@fuzdev/fuz_app 0.112.0 → 0.113.0

package/dist/testing/auth_apps.js

@@ -11,9 +11,11 @@ import { Hono } from 'hono';
 import { Logger } from '@fuzdev/fuz_util/log.ts';
 import { apply_route_specs } from '../http/route_spec.js';
 import { is_public_auth } from '../http/auth_shape.js';
+import { CREDENTIAL_TYPE_DAEMON_TOKEN, CREDENTIAL_TYPE_SESSION } from '../auth/credential_type_schema.js';
+import { ROLE_KEEPER } from '../auth/role_schema.js';
 import { fuz_auth_guard_resolver } from '../auth/auth_guard_resolver.js';
 import { REQUEST_CONTEXT_KEY, create_fuz_authorization_handler } from '../auth/request_context.js';
-import { ACCOUNT_ID_KEY, CREDENTIAL_TYPE_KEY, TEST_CONTEXT_PRESET_KEY } from '../hono_context.js';
+import { ACCOUNT_ID_KEY, CREDENTIAL_TYPES, CREDENTIAL_TYPE_KEY, TEST_CONTEXT_PRESET_KEY } from '../hono_context.js';
 import { create_stub_db } from './stubs.js';
 import { create_test_account, create_test_actor, create_test_role_grant } from './entities.js';
 /**
@@ -40,7 +42,7 @@ export const create_test_app_from_specs = (route_specs, auth_ctx, credential_typ
         if (auth_ctx) {
             c.set(ACCOUNT_ID_KEY, auth_ctx.account.id);
             c.set(REQUEST_CONTEXT_KEY, auth_ctx);
-            c.set(CREDENTIAL_TYPE_KEY, credential_type ?? 'session');
+            c.set(CREDENTIAL_TYPE_KEY, credential_type ?? CREDENTIAL_TYPE_SESSION);
             c.set(TEST_CONTEXT_PRESET_KEY, true);
         }
         await next();
@@ -59,25 +61,52 @@ export const create_auth_test_apps = (route_specs, roles) => {
     for (const role of roles) {
         by_role.set(role, create_test_app_from_specs(route_specs, create_test_request_context(role)));
     }
+    const by_credential_type = new Map(CREDENTIAL_TYPES.map((credential_type) => [
+        credential_type,
+        create_test_app_from_specs(route_specs, create_test_request_context(ROLE_KEEPER), credential_type)
+    ]));
     return {
         public: create_test_app_from_specs(route_specs),
         authed: create_test_app_from_specs(route_specs, create_test_request_context()),
-        keeper: create_test_app_from_specs(route_specs, create_test_request_context('keeper'), 'daemon_token'),
+        keeper: by_credential_type.get(CREDENTIAL_TYPE_DAEMON_TOKEN),
+        by_credential_type,
         by_role
     };
 };
 /**
  * Select the Hono test app with correct auth for a route.
  *
+ * The credential channel is decided first, because the channel gate is
+ * pre-authorization: an app whose credential the route refuses never reaches
+ * the role gate, so a role-correct app on the wrong channel answers
+ * `credential_type_required`, and a "correct auth passes guard" case reads it
+ * as a failure of the role gate that never ran.
+ *
+ * A gate admitting `'session'` falls through to the `by_role` /
+ * `authed` apps, which carry that channel. Any other gate leaves the
+ * `by_credential_type` app as the only candidate — those hold the keeper
+ * role, which is why a route pairing a non-session channel with some *other*
+ * role has no app and says so.
+ *
  * @throws Error if `auth.roles` names a role not present in `apps.by_role` —
  *   surfaces a missing entry in the `roles` array passed to
  *   `create_auth_test_apps`.
+ * @throws Error if the route pairs a non-session channel with a role the
+ *   channel apps don't hold. Silently handing back a session app would turn
+ *   every case on the route into a misattributed 403.
  */
 export const select_auth_app = (apps, auth) => {
     if (is_public_auth(auth))
         return apps.public;
-    if (auth.credential_types?.includes('daemon_token'))
-        return apps.keeper;
+    const credential_types = auth.credential_types;
+    if (credential_types?.length && !credential_types.includes(CREDENTIAL_TYPE_SESSION)) {
+        const channel = CREDENTIAL_TYPES.find((t) => credential_types.includes(t));
+        const app = channel === undefined ? undefined : apps.by_credential_type.get(channel);
+        const roles = auth.roles;
+        if (app && (!roles?.length || roles.includes(ROLE_KEEPER)))
+            return app;
+        throw new Error(`No test app for credential types '${credential_types.join("', '")}'${roles?.length ? ` with roles '${roles.join("', '")}'` : ''} — the channel apps hold the '${ROLE_KEEPER}' role, and only the session channel has per-role apps`);
+    }
     if (auth.roles?.length) {
         // Multi-role disjunction: any of the named roles admits the caller.
         // Tests pick the first role's app; consumers wanting per-role coverage

