBAMpC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,WAAW,cAAc,CAAC,SAAS;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,cAAc,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/D,iFAAiF;IACjF,eAAe,EAAE,CAAC,QAAQ,EAAE,SAAS,KAAK,MAAM,CAAC;IACjD,mEAAmE;IACnE,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,GAAG,IAAI,CAAC;CACvD;AAED;;GAEG;AACH,MAAM,WAAW,aAAa,CAAC,SAAS;IACvC,4BAA4B;IAC5B,QAAQ,EAAE,SAAS,CAAC;IACpB,kEAAkE;IAClE,wBAAwB,EAAE,OAAO,CAAC;IAClC;;;;;;OAMG;IACH,yBAAyB,EAAE,OAAO,CAAC;IACnC,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,aAAa,GAAU,SAAS,EAC5C,cAAc,MAAM,GAAG,SAAS,EAChC,SAAS,OAAO,EAChB,SAAS,cAAc,CAAC,SAAS,CAAC,EAClC,cAAc,MAAM,KAClB,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,IAAI,GAAG,SAAS,CAoCrD,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B,GAAU,SAAS,EAC1D,SAAS,OAAO,EAChB,UAAU,SAAS,EACnB,SAAS,cAAc,CAAC,SAAS,CAAC,EAClC,cAAc,MAAM,KAClB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAoB,CAAC,SAAS;IAC9C,oCAAoC;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,sCAAsC;IACtC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IACrC,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,EAAE,SAAS,CAAC;CACrB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,GAAI,aAAa,MAAM,KAAG,cAAc,CAAC,MAAM,CAK/E,CAAC;AAEH,iDAAiD;AACjD,eAAO,MAAM,kBAAkB,EAAE,cAAc,CAAC,MAAM,CAAwC,CAAC;AAE/F;;;;;;;;;;;;GAYG;AAEH,eAAO,MAAM,sBAAsB,GAAU,SAAS,EACrD,cAAc,MAAM,GAAG,SAAS,EAChC,SAAS,OAAO,EAChB,SAAS,cAAc,CAAC,SAAS,CAAC,EAClC,cAAc,MAAM,KAClB,OAAO,CAAC,oBAAoB,CAAC,SAAS,CAAC,CA8BzC,CAAC"}
+{"version":3,"file":"session_cookie.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_cookie.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,QAAoB,CAAC;AAQjD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,oBAMpC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,WAAW,cAAc,CAAC,SAAS;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/D,iFAAiF;IACjF,eAAe,EAAE,CAAC,QAAQ,EAAE,SAAS,KAAK,MAAM,CAAC;IACjD,mEAAmE;IACnE,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,GAAG,IAAI,CAAC;CACvD;AAED;;GAEG;AACH,MAAM,WAAW,aAAa,CAAC,SAAS;IACvC,4BAA4B;IAC5B,QAAQ,EAAE,SAAS,CAAC;IACpB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,aAAa,GAAU,SAAS,EAC5C,cAAc,MAAM,GAAG,SAAS,EAChC,SAAS,OAAO,EAChB,SAAS,cAAc,CAAC,SAAS,CAAC,EAClC,cAAc,MAAM,KAClB,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,IAAI,GAAG,SAAS,CA+BrD,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B,GAAU,SAAS,EAC1D,SAAS,OAAO,EAChB,UAAU,SAAS,EACnB,SAAS,cAAc,CAAC,SAAS,CAAC,EAClC,cAAc,MAAM,KAClB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAoB,CAAC,SAAS;IAC9C,oCAAoC;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,sCAAsC;IACtC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,SAAS,CAAC;CACrB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,GAAI,aAAa,MAAM,KAAG,cAAc,CAAC,MAAM,CAK/E,CAAC;AAEH,iDAAiD;AACjD,eAAO,MAAM,kBAAkB,EAAE,cAAc,CAAC,MAAM,CAAwC,CAAC;AAE/F;;;;;;;;;;;;;;;;;GAiBG;AAEH,eAAO,MAAM,sBAAsB,GAAU,SAAS,EACrD,cAAc,MAAM,GAAG,SAAS,EAChC,SAAS,OAAO,EAChB,SAAS,cAAc,CAAC,SAAS,CAAC,EAClC,cAAc,MAAM,KAClB,OAAO,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAgBzC,CAAC"}

