@fuzdev/fuz_app 0.109.0 → 0.110.1

package/dist/testing/cross_backend/token_lifetime.js

@@ -0,0 +1,99 @@
+import '../assert_dev_env.js';
+/**
+ * Cross-backend parity suite for the **API token lifetime** axis of
+ * `account_token_create` — the round-trip that keeps a one-sided landing
+ * impossible.
+ *
+ * ## Why this suite exists
+ *
+ * The action-manifest parity gate captures `{method, side_effects, auth}` and
+ * **no param schemas**, while the TS spine validates params against a Zod
+ * `strictObject` and the Rust spine hand-parses with `params.get(...)`. So a
+ * spine that silently ignored the `lifetime` field would answer the same mint
+ * request with a **200 and an eternal token** — same method, same status,
+ * nothing red anywhere. The forcing function has to observe the *stored*
+ * state: mint with a TTL, then read `expires_at` back off the wire.
+ *
+ * ## What it pins
+ *
+ * - **A TTL mint stores a bounded expiry** — `account_token_create` with
+ *   `{kind:'ttl', days}` returns a non-null `expires_at` (create output *and*
+ *   `account_token_list`), landing within a generous window around
+ *   `now + days`. A spine that dropped the field returns `null` and fails.
+ * - **An eternal mint stores NULL** — the control: `{kind:'eternal'}` yields
+ *   `expires_at: null` on both reads.
+ * - **An omitted lifetime is refused** — `lifetime` is required; a mint
+ *   without it must 400 `invalid_params` on both spines. This is the direct
+ *   pin on the silently-ignoring-unknown-shapes hazard.
+ * - **Out-of-range days are refused** — `days: 0` 400s identically, so the
+ *   two hand-rolled bounds checks can't drift.
+ *
+ * `$lib`-free by contract (relative specifiers only), like the sibling
+ * cross-backend suites. Runs both legs — in-process (`gro test`) and
+ * cross-process — through the shared `{setup_test}` protocol.
+ *
+ * @module
+ */
+import { describe, test, assert } from 'vitest';
+import { account_token_create_action_spec, account_token_list_action_spec, TokenCreateOutput, TokenListOutput } from '../../auth/account_action_specs.js';
+import { cross_rpc_call, error_reason, expect_output } from './cell_cross_helpers.js';
+import { SPINE_RPC_PATH } from './spine_surface_constants.js';
+/** TTL used by the bounded-mint case. */
+const TTL_DAYS = 30;
+/**
+ * Window slack around `now + days` for the expiry assertion — generous (1h)
+ * because the TS spine computes the expiry from the handler clock while the
+ * Rust spine binds a `SystemTime` computed at dispatch; only gross divergence
+ * (wrong unit, wrong sign, silently-dropped field) should fail.
+ */
+const EXPIRY_SLACK_MS = 60 * 60 * 1000;
+export const describe_token_lifetime_cross_tests = (options) => {
+    const { setup_test } = options;
+    const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
+    describe('api token lifetime parity', () => {
+        test('a ttl mint stores a bounded expiry (create output + list round-trip)', async () => {
+            const fixture = await setup_test();
+            const before = Date.now();
+            const create_res = await cross_rpc_call(fixture.transport, rpc_path, account_token_create_action_spec.method, {
+                name: 'ttl-token',
+                scope: { kind: 'full' },
+                lifetime: { kind: 'ttl', days: TTL_DAYS }
+            }, fixture.create_session_headers());