package/dist/testing/cross_backend/testing_reset_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAKzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAqCzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;QAiBpC;;;;;;;;WAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWyC,CAAC;AAE/C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,QAAO,SACmB,CAAC;AAE3E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;CAeK,CAAC;AAE/C;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYF,CAAC;AAyB/C,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CAsIjB,CAAC;AAEF,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,UAAmC,CAAC"}
+{"version":3,"file":"testing_reset_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/testing_reset_actions.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAKzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AAqCzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;QAiBpC;;;;;;;;WAQG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWyC,CAAC;AAE/C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;CAWA,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;CAwBC,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC,QAAO,SACmB,CAAC;AAE3E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;CAeK,CAAC;AAE/C;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,qCAAqC,QAAO,SAGvD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;CAYJ,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,QAAO,SAGzD,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaF,CAAC;AAyB/C,eAAO,MAAM,qCAAqC,GACjD,SAAS,aAAa,CAAC,SAAS,CAAC,KAC/B,SAMF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,OAAO,EACb,SAAS,2BAA2B,KAClC,KAAK,CAAC,SAAS,CAsIjB,CAAC;AAEF,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,UAAmC,CAAC"}

package/dist/testing/cross_backend/testing_reset_actions.js

@@ -368,8 +368,9 @@ export const testing_action_manifest_action_spec = {
     input: z.strictObject({}),
     output: ActionManifest,
     async: true,
-    description: 'Test-binary only — dump the live RPC registry as a normalized {method, auth, side_effects} ' +
-        'manifest for cross-impl method-set + auth-shape parity diffing.'
+    description: 'Test-binary only — dump the live RPC registry as a normalized ' +
+        '{method, auth, side_effects, rate_limit} manifest for cross-impl method-set + ' +
+        'auth-shape parity diffing.'
 };
 /**
  * Build the `_testing_action_manifest` action over a backend's full live RPC

package/dist/testing/cross_backend/token_scope_surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token_scope_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/token_scope_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAiE9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAkB1E,wDAAwD;AACxD,MAAM,WAAW,iCAAkC,SAAQ,uCAAuC;IACjG,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AA2DD,eAAO,MAAM,wCAAwC,GACpD,SAAS,iCAAiC,KACxC,IAwHF,CAAC"}
+{"version":3,"file":"token_scope_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/token_scope_surface.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA8E9B,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,YAAY,CAAC;AAkB1E,wDAAwD;AACxD,MAAM,WAAW,iCAAkC,SAAQ,uCAAuC;IACjG,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAwFD,eAAO,MAAM,wCAAwC,GACpD,SAAS,iCAAiC,KACxC,IAwHF,CAAC"}

