@fuzdev/fuz_app 0.117.1 → 0.118.0

package/dist/auth/role_grant_offer_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_grant_offer_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_grant_offer_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAI9C,mEAAmE;AACnE,eAAO,MAAM,mCAAmC,MAAM,CAAC;AAEvD,yFAAyF;AACzF,eAAO,MAAM,+BAA+B,QAA2B,CAAC;AAExE,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,IAAI,CAAC;IACT,aAAa,EAAE,IAAI,CAAC;IACpB,aAAa,EAAE,IAAI,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;;OAKG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,uBAAuB,EAAE,IAAI,GAAG,IAAI,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAgB,SAAQ,cAAc;IACtD,eAAe,EAAE,IAAI,CAAC;CACtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IACzC,aAAa,EAAE,IAAI,CAAC;IACpB,aAAa,EAAE,IAAI,CAAC;IACpB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,CAAC;CACjB;AAED,wDAAwD;AACxD,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;kBAoD4D,CAAC;AAC5F,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,gEAAgE;AAChE,eAAO,MAAM,wBAAwB,GAAI,OAAO,cAAc,KAAG,kBAiB/D,CAAC"}
+{"version":3,"file":"role_grant_offer_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_grant_offer_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAI9C,mEAAmE;AACnE,eAAO,MAAM,mCAAmC,MAAM,CAAC;AAEvD,yFAAyF;AACzF,eAAO,MAAM,+BAA+B,QAA2B,CAAC;AAExE,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,IAAI,CAAC;IACT,aAAa,EAAE,IAAI,CAAC;IACpB,aAAa,EAAE,IAAI,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;;OAKG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,uBAAuB,EAAE,IAAI,GAAG,IAAI,CAAC;IACrC;;;;;;;OAOG;IACH,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAgB,SAAQ,cAAc;IACtD,eAAe,EAAE,IAAI,CAAC;CACtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IACzC,aAAa,EAAE,IAAI,CAAC;IACpB,aAAa,EAAE,IAAI,CAAC;IACpB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,CAAC;CACjB;AAED,wDAAwD;AACxD,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;kBAoD4D,CAAC;AAC5F,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,gEAAgE;AAChE,eAAO,MAAM,wBAAwB,GAAI,OAAO,cAAc,KAAG,kBAiB/D,CAAC"}

package/dist/db/migrate.d.ts

@@ -86,7 +86,7 @@ export interface MigrationResult {
  * Callers branch on `.kind` rather than matching error messages — message
  * text is for operators, not control flow.
  */
-export type MigrationErrorKind = 'binary-older-than-db' | 'name-divergence-at-N' | 'old-tracker-shape' | 'migration-failed' | 'baseline-name-not-in-code' | 'baseline-name-out-of-order' | 'baseline-namespace-already-populated';
+export type MigrationErrorKind = 'binary-older-than-db' | 'name-divergence-at-N' | 'migration-failed' | 'baseline-name-not-in-code' | 'baseline-name-out-of-order' | 'baseline-namespace-already-populated';
 /** Structured context passed alongside a `MigrationError`. */
 export interface MigrationErrorContext {
     namespace?: string;
@@ -137,26 +137,22 @@ export declare class MigrationError extends Error {
  *   namespaces are omitted)
  * @mutates schema_version - inserts one row per applied migration
  * @throws MigrationError with `kind` of `binary-older-than-db`,
- *   `name-divergence-at-N`, `old-tracker-shape`, or `migration-failed`
+ *   `name-divergence-at-N`, or `migration-failed`
  */
 export declare const run_migrations: (db: Db, namespaces: Array<MigrationNamespace>) => Promise<Array<MigrationResult>>;
 /**
  * Insert tracker rows for the named migrations of a namespace **without
  * executing them**.
  *
- * Used to promote an existing schema (e.g. produced by a pre-0.42 build,
- * preserved through a tracker-shape upgrade) into the new identity tracker.
+ * Used to promote an existing schema (e.g. produced by an out-of-band
+ * bootstrap, or a hand-applied DDL set) into the identity tracker.
  * `baseline()` trusts the operator-supplied list — it does not verify that
  * the schema actually matches what the named migrations would have produced.
  * Pair with a schema-assertion script post-baseline before re-enabling traffic.
  *
  * Contract:
- * - Probes for the pre-0.42 tracker shape; throws `old-tracker-shape` if
- *   found (DDL with `IF NOT EXISTS` would otherwise no-op against the old
- *   table and the INSERT would fail with a confusing column-not-found).
- * - Creates the new-shape `schema_version` table if missing — cutover
- *   scripts that just dropped the old-shape table can call `baseline()`
- *   directly with no separate DDL step.
+ * - Creates the `schema_version` table if missing — a promotion script can
+ *   call `baseline()` against a fresh tracker with no separate DDL step.
  * - Acquires the same per-namespace advisory lock as `run_migrations` (with
  *   the same try/catch fallback for environments lacking `pg_advisory_lock`).
  * - Refuses if any tracker rows already exist *for this namespace* — lets
@@ -172,9 +168,8 @@ export declare const run_migrations: (db: Db, namespaces: Array<MigrationNamespa
  * @param names - prefix of `ns.migrations[].name` to record as already-applied
  * @mutates schema_version - inserts tracker rows for `names` without running
  *   the corresponding migration bodies
- * @throws MigrationError with `kind` of `old-tracker-shape`,
- *   `baseline-name-not-in-code`, `baseline-name-out-of-order`, or
- *   `baseline-namespace-already-populated`
+ * @throws MigrationError with `kind` of `baseline-name-not-in-code`,
+ *   `baseline-name-out-of-order`, or `baseline-namespace-already-populated`
  */
 export declare const baseline: (db: Db, ns: MigrationNamespace, names: ReadonlyArray<string>) => Promise<void>;
 //# sourceMappingURL=migrate.d.ts.map