package/dist/auth/session_cookie.js

@@ -9,16 +9,15 @@
  *
  * @module
  */
-/** Cookie max age in seconds (30 days — aligned with AUTH_SESSION_LIFETIME_MS). */
-export const SESSION_AGE_MAX = 60 * 60 * 24 * 30;
 /**
- * Threshold (seconds) at which `process_session_cookie` re-signs a still-valid
- * cookie to extend its embedded expiration. Mirrors the DB-side
- * `AUTH_SESSION_EXTEND_THRESHOLD_MS` so a continuously-active user's cookie
- * stays in sync with their server-side session lifetime. Set
- * `SessionOptions.refresh_threshold_seconds = 0` to disable.
+ * Cookie max age in seconds (30 days — aligned with AUTH_SESSION_LIFETIME_MS).
+ *
+ * This is an **absolute** session lifetime: the cookie is signed once at
+ * mint (`expires_at = mint + max_age`) and never re-signed, matching the DB
+ * row's fixed `expires_at`. There is deliberately no sliding renewal on
+ * either leg — see `docs/security.md` §Session Security.
  */
-export const SESSION_REFRESH_THRESHOLD_S = 60 * 60 * 24;
+export const SESSION_AGE_MAX = 60 * 60 * 24 * 30;
 /** Separator between identity payload and expires_at in signed value. */
 const VALUE_SEPARATOR = ':';
 /** Strict integer matcher for the embedded `expires_at` field. */
@@ -42,9 +41,7 @@ export const session_cookie_options = {
  * Parse a signed session cookie value.
  *
  * The signed value format is `${encode(identity)}:${expires_at}`.
- * Tries all keys in order to support key rotation. The result's
- * `should_refresh_expiration` flag fires when the cookie is within
- * `options.refresh_threshold_seconds` of `expires_at`.
+ * Tries all keys in order to support key rotation.
  *
  * @param signed_value - the raw cookie value (signed)
  * @param keyring - key ring for verification
@@ -79,12 +76,8 @@ export const parse_session = async (signed_value, keyring, options, now_seconds)
     const now = now_seconds ?? Math.floor(Date.now() / 1000);
     if (expires_at <= now)
         return null;
-    const refresh_threshold = options.refresh_threshold_seconds ?? SESSION_REFRESH_THRESHOLD_S;
-    const should_refresh_expiration = refresh_threshold > 0 && expires_at - now <= refresh_threshold;
     return {
         identity,
-        should_refresh_signature: result.key_index > 0,
-        should_refresh_expiration,
         key_index: result.key_index
     };
 };
@@ -128,9 +121,14 @@ export const fuz_session_config = create_session_config('fuz_session');
 /**
  * Process a session cookie and determine what action to take.
  *
- * `action: 'refresh'` fires on key rotation **or** impending expiration
- * (within `options.refresh_threshold_seconds`); both produce a freshly-signed
- * `new_signed_value`.
+ * There is deliberately no refresh action: any re-sign computes a fresh
+ * `now + max_age` expiry, extending the cookie past the DB row's fixed
+ * `expires_at` — the holder would go silently anonymous while carrying a
+ * self-perpetuating cookie. The absolute lifetime is one signing at mint,
+ * on both legs, matching the Rust spine. A cookie signed by a retired
+ * (non-primary) key keeps verifying until the key leaves the keyring;
+ * retired keys are safe to drop after `SESSION_AGE_MAX` (see
+ * `docs/security.md` §Cookie Key Rotation).
  *
  * @param signed_value - the raw cookie value (may be undefined)
  * @param keyring - key ring for verification and signing
@@ -149,13 +147,5 @@ export const process_session_cookie = async (signed_value, keyring, options, now
         // Invalid cookie - should be cleared
         return { valid: false, action: 'clear' };
     }
-    // Valid session — re-sign if the verifying key isn't primary OR if the
-    // embedded expiration is approaching the threshold. The latter mirrors
-    // `query_session_touch`'s DB-side extension so a continuously-active user's
-    // cookie doesn't hard-expire while their server session is still alive.
-    if (parsed.should_refresh_signature || parsed.should_refresh_expiration) {
-        const new_signed_value = await create_session_cookie_value(keyring, parsed.identity, options, now);
-        return { valid: true, action: 'refresh', new_signed_value, identity: parsed.identity };
-    }
     return { valid: true, action: 'none', identity: parsed.identity };
 };

