@fuzdev/fuz_app 0.111.0 → 0.113.0

package/dist/db/sql_columns.d.ts

@@ -10,7 +10,16 @@
  * client-safe subset — rather than spelling a second column list, so the
  * drift guard on the base const (`assert_columns_match_live` in
  * `testing/db.ts`) covers every derived projection too. Twin of the Rust
- * spine's `*_COLUMNS` consts + `fuz_db::qualify_columns`.
+ * spine's `*_COLUMNS` consts + `fuz_db::qualify_columns` / `omit_columns`.
+ *
+ * A read that needs a column rendered as something other than the bare
+ * reference passes a `ColumnExpr` — the `expr` override, twin of the third
+ * argument to `fuz_db::qualify_columns`. Every timestamp that reaches the
+ * wire projects through `iso8601_timestamp_column` so both spines serialize
+ * the same instant to the same bytes; each query module builds its override
+ * with `iso8601_timestamp_expr` over its table const. An override costs one
+ * rule — a projected `ORDER BY` must qualify its column — stated on
+ * `qualify_columns`.
  *
  * Placement rule: a const lives in its table's query module. When two query
  * modules project the same table (the revoke cascades in
@@ -26,13 +35,68 @@
  *
  * @module
  */
+/**
+ * Per-column expression override for a projection — return the SQL to
+ * project for `column`, or `undefined` to keep the bare column reference.
+ *
+ * Twin of the `expr` closure `fuz_db::qualify_columns` takes. The Rust side
+ * decodes rows positionally, so its overrides need no output name; TS reads
+ * rows by name, so `columns_sql` / `qualify_columns` alias every override
+ * back to its column (`… AS created_at`) — otherwise a `to_char(…)`
+ * projection would arrive under Postgres' derived name and read as
+ * `undefined`.
+ *
+ * `undefined` is the *only* decline sentinel. An empty string is a returned
+ * expression, not a decline: it renders ` AS created_at` and the query fails
+ * to parse. This is documented rather than guarded — every override in the
+ * repo is a literal lookup returning a fragment or nothing, and a malformed
+ * projection failing loud at the first query beats silently swallowing an
+ * expression the caller meant to supply.
+ */
+export type ColumnExpr = (column: string) => string | undefined;
+/**
+ * Build a `to_char({alias}.{column} AT TIME ZONE 'UTC',
+ * 'YYYY-MM-DD"T"HH24:MI:SS"Z"')` fragment for embedding in a SELECT
+ * projection, via a `ColumnExpr` override.
+ *
+ * The format literal is the spine's canonical timestamp wire shape —
+ * second-precision UTC ISO-8601, exactly 20 characters — byte-identical to
+ * `fuz_db::iso8601_timestamp_column`, so the two backends serialize the same
+ * instant to the same bytes. `to_iso8601_seconds` (`timestamp.ts`) is the
+ * same shape for stamps minted in TS rather than read from Postgres.
+ *
+ * @param alias - the table alias or name to qualify the column with, or the
+ *   empty string for an unqualified reference
+ * @param column - the timestamp column name
+ * @returns the `to_char(…)` fragment
+ */
+export declare const iso8601_timestamp_column: (alias: string, column: string) => string;
+/**
+ * Build a table's timestamp override: a `ColumnExpr` factory that projects
+ * each of `timestamp_columns` through `iso8601_timestamp_column` and declines
+ * every other column. The result takes the row qualifier — the empty string
+ * for a bare-table read, the alias for a JOIN — so one definition per query
+ * module serves every read in it.
+ *
+ * `timestamp_columns` is typed against `columns` (and checked at build time),
+ * so a misspelled name is a compile error and a stale one throws at module
+ * load rather than silently leaving a column projected as a `Date`.
+ *
+ * @param columns - the table's `*_COLUMNS` const
+ * @param timestamp_columns - the members of `columns` that carry timestamps
+ * @returns `(alias) => ColumnExpr`
+ * @throws Error when a name in `timestamp_columns` is not in `columns`
+ */
+export declare const iso8601_timestamp_expr: <T extends string>(columns: ReadonlyArray<T>, timestamp_columns: ReadonlyArray<NoInfer<T>>) => ((alias: string) => ColumnExpr);
 /**
  * Render a `*_COLUMNS` const as a SQL select list, in projection order.
  *
  * @param columns - the column names
+ * @param expr - optional per-column expression override; an overridden
+ *   column is aliased back to its own name
  * @returns `a, b, c`
  */
-export declare const columns_sql: (columns: ReadonlyArray<string>) => string;
+export declare const columns_sql: (columns: ReadonlyArray<string>, expr?: ColumnExpr) => string;
 /**
  * Render a `*_COLUMNS` const as a SQL select list with every column qualified
  * by a table alias, for reads that alias the table (JOINs, the `c`-aliased
@@ -43,12 +107,25 @@ export declare const columns_sql: (columns: ReadonlyArray<string>) => string;
  * alias through gets a thrown error instead of a malformed (or injectable)
  * projection.
  *
+ * **An `expr` override costs one rule: an `ORDER BY` in a projected SELECT
+ * must qualify its column.** An override is aliased back to its own name
+ * (`… AS created_at`), and Postgres resolves a bare `ORDER BY created_at`
+ * against the *output* names first, so it would sort on the `to_char(…)`
+ * text — collapsing sub-second order into ties and losing the btree index (a
+ * `Sort` node over the expression instead of an `Index Scan`). Writing
+ * `ORDER BY <alias>.created_at` (or `<table>.created_at`) names the input
+ * column and both go away. The Rust twin needs no such rule: it decodes
+ * positionally, so `fuz_db::qualify_columns` emits no alias and its bare
+ * `ORDER BY created_at` already means the column.
+ *
  * @param columns - the column names
  * @param alias - the table alias or name to prefix each column with
+ * @param expr - optional per-column expression override; an overridden
+ *   column is aliased back to its own name
  * @returns `alias.a, alias.b, alias.c`
  * @throws Error when `alias` is not a valid SQL identifier
  */
-export declare const qualify_columns: (columns: ReadonlyArray<string>, alias: string) => string;
+export declare const qualify_columns: (columns: ReadonlyArray<string>, alias: string, expr?: ColumnExpr) => string;
 /**
  * Drop named columns from a `*_COLUMNS` const, preserving projection order —
  * for a read that deliberately narrows the row (a client-safe listing, a