package/dist/testing/cross_backend/token_scope_surface.js

@@ -26,6 +26,15 @@ import '../assert_dev_env.js';
  *   `required_scope` capability string, per surface. A spine that renamed a
  *   surface, dropped the `surface:` prefix, or emitted the JSON-RPC envelope
  *   from a REST route fails here.
+ * - **The audit stream's channel denial** — that surface is gated to
+ *   `credential_types: ['session']` on both spines, so a bearer never reaches
+ *   its scope gate and the observable is `credential_type_required` instead.
+ *   The case is kept here rather than moved: it is still the bearer-vs-surface
+ *   probe, and what it now pins is the coarser-gate-first ordering both spines
+ *   run (a spine that checked scope first would answer `token_scope_required`).
+ *   `surface:audit_stream`'s own capability string is consequently unreachable
+ *   on the default mount and has no cross-impl pin — each spine's census holds
+ *   its declaration, the way the WS upgrade's is held.
  * - **Scope outranks role** — a narrowed token whose account *also* lacks the
  *   gating role must hear `token_scope_required`, not
  *   `insufficient_permissions`. This is the observable the TS↔Rust ordering
@@ -37,16 +46,17 @@ import '../assert_dev_env.js';
  * Two non-vacuity controls hold the negatives honest: the narrowed token must
  * still reach the RPC method it *does* name (otherwise a spine that rejected
  * the credential outright would pass every denial), and a **full** bearer must
- * reach the same surface (otherwise a route broken for all bearers would pass
- * too).
+ * reach `fact_bare` (otherwise a route broken for all bearers would pass too).
+ * The second has no audit-stream twin by construction — refusing every bearer
+ * is exactly what that route's channel gate is for.
  *
  * ## Why the WS upgrade isn't here
  *
  * Rule 3's third probeable surface is the WebSocket upgrade, and it is
  * deliberately omitted: `create_ws_transport` threads cookies, not bearer
  * headers, and a refused upgrade surfaces as a thrown connection error whose
- * body — the thing this suite exists to compare — isn't readable. The two HTTP
- * surfaces are where the denial body is observable, which is what the parity
+ * body — the thing this suite exists to compare — isn't readable. The HTTP
+ * surfaces are where a denial body is observable, which is what the parity
  * gate needs. The WS gate keeps its per-spine coverage (fuz_app's surface
  * census pins the call site; the Rust census pins its own).
  *
@@ -57,7 +67,7 @@ import '../assert_dev_env.js';
  */
 import { describe, assert } from 'vitest';
 import { account_token_create_action_spec } from '../../auth/account_action_specs.js';
-import { ERROR_TOKEN_SCOPE_REQUIRED } from '../../http/error_schemas.js';
+import { ERROR_CREDENTIAL_TYPE_REQUIRED, ERROR_TOKEN_SCOPE_REQUIRED } from '../../http/error_schemas.js';
 import { test_if } from './capabilities.js';
 import { cross_rpc_call } from './cell_cross_helpers.js';
 import { SPINE_RPC_PATH } from './spine_surface_constants.js';
@@ -107,6 +117,25 @@ const assert_surface_denied = async (fresh_transport, path, token, surface) => {
     const body = await res.json();
     assert.deepStrictEqual(body, surface_denial_body(surface), `${path} must return the canonical flat surface denial`);
 };
+/**
+ * Assert a bearer GET is refused by the *channel* gate rather than the scope
+ * gate — the shape a surface takes once it declares
+ * `credential_types: ['session']`.
+ *
+ * Distinct from `assert_surface_denied` on purpose: a channel-gated surface
+ * refuses **every** bearer, narrow or full, so the denial cannot name a scope.
+ * A narrowed token is still the right probe — it proves the channel gate runs
+ * *first*, since a scope-gated route would have answered
+ * `token_scope_required` instead.
+ */
+const assert_channel_denied = async (fresh_transport, path, token, credential_types) => {
+    const res = await fresh_transport({ origin: null })(path, {
+        headers: { authorization: `Bearer ${token}` }
+    });
+    assert.strictEqual(res.status, 403, `${path} must refuse a bearer with 403`);
+    const body = await res.json();
+    assert.deepStrictEqual(body, { error: ERROR_CREDENTIAL_TYPE_REQUIRED, required_credential_types: credential_types }, `${path} must return the canonical flat credential-type denial`);
+};
 export const describe_token_scope_surface_cross_tests = (options) => {
     const { setup_test, capabilities } = options;
     const rpc_path = options.rpc_path ?? SPINE_RPC_PATH;
@@ -123,10 +152,10 @@ export const describe_token_scope_surface_cross_tests = (options) => {
             const res = await cross_rpc_call(fixture.fresh_transport({ origin: null }), rpc_path, ADMITTED_METHOD, undefined, { authorization: `Bearer ${token}` });
             assert.ok(res.ok, `admitted method must succeed: ${JSON.stringify(res.error)}`);
         });
-        test_if(capabilities.sse, 'a narrowed token is refused the audit stream (surface:audit_stream)', async () => {
+        test_if(capabilities.sse, 'the audit stream refuses a bearer at the channel gate (credential_types)', async () => {
             const fixture = await setup_test();
             const token = await mint_narrowed_token(fixture.transport, rpc_path, fixture.create_session_headers());
-            await assert_surface_denied(fixture.fresh_transport, sse_path, token, 'audit_stream');
+            await assert_channel_denied(fixture.fresh_transport, sse_path, token, ['session']);
         });
         test_if(capabilities.fact_serving, 'a narrowed token is refused the bare-hash fact read (surface:fact_bare)', async () => {
             const fixture = await setup_test();

package/dist/testing/surface_invariants.d.ts

@@ -5,7 +5,13 @@ import type { AppSurface } from '../http/surface.js';
  */
 export declare const assert_protected_routes_declare_401: (surface: AppSurface) => void;
 /**
- * Every role/keeper route has 403 in `error_schemas`.
+ * Every route with an authority gate that can answer 403 declares one — a
+ * role gate, or a credential-channel gate of any kind (keeper included).
+ *
+ * The credential half is not just the keeper routes: the session-only gates
+ * point the same axis the other way and refuse with the same status, so a
+ * route carrying one and no 403 schema would have its denial body go
+ * unvalidated by the DEV-only error-schema check.
  */
 export declare const assert_role_routes_declare_403: (surface: AppSurface) => void;
 /**