package/dist/db/migrate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/migrate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAIH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAElC;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;CAC7B;AAED,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAC3B,sBAAsB,GACtB,sBAAsB,GACtB,mBAAmB,GACnB,kBAAkB,GAClB,2BAA2B,GAC3B,4BAA4B,GAC5B,sCAAsC,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,WAAW,qBAAqB;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;gBAEnC,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB;CAQtF;AA6ED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,cAAc,GAC1B,IAAI,EAAE,EACN,YAAY,KAAK,CAAC,kBAAkB,CAAC,KACnC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAuFhC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,eAAO,MAAM,QAAQ,GACpB,IAAI,EAAE,EACN,IAAI,kBAAkB,EACtB,OAAO,aAAa,CAAC,MAAM,CAAC,KAC1B,OAAO,CAAC,IAAI,CA+Dd,CAAC"}
+{"version":3,"file":"migrate.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/migrate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAIH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAElC;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;CAC7B;AAED,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAC3B,sBAAsB,GACtB,sBAAsB,GACtB,kBAAkB,GAClB,2BAA2B,GAC3B,4BAA4B,GAC5B,sCAAsC,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,WAAW,qBAAqB;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;gBAEnC,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB;CAQtF;AAsDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,cAAc,GAC1B,IAAI,EAAE,EACN,YAAY,KAAK,CAAC,kBAAkB,CAAC,KACnC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAmFhC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,QAAQ,GACpB,IAAI,EAAE,EACN,IAAI,kBAAkB,EACtB,OAAO,aAAa,CAAC,MAAM,CAAC,KAC1B,OAAO,CAAC,IAAI,CA2Dd,CAAC"}