+            const created = expect_output(create_res, TokenCreateOutput);
+            assert.ok(created.expires_at !== null, 'a ttl mint must return a non-null expires_at — null means the spine dropped the field');
+            const expires_ms = Date.parse(created.expires_at);
+            assert.ok(!Number.isNaN(expires_ms), `expires_at must parse as a date: ${created.expires_at}`);
+            const expected = before + TTL_DAYS * 86_400_000;
+            assert.ok(Math.abs(expires_ms - expected) < EXPIRY_SLACK_MS, `expires_at must land near now + ${TTL_DAYS}d (got ${created.expires_at})`);
+            // The read-back — the half a silently-ignoring spine can't fake.
+            const list_res = await cross_rpc_call(fixture.transport, rpc_path, account_token_list_action_spec.method, undefined, fixture.create_session_headers());
+            const listed = expect_output(list_res, TokenListOutput);
+            const row = listed.tokens.find((t) => t.id === created.id);
+            assert.ok(row, 'the minted token must appear in account_token_list');
+            assert.ok(row.expires_at !== null, 'account_token_list must report the stored expiry, not null');
+        });
+        test('an eternal mint stores NULL expiry', async () => {
+            const fixture = await setup_test();
+            const create_res = await cross_rpc_call(fixture.transport, rpc_path, account_token_create_action_spec.method, { name: 'eternal-token', scope: { kind: 'full' }, lifetime: { kind: 'eternal' } }, fixture.create_session_headers());
+            const created = expect_output(create_res, TokenCreateOutput);
+            assert.strictEqual(created.expires_at, null, 'an eternal mint must return expires_at: null');
+            const list_res = await cross_rpc_call(fixture.transport, rpc_path, account_token_list_action_spec.method, undefined, fixture.create_session_headers());
+            const listed = expect_output(list_res, TokenListOutput);
+            const row = listed.tokens.find((t) => t.id === created.id);
+            assert.ok(row, 'the minted token must appear in account_token_list');
+            assert.strictEqual(row.expires_at, null, 'the stored token must be eternal');
+        });
+        test('an omitted lifetime is refused with invalid_params on every spine', async () => {
+            const fixture = await setup_test();
+            const res = await cross_rpc_call(fixture.transport, rpc_path, account_token_create_action_spec.method, { name: 'no-lifetime', scope: { kind: 'full' } }, fixture.create_session_headers());
+            assert.ok(!res.ok, 'a mint without lifetime must be refused, never defaulted');
+            assert.strictEqual(res.error?.code, -32602, `expected invalid_params, got ${JSON.stringify(res.error)} (reason: ${String(error_reason(res))})`);
+        });
+        test('out-of-range ttl days are refused identically', async () => {
+            const fixture = await setup_test();
+            const res = await cross_rpc_call(fixture.transport, rpc_path, account_token_create_action_spec.method, { name: 'zero-days', scope: { kind: 'full' }, lifetime: { kind: 'ttl', days: 0 } }, fixture.create_session_headers());
+            assert.ok(!res.ok, 'days: 0 must be refused');
+            assert.strictEqual(res.error?.code, -32602, `expected invalid_params: ${JSON.stringify(res.error)}`);
+        });
+    });
+};