package/dist/testing/surface_invariants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"surface_invariants.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/surface_invariants.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAuB7B,OAAO,KAAK,EAAE,UAAU,EAAwB,MAAM,oBAAoB,CAAC;AAe3E;;GAEG;AACH,eAAO,MAAM,mCAAmC,GAAI,SAAS,UAAU,KAAG,IAQzE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,8BAA8B,GAAI,SAAS,UAAU,KAAG,IASpE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,+BAA+B,GAAI,SAAS,UAAU,KAAG,IAQrE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,UAAU,KAAG,IAQtE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,+BAA+B,GAAI,SAAS,UAAU,KAAG,IAQrE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,2BAA2B,GAAI,SAAS,UAAU,KAAG,IAIjE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B,GAAI,SAAS,UAAU,KAAG,IAOhE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mCAAmC,GAAI,SAAS,UAAU,KAAG,IAezE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uCAAuC,GAAI,SAAS,UAAU,KAAG,IAO7E,CAAC;AAyBF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oCAAoC,GAAI,SAAS,UAAU,KAAG,IAoC1E,CAAC;AAsEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sCAAsC,GAAI,SAAS,UAAU,KAAG,IAU5E,CAAC;AAIF,4DAA4D;AAC5D,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAEpE,iEAAiE;AACjE,MAAM,WAAW,qBAAqB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,sBAAsB,CAAC;IACpC,qDAAqD;IACrD,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;CAClC;AAiED;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,GAAI,SAAS,UAAU,KAAG,KAAK,CAAC,qBAAqB,CAgB7F,CAAC;AAIF;;;;;;GAMG;AACH,eAAO,MAAM,sCAAsC,GAAI,SAAS,UAAU,KAAG,IAS5E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qCAAqC,GAAI,SAAS,UAAU,KAAG,IAS3E,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,4CAA4C,GAAI,SAAS,UAAU,KAAG,IAWlF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sCAAsC,GAAI,SAAS,UAAU,KAAG,IAa5E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,cAAc,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,UAAU,KAAG,IAoB/D,CAAC;AAIF;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC5C;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;IAClD;;;OAGG;IACH,yBAAyB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1C;;;OAGG;IACH,qBAAqB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtC;AASD;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC,GAChD,SAAS,UAAU,EACnB,qBAAoB,KAAK,CAAC,MAAM,GAAG,MAAM,CAA8B,KACrE,IAcF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,UAAU,EACnB,YAAW,KAAK,CAAC,MAAM,CAAM,KAC3B,IAYF,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,+BAA+B,GAAI,SAAS,UAAU,KAAG,IAQrE,CAAC;AAKF;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,UAAU,EACnB,WAAU,KAAK,CAAC,MAAM,CAAiC,KACrD,IAWF,CAAC;AAWF,mDAAmD;AACnD,MAAM,WAAW,2BAA2B;IAC3C,6FAA6F;IAC7F,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,mEAAmE;IACnE,eAAe,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,kDAAkD;IAClD,SAAS,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,uCAAuC,EAAE,aAAa,CAAC,MAAM,CAAM,CAAC;AAEjF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,8BAA8B,EAAE,2BAG5C,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,UAAU,EACnB,UAAU,2BAA2B,KACnC,IAsBF,CAAC;AAIF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,UAAU,KAAG,IAY/D,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,UAAU,KAAG,IAMtE,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,GAC1C,SAAS,UAAU,EACnB,UAAS,4BAAiC,KACxC,IAKF,CAAC"}
+{"version":3,"file":"surface_invariants.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/surface_invariants.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAuB7B,OAAO,KAAK,EAAE,UAAU,EAAwB,MAAM,oBAAoB,CAAC;AAgB3E;;GAEG;AACH,eAAO,MAAM,mCAAmC,GAAI,SAAS,UAAU,KAAG,IAQzE,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,GAAI,SAAS,UAAU,KAAG,IASpE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,+BAA+B,GAAI,SAAS,UAAU,KAAG,IAQrE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,UAAU,KAAG,IAQtE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,+BAA+B,GAAI,SAAS,UAAU,KAAG,IAQrE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,2BAA2B,GAAI,SAAS,UAAU,KAAG,IAIjE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B,GAAI,SAAS,UAAU,KAAG,IAOhE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mCAAmC,GAAI,SAAS,UAAU,KAAG,IAezE,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uCAAuC,GAAI,SAAS,UAAU,KAAG,IAO7E,CAAC;AAyBF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oCAAoC,GAAI,SAAS,UAAU,KAAG,IAoC1E,CAAC;AAsEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sCAAsC,GAAI,SAAS,UAAU,KAAG,IAU5E,CAAC;AAIF,4DAA4D;AAC5D,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAEpE,iEAAiE;AACjE,MAAM,WAAW,qBAAqB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,sBAAsB,CAAC;IACpC,qDAAqD;IACrD,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;CAClC;AAiED;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,GAAI,SAAS,UAAU,KAAG,KAAK,CAAC,qBAAqB,CAgB7F,CAAC;AAIF;;;;;;GAMG;AACH,eAAO,MAAM,sCAAsC,GAAI,SAAS,UAAU,KAAG,IAS5E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qCAAqC,GAAI,SAAS,UAAU,KAAG,IAS3E,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,4CAA4C,GAAI,SAAS,UAAU,KAAG,IAWlF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sCAAsC,GAAI,SAAS,UAAU,KAAG,IAa5E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,cAAc,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,UAAU,KAAG,IAoB/D,CAAC;AAIF;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC5C;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;IAClD;;;OAGG;IACH,yBAAyB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1C;;;OAGG;IACH,qBAAqB,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtC;AASD;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC,GAChD,SAAS,UAAU,EACnB,qBAAoB,KAAK,CAAC,MAAM,GAAG,MAAM,CAA8B,KACrE,IAcF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qCAAqC,GACjD,SAAS,UAAU,EACnB,YAAW,KAAK,CAAC,MAAM,CAAM,KAC3B,IAYF,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,+BAA+B,GAAI,SAAS,UAAU,KAAG,IAQrE,CAAC;AAKF;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,UAAU,EACnB,WAAU,KAAK,CAAC,MAAM,CAAiC,KACrD,IAWF,CAAC;AAWF,mDAAmD;AACnD,MAAM,WAAW,2BAA2B;IAC3C,6FAA6F;IAC7F,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,mEAAmE;IACnE,eAAe,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,kDAAkD;IAClD,SAAS,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,uCAAuC,EAAE,aAAa,CAAC,MAAM,CAAM,CAAC;AAEjF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,8BAA8B,EAAE,2BAG5C,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,UAAU,EACnB,UAAU,2BAA2B,KACnC,IAsBF,CAAC;AAIF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,UAAU,KAAG,IAY/D,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gCAAgC,GAAI,SAAS,UAAU,KAAG,IAMtE,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,GAC1C,SAAS,UAAU,EACnB,UAAS,4BAAiC,KACxC,IAKF,CAAC"}