package/dist/auth/session_middleware.d.ts

@@ -35,7 +35,7 @@ export declare const clear_session_cookie: <T>(c: Context, options: SessionOptio
  *
  * @param keyring - key ring for cookie verification
  * @param options - session configuration
- * @mutates Hono context - sets `options.context_key` and may refresh or clear the session cookie
+ * @mutates Hono context - sets `options.context_key` and may clear the session cookie
  */
 export declare const create_session_middleware: <TIdentity>(keyring: Keyring, options: SessionOptions<TIdentity>) => MiddlewareHandler;
 /**

package/dist/auth/session_middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session_middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAGvD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACN,KAAK,cAAc,EAKnB,MAAM,qBAAqB,CAAC;AAQ7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD;;GAEG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,EACnC,GAAG,OAAO,EACV,SAAS,cAAc,CAAC,CAAC,CAAC,KACxB,MAAM,GAAG,SAEX,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,EACnC,GAAG,OAAO,EACV,OAAO,MAAM,EACb,SAAS,cAAc,CAAC,CAAC,CAAC,KACxB,IAOF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,cAAc,CAAC,CAAC,CAAC,KAAG,IAMhF,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,EAClD,SAAS,OAAO,EAChB,SAAS,cAAc,CAAC,SAAS,CAAC,KAChC,iBAgBF,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAChD,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,IAAI,EAAE,SAAS,CAAC;IAChB,2CAA2C;IAC3C,CAAC,EAAE,OAAO,CAAC;IACX,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,gCAAgC,KACvC,OAAO,CAAC,IAAI,CAad,CAAC"}
+{"version":3,"file":"session_middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAGvD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACN,KAAK,cAAc,EAKnB,MAAM,qBAAqB,CAAC;AAQ7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD;;GAEG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,EACnC,GAAG,OAAO,EACV,SAAS,cAAc,CAAC,CAAC,CAAC,KACxB,MAAM,GAAG,SAEX,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,EACnC,GAAG,OAAO,EACV,OAAO,MAAM,EACb,SAAS,cAAc,CAAC,CAAC,CAAC,KACxB,IAOF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,cAAc,CAAC,CAAC,CAAC,KAAG,IAMhF,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,EAClD,SAAS,OAAO,EAChB,SAAS,cAAc,CAAC,SAAS,CAAC,KAChC,iBAcF,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAChD,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,IAAI,EAAE,SAAS,CAAC;IAChB,2CAA2C;IAC3C,CAAC,EAAE,OAAO,CAAC;IACX,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,gCAAgC,KACvC,OAAO,CAAC,IAAI,CAad,CAAC"}