package/dist/testing/cross_backend/token_scope_surface.js

@@ -87,7 +87,7 @@ const surface_denial_body = (surface) => ({
  * narrowed token on an account that lacks the gating role.
  */
 const mint_narrowed_token = async (transport, rpc_path, session_headers) => {
-    const res = await cross_rpc_call(transport, rpc_path, account_token_create_action_spec.method, { scope: { kind: 'methods', methods: [ADMITTED_METHOD] } }, session_headers);
+    const res = await cross_rpc_call(transport, rpc_path, account_token_create_action_spec.method, { scope: { kind: 'methods', methods: [ADMITTED_METHOD] }, lifetime: { kind: 'eternal' } }, session_headers);
     assert.ok(res.ok, `minting a narrowed token failed: ${JSON.stringify(res.error)}`);
     const token = res.result?.token;
     assert.ok(typeof token === 'string' && token.length > 0, 'mint returned no token');

package/dist/testing/daemon_token_rotation.d.ts

@@ -0,0 +1,83 @@
+import './assert_dev_env.js';
+/**
+ * Daemon-token **producer** — rotation + file persistence, test-harness only.
+ *
+ * No production assembly mints daemon tokens: the credential's only remaining
+ * role is the cross-process test harness's keeper channel (`_testing_reset`
+ * etc.), so the producer lives here behind `assert_dev_env` where it cannot
+ * reach a production bundle. The *consumer* half — validating a presented
+ * `X-Daemon-Token` — stays in `auth/daemon_token_middleware.ts`, mirroring
+ * the Rust spine, whose producer is confined to `fuz_testing`.
+ *
+ * The token file is written atomically at mode `0600` via
+ * `write_file_atomic` (unique temp name + exclusive create), so it never
+ * exists group/other-readable — the old optional-`chmod` pattern let a
+ * default umask land it at `0644`.
+ *
+ * @module
+ */
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
+import type { EnvDeps, FsWriteDeps, FsRemoveDeps } from '../runtime/deps.js';
+import type { QueryDeps } from '../db/query_deps.js';
+import { type DaemonTokenState } from '../auth/daemon_token.js';
+/** Default rotation interval in milliseconds (30 seconds). */
+export declare const DEFAULT_ROTATION_INTERVAL_MS = 30000;
+/** Deps for writing the daemon token to disk. */
+export type DaemonTokenWriteDeps = Pick<EnvDeps, 'env_get'> & Pick<FsWriteDeps, 'mkdir' | 'write_text_file' | 'rename'>;
+/**
+ * Get the daemon token file path (`~/.{name}/run/daemon_token`).
+ *
+ * @param runtime - runtime with `env_get` capability
+ * @param name - application name
+ * @returns path to `daemon_token`, or `null` if `$HOME` is not set
+ */
+export declare const get_daemon_token_path: (runtime: Pick<EnvDeps, "env_get">, name: string) => string | null;
+/**
+ * Write the current token to disk atomically at mode `0600`.
+ *
+ * On-disk format is JSON `{"token": "..."}` — the wrapper leaves room for
+ * future fields (rotated_at, version) without changing every reader. Both
+ * the TS cross-backend harness reader (`spawn_backend.read_daemon_token`)
+ * and the Rust daemon-token writer match this shape.
+ *
+ * @param runtime - runtime with file write capabilities
+ * @param token_path - path to write the token
+ * @param token - the raw token string
+ * @mutates filesystem - writes `token_path` atomically at mode `0600`
+ */
+export declare const write_daemon_token: (runtime: DaemonTokenWriteDeps, token_path: string, token: string) => Promise<void>;
+/** Options for daemon token rotation. */
+export interface DaemonTokenRotationOptions {
+    /**
+     * Absolute path the token file is written to. Caller computes from
+     * its own conventions — e.g. `get_daemon_token_path(runtime, app_name)`
+     * for the standard `~/.{name}/run/daemon_token` layout, or a path
+     * derived from `PUBLIC_<APP>_DIR` for cross-process test setups that
+     * isolate the app dir to a tmpdir.
+     */
+    token_path: string;
+    /** Rotation interval in ms. Default: `30000` (30s). */
+    rotation_interval_ms?: number;
+}
+/** Result of starting daemon token rotation. */
+export interface DaemonTokenRotation {
+    /** The mutable runtime state. Pass to `create_daemon_token_middleware`. */
+    state: DaemonTokenState;
+    /** Stop rotation, clean up the interval, and delete the token file. Call on graceful shutdown. */
+    stop: () => Promise<void>;
+}
+/**
+ * Start daemon token rotation.
+ *
+ * Generates an initial token, writes it to disk, resolves the keeper account,
+ * and sets up periodic rotation. Returns the mutable state object and a stop function.
+ *
+ * @param runtime - runtime with file and remove capabilities
+ * @param deps - query dependencies for resolving keeper account
+ * @param options - rotation configuration
+ * @param log - the logger instance
+ * @returns rotation state and stop function
+ * @mutates filesystem - writes the token file on each rotation; `stop` removes it
+ */
+export declare const start_daemon_token_rotation: (runtime: DaemonTokenWriteDeps & FsRemoveDeps, deps: QueryDeps, options: DaemonTokenRotationOptions, log: Logger) => Promise<DaemonTokenRotation>;
+//# sourceMappingURL=daemon_token_rotation.d.ts.map