package/dist/testing/surface_invariants.js

@@ -18,7 +18,7 @@ import './assert_dev_env.js';
  */
 import { assert } from 'vitest';
 import { middleware_applies } from '../http/schema_helpers.js';
-import { filter_protected_routes, filter_role_routes, filter_keeper_routes, filter_routes_with_input, filter_routes_with_params, filter_routes_with_query, filter_public_routes, format_route_key } from '../http/surface_query.js';
+import { filter_protected_routes, filter_role_routes, filter_keeper_routes, filter_credential_gated_routes, filter_routes_with_input, filter_routes_with_params, filter_routes_with_query, filter_public_routes, format_route_key } from '../http/surface_query.js';
 import { PROTOCOL_ACTION_METHODS } from '../actions/action_codegen.js';
 // --- Structural invariants ---
 /**
@@ -31,13 +31,19 @@ export const assert_protected_routes_declare_401 = (surface) => {
     }
 };
 /**
- * Every role/keeper route has 403 in `error_schemas`.
+ * Every route with an authority gate that can answer 403 declares one — a
+ * role gate, or a credential-channel gate of any kind (keeper included).
+ *
+ * The credential half is not just the keeper routes: the session-only gates
+ * point the same axis the other way and refuse with the same status, so a
+ * route carrying one and no 403 schema would have its denial body go
+ * unvalidated by the DEV-only error-schema check.
  */
 export const assert_role_routes_declare_403 = (surface) => {
     const role_routes = filter_role_routes(surface);
-    const keeper_routes = filter_keeper_routes(surface);
-    for (const route of [...role_routes, ...keeper_routes]) {
-        assert.ok(route.error_schemas && '403' in route.error_schemas, `${format_route_key(route)} requires role/keeper but missing 403 error schema`);
+    const credential_gated_routes = filter_credential_gated_routes(surface);
+    for (const route of [...role_routes, ...credential_gated_routes]) {
+        assert.ok(route.error_schemas && '403' in route.error_schemas, `${format_route_key(route)} has a role or credential gate but missing 403 error schema`);
     }
 };
 /**

package/dist/ui/AdminAccounts.svelte

@@ -44,9 +44,9 @@
 	<h1>accounts</h1>
 	{#if admin_accounts.account_count > 0}
 		<p>
-			<span class="chip color_a"
-				>{admin_accounts.account_count} account{admin_accounts.account_count === 1 ? '' : 's'}</span
-			>
+			<span class="chip color_a">
+				{admin_accounts.account_count} account{admin_accounts.account_count === 1 ? '' : 's'}
+			</span>
 		</p>
 	{/if}
 
@@ -158,7 +158,9 @@
 					{#each admin_accounts.grantable_roles as role (role)}
 						{@const key = grant_key(row.account.id, role)}
 						{@const grant_error = admin_accounts.grant.error(key)}
-						{#if !row.role_grants.some((p) => p.role === role) && !row.pending_offers.some((o) => o.role === role)}
+						{#if !row.role_grants.some((p) => p.role === role) &&
+							!row.pending_offers.some((o) => o.role === role)
+						}
 							<ConfirmButton
 								onconfirm={() => admin_accounts.submit_grant(row.account.id, role)}
 								title="offer {role}"

package/dist/ui/AdminAccounts.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdminAccounts.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminAccounts.svelte"],"names":[],"mappings":"AAkMA,QAAA,MAAM,aAAa,2DAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}
+{"version":3,"file":"AdminAccounts.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminAccounts.svelte"],"names":[],"mappings":"AAqMA,QAAA,MAAM,aAAa,2DAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}

package/dist/ui/AdminInvites.svelte

@@ -59,9 +59,9 @@
 	</section>
 	{#if admin_invites.invite_count > 0}
 		<p>
-			<span class="chip color_a"
-				>{admin_invites.unclaimed_count} unclaimed / {admin_invites.invite_count} total</span
-			>
+			<span class="chip color_a">
+				{admin_invites.unclaimed_count} unclaimed / {admin_invites.invite_count} total
+			</span>
 		</p>
 	{/if}
 