package/dist/db/sql_columns.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sql_columns.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/sql_columns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,SAAS,aAAa,CAAC,MAAM,CAAC,KAAG,MAA4B,CAAC;AAE1F;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,eAAe,GAAI,SAAS,aAAa,CAAC,MAAM,CAAC,EAAE,OAAO,MAAM,KAAG,MAG/E,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY,GAAI,CAAC,SAAS,MAAM,EAC5C,SAAS,aAAa,CAAC,CAAC,CAAC,EACzB,GAAG,SAAS,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAC3B,aAAa,CAAC,CAAC,CAOjB,CAAC"}
+{"version":3,"file":"sql_columns.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/sql_columns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAIH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;AAEhE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,wBAAwB,GAAI,OAAO,MAAM,EAAE,QAAQ,MAAM,KAAG,MAGS,CAAC;AAEnF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,GAAI,CAAC,SAAS,MAAM,EACtD,SAAS,aAAa,CAAC,CAAC,CAAC,EACzB,mBAAmB,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAC1C,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,UAAU,CAYhC,CAAC;AAqBF;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,GAAI,SAAS,aAAa,CAAC,MAAM,CAAC,EAAE,OAAO,UAAU,KAAG,MACvB,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,eAAe,GAC3B,SAAS,aAAa,CAAC,MAAM,CAAC,EAC9B,OAAO,MAAM,EACb,OAAO,UAAU,KACf,MAGF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY,GAAI,CAAC,SAAS,MAAM,EAC5C,SAAS,aAAa,CAAC,CAAC,CAAC,EACzB,GAAG,SAAS,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAC3B,aAAa,CAAC,CAAC,CAOjB,CAAC"}

package/dist/db/sql_columns.js

@@ -10,7 +10,16 @@
  * client-safe subset — rather than spelling a second column list, so the
  * drift guard on the base const (`assert_columns_match_live` in
  * `testing/db.ts`) covers every derived projection too. Twin of the Rust
- * spine's `*_COLUMNS` consts + `fuz_db::qualify_columns`.
+ * spine's `*_COLUMNS` consts + `fuz_db::qualify_columns` / `omit_columns`.
+ *
+ * A read that needs a column rendered as something other than the bare
+ * reference passes a `ColumnExpr` — the `expr` override, twin of the third
+ * argument to `fuz_db::qualify_columns`. Every timestamp that reaches the
+ * wire projects through `iso8601_timestamp_column` so both spines serialize
+ * the same instant to the same bytes; each query module builds its override
+ * with `iso8601_timestamp_expr` over its table const. An override costs one
+ * rule — a projected `ORDER BY` must qualify its column — stated on
+ * `qualify_columns`.
  *
  * Placement rule: a const lives in its table's query module. When two query
  * modules project the same table (the revoke cascades in
@@ -27,13 +36,78 @@
  * @module
  */
 import { assert_valid_sql_identifier } from './sql_identifier.js';
+/**
+ * Build a `to_char({alias}.{column} AT TIME ZONE 'UTC',
+ * 'YYYY-MM-DD"T"HH24:MI:SS"Z"')` fragment for embedding in a SELECT
+ * projection, via a `ColumnExpr` override.
+ *
+ * The format literal is the spine's canonical timestamp wire shape —
+ * second-precision UTC ISO-8601, exactly 20 characters — byte-identical to
+ * `fuz_db::iso8601_timestamp_column`, so the two backends serialize the same
+ * instant to the same bytes. `to_iso8601_seconds` (`timestamp.ts`) is the
+ * same shape for stamps minted in TS rather than read from Postgres.
+ *
+ * @param alias - the table alias or name to qualify the column with, or the
+ *   empty string for an unqualified reference
+ * @param column - the timestamp column name
+ * @returns the `to_char(…)` fragment
+ */
+export const iso8601_timestamp_column = (alias, column) => alias === ''
+    ? `to_char(${column} AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS"Z"')`
+    : `to_char(${alias}.${column} AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS"Z"')`;
+/**
+ * Build a table's timestamp override: a `ColumnExpr` factory that projects
+ * each of `timestamp_columns` through `iso8601_timestamp_column` and declines
+ * every other column. The result takes the row qualifier — the empty string
+ * for a bare-table read, the alias for a JOIN — so one definition per query
+ * module serves every read in it.
+ *
+ * `timestamp_columns` is typed against `columns` (and checked at build time),
+ * so a misspelled name is a compile error and a stale one throws at module
+ * load rather than silently leaving a column projected as a `Date`.
+ *
+ * @param columns - the table's `*_COLUMNS` const
+ * @param timestamp_columns - the members of `columns` that carry timestamps
+ * @returns `(alias) => ColumnExpr`
+ * @throws Error when a name in `timestamp_columns` is not in `columns`
+ */
+export const iso8601_timestamp_expr = (columns, timestamp_columns) => {
+    for (const t of timestamp_columns) {
+        if (!columns.includes(t)) {
+            throw new Error(`iso8601_timestamp_expr: "${t}" is not in the column list "${columns.join(', ')}"`);
+        }
+    }
+    return (alias) => (column) => timestamp_columns.includes(column)
+        ? iso8601_timestamp_column(alias, column)
+        : undefined;
+};
+/**
+ * Render one projection entry — the `expr` override aliased back to its
+ * column name, or `fallback` when the override declines the column
+ * (`undefined`, and only `undefined` — see `ColumnExpr`).
+ *
+ * The alias this adds is what makes the `ORDER BY` rule on `qualify_columns`
+ * necessary.
+ *
+ * @param column - the column name, and the output name an override is aliased to
+ * @param fallback - what to project when the override declines — the bare
+ *   column, or the alias-qualified reference
+ * @param expr - the per-column expression override, if the read has one
+ * @returns the projection entry, `<expr> AS <column>` or `fallback`
+ */
+const render_column = (column, fallback, expr) => {
+    const override = expr?.(column);
+    return override === undefined ? fallback : `${override} AS ${column}`;
+};
 /**
  * Render a `*_COLUMNS` const as a SQL select list, in projection order.
  *
  * @param columns - the column names
+ * @param expr - optional per-column expression override; an overridden
+ *   column is aliased back to its own name
  * @returns `a, b, c`
  */
-export const columns_sql = (columns) => columns.join(', ');
+export const columns_sql = (columns, expr) => columns.map((c) => render_column(c, c, expr)).join(', ');
 /**
  * Render a `*_COLUMNS` const as a SQL select list with every column qualified
  * by a table alias, for reads that alias the table (JOINs, the `c`-aliased
@@ -44,14 +118,27 @@ export const columns_sql = (columns) => columns.join(', ');
  * alias through gets a thrown error instead of a malformed (or injectable)
  * projection.
  *
+ * **An `expr` override costs one rule: an `ORDER BY` in a projected SELECT
+ * must qualify its column.** An override is aliased back to its own name
+ * (`… AS created_at`), and Postgres resolves a bare `ORDER BY created_at`
+ * against the *output* names first, so it would sort on the `to_char(…)`
+ * text — collapsing sub-second order into ties and losing the btree index (a
+ * `Sort` node over the expression instead of an `Index Scan`). Writing
+ * `ORDER BY <alias>.created_at` (or `<table>.created_at`) names the input
+ * column and both go away. The Rust twin needs no such rule: it decodes
+ * positionally, so `fuz_db::qualify_columns` emits no alias and its bare
+ * `ORDER BY created_at` already means the column.
+ *
  * @param columns - the column names
  * @param alias - the table alias or name to prefix each column with
+ * @param expr - optional per-column expression override; an overridden
+ *   column is aliased back to its own name
  * @returns `alias.a, alias.b, alias.c`
  * @throws Error when `alias` is not a valid SQL identifier
  */
-export const qualify_columns = (columns, alias) => {
+export const qualify_columns = (columns, alias, expr) => {
     assert_valid_sql_identifier(alias);
-    return columns_sql(columns.map((c) => `${alias}.${c}`));
+    return columns.map((c) => render_column(c, `${alias}.${c}`, expr)).join(', ');
 };
 /**
  * Drop named columns from a `*_COLUMNS` const, preserving projection order —