package/dist/testing/daemon_token_rotation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon_token_rotation.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/daemon_token_rotation.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG7E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGvF,8DAA8D;AAC9D,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD,iDAAiD;AACjD,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,GAC1D,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,iBAAiB,GAAG,QAAQ,CAAC,CAAC;AAE3D;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,GACjC,SAAS,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,EACjC,MAAM,MAAM,KACV,MAAM,GAAG,IAGX,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,GAC9B,SAAS,oBAAoB,EAC7B,YAAY,MAAM,EAClB,OAAO,MAAM,KACX,OAAO,CAAC,IAAI,CAId,CAAC;AAEF,yCAAyC;AACzC,MAAM,WAAW,0BAA0B;IAC1C;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,gDAAgD;AAChD,MAAM,WAAW,mBAAmB;IACnC,2EAA2E;IAC3E,KAAK,EAAE,gBAAgB,CAAC;IACxB,kGAAkG;IAClG,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,2BAA2B,GACvC,SAAS,oBAAoB,GAAG,YAAY,EAC5C,MAAM,SAAS,EACf,SAAS,0BAA0B,EACnC,KAAK,MAAM,KACT,OAAO,CAAC,mBAAmB,CAqD7B,CAAC"}

package/dist/testing/daemon_token_rotation.js

@@ -0,0 +1,99 @@
+import './assert_dev_env.js';
+import { write_file_atomic } from '../runtime/fs.js';
+import { get_app_dir } from '../cli/config.js';
+import { generate_daemon_token } from '../auth/daemon_token.js';
+import { resolve_keeper_account_id } from '../auth/daemon_token_middleware.js';
+/** Default rotation interval in milliseconds (30 seconds). */
+export const DEFAULT_ROTATION_INTERVAL_MS = 30_000;
+/**
+ * Get the daemon token file path (`~/.{name}/run/daemon_token`).
+ *
+ * @param runtime - runtime with `env_get` capability
+ * @param name - application name
+ * @returns path to `daemon_token`, or `null` if `$HOME` is not set
+ */
+export const get_daemon_token_path = (runtime, name) => {
+    const app_dir = get_app_dir(runtime, name);
+    return app_dir ? `${app_dir}/run/daemon_token` : null;
+};
+/**
+ * Write the current token to disk atomically at mode `0600`.
+ *
+ * On-disk format is JSON `{"token": "..."}` — the wrapper leaves room for
+ * future fields (rotated_at, version) without changing every reader. Both
+ * the TS cross-backend harness reader (`spawn_backend.read_daemon_token`)
+ * and the Rust daemon-token writer match this shape.
+ *
+ * @param runtime - runtime with file write capabilities
+ * @param token_path - path to write the token
+ * @param token - the raw token string
+ * @mutates filesystem - writes `token_path` atomically at mode `0600`
+ */
+export const write_daemon_token = async (runtime, token_path, token) => {
+    await write_file_atomic(runtime, token_path, JSON.stringify({ token }) + '\n', {
+        mode: 0o600
+    });
+};
+/**
+ * Start daemon token rotation.
+ *
+ * Generates an initial token, writes it to disk, resolves the keeper account,
+ * and sets up periodic rotation. Returns the mutable state object and a stop function.
+ *
+ * @param runtime - runtime with file and remove capabilities
+ * @param deps - query dependencies for resolving keeper account
+ * @param options - rotation configuration
+ * @param log - the logger instance
+ * @returns rotation state and stop function
+ * @mutates filesystem - writes the token file on each rotation; `stop` removes it
+ */
+export const start_daemon_token_rotation = async (runtime, deps, options, log) => {
+    const { token_path, rotation_interval_ms = DEFAULT_ROTATION_INTERVAL_MS } = options;
+    // ensure parent directory exists
+    const last_slash = token_path.lastIndexOf('/');
+    if (last_slash > 0) {
+        await runtime.mkdir(token_path.slice(0, last_slash), { recursive: true });
+    }
+    // resolve keeper account (may be null pre-bootstrap; the middleware
+    // lazily refreshes on the first null hit to cover the
+    // rotation-starts-before-bootstrap case)
+    const keeper_account_id = await resolve_keeper_account_id(deps);
+    // generate initial token and write to disk
+    const initial_token = generate_daemon_token();
+    await write_daemon_token(runtime, token_path, initial_token);
+    const state = {
+        current_token: initial_token,
+        previous_token: null,
+        rotated_at: new Date(),
+        keeper_account_id
+    };
+    let writing = false;
+    const interval_id = setInterval(async () => {
+        if (writing)
+            return; // skip if previous rotation write still in progress
+        writing = true;
+        try {
+            const new_token = generate_daemon_token();
+            state.previous_token = state.current_token;
+            state.current_token = new_token;
+            state.rotated_at = new Date();
+            await write_daemon_token(runtime, token_path, new_token);
+        }
+        catch (err) {
+            log.error('Failed to write rotated token:', err);
+        }
+        finally {
+            writing = false;
+        }
+    }, rotation_interval_ms);
+    const stop = async () => {
+        clearInterval(interval_id);
+        try {
+            await runtime.remove(token_path);
+        }
+        catch {
+            // already removed or never written
+        }
+    };
+    return { state, stop };
+};