package/dist/ui/AdminInvites.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdminInvites.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminInvites.svelte"],"names":[],"mappings":"AAqJA,QAAA,MAAM,YAAY,2DAAwC,CAAC;AAC3D,KAAK,YAAY,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;AACpD,eAAe,YAAY,CAAC"}
+{"version":3,"file":"AdminInvites.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminInvites.svelte"],"names":[],"mappings":"AAuJA,QAAA,MAAM,YAAY,2DAAwC,CAAC;AAC3D,KAAK,YAAY,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;AACpD,eAAe,YAAY,CAAC"}

package/dist/ui/AdminOverview.svelte

@@ -146,9 +146,9 @@
 				<div class="baseline-row gap_xs font_size_sm mt_sm">
 					<span class="text_50">newest session:</span>
 					<strong>{most_recent.username}</strong>
-					<span class="text_50" title={format_datetime_local(most_recent.created_at)}
-						>{format_relative_time(most_recent.created_at)}</span
-					>
+					<span class="text_50" title={format_datetime_local(most_recent.created_at)}>
+						{format_relative_time(most_recent.created_at)}
+					</span>
 				</div>
 			{/if}
 		{/if}
@@ -214,9 +214,9 @@
 			<ul class="compact-list">
 				{#each recent_events as event (event.id)}
 					<li>
-						<span class="text_50 font_size_sm" title={format_datetime_local(event.created_at)}
-							>{format_relative_time(event.created_at)}</span
-						>
+						<span class="text_50 font_size_sm" title={format_datetime_local(event.created_at)}>
+							{format_relative_time(event.created_at)}
+						</span>
 						<code class="font_size_sm">{event.event_type}</code>
 						{#if event.outcome === 'failure'}
 							<span class="chip font_size_sm color_c">fail</span>
@@ -251,9 +251,9 @@
 				<ul class="compact-list">
 					{#each role_grant_changes.slice(0, 4) as event (event.id)}
 						<li class="font_size_sm">
-							<span class="text_50" title={format_datetime_local(event.created_at)}
-								>{format_relative_time(event.created_at)}</span
-							>
+							<span class="text_50" title={format_datetime_local(event.created_at)}>
+								{format_relative_time(event.created_at)}
+							</span>
 							<code>{event.event_type === 'role_grant_create' ? 'grant' : 'revoke'}</code>
 							{#if event.metadata?.role}
 								<span class="chip font_size_sm">{event.metadata.role}</span>
@@ -309,7 +309,7 @@
 					label="log out"
 				>
 					{#snippet popover_button_content()}
-						<span class="p_md"> log out </span>
+						<span class="p_md">log out</span>
 					{/snippet}
 				</ConfirmButton>
 			</div>

package/dist/ui/AdminOverview.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdminOverview.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminOverview.svelte"],"names":[],"mappings":"AAyUA,QAAA,MAAM,aAAa,2DAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}
+{"version":3,"file":"AdminOverview.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminOverview.svelte"],"names":[],"mappings":"AA+UA,QAAA,MAAM,aAAa,2DAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}

package/dist/ui/AdminRoleGrantHistory.svelte

@@ -74,14 +74,14 @@
 				{:else if column.key === 'username'}
 					<!-- Prefer actor-grain id in the truncated fallback; account is
 					     the second fallback for events with no actor binding. -->
-					<span class="text_50"
-						>{row.username ?? truncate_uuid(row.actor_id ?? row.account_id ?? '?')}</span
-					>
+					<span class="text_50">
+						{row.username ?? truncate_uuid(row.actor_id ?? row.account_id ?? '?')}
+					</span>
 				{:else if column.key === 'target_username'}
-					<span class="text_50"
-						>{row.target_username ??
-							truncate_uuid(row.target_actor_id ?? row.target_account_id ?? '?')}</span
-					>
+					<span class="text_50">
+						{row.target_username ??
+							truncate_uuid(row.target_actor_id ?? row.target_account_id ?? '?')}
+					</span>
 				{:else if column.key === 'created_at'}
 					<span title={format_datetime_local(row.created_at)}>
 						{format_relative_time(row.created_at)}

package/dist/ui/AdminRoleGrantHistory.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdminRoleGrantHistory.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminRoleGrantHistory.svelte"],"names":[],"mappings":"AAmGA,QAAA,MAAM,qBAAqB,2DAAwC,CAAC;AACpE,KAAK,qBAAqB,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACtE,eAAe,qBAAqB,CAAC"}
+{"version":3,"file":"AdminRoleGrantHistory.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/AdminRoleGrantHistory.svelte"],"names":[],"mappings":"AAuGA,QAAA,MAAM,qBAAqB,2DAAwC,CAAC;AACpE,KAAK,qBAAqB,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACtE,eAAe,qBAAqB,CAAC"}

package/dist/ui/AdminSettings.svelte

@@ -33,7 +33,7 @@
 		label="log out"
 	>
 		{#snippet popover_button_content()}
-			<span class="p_md"> log out </span>
+			<span class="p_md">log out</span>
 		{/snippet}
 	</ConfirmButton>
 </section>

package/dist/ui/RoleGrantOfferInbox.svelte

@@ -48,7 +48,10 @@
 <section class="role-grant-offer-inbox">
 	<h2>pending offers</h2>
 