package/dist/http/CLAUDE.md

@@ -107,7 +107,9 @@ wrapper). See `auth/signup_routes.ts`.
 
 **Ordering: 401 → authz → 403 → 400 → handler.** Mirrors the RPC dispatcher
 (`actions/action_rpc.ts`) so HTTP RPC and REST fail with the same priority, and
-matches the Rust spine, which validates handler-side. Body validation runs last
+matches the Rust spine, which validates handler-side — with the one difference
+that the dispatcher carries a per-action rate-limit phase (429) between 403 and
+400 that REST has no equivalent of. Body validation runs last
 so a caller the authority gates refuse learns nothing about the route's input
 shape — a 400 would confirm the route exists and describe how to call it.
 Params and query still validate first: they are part of addressing the route,
@@ -262,11 +264,11 @@ the source specs, for tests that need to iterate over raw specs.
 No side effects, no state — filters and groupings over `AppSurface`:
 
 - `filter_protected_routes` / `filter_public_routes`
-- `filter_role_routes` / `filter_authenticated_routes` / `filter_keeper_routes` / `filter_routes_for_role(role)`
+- `filter_role_routes` / `filter_authenticated_routes` / `filter_keeper_routes` / `filter_credential_gated_routes` (any `auth.credential_types` gate — superset of keeper) / `filter_routes_for_role(role)`
 - `filter_routes_by_prefix(prefix)` / `filter_routes_with_input` / `filter_routes_with_params` / `filter_routes_with_query` / `filter_mutation_routes` / `filter_rate_limited_routes`
-- `routes_by_auth_type(surface)` — `Map<RouteAuthCategory, Array<AppSurfaceRoute>>` where `RouteAuthCategory = 'none' | 'authenticated' | 'optional' | 'keeper' | 'role:<name>' | 'other'`. Multi-role specs appear under each role bucket
+- `routes_by_auth_type(surface)` — `Map<RouteAuthCategory, Array<AppSurfaceRoute>>` where `RouteAuthCategory = 'none' | 'authenticated' | 'optional' | 'keeper' | 'role:<name>' | 'credential:<type>' | 'other'`. Multi-role / multi-channel specs appear under each bucket. Keeper is tested before the role bucket and the general credential bucket after it — keeper is an authority _level_ and names the route, a session gate is a _channel_ restriction over the authority the route already declares (so the audit SSE stream buckets as `role:admin`)
 - `format_route_key(route)` → `'METHOD /path'`
-- `surface_auth_summary(surface)` — counts per auth type, roles broken out by name
+- `surface_auth_summary(surface)` — counts per auth type, roles and credential channels broken out by name; buckets exactly as `routes_by_auth_type`
 
 The per-route auth predicates these filters compose over (`is_public_auth`,
 `is_role_auth`, `is_credential_gated_auth`, `is_keeper_auth`,

package/dist/http/auth_shape.d.ts

@@ -189,16 +189,29 @@ export declare const is_role_auth: (auth: RouteAuth) => boolean;
 /** True iff the route declares any credential-type gate (`auth.credential_types?.length`). */
 export declare const is_credential_gated_auth: (auth: RouteAuth) => boolean;
 /**
- * True iff the route is the keeper bucket — credential gate restricted
- * to `daemon_token`. Keeper is the only credential gate today; if more
- * land, this filter widens. Knows the `'daemon_token'` literal directly
- * (the keeper composition is fuz_app's only registered credential gate).
+ * True iff the route is the keeper bucket — a credential gate admitting
+ * `daemon_token`. Knows the literal directly, because keeper is a named
+ * authority level rather than one channel among many: it is the ceiling
+ * sessions and api tokens cannot reach.
+ *
+ * Narrower than `is_credential_gated_auth`, which is true of every channel
+ * gate — including the session-only gates pointing the other way (the
+ * credential-minting actions, `POST /logout` / `POST /password`, the audit
+ * SSE stream). Reach for the general predicate when the question is "does a
+ * channel gate answer here"; reach for this one only when the question is
+ * about keeper specifically.
  */
 export declare const is_keeper_auth: (auth: RouteAuth) => boolean;
 /**
  * True iff the route is plain authenticated — `account === 'required'`
- * with no role gate and no credential gate. Account-grain authenticated
- * routes (logout, password change, account self-service) fall here.
+ * with no role gate and no credential gate: any credential the auth
+ * middleware resolved gets in.
+ *
+ * A channel gate takes a route out of this bucket, which is why the
+ * account-grain routes one might expect here are not — `POST /logout`,
+ * `POST /password`, and the `account_*` credential-lifecycle actions all
+ * declare `credential_types: ['session']` and answer to
+ * `is_credential_gated_auth` instead.
  */
 export declare const is_plain_authenticated_auth: (auth: RouteAuth) => boolean;
 /**