package/dist/testing/integration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAsB7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAMhE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAkB1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAW,KAAK,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAG1D;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC9C;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;;;;;;OASG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,kEAAkE;IAClE,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;OAIG;IACH,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,mCAAmC,GAC/C,SAAS,8BAA8B,KACrC,IA86CF,CAAC"}
+{"version":3,"file":"integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAsB7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAMhE,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAkB1B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAW,KAAK,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAG1D;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC9C;;;;OAIG;IACH,UAAU,EAAE,SAAS,CAAC;IACtB;;;;;;;;;OASG;IACH,cAAc,EAAE,cAAc,CAAC;IAC/B,kEAAkE;IAClE,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;OAIG;IACH,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,mCAAmC,GAC/C,SAAS,8BAA8B,KACrC,IA07CF,CAAC"}

package/dist/testing/integration.js

@@ -634,7 +634,11 @@ export const describe_standard_integration_tests = (options) => {
                     app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_token_create_action_spec,
-                    params: { name: 'test-revoke', scope: { kind: 'full' } },
+                    params: {
+                        name: 'test-revoke',
+                        scope: { kind: 'full' },
+                        lifetime: { kind: 'eternal' }
+                    },
                     headers: fixture.create_session_headers()
                 });
                 assert.ok(create_res.ok, 'account_token_create should succeed');
@@ -943,7 +947,11 @@ export const describe_standard_integration_tests = (options) => {
                     app: { request: unauthed },
                     path: rpc_path,
                     spec: account_token_create_action_spec,
-                    params: { name: 'unauth-probe', scope: { kind: 'full' } },
+                    params: {
+                        name: 'unauth-probe',
+                        scope: { kind: 'full' },
+                        lifetime: { kind: 'eternal' }
+                    },
                     headers: { host: 'localhost' }
                 });
                 assert.strictEqual(token_create.status, 401);
@@ -1039,7 +1047,11 @@ export const describe_standard_integration_tests = (options) => {
                     app: { request: fixture.transport },
                     path: rpc_path,
                     spec: account_token_create_action_spec,
-                    params: { name: 'test-token', scope: { kind: 'full' } },
+                    params: {
+                        name: 'test-token',
+                        scope: { kind: 'full' },
+                        lifetime: { kind: 'eternal' }
+                    },
                     headers: fixture.create_session_headers()
                 });
                 assert.ok(create_res.ok, 'account_token_create should succeed');