-	{#if role_grant_offers.list.error || role_grant_offers.accept.error || role_grant_offers.decline.error}
+	{#if role_grant_offers.list.error ||
+		role_grant_offers.accept.error ||
+		role_grant_offers.decline.error
+	}
 		<p class="color_c_50">
 			{role_grant_offers.list.error ??
 				role_grant_offers.accept.error ??

package/dist/ui/RoleGrantOfferInbox.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RoleGrantOfferInbox.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/RoleGrantOfferInbox.svelte"],"names":[],"mappings":"AAmBA,OAAO,EAA6C,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE/F,KAAK,gBAAgB,GAAI;IACxB,uEAAuE;IACvE,YAAY,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,MAAM,CAAC;IACjD;;;;OAIG;IACH,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B,+DAA+D;IAC/D,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACvC,CAAC;AA+FH,QAAA,MAAM,mBAAmB,sDAAwC,CAAC;AAClE,KAAK,mBAAmB,GAAG,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAClE,eAAe,mBAAmB,CAAC"}
+{"version":3,"file":"RoleGrantOfferInbox.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/RoleGrantOfferInbox.svelte"],"names":[],"mappings":"AAmBA,OAAO,EAA6C,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE/F,KAAK,gBAAgB,GAAI;IACxB,uEAAuE;IACvE,YAAY,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,MAAM,CAAC;IACjD;;;;OAIG;IACH,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B,+DAA+D;IAC/D,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACvC,CAAC;AAiGH,QAAA,MAAM,mBAAmB,sDAAwC,CAAC;AAClE,KAAK,mBAAmB,GAAG,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAClE,eAAe,mBAAmB,CAAC"}

package/dist/ui/SurfaceExplorer.svelte

@@ -13,6 +13,7 @@
 	import type { AppSurface, AppSurfaceRoute, AppSurfaceDiagnostic } from '../http/surface.js';
 	import { surface_auth_summary, format_route_key } from '../http/surface_query.js';
 	import {
+		is_credential_gated_auth,
 		is_keeper_auth,
 		is_plain_authenticated_auth,
 		is_public_auth,
@@ -22,7 +23,7 @@
 
 	const { surface }: { surface: AppSurface } = $props();
 
-	const auth_types = ['all', 'none', 'authenticated', 'role', 'keeper'] as const;
+	const auth_types = ['all', 'none', 'authenticated', 'role', 'credential', 'keeper'] as const;
 
 	let auth_filter: (typeof auth_types)[number] = $state.raw('all');
 	let expanded_route: string | null = $state.raw(null);
@@ -49,6 +50,8 @@
 				return is_plain_authenticated_auth(auth);
 			case 'role':
 				return is_role_auth(auth);
+			case 'credential':
+				return is_credential_gated_auth(auth) && !is_keeper_auth(auth);
 			case 'keeper':
 				return is_keeper_auth(auth);
 		}
@@ -90,32 +93,44 @@
 		if (is_public_auth(auth)) return 'chip color_b';
 		if (is_keeper_auth(auth)) return 'chip color_c';
 		if (is_role_auth(auth)) return 'chip color_d';
+		if (is_credential_gated_auth(auth)) return 'chip color_e';
 		if (is_plain_authenticated_auth(auth)) return 'chip color_a';
 		return 'chip';
 	};
 
 	const role_count = $derived(Array.from(summary.role.values()).reduce((sum, n) => sum + n, 0));
+	const credential_count = $derived(
+		Array.from(summary.credential.values()).reduce((sum, n) => sum + n, 0)
+	);
 </script>
 
 <section>
 	<div class="row" style:gap="var(--space_md)" style:flex-wrap="wrap" style:align-items="center">
 		<span class="chip">{surface.routes.length} routes</span>
 		{#if summary.none > 0}<span class="chip color_b">{summary.none} public</span>{/if}
-		{#if summary.authenticated > 0}<span class="chip color_a"
-				>{summary.authenticated} authenticated</span
-			>{/if}
+		{#if summary.authenticated > 0}
+			<span class="chip color_a">{summary.authenticated} authenticated</span>
+		{/if}
 		{#if role_count > 0}<span class="chip color_d">{role_count} role</span>{/if}
+		{#if credential_count > 0}
+			<span class="chip color_e">{credential_count} credential-gated</span>
+		{/if}
 		{#if summary.keeper > 0}<span class="chip color_c">{summary.keeper} keeper</span>{/if}
 		<span class="chip">{surface.middleware.length} middleware</span>
 		{#if rpc_method_count > 0}<span class="chip">{rpc_method_count} rpc methods</span>{/if}
 		{#if ws_method_count > 0}<span class="chip">{ws_method_count} ws methods</span>{/if}
 		{#if surface.env.length}<span class="chip">{surface.env.length} env</span>{/if}
 		{#if surface.events.length}<span class="chip">{surface.events.length} events</span>{/if}
-		{#if surface.diagnostics.length}{@const warnings = surface.diagnostics.filter(
+		{#if surface.diagnostics.length}
+			{@const warnings = surface.diagnostics.filter(
 				(d: AppSurfaceDiagnostic) => d.level === 'warning'
-			)}{#if warnings.length}<span class="chip color_e"
-					>{warnings.length} warning{warnings.length === 1 ? '' : 's'}</span
-				>{/if}{/if}
+			)}
+			{#if warnings.length}
+				<span class="chip color_e">
+					{warnings.length} warning{warnings.length === 1 ? '' : 's'}
+				</span>
+			{/if}
+		{/if}
 	</div>
 