package/dist/http/auth_shape.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth_shape.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/auth_shape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,WAAW,6DAGtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,OAAO,KAAG,MAAM,GAAG,SAGtD,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,aAAa;;;;EAA2C,CAAC;AACtE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;IAMpB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;;kBAyCF,CAAC;AACJ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAUlD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,MAAM,SAAS,KAAG,OACA,CAAC;AAElD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,SAAS,KAAG,OAAgC,CAAC;AAE/E;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,SAAS,KAAG,OAAkC,CAAC;AAEnF,wEAAwE;AACxE,eAAO,MAAM,YAAY,GAAI,MAAM,SAAS,KAAG,OAA+B,CAAC;AAE/E,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB,GAAI,MAAM,SAAS,KAAG,OAC3B,CAAC;AAEjC;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,MAAM,SAAS,KAAG,OACQ,CAAC;AAE1D;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,GAAI,MAAM,SAAS,KAAG,OACwB,CAAC;AAYvF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GAAI,QAAQ,CAAC,CAAC,OAAO,KAAG,OAIhE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC3B,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sCAAsC,GAClD,MAAM,SAAS,EACf,OAAO,WAAW,EAClB,SAAS,MAAM,KACb,IAmBF,CAAC"}
+{"version":3,"file":"auth_shape.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/auth_shape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,WAAW,6DAGtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,OAAO,KAAG,MAAM,GAAG,SAGtD,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,aAAa;;;;EAA2C,CAAC;AACtE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;IAMpB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;;kBAyCF,CAAC;AACJ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAUlD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,MAAM,SAAS,KAAG,OACA,CAAC;AAElD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,SAAS,KAAG,OAAgC,CAAC;AAE/E;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,SAAS,KAAG,OAAkC,CAAC;AAEnF,wEAAwE;AACxE,eAAO,MAAM,YAAY,GAAI,MAAM,SAAS,KAAG,OAA+B,CAAC;AAE/E,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB,GAAI,MAAM,SAAS,KAAG,OAC3B,CAAC;AAEjC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,GAAI,MAAM,SAAS,KAAG,OACQ,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B,GAAI,MAAM,SAAS,KAAG,OACwB,CAAC;AAYvF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GAAI,QAAQ,CAAC,CAAC,OAAO,KAAG,OAIhE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC3B,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sCAAsC,GAClD,MAAM,SAAS,EACf,OAAO,WAAW,EAClB,SAAS,MAAM,KACb,IAmBF,CAAC"}

package/dist/http/auth_shape.js

@@ -224,16 +224,29 @@ export const is_role_auth = (auth) => !!auth.roles?.length;
 /** True iff the route declares any credential-type gate (`auth.credential_types?.length`). */
 export const is_credential_gated_auth = (auth) => !!auth.credential_types?.length;
 /**
- * True iff the route is the keeper bucket — credential gate restricted
- * to `daemon_token`. Keeper is the only credential gate today; if more
- * land, this filter widens. Knows the `'daemon_token'` literal directly
- * (the keeper composition is fuz_app's only registered credential gate).
+ * True iff the route is the keeper bucket — a credential gate admitting
+ * `daemon_token`. Knows the literal directly, because keeper is a named
+ * authority level rather than one channel among many: it is the ceiling
+ * sessions and api tokens cannot reach.
+ *
+ * Narrower than `is_credential_gated_auth`, which is true of every channel
+ * gate — including the session-only gates pointing the other way (the
+ * credential-minting actions, `POST /logout` / `POST /password`, the audit
+ * SSE stream). Reach for the general predicate when the question is "does a
+ * channel gate answer here"; reach for this one only when the question is
+ * about keeper specifically.
  */
 export const is_keeper_auth = (auth) => auth.credential_types?.includes('daemon_token') ?? false;
 /**
  * True iff the route is plain authenticated — `account === 'required'`
- * with no role gate and no credential gate. Account-grain authenticated
- * routes (logout, password change, account self-service) fall here.
+ * with no role gate and no credential gate: any credential the auth
+ * middleware resolved gets in.
+ *
+ * A channel gate takes a route out of this bucket, which is why the
+ * account-grain routes one might expect here are not — `POST /logout`,
+ * `POST /password`, and the `account_*` credential-lifecycle actions all
+ * declare `credential_types: ['session']` and answer to
+ * `is_credential_gated_auth` instead.
  */
 export const is_plain_authenticated_auth = (auth) => auth.account === 'required' && !is_role_auth(auth) && !is_credential_gated_auth(auth);
 // --- Registry-time invariant 2 enforcement ---

package/dist/http/jsonrpc_helpers.d.ts

@@ -43,6 +43,19 @@ export declare const is_jsonrpc_error_response: (message: unknown) => message is
  * Returns `null` if no valid id can be extracted.
  */
 export declare const to_jsonrpc_message_id: (message_or_id: unknown) => JsonrpcRequestId | null;
+/**
+ * The id an error response to a rejected envelope can echo: the frame's
+ * `id` when the frame is an object carrying a valid one, else `null`.
+ *
+ * Unlike `to_jsonrpc_message_id`, a scalar frame (`5`, `"x"`) is never read
+ * as its own id — a non-object body has no id to echo, which is the Rust
+ * twin's `classify` answer too. Both transports use this for the
+ * `invalid_request` reply.
+ *
+ * @param frame - the parsed body, of any shape
+ * @returns the echoable id, or `null`
+ */
+export declare const to_jsonrpc_envelope_id: (frame: unknown) => JsonrpcRequestId | null;
 /**
  * Normalizes input to JSON-RPC params format.
  * Returns `undefined` for null/undefined, wraps primitives in `{value}`.