package/dist/testing/stubs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stubs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/stubs.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAa7B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAG3E,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAmB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAA+B,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAI9F;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,GAAG,GAAG,EAAE,OAAO,MAAM,KAAG,CAqBtD,CAAC;AAET;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,GAAG,GAAG,EAAE,QAAQ,MAAM,EAAE,YAAY,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,CAOxF,CAAC;AAET,iEAAiE;AACjE,eAAO,MAAM,IAAI,EAAE,GAAkC,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,QAAO,EAI/B,CAAC;AAEJ,gDAAgD;AAChD,eAAO,MAAM,YAAY,QAAO,QAAgC,CAAC;AAEjE,2CAA2C;AAC3C,eAAO,MAAM,OAAO,GAAU,IAAI,GAAG,EAAE,MAAM,GAAG,KAAG,OAAO,CAAC,IAAI,CAAW,CAAC;AAI3E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,QAAO,YAW3C,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,QAAO,WAUxC,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,aAAa,EAAE,OAS3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,QAAO,OAStC,CAAC;AAEH,2FAA2F;AAC3F,eAAO,MAAM,0BAA0B,GAAI,UAAU;IACpD,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAC/B,KAAG,KAAK,CAAC,cAAc,CAqBvB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,GAC1C,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,gBAsBF,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,+BAA+B;IAC/C,6DAA6D;IAC7D,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,qFAAqF;IACrF,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7F;;;;;;;;OAQG;IACH,YAAY,CAAC,EACZ,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAC5F,mFAAmF;IACnF,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/E;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,cAmDF,CAAC"}
+{"version":3,"file":"stubs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/stubs.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAa7B,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAG3E,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAmB,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAA+B,KAAK,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAI9F;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,GAAG,GAAG,EAAE,OAAO,MAAM,KAAG,CAqBtD,CAAC;AAET;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,GAAG,GAAG,EAAE,QAAQ,MAAM,EAAE,YAAY,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,CAOxF,CAAC;AAET,iEAAiE;AACjE,eAAO,MAAM,IAAI,EAAE,GAAkC,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,QAAO,EAI/B,CAAC;AAEJ,gDAAgD;AAChD,eAAO,MAAM,YAAY,QAAO,QAAgC,CAAC;AAEjE,2CAA2C;AAC3C,eAAO,MAAM,OAAO,GAAU,IAAI,GAAG,EAAE,MAAM,GAAG,KAAG,OAAO,CAAC,IAAI,CAAW,CAAC;AAI3E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,QAAO,YAW3C,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,QAAO,WAUxC,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,aAAa,EAAE,OAQ3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,QAAO,OAUtC,CAAC;AAEH,2FAA2F;AAC3F,eAAO,MAAM,0BAA0B,GAAI,UAAU;IACpD,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAC/B,KAAG,KAAK,CAAC,cAAc,CAqBvB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,GAC1C,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,gBAsBF,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,+BAA+B;IAC/C,6DAA6D;IAC7D,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,qFAAqF;IACrF,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7F;;;;;;;;OAQG;IACH,YAAY,CAAC,EACZ,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAC5F,mFAAmF;IACnF,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/E;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,sBAAsB,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,cAmDF,CAAC"}

package/dist/testing/stubs.js

@@ -133,8 +133,7 @@ export const create_stub_audit_sse = () => {
 };
 /** Stub `AppDeps` for auth surface tests — throws on any method access. */
 export const stub_app_deps = {
-    stat: create_throwing_stub('stat'),
-    read_text_file: create_throwing_stub('read_text_file'),
+    read_secure_file: create_throwing_stub('read_secure_file'),
     delete_file: create_throwing_stub('delete_file'),
     keyring: create_throwing_stub('keyring'),
     password: create_throwing_stub('password'),
@@ -146,8 +145,9 @@ export const stub_app_deps = {
  * Create no-op `AppDeps` for auth surface testing.
  */
 export const create_stub_app_deps = () => ({
-    stat: async () => null,
-    read_text_file: async () => '',
+    read_secure_file: async (path) => {
+        throw new Error(`ENOENT: no such file or directory: ${path}`);
+    },
     delete_file: async (_path) => { },
     keyring: create_noop_stub('keyring'),
     password: create_noop_stub('password'),