package/dist/auth/session_middleware.js

@@ -49,7 +49,7 @@ export const clear_session_cookie = (c, options) => {
  *
  * @param keyring - key ring for cookie verification
  * @param options - session configuration
- * @mutates Hono context - sets `options.context_key` and may refresh or clear the session cookie
+ * @mutates Hono context - sets `options.context_key` and may clear the session cookie
  */
 export const create_session_middleware = (keyring, options) => {
     return async (c, next) => {
@@ -60,9 +60,6 @@ export const create_session_middleware = (keyring, options) => {
         if (result.action === 'clear') {
             clear_session_cookie(c, options);
         }
-        else if (result.action === 'refresh' && result.new_signed_value) {
-            set_session_cookie(c, result.new_signed_value, options);
-        }
         await next();
     };
 };

package/dist/auth/session_queries.d.ts

@@ -6,13 +6,17 @@
  *
  * @module
  */
-import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import type { QueryDeps } from '../db/query_deps.js';
 import type { AuthSession, SessionId } from './account_schema.js';
-/** Session lifetime in milliseconds (30 days). */
+/**
+ * Session lifetime in milliseconds (30 days).
+ *
+ * An **absolute** cap: `expires_at` is set once at mint and never extended —
+ * there is deliberately no touch/renewal query on either spine (a sliding
+ * window renews a leaked cookie forever; see `docs/security.md` §Session
+ * Security). The cookie's `SESSION_AGE_MAX` mirrors this value.
+ */
 export declare const AUTH_SESSION_LIFETIME_MS: number;
-/** Extend session when it has less than this remaining (1 day in ms). */
-export declare const AUTH_SESSION_EXTEND_THRESHOLD_MS: number;
 /**
  * Hash a session token to its storage key using blake3.
  *
@@ -46,16 +50,6 @@ export declare const query_create_session: (deps: QueryDeps, token_hash: string,
  * @param token_hash - blake3 hash of the session token
  */
 export declare const query_session_get_valid: (deps: QueryDeps, token_hash: string) => Promise<AuthSession | undefined>;
-/**
- * Update `last_seen_at` and optionally extend expiry for a session.
- *
- * Extends if less than `AUTH_SESSION_EXTEND_THRESHOLD_MS` remaining.
- *
- * @param deps - query dependencies
- * @param token_hash - blake3 hash of the session token
- * @mutates `auth_session` row - updates `last_seen_at` and conditionally `expires_at`
- */
-export declare const query_session_touch: (deps: QueryDeps, token_hash: string) => Promise<void>;
 /**
  * Revoke (delete) a session by its token hash, with no account scoping.
  *
@@ -137,9 +131,14 @@ export declare const query_session_enforce_limit: (deps: QueryDeps, account_id:
 /**
  * List all active sessions across all accounts with usernames.
  *
+ * Ordered by `created_at DESC` (newest session first), matching the
+ * per-account listing. `last_seen_at` is still selected for the wire shape
+ * but is decorative — nothing updates it post-mint (it always equals
+ * `created_at`); it is slated for removal on its own twin migration.
+ *
  * @param deps - query dependencies
  * @param limit - maximum entries to return
- * @returns active sessions joined with account usernames, newest activity first
+ * @returns active sessions joined with account usernames, newest first
  */
 export declare const query_session_list_all_active: (deps: QueryDeps, limit?: number) => Promise<Array<AuthSession & {
     username: string;
@@ -151,19 +150,4 @@ export declare const query_session_list_all_active: (deps: QueryDeps, limit?: nu
  * @mutates `auth_session` table - deletes every row past `expires_at`
  */
 export declare const query_session_cleanup_expired: (deps: QueryDeps) => Promise<number>;
-/**
- * Touch a session without blocking the caller.
- *
- * Errors are logged to console — session touching never breaks request flows.
- * Pass `pending_effects` (from `c.var.pending_effects`) to register
- * the promise for test flushing.
- *
- * @param deps - query dependencies
- * @param token_hash - blake3 hash of the session token
- * @param pending_effects - optional array to register the effect for later awaiting
- * @param log - the logger instance
- * @returns the settled promise (callers may ignore it — fire-and-forget semantics preserved)
- * @mutates `pending_effects` - pushes the in-flight settled promise when provided
- */
-export declare const session_touch_fire_and_forget: (deps: QueryDeps, token_hash: string, pending_effects: Array<Promise<void>> | undefined, log: Logger) => Promise<void>;
 //# sourceMappingURL=session_queries.d.ts.map