package/dist/http/jsonrpc_helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jsonrpc_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/jsonrpc_helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EACN,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,cAAc,EAEnB,eAAe,EACf,MAAM,cAAc,CAAC;AAKtB,0CAA0C;AAC1C,eAAO,MAAM,sBAAsB,GAClC,QAAQ,aAAa,EACrB,QAAQ,oBAAoB,GAAG,SAAS,EACxC,IAAI,gBAAgB,KAClB,cAUF,CAAC;AAEF,mDAAmD;AACnD,eAAO,MAAM,uBAAuB,GACnC,IAAI,gBAAgB,EACpB,QAAQ,aAAa,KACnB,eAID,CAAC;AAEH,6EAA6E;AAC7E,eAAO,MAAM,2BAA2B,GACvC,QAAQ,aAAa,EACrB,QAAQ,yBAAyB,GAAG,SAAS,KAC3C,mBASF,CAAC;AAEF,iDAAiD;AACjD,eAAO,MAAM,6BAA6B,GACzC,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAC9B,OAAO,oBAAoB,CAAC,OAAO,CAAC,KAClC,oBAID,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,GACrD,IAAI,gBAAgB,GAAG,IAAI,EAC3B,OAAO,OAAO,KACZ,oBAyBF,CAAC;AAIF,kFAAkF;AAClF,eAAO,MAAM,qBAAqB,GAAI,IAAI,OAAO,KAAG,EAAE,IAAI,gBAGzD,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,GAC7B,SAAS,OAAO,KACd,OAAO,IAAI;IAAE,OAAO,EAAE,OAAO,eAAe,CAAA;CAIF,CAAC;AAE9C,sEAAsE;AACtE,eAAO,MAAM,kBAAkB,GAC9B,SAAS,OAAO,KACd,OAAO,IAAI,cAAc,GAAG,KAAK,CAAC,cAAc,CAGrB,CAAC;AAE/B,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,GAAI,SAAS,OAAO,KAAG,OAAO,IAAI,cACI,CAAC;AAEtE,wEAAwE;AACxE,eAAO,MAAM,uBAAuB,GAAI,SAAS,OAAO,KAAG,OAAO,IAAI,mBACE,CAAC;AAEzE,0EAA0E;AAC1E,eAAO,MAAM,mBAAmB,GAAI,SAAS,OAAO,KAAG,OAAO,IAAI,eACG,CAAC;AAEtE,uEAAuE;AACvE,eAAO,MAAM,yBAAyB,GAAI,SAAS,OAAO,KAAG,OAAO,IAAI,oBACJ,CAAC;AAIrE;;;GAGG;AACH,eAAO,MAAM,qBAAqB,GAAI,eAAe,OAAO,KAAG,gBAAgB,GAAG,IAOjF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAAI,OAAO,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAQxE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAAI,QAAQ,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAQrE,CAAC"}
+{"version":3,"file":"jsonrpc_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/jsonrpc_helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EACN,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,cAAc,EAEnB,eAAe,EACf,MAAM,cAAc,CAAC;AAKtB,0CAA0C;AAC1C,eAAO,MAAM,sBAAsB,GAClC,QAAQ,aAAa,EACrB,QAAQ,oBAAoB,GAAG,SAAS,EACxC,IAAI,gBAAgB,KAClB,cAUF,CAAC;AAEF,mDAAmD;AACnD,eAAO,MAAM,uBAAuB,GACnC,IAAI,gBAAgB,EACpB,QAAQ,aAAa,KACnB,eAID,CAAC;AAEH,6EAA6E;AAC7E,eAAO,MAAM,2BAA2B,GACvC,QAAQ,aAAa,EACrB,QAAQ,yBAAyB,GAAG,SAAS,KAC3C,mBASF,CAAC;AAEF,iDAAiD;AACjD,eAAO,MAAM,6BAA6B,GACzC,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAC9B,OAAO,oBAAoB,CAAC,OAAO,CAAC,KAClC,oBAID,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,GACrD,IAAI,gBAAgB,GAAG,IAAI,EAC3B,OAAO,OAAO,KACZ,oBAyBF,CAAC;AAIF,kFAAkF;AAClF,eAAO,MAAM,qBAAqB,GAAI,IAAI,OAAO,KAAG,EAAE,IAAI,gBAGzD,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,GAC7B,SAAS,OAAO,KACd,OAAO,IAAI;IAAE,OAAO,EAAE,OAAO,eAAe,CAAA;CAIF,CAAC;AAE9C,sEAAsE;AACtE,eAAO,MAAM,kBAAkB,GAC9B,SAAS,OAAO,KACd,OAAO,IAAI,cAAc,GAAG,KAAK,CAAC,cAAc,CAGrB,CAAC;AAE/B,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,GAAI,SAAS,OAAO,KAAG,OAAO,IAAI,cACI,CAAC;AAEtE,wEAAwE;AACxE,eAAO,MAAM,uBAAuB,GAAI,SAAS,OAAO,KAAG,OAAO,IAAI,mBACE,CAAC;AAEzE,0EAA0E;AAC1E,eAAO,MAAM,mBAAmB,GAAI,SAAS,OAAO,KAAG,OAAO,IAAI,eACG,CAAC;AAEtE,uEAAuE;AACvE,eAAO,MAAM,yBAAyB,GAAI,SAAS,OAAO,KAAG,OAAO,IAAI,oBACJ,CAAC;AAIrE;;;GAGG;AACH,eAAO,MAAM,qBAAqB,GAAI,eAAe,OAAO,KAAG,gBAAgB,GAAG,IAOjF,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,GAAI,OAAO,OAAO,KAAG,gBAAgB,GAAG,IACX,CAAC;AAEjE;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAAI,OAAO,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAQxE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAAI,QAAQ,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAQrE,CAAC"}

package/dist/http/jsonrpc_helpers.js

@@ -110,6 +110,19 @@ export const to_jsonrpc_message_id = (message_or_id) => {
     const maybe_id = typeof message_or_id === 'object' ? message_or_id.id : message_or_id;
     return is_jsonrpc_request_id(maybe_id) ? maybe_id : null;
 };
+/**
+ * The id an error response to a rejected envelope can echo: the frame's
+ * `id` when the frame is an object carrying a valid one, else `null`.
+ *
+ * Unlike `to_jsonrpc_message_id`, a scalar frame (`5`, `"x"`) is never read
+ * as its own id — a non-object body has no id to echo, which is the Rust
+ * twin's `classify` answer too. Both transports use this for the
+ * `invalid_request` reply.
+ *
+ * @param frame - the parsed body, of any shape
+ * @returns the echoable id, or `null`
+ */
+export const to_jsonrpc_envelope_id = (frame) => typeof frame === 'object' ? to_jsonrpc_message_id(frame) : null;
 /**
  * Normalizes input to JSON-RPC params format.
  * Returns `undefined` for null/undefined, wraps primitives in `{value}`.