package/dist/ui/AccountSessions.svelte

@@ -34,7 +34,6 @@
 	const columns: Array<DatatableColumn<AuthSessionJson>> = [
 		{ key: 'id', label: 'session', width: 140 },
 		{ key: 'created_at', label: 'created', width: 120 },
-		{ key: 'last_seen_at', label: 'last seen', width: 120 },
 		{ key: 'expires_at', label: 'expires', width: 120 },
 		{ key: 'account_id', label: '', width: 100 }
 	];
@@ -71,10 +70,6 @@
 					<span title={format_datetime_local(row.created_at)}>
 						{format_relative_time(row.created_at)}
 					</span>
-				{:else if column.key === 'last_seen_at'}
-					<span title={format_datetime_local(row.last_seen_at)}>
-						{format_relative_time(row.last_seen_at)}
-					</span>
 				{:else if column.key === 'expires_at'}
 					<span title={format_datetime_local(row.expires_at)}>
 						{format_relative_time(row.expires_at)}

package/dist/ui/AccountSessions.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AccountSessions.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AccountSessions.svelte"],"names":[],"mappings":"AAiHA,UAAU,kCAAkC,CAAC,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,OAAO,GAAG,EAAE,EAAE,QAAQ,GAAG,MAAM;IACpM,KAAK,OAAO,EAAE,OAAO,QAAQ,EAAE,2BAA2B,CAAC,KAAK,CAAC,GAAG,OAAO,QAAQ,EAAE,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG;QAAE,UAAU,CAAC,EAAE,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC;IACjK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,KAAK,CAAA;KAAC,GAAG,OAAO,GAAG;QAAE,IAAI,CAAC,EAAE,GAAG,CAAC;QAAC,GAAG,CAAC,EAAE,GAAG,CAAA;KAAE,CAAC;IACtG,YAAY,CAAC,EAAE,QAAQ,CAAC;CAC3B;AAKD,QAAA,MAAM,eAAe;;kBAA+E,CAAC;AACnF,KAAK,eAAe,GAAG,YAAY,CAAC,OAAO,eAAe,CAAC,CAAC;AAC9D,eAAe,eAAe,CAAC"}
+{"version":3,"file":"AccountSessions.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AccountSessions.svelte"],"names":[],"mappings":"AA4GA,UAAU,kCAAkC,CAAC,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,OAAO,GAAG,EAAE,EAAE,QAAQ,GAAG,MAAM;IACpM,KAAK,OAAO,EAAE,OAAO,QAAQ,EAAE,2BAA2B,CAAC,KAAK,CAAC,GAAG,OAAO,QAAQ,EAAE,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG;QAAE,UAAU,CAAC,EAAE,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC;IACjK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,KAAK,CAAA;KAAC,GAAG,OAAO,GAAG;QAAE,IAAI,CAAC,EAAE,GAAG,CAAC;QAAC,GAAG,CAAC,EAAE,GAAG,CAAA;KAAE,CAAC;IACtG,YAAY,CAAC,EAAE,QAAQ,CAAC;CAC3B;AAKD,QAAA,MAAM,eAAe;;kBAA+E,CAAC;AACnF,KAAK,eAAe,GAAG,YAAY,CAAC,OAAO,eAAe,CAAC,CAAC;AAC9D,eAAe,eAAe,CAAC"}

package/dist/ui/AdminOverview.svelte

@@ -52,10 +52,13 @@
 
 	// sessions
 	const unique_users = $derived(new Set(sessions.sessions.map((s) => s.username)).size);
+	// newest session by mint time — sessions carry no activity signal
+	// (`last_seen_at` is decorative post-hard-cap; see `docs/security.md`
+	// §Session Security)
 	const most_recent = $derived(
 		sessions.sessions.length > 0
 			? sessions.sessions.reduce((a, b) =>
-					new Date(a.last_seen_at) > new Date(b.last_seen_at) ? a : b
+					new Date(a.created_at) > new Date(b.created_at) ? a : b
 				)
 			: null
 	);
@@ -146,10 +149,10 @@
 			</div>
 			{#if most_recent}
 				<div class="baseline-row gap_xs font_size_sm mt_sm">
-					<span class="text_50">last active:</span>
+					<span class="text_50">newest session:</span>
 					<strong>{most_recent.username}</strong>
-					<span class="text_50" title={format_datetime_local(most_recent.last_seen_at)}
-						>{format_relative_time(most_recent.last_seen_at)}</span
+					<span class="text_50" title={format_datetime_local(most_recent.created_at)}
+						>{format_relative_time(most_recent.created_at)}</span
 					>
 				</div>
 			{/if}