 	<h3>routes</h3>
@@ -221,9 +236,9 @@
 						<tr>
 							<td><code>{mw.name}</code></td>
 							<td><code>{mw.path}</code></td>
-							<td class="text_50"
-								>{mw.error_schemas ? Object.keys(mw.error_schemas).join(', ') : '-'}</td
-							>
+							<td class="text_50">
+								{mw.error_schemas ? Object.keys(mw.error_schemas).join(', ') : '-'}
+							</td>
 						</tr>
 					{/each}
 				</tbody>
@@ -280,11 +295,11 @@
 							<td>
 								<!-- TODO fix the `as any` cast -->
 								{#if event.params_schema}
-									<code
-										>{Object.keys(
+									<code>
+										{Object.keys(
 											(event.params_schema as any).properties ?? event.params_schema
-										).join(', ')}</code
-									>
+										).join(', ')}
+									</code>
 								{:else}
 									<span class="text_50">none</span>
 								{/if}
@@ -457,8 +472,9 @@
 				<tbody>
 					{#each surface.diagnostics as d, i (i)}
 						<tr>
-							<td><span class={d.level === 'warning' ? 'chip color_e' : 'chip'}>{d.level}</span></td
-							>
+							<td>
+								<span class={d.level === 'warning' ? 'chip color_e' : 'chip'}>{d.level}</span>
+							</td>
 							<td><code>{d.category}</code></td>
 							<td>{d.message}</td>
 							<td class="text_50">{d.source ?? '-'}</td>

package/dist/ui/SurfaceExplorer.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SurfaceExplorer.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/SurfaceExplorer.svelte"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,UAAU,EAAyC,MAAM,oBAAoB,CAAC;AAU3F,KAAK,gBAAgB,GAAI;IAAE,OAAO,EAAE,UAAU,CAAA;CAAE,CAAC;AAgclD,QAAA,MAAM,eAAe,sDAAwC,CAAC;AAC9D,KAAK,eAAe,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;AAC1D,eAAe,eAAe,CAAC"}
+{"version":3,"file":"SurfaceExplorer.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/SurfaceExplorer.svelte"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,UAAU,EAAyC,MAAM,oBAAoB,CAAC;AAW3F,KAAK,gBAAgB,GAAI;IAAE,OAAO,EAAE,UAAU,CAAA;CAAE,CAAC;AAwdlD,QAAA,MAAM,eAAe,sDAAwC,CAAC;AAC9D,KAAK,eAAe,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;AAC1D,eAAe,eAAe,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.112.0",
+  "version": "0.113.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",
@@ -32,7 +32,7 @@
   },
   "peerDependencies": {
     "@electric-sql/pglite": ">=0.4",
-    "@fuzdev/blake3_wasm": ">=0.1.0",
+    "@fuzdev/blake3-wasm": ">=0.2.0",
     "@fuzdev/fuz_util": ">=0.68.0",
     "@hono/node-server": ">=1",
     "@hono/node-ws": ">=1",
@@ -73,12 +73,12 @@
   },
   "devDependencies": {
     "@electric-sql/pglite": "^0.4.5",
-    "@fuzdev/blake3_wasm": "^0.1.1",
-    "@fuzdev/fuz_code": "^0.47.0",
-    "@fuzdev/fuz_css": "^0.63.2",
-    "@fuzdev/fuz_ui": "^0.206.6",
-    "@fuzdev/fuz_util": "^0.68.0",
-    "@fuzdev/gro": "0.205.1",
+    "@fuzdev/blake3-wasm": "^0.2.0",
+    "@fuzdev/fuz_code": "^0.48.0",
+    "@fuzdev/fuz_css": "^0.63.3",
+    "@fuzdev/fuz_ui": "^0.208.0",
+    "@fuzdev/fuz_util": "^0.69.0",
+    "@fuzdev/gro": "^0.212.0",
     "@fuzdev/mdz": "^0.3.0",
     "@hono/node-server": "^1.19.14",
     "@hono/node-ws": "^1.3.1",
@@ -104,13 +104,13 @@
     "prettier-plugin-svelte": "^4.1.1",
     "svelte": "^5.56.4",
     "svelte-check": "^4.7.1",
-    "svelte-docinfo": "^0.5.4",
+    "svelte-docinfo": "^0.7.0",
     "svelte2tsx": "^0.7.52",
     "tslib": "^2.8.1",
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.57.0",
     "vite": "^7.3.1",
-    "vitest": "^4.0.18",
+    "vitest": "^5.0.0",
     "ws": "^8.20.1",
     "zimmerframe": "^1.1.4",
     "zod": "^4.3.6"