package/dist/http/surface_query.d.ts

@@ -27,6 +27,17 @@ export declare const filter_role_routes: (surface: AppSurface) => Array<AppSurfa
 export declare const filter_authenticated_routes: (surface: AppSurface) => Array<AppSurfaceRoute>;
 /** Filter routes that require keeper credentials (`daemon_token`). */
 export declare const filter_keeper_routes: (surface: AppSurface) => Array<AppSurfaceRoute>;
+/**
+ * Filter routes gated to a credential channel (any non-empty
+ * `auth.credential_types`), whichever channel that is.
+ *
+ * Superset of `filter_keeper_routes`: keeper is the `daemon_token` gate, and
+ * the same axis points the other way on the session-only routes (the
+ * credential-minting actions, `POST /logout` / `POST /password`, the audit
+ * SSE stream). Adversarial runners need the whole bucket, since every route
+ * in it answers `credential_type_required` to a channel it does not admit.
+ */
+export declare const filter_credential_gated_routes: (surface: AppSurface) => Array<AppSurfaceRoute>;
 /** Filter routes whose `auth.roles` includes the named role. */
 export declare const filter_routes_for_role: (surface: AppSurface, role: string) => Array<AppSurfaceRoute>;
 /**
@@ -38,11 +49,22 @@ export declare const filter_routes_for_role: (surface: AppSurface, role: string)
  * - `'role:<name>'` for each role declared on `auth.roles` (multi-role specs
  *   are emitted multiple times; callers that need single-bucket grouping
  *   should pre-collapse)
+ * - `'credential:<type>'` for each channel a role-less route's
+ *   `credential_types` admits — the session-only gates (`POST /logout`,
+ *   `POST /password`, the `account_*` credential-lifecycle actions), plus any
+ *   channel a consumer registers
  * - `'authenticated'` for `account === 'required'` without role / credential gate
  * - `'optional'` when either axis is `'optional'` and no other bucket fits
  * - `'other'` as a last-resort bucket for shapes that don't match above
+ *
+ * Keeper is tested before the role bucket and the general credential bucket
+ * after it, which is not an inconsistency: keeper is an authority *level* — a
+ * ceiling no session or api token reaches — so it names the route, while a
+ * session gate is a *channel* restriction layered over whatever authority the
+ * route already declares. So the audit SSE stream, gated to the session
+ * channel and to the admin role, buckets as `role:admin`.
  */
-export type RouteAuthCategory = 'none' | 'authenticated' | 'optional' | 'keeper' | `role:${string}` | 'other';
+export type RouteAuthCategory = 'none' | 'authenticated' | 'optional' | 'keeper' | `role:${string}` | `credential:${string}` | 'other';
 /**
  * Group routes by auth category (see `RouteAuthCategory`). Multi-role specs
  * appear under each of their role buckets.
@@ -65,16 +87,19 @@ export declare const format_route_key: (route: AppSurfaceRoute) => string;
 /**
  * Summarize route auth distribution across the surface.
  *
- * Categorical view over the flat auth record. Multi-role specs
- * contribute one count per role they admit.
+ * Categorical view over the flat auth record, bucketing exactly as
+ * `routes_by_auth_type`. Multi-role and multi-channel specs contribute one
+ * count per role / channel they admit.
  *
- * @returns counts by auth category, with role counts broken out by role name
+ * @returns counts by auth category, with role and channel counts broken out
+ *   by name
  */
 export declare const surface_auth_summary: (surface: AppSurface) => {
     none: number;
     authenticated: number;
     optional: number;
     role: Map<string, number>;
+    credential: Map<string, number>;
     keeper: number;
     other: number;
 };