package/dist/auth/session_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAElE,kDAAkD;AAClD,eAAO,MAAM,wBAAwB,QAA2B,CAAC;AAEjE,yEAAyE;AACzE,eAAO,MAAM,gCAAgC,QAAsB,CAAC;AAEpE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,KAAG,SAElD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAAO,MAEzC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,EAClB,YAAY,IAAI,KACd,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,WAAW,GAAG,SAAS,CAKjC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAU,MAAM,SAAS,EAAE,YAAY,MAAM,KAAG,OAAO,CAAC,IAAI,CAY3F,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,IAAI,CAEd,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,KAChB,OAAO,CAAC,OAAO,CAMjB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAU,KACR,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAK5B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,2BAA2B,GACvC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAc,MAAM,KAClB,OAAO,CAAC,MAAM,CAYhB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,cAAW,KACT,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CASnD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,MAAM,CAKnF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,iBAAiB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACjD,KAAK,MAAM,KACT,OAAO,CAAC,IAAI,CAMd,CAAC"}
+{"version":3,"file":"session_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAA2B,CAAC;AAEjE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,KAAG,SAElD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAAO,MAEzC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,EAClB,YAAY,IAAI,KACd,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,WAAW,GAAG,SAAS,CAKjC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,IAAI,CAEd,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,KAChB,OAAO,CAAC,OAAO,CAMjB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAU,KACR,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAK5B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,2BAA2B,GACvC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAc,MAAM,KAClB,OAAO,CAAC,MAAM,CAYhB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,cAAW,KACT,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CASnD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,MAAM,CAKnF,CAAC"}