package/dist/ui/AdminOverview.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdminOverview.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminOverview.svelte"],"names":[],"mappings":"AA2UA,QAAA,MAAM,aAAa,2DAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}
+{"version":3,"file":"AdminOverview.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminOverview.svelte"],"names":[],"mappings":"AA8UA,QAAA,MAAM,aAAa,2DAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}

package/dist/ui/AdminSessions.svelte

@@ -26,7 +26,6 @@
 		{ key: 'username', label: 'user', width: 120 },
 		{ key: 'id', label: 'session', width: 130 },
 		{ key: 'created_at', label: 'created', width: 100 },
-		{ key: 'last_seen_at', label: 'last seen', width: 100 },
 		{ key: 'expires_at', label: 'expires', width: 100 },
 		{ key: 'account_id', label: '', width: 220 }
 	];
@@ -53,10 +52,6 @@
 					<span title={format_datetime_local(row.created_at)}>
 						{format_relative_time(row.created_at)}
 					</span>
-				{:else if column.key === 'last_seen_at'}
-					<span title={format_datetime_local(row.last_seen_at)}>
-						{format_relative_time(row.last_seen_at)}
-					</span>
 				{:else if column.key === 'expires_at'}
 					<span title={format_datetime_local(row.expires_at)}>
 						{format_relative_time(row.expires_at)}

package/dist/ui/AdminSessions.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdminSessions.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminSessions.svelte"],"names":[],"mappings":"AAkGA,UAAU,kCAAkC,CAAC,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,OAAO,GAAG,EAAE,EAAE,QAAQ,GAAG,MAAM;IACpM,KAAK,OAAO,EAAE,OAAO,QAAQ,EAAE,2BAA2B,CAAC,KAAK,CAAC,GAAG,OAAO,QAAQ,EAAE,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG;QAAE,UAAU,CAAC,EAAE,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC;IACjK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,KAAK,CAAA;KAAC,GAAG,OAAO,GAAG;QAAE,IAAI,CAAC,EAAE,GAAG,CAAC;QAAC,GAAG,CAAC,EAAE,GAAG,CAAA;KAAE,CAAC;IACtG,YAAY,CAAC,EAAE,QAAQ,CAAC;CAC3B;AAKD,QAAA,MAAM,aAAa;;kBAA+E,CAAC;AACjF,KAAK,aAAa,GAAG,YAAY,CAAC,OAAO,aAAa,CAAC,CAAC;AAC1D,eAAe,aAAa,CAAC"}
+{"version":3,"file":"AdminSessions.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminSessions.svelte"],"names":[],"mappings":"AA6FA,UAAU,kCAAkC,CAAC,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,KAAK,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,OAAO,GAAG,EAAE,EAAE,QAAQ,GAAG,MAAM;IACpM,KAAK,OAAO,EAAE,OAAO,QAAQ,EAAE,2BAA2B,CAAC,KAAK,CAAC,GAAG,OAAO,QAAQ,EAAE,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG;QAAE,UAAU,CAAC,EAAE,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC;IACjK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,KAAK,CAAA;KAAC,GAAG,OAAO,GAAG;QAAE,IAAI,CAAC,EAAE,GAAG,CAAC;QAAC,GAAG,CAAC,EAAE,GAAG,CAAA;KAAE,CAAC;IACtG,YAAY,CAAC,EAAE,QAAQ,CAAC;CAC3B;AAKD,QAAA,MAAM,aAAa;;kBAA+E,CAAC;AACjF,KAAK,aAAa,GAAG,YAAY,CAAC,OAAO,aAAa,CAAC,CAAC;AAC1D,eAAe,aAAa,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.109.0",
+  "version": "0.110.1",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",