package/dist/http/surface_query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"surface_query.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/surface_query.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAQhE,6DAA6D;AAC7D,eAAO,MAAM,uBAAuB,GAAI,SAAS,UAAU,KAAG,KAAK,CAAC,eAAe,CAC7B,CAAC;AAEvD,2EAA2E;AAC3E,eAAO,MAAM,oBAAoB,GAAI,SAAS,UAAU,KAAG,KAAK,CAAC,eAAe,CAC3B,CAAC;AAEtD,0EAA0E;AAC1E,eAAO,MAAM,kBAAkB,GAAI,SAAS,UAAU,KAAG,KAAK,CAAC,eAAe,CAC3B,CAAC;AAEpD;;;GAGG;AACH,eAAO,MAAM,2BAA2B,GAAI,SAAS,UAAU,KAAG,KAAK,CAAC,eAAe,CACrB,CAAC;AAEnE,sEAAsE;AACtE,eAAO,MAAM,oBAAoB,GAAI,SAAS,UAAU,KAAG,KAAK,CAAC,eAAe,CAC3B,CAAC;AAEtD,gEAAgE;AAChE,eAAO,MAAM,sBAAsB,GAAI,SAAS,UAAU,EAAE,MAAM,MAAM,KAAG,KAAK,CAAC,eAAe,CAC5B,CAAC;AAErE;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,iBAAiB,GAC5B,MAAM,GAAG,eAAe,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,MAAM,EAAE,GAAG,OAAO,CAAC;AAE/E;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAAI,SAAS,UAAU,KAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,eAAe,CAAC,CAmC3F,CAAC;AAEF,qDAAqD;AACrD,eAAO,MAAM,uBAAuB,GACnC,SAAS,UAAU,EACnB,QAAQ,MAAM,KACZ,KAAK,CAAC,eAAe,CAA4D,CAAC;AAErF,uDAAuD;AACvD,eAAO,MAAM,wBAAwB,GAAI,SAAS,UAAU,KAAG,KAAK,CAAC,eAAe,CAC9B,CAAC;AAEvD,wDAAwD;AACxD,eAAO,MAAM,yBAAyB,GAAI,SAAS,UAAU,KAAG,KAAK,CAAC,eAAe,CAC9B,CAAC;AAExD,uDAAuD;AACvD,eAAO,MAAM,wBAAwB,GAAI,SAAS,UAAU,KAAG,KAAK,CAAC,eAAe,CAC9B,CAAC;AAEvD,mEAAmE;AACnE,eAAO,MAAM,sBAAsB,GAAI,SAAS,UAAU,KAAG,KAAK,CAAC,eAAe,CACtC,CAAC;AAE7C,gDAAgD;AAChD,eAAO,MAAM,0BAA0B,GAAI,SAAS,UAAU,KAAG,KAAK,CAAC,eAAe,CAC9B,CAAC;AAEzD,iEAAiE;AACjE,eAAO,MAAM,gBAAgB,GAAI,OAAO,eAAe,KAAG,MAAyC,CAAC;AAEpG;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAChC,SAAS,UAAU,KACjB;IACF,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CAqCd,CAAC"}
+{"version":3,"file":"surface_query.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/surface_query.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAShE,6DAA6D;AAC7D,eAAO,MAAM,uBAAuB,GAAI,SAAS,UAAU,KAAG,KAAK,CAAC,eAAe,CAC7B,CAAC;AAEvD,2EAA2E;AAC3E,eAAO,MAAM,oBAAoB,GAAI,SAAS,UAAU,KAAG,KAAK,CAAC,eAAe,CAC3B,CAAC;AAEtD,0EAA0E;AAC1E,eAAO,MAAM,kBAAkB,GAAI,SAAS,UAAU,KAAG,KAAK,CAAC,eAAe,CAC3B,CAAC;AAEpD;;;GAGG;AACH,eAAO,MAAM,2BAA2B,GAAI,SAAS,UAAU,KAAG,KAAK,CAAC,eAAe,CACrB,CAAC;AAEnE,sEAAsE;AACtE,eAAO,MAAM,oBAAoB,GAAI,SAAS,UAAU,KAAG,KAAK,CAAC,eAAe,CAC3B,CAAC;AAEtD;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B,GAAI,SAAS,UAAU,KAAG,KAAK,CAAC,eAAe,CAC3B,CAAC;AAEhE,gEAAgE;AAChE,eAAO,MAAM,sBAAsB,GAAI,SAAS,UAAU,EAAE,MAAM,MAAM,KAAG,KAAK,CAAC,eAAe,CAC5B,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,iBAAiB,GAC1B,MAAM,GACN,eAAe,GACf,UAAU,GACV,QAAQ,GACR,QAAQ,MAAM,EAAE,GAChB,cAAc,MAAM,EAAE,GACtB,OAAO,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAAI,SAAS,UAAU,KAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,eAAe,CAAC,CAwC3F,CAAC;AAEF,qDAAqD;AACrD,eAAO,MAAM,uBAAuB,GACnC,SAAS,UAAU,EACnB,QAAQ,MAAM,KACZ,KAAK,CAAC,eAAe,CAA4D,CAAC;AAErF,uDAAuD;AACvD,eAAO,MAAM,wBAAwB,GAAI,SAAS,UAAU,KAAG,KAAK,CAAC,eAAe,CAC9B,CAAC;AAEvD,wDAAwD;AACxD,eAAO,MAAM,yBAAyB,GAAI,SAAS,UAAU,KAAG,KAAK,CAAC,eAAe,CAC9B,CAAC;AAExD,uDAAuD;AACvD,eAAO,MAAM,wBAAwB,GAAI,SAAS,UAAU,KAAG,KAAK,CAAC,eAAe,CAC9B,CAAC;AAEvD,mEAAmE;AACnE,eAAO,MAAM,sBAAsB,GAAI,SAAS,UAAU,KAAG,KAAK,CAAC,eAAe,CACtC,CAAC;AAE7C,gDAAgD;AAChD,eAAO,MAAM,0BAA0B,GAAI,SAAS,UAAU,KAAG,KAAK,CAAC,eAAe,CAC9B,CAAC;AAEzD,iEAAiE;AACjE,eAAO,MAAM,gBAAgB,GAAI,OAAO,eAAe,KAAG,MAAyC,CAAC;AAEpG;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,GAChC,SAAS,UAAU,KACjB;IACF,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1B,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CA4Cd,CAAC"}

package/dist/http/surface_query.js

@@ -13,7 +13,7 @@
  *
  * @module
  */
-import { is_keeper_auth, is_plain_authenticated_auth, is_public_auth, is_role_auth } from './auth_shape.js';
+import { is_credential_gated_auth, is_keeper_auth, is_plain_authenticated_auth, is_public_auth, is_role_auth } from './auth_shape.js';
 /** Filter routes that require any form of authentication. */
 export const filter_protected_routes = (surface) => surface.routes.filter((r) => !is_public_auth(r.auth));
 /** Filter routes that are publicly accessible (no auth surface at all). */
@@ -27,6 +27,17 @@ export const filter_role_routes = (surface) => surface.routes.filter((r) => is_r
 export const filter_authenticated_routes = (surface) => surface.routes.filter((r) => is_plain_authenticated_auth(r.auth));
 /** Filter routes that require keeper credentials (`daemon_token`). */
 export const filter_keeper_routes = (surface) => surface.routes.filter((r) => is_keeper_auth(r.auth));
+/**
+ * Filter routes gated to a credential channel (any non-empty
+ * `auth.credential_types`), whichever channel that is.
+ *
+ * Superset of `filter_keeper_routes`: keeper is the `daemon_token` gate, and
+ * the same axis points the other way on the session-only routes (the
+ * credential-minting actions, `POST /logout` / `POST /password`, the audit
+ * SSE stream). Adversarial runners need the whole bucket, since every route
+ * in it answers `credential_type_required` to a channel it does not admit.
+ */
+export const filter_credential_gated_routes = (surface) => surface.routes.filter((r) => is_credential_gated_auth(r.auth));
 /** Filter routes whose `auth.roles` includes the named role. */
 export const filter_routes_for_role = (surface, role) => surface.routes.filter((r) => r.auth.roles?.includes(role) ?? false);
 /**
@@ -58,6 +69,11 @@ export const routes_by_auth_type = (surface) => {
                 push(`role:${role}`, r);
             continue;
         }
+        if (is_credential_gated_auth(auth)) {
+            for (const credential_type of auth.credential_types)
+                push(`credential:${credential_type}`, r);
+            continue;
+        }
         if (is_plain_authenticated_auth(auth)) {
             push('authenticated', r);
             continue;
@@ -87,16 +103,19 @@ export const format_route_key = (route) => `${route.method} ${route.path}`;
 /**
  * Summarize route auth distribution across the surface.
  *
- * Categorical view over the flat auth record. Multi-role specs
- * contribute one count per role they admit.
+ * Categorical view over the flat auth record, bucketing exactly as
+ * `routes_by_auth_type`. Multi-role and multi-channel specs contribute one
+ * count per role / channel they admit.
  *
- * @returns counts by auth category, with role counts broken out by role name
+ * @returns counts by auth category, with role and channel counts broken out
+ *   by name
  */
 export const surface_auth_summary = (surface) => {
     let none = 0;
     let authenticated = 0;
     let optional = 0;
     const role = new Map();
+    const credential = new Map();
     let keeper = 0;
     let other = 0;
     for (const r of surface.routes) {
@@ -115,6 +134,12 @@ export const surface_auth_summary = (surface) => {
             }
             continue;
         }
+        if (is_credential_gated_auth(auth)) {
+            for (const credential_type of auth.credential_types) {
+                credential.set(credential_type, (credential.get(credential_type) ?? 0) + 1);
+            }
+            continue;
+        }
         if (is_plain_authenticated_auth(auth)) {
             authenticated++;
             continue;
@@ -125,5 +150,5 @@ export const surface_auth_summary = (surface) => {
         }
         other++;
     }
-    return { none, authenticated, optional, role, keeper, other };
+    return { none, authenticated, optional, role, credential, keeper, other };
 };