package/dist/auth/session_queries.js

@@ -8,10 +8,15 @@
  */
 import { hash_blake3 } from '@fuzdev/fuz_util/hash_blake3.ts';
 import { generate_random_base64url } from '../crypto.js';
-/** Session lifetime in milliseconds (30 days). */
+/**
+ * Session lifetime in milliseconds (30 days).
+ *
+ * An **absolute** cap: `expires_at` is set once at mint and never extended —
+ * there is deliberately no touch/renewal query on either spine (a sliding
+ * window renews a leaked cookie forever; see `docs/security.md` §Session
+ * Security). The cookie's `SESSION_AGE_MAX` mirrors this value.
+ */
 export const AUTH_SESSION_LIFETIME_MS = 30 * 24 * 60 * 60 * 1000;
-/** Extend session when it has less than this remaining (1 day in ms). */
-export const AUTH_SESSION_EXTEND_THRESHOLD_MS = 24 * 60 * 60 * 1000;
 /**
  * Hash a session token to its storage key using blake3.
  *
@@ -57,25 +62,6 @@ export const query_create_session = async (deps, token_hash, account_id, expires
 export const query_session_get_valid = async (deps, token_hash) => {
     return deps.db.query_one(`SELECT * FROM auth_session WHERE id = $1 AND expires_at > NOW()`, [token_hash]);
 };
-/**
- * Update `last_seen_at` and optionally extend expiry for a session.
- *
- * Extends if less than `AUTH_SESSION_EXTEND_THRESHOLD_MS` remaining.
- *
- * @param deps - query dependencies
- * @param token_hash - blake3 hash of the session token
- * @mutates `auth_session` row - updates `last_seen_at` and conditionally `expires_at`
- */
-export const query_session_touch = async (deps, token_hash) => {
-    const new_expires = new Date(Date.now() + AUTH_SESSION_LIFETIME_MS);
-    await deps.db.query(`UPDATE auth_session
-		 SET last_seen_at = NOW(),
-		     expires_at = CASE
-		       WHEN expires_at - NOW() < INTERVAL '1 day' THEN $2::timestamptz
-		       ELSE expires_at
-		     END
-		 WHERE id = $1`, [token_hash, new_expires.toISOString()]);
-};
 /**
  * Revoke (delete) a session by its token hash, with no account scoping.
  *
@@ -176,16 +162,21 @@ export const query_session_enforce_limit = async (deps, account_id, max_sessions
 /**
  * List all active sessions across all accounts with usernames.
  *
+ * Ordered by `created_at DESC` (newest session first), matching the
+ * per-account listing. `last_seen_at` is still selected for the wire shape
+ * but is decorative — nothing updates it post-mint (it always equals
+ * `created_at`); it is slated for removal on its own twin migration.
+ *
  * @param deps - query dependencies
  * @param limit - maximum entries to return
- * @returns active sessions joined with account usernames, newest activity first
+ * @returns active sessions joined with account usernames, newest first
  */
 export const query_session_list_all_active = async (deps, limit = 200) => {
     return deps.db.query(`SELECT s.id, s.account_id, s.created_at, s.expires_at, s.last_seen_at, a.username
 		 FROM auth_session s
 		 JOIN account a ON a.id = s.account_id
 		 WHERE s.expires_at > NOW()
-		 ORDER BY s.last_seen_at DESC LIMIT $1`, [limit]);
+		 ORDER BY s.created_at DESC, s.id DESC LIMIT $1`, [limit]);
 };
 /**
  * Delete expired sessions.
@@ -197,24 +188,3 @@ export const query_session_cleanup_expired = async (deps) => {
     const rows = await deps.db.query(`DELETE FROM auth_session WHERE expires_at <= NOW() RETURNING id`);
     return rows.length;
 };
-/**
- * Touch a session without blocking the caller.
- *
- * Errors are logged to console — session touching never breaks request flows.
- * Pass `pending_effects` (from `c.var.pending_effects`) to register
- * the promise for test flushing.
- *
- * @param deps - query dependencies
- * @param token_hash - blake3 hash of the session token
- * @param pending_effects - optional array to register the effect for later awaiting
- * @param log - the logger instance
- * @returns the settled promise (callers may ignore it — fire-and-forget semantics preserved)
- * @mutates `pending_effects` - pushes the in-flight settled promise when provided
- */
-export const session_touch_fire_and_forget = (deps, token_hash, pending_effects, log) => {
-    const p = query_session_touch(deps, token_hash).catch((err) => {
-        log.error('Session touch failed:', err);
-    });
-    pending_effects?.push(p);
-    return p;
-};

package/dist/auth/token_lifetime.d.ts

@@ -0,0 +1,51 @@
+/**
+ * API token lifetime — the temporal axis of a minted credential.
+ *
+ * `lifetime` is **required** on `account_token_create`, mirroring `scope`:
+ * there is deliberately no default. A caller who wants a never-expiring token
+ * spells `{kind: 'eternal'}`, and the request records that they did — an
+ * omitted lifetime is a validation error upstream, not an eternal token.
+ * `expires_at IS NULL` therefore means "deliberately eternal", never "minted
+ * before the policy existed".
+ *
+ * Lifetime is deliberately **not** part of the scope document — `TokenScope`
+ * is strict on both spines and sits on the hot resolve path. The expiry lives
+ * in the indexed `api_token.expires_at` column where the SQL validation gate
+ * already enforces it (`expires_at IS NULL OR expires_at > NOW()`).
+ *
+ * A framework-level ceiling (`max_token_ttl_days`) is deferred until `fuzf`
+ * has an expiry story (an expiry-aware read + a 401 hint); see
+ * `docs/security.md` §API tokens.
+ *
+ * @module
+ */
+import { z } from 'zod';
+/**
+ * Upper bound on `ttl.days` — a sanity cap (100 years), not a policy ceiling.
+ * Shared with the Rust twin so out-of-range requests 400 identically on both
+ * spines.
+ */
+export declare const TOKEN_TTL_DAYS_MAX = 36500;
+/**
+ * Caller-provided lifetime for `account_token_create`.
+ *
+ * `eternal` mints a never-expiring token (`expires_at` NULL); `ttl` bounds it
+ * to `days` from mint time. `eternal` is deliberately the first variant so
+ * schema-driven test generators produce it by default.
+ */
+export declare const TokenLifetimeInput: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"eternal">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"ttl">;
+    days: z.ZodNumber;
+}, z.core.$strict>], "kind">;
+export type TokenLifetimeInput = z.infer<typeof TokenLifetimeInput>;
+/**
+ * Resolve a lifetime input to the `expires_at` value the mint query stores.
+ *
+ * @param lifetime - the validated lifetime input
+ * @param now - mint time (injectable for tests; defaults to the current time)
+ * @returns the expiry `Date`, or `null` for an eternal token
+ */
+export declare const token_lifetime_to_expires_at: (lifetime: TokenLifetimeInput, now?: Date) => Date | null;
+//# sourceMappingURL=token_lifetime.d.ts.map

package/dist/auth/token_lifetime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token_lifetime.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/token_lifetime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,QAAS,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB;;;;;4BAM7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAU,kBAAkB,EAC5B,MAAK,IAAiB,KACpB,IAAI,GAAG,IAGT,CAAC"}

package/dist/auth/token_lifetime.js

@@ -0,0 +1,54 @@
+/**
+ * API token lifetime — the temporal axis of a minted credential.
+ *
+ * `lifetime` is **required** on `account_token_create`, mirroring `scope`:
+ * there is deliberately no default. A caller who wants a never-expiring token
+ * spells `{kind: 'eternal'}`, and the request records that they did — an
+ * omitted lifetime is a validation error upstream, not an eternal token.
+ * `expires_at IS NULL` therefore means "deliberately eternal", never "minted
+ * before the policy existed".
+ *
+ * Lifetime is deliberately **not** part of the scope document — `TokenScope`
+ * is strict on both spines and sits on the hot resolve path. The expiry lives
+ * in the indexed `api_token.expires_at` column where the SQL validation gate
+ * already enforces it (`expires_at IS NULL OR expires_at > NOW()`).
+ *
+ * A framework-level ceiling (`max_token_ttl_days`) is deferred until `fuzf`
+ * has an expiry story (an expiry-aware read + a 401 hint); see
+ * `docs/security.md` §API tokens.
+ *
+ * @module
+ */
+import { z } from 'zod';
+/**
+ * Upper bound on `ttl.days` — a sanity cap (100 years), not a policy ceiling.
+ * Shared with the Rust twin so out-of-range requests 400 identically on both
+ * spines.
+ */
+export const TOKEN_TTL_DAYS_MAX = 36_500;
+/**
+ * Caller-provided lifetime for `account_token_create`.
+ *
+ * `eternal` mints a never-expiring token (`expires_at` NULL); `ttl` bounds it
+ * to `days` from mint time. `eternal` is deliberately the first variant so
+ * schema-driven test generators produce it by default.
+ */
+export const TokenLifetimeInput = z.discriminatedUnion('kind', [
+    z.strictObject({ kind: z.literal('eternal') }),
+    z.strictObject({
+        kind: z.literal('ttl'),
+        days: z.number().int().min(1).max(TOKEN_TTL_DAYS_MAX)
+    })
+]);
+/**
+ * Resolve a lifetime input to the `expires_at` value the mint query stores.
+ *
+ * @param lifetime - the validated lifetime input
+ * @param now - mint time (injectable for tests; defaults to the current time)
+ * @returns the expiry `Date`, or `null` for an eternal token
+ */
+export const token_lifetime_to_expires_at = (lifetime, now = new Date()) => {
+    if (lifetime.kind === 'eternal')
+        return null;
+    return new Date(now.getTime() + lifetime.days * 86_400_000);
+};