package/dist/realtime/sse_auth_guard.d.ts

@@ -31,9 +31,15 @@ export declare const AUDIT_LOG_CHANNEL = "audit_log";
  * `session_revoke` closes only the stream tied to the specific revoked session
  * (matched by the blake3 session hash in `event.metadata.session_id`) — closing
  * all of a user's streams for a single-session revoke would be over-aggressive.
- * The single `token_revoke` the WS half handles is omitted: an SSE stream is
- * opened under a cookie session, never an API token, so no stream is keyed by a
- * single token id.
+ * The single `token_revoke` the WS half handles is omitted, and what makes that
+ * correct is a gate rather than an assumption: the audit route declares
+ * `credential_types: ['session']` (`auth/audit_log_route_schema.ts`), so a
+ * bearer is refused at the channel and no stream is ever keyed by a single
+ * token id. **A consumer that widens that gate must key its subscribers by
+ * api-token id and add `token_revoke` here** — otherwise a revoked token keeps
+ * receiving audit rows for the life of the connection. The Rust twin enforces
+ * the same pairing structurally, via the `RevocationScope` column on
+ * `AUDIT_EVENT_SPECS`.
  */
 export declare const disconnect_event_types: ReadonlySet<string>;
 /**

package/dist/realtime/sse_auth_guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sse_auth_guard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/realtime/sse_auth_guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAGN,KAAK,aAAa,EAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACrF,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAEtE,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAE7C;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAOrD,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,GAAI,CAAC,EACtC,UAAU,kBAAkB,CAAC,CAAC,CAAC,EAC/B,eAAe,MAAM,GAAG,IAAI,EAC5B,KAAK,MAAM,KACT,CAAC,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CA6CjC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC3B,8FAA8F;IAC9F,SAAS,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,EAAE,gBAAgB,KAAK,MAAM,IAAI,CAAC;IAC1F,kFAAkF;IAClF,GAAG,EAAE,MAAM,CAAC;IACZ,yJAAyJ;IACzJ,cAAc,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;IAC/C,yEAAyE;IACzE,QAAQ,EAAE,kBAAkB,CAAC,eAAe,CAAC,CAAC;CAC9C;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,SAAS,CAOlD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,eAAO,MAAM,oBAAoB,GAAI,SAAS;IAC7C,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,KAAG,WAgBH,CAAC"}
+{"version":3,"file":"sse_auth_guard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/realtime/sse_auth_guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAGN,KAAK,aAAa,EAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,KAAK,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACrF,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAEtE,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAOrD,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,GAAI,CAAC,EACtC,UAAU,kBAAkB,CAAC,CAAC,CAAC,EAC/B,eAAe,MAAM,GAAG,IAAI,EAC5B,KAAK,MAAM,KACT,CAAC,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CA6CjC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC3B,8FAA8F;IAC9F,SAAS,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,EAAE,gBAAgB,KAAK,MAAM,IAAI,CAAC;IAC1F,kFAAkF;IAClF,GAAG,EAAE,MAAM,CAAC;IACZ,yJAAyJ;IACzJ,cAAc,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;IAC/C,yEAAyE;IACzE,QAAQ,EAAE,kBAAkB,CAAC,eAAe,CAAC,CAAC;CAC9C;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,SAAS,CAOlD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,eAAO,MAAM,oBAAoB,GAAI,SAAS;IAC7C,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,KAAG,WAgBH,CAAC"}

package/dist/realtime/sse_auth_guard.js

@@ -29,9 +29,15 @@ export const AUDIT_LOG_CHANNEL = 'audit_log';
  * `session_revoke` closes only the stream tied to the specific revoked session
  * (matched by the blake3 session hash in `event.metadata.session_id`) — closing
  * all of a user's streams for a single-session revoke would be over-aggressive.
- * The single `token_revoke` the WS half handles is omitted: an SSE stream is
- * opened under a cookie session, never an API token, so no stream is keyed by a
- * single token id.
+ * The single `token_revoke` the WS half handles is omitted, and what makes that
+ * correct is a gate rather than an assumption: the audit route declares
+ * `credential_types: ['session']` (`auth/audit_log_route_schema.ts`), so a
+ * bearer is refused at the channel and no stream is ever keyed by a single
+ * token id. **A consumer that widens that gate must key its subscribers by
+ * api-token id and add `token_revoke` here** — otherwise a revoked token keeps
+ * receiving audit rows for the life of the connection. The Rust twin enforces
+ * the same pairing structurally, via the `RevocationScope` column on
+ * `AUDIT_EVENT_SPECS`.
  */
 export const disconnect_event_types = new Set([
     'role_grant_revoke', // role revoked — user lost access

package/dist/server/serve_fact_route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve_fact_route.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/serve_fact_route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAetD,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAE5F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAM/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AA6DjD,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;CACZ;AAgHD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,+BAA+B,KACtC,SAgDF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,SA0CF,CAAC"}
+{"version":3,"file":"serve_fact_route.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/serve_fact_route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwFG;AAMH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAetD,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAE5F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAM/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAkEjD,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;CACZ;AAgHD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,+BAA+B,KACtC,SAgDF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,SA0CF,CAAC"}