package/dist/db/migrate.js

@@ -83,24 +83,6 @@ CREATE TABLE IF NOT EXISTS schema_version (
   PRIMARY KEY (namespace, name),
   UNIQUE (namespace, sequence)
 )`;
-/**
- * Detect the pre-0.42 `schema_version` shape (`namespace`, `version`,
- * `applied_at`). The new-shape DDL uses `IF NOT EXISTS` and would silently
- * no-op against the old table, so this probe runs before DDL and before any
- * per-namespace lock.
- */
-const detect_old_tracker = async (db) => {
-    const row = await db.query_one(`SELECT EXISTS (
-			SELECT 1 FROM information_schema.columns
-			WHERE table_schema = 'public'
-			  AND table_name = 'schema_version'
-			  AND column_name = 'version'
-		) as exists`);
-    return row?.exists ?? false;
-};
-const OLD_TRACKER_HINT = 'Detected fuz_app < 0.42 tracker shape (schema_version.version column exists). ' +
-    'Hint: `DROP TABLE schema_version` and re-run, or call `baseline()` first if ' +
-    'preserving an existing schema.';
 /**
  * Compute a stable int32 advisory lock key from a namespace string.
  *
@@ -171,12 +153,9 @@ const with_namespace_lock = async (db, namespace, fn) => {
  *   namespaces are omitted)
  * @mutates schema_version - inserts one row per applied migration
  * @throws MigrationError with `kind` of `binary-older-than-db`,
- *   `name-divergence-at-N`, `old-tracker-shape`, or `migration-failed`
+ *   `name-divergence-at-N`, or `migration-failed`
  */
 export const run_migrations = async (db, namespaces) => {
-    if (await detect_old_tracker(db)) {
-        throw new MigrationError('old-tracker-shape', OLD_TRACKER_HINT);
-    }
     await db.query(SCHEMA_VERSION_DDL);
     const results = [];
     for (const { namespace, migrations } of namespaces) {
@@ -206,10 +185,10 @@ export const run_migrations = async (db, namespaces) => {
                         `that follow it, or delete from row ${i} onward to re-apply the tail).`, { namespace, at_index: i });
                 }
             }
-            // Step 5: up-to-date case
+            // up-to-date case
             if (applied.length === migrations.length)
                 return;
-            // Step 6: run pending tail in a single chain-tx
+            // Step 5: run pending tail in a single chain-tx
             let next_sequence = applied.length > 0 ? applied[applied.length - 1].sequence + 1 : 0;
             const applied_names = [];
             await db.transaction(async (tx) => {
@@ -240,19 +219,15 @@ export const run_migrations = async (db, namespaces) => {
  * Insert tracker rows for the named migrations of a namespace **without
  * executing them**.
  *
- * Used to promote an existing schema (e.g. produced by a pre-0.42 build,
- * preserved through a tracker-shape upgrade) into the new identity tracker.
+ * Used to promote an existing schema (e.g. produced by an out-of-band
+ * bootstrap, or a hand-applied DDL set) into the identity tracker.
  * `baseline()` trusts the operator-supplied list — it does not verify that
  * the schema actually matches what the named migrations would have produced.
  * Pair with a schema-assertion script post-baseline before re-enabling traffic.
  *
  * Contract:
- * - Probes for the pre-0.42 tracker shape; throws `old-tracker-shape` if
- *   found (DDL with `IF NOT EXISTS` would otherwise no-op against the old
- *   table and the INSERT would fail with a confusing column-not-found).
- * - Creates the new-shape `schema_version` table if missing — cutover
- *   scripts that just dropped the old-shape table can call `baseline()`
- *   directly with no separate DDL step.
+ * - Creates the `schema_version` table if missing — a promotion script can
+ *   call `baseline()` against a fresh tracker with no separate DDL step.
  * - Acquires the same per-namespace advisory lock as `run_migrations` (with
  *   the same try/catch fallback for environments lacking `pg_advisory_lock`).
  * - Refuses if any tracker rows already exist *for this namespace* — lets
@@ -268,14 +243,10 @@ export const run_migrations = async (db, namespaces) => {
  * @param names - prefix of `ns.migrations[].name` to record as already-applied
  * @mutates schema_version - inserts tracker rows for `names` without running
  *   the corresponding migration bodies
- * @throws MigrationError with `kind` of `old-tracker-shape`,
- *   `baseline-name-not-in-code`, `baseline-name-out-of-order`, or
- *   `baseline-namespace-already-populated`
+ * @throws MigrationError with `kind` of `baseline-name-not-in-code`,
+ *   `baseline-name-out-of-order`, or `baseline-namespace-already-populated`
  */
 export const baseline = async (db, ns, names) => {
-    if (await detect_old_tracker(db)) {
-        throw new MigrationError('old-tracker-shape', OLD_TRACKER_HINT, { namespace: ns.namespace });
-    }
     await db.query(SCHEMA_VERSION_DDL);
     const code_names = ns.migrations.map((m) => m.name);
     // Validate every supplied name exists in code (catches drift between cutover

package/dist/db/status.d.ts

@@ -82,12 +82,6 @@ export interface DbStatus {
     tables: Array<TableStatus>;
     /** Per-namespace migration status. */
     migrations: Array<MigrationStatus>;
-    /**
-     * True if the pre-0.42 `schema_version` shape (with a `version` column)
-     * was detected. The runner refuses to start in this state — operators
-     * see this flag as their cue to drop the table or call `baseline()`.
-     */
-    old_tracker_shape?: boolean;
 }
 /**
  * Query database status including connectivity, tables, and migration state.

package/dist/db/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GACnB;IACA,mEAAmE;IACnE,IAAI,EAAE,eAAe,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;CAChB,GACD;IACA,kEAAkE;IAClE,IAAI,EAAE,cAAc,CAAC;IACrB,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;CAChB,CAAC;AAEL;;GAEG;AACH,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,2EAA2E;IAC3E,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACxB,yCAAyC;IACzC,SAAS,EAAE,OAAO,CAAC;IACnB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3B,sCAAsC;IACtC,UAAU,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IACnC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC5B;AA8BD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,GAC3B,IAAI,EAAE,EACN,aAAa,KAAK,CAAC,kBAAkB,CAAC,KACpC,OAAO,CAAC,QAAQ,CA2GlB,CAAC;AAeF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAAI,QAAQ,QAAQ,KAAG,MAoDnD,CAAC"}
+{"version":3,"file":"status.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GACnB;IACA,mEAAmE;IACnE,IAAI,EAAE,eAAe,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;CAChB,GACD;IACA,kEAAkE;IAClE,IAAI,EAAE,cAAc,CAAC;IACrB,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;CAChB,CAAC;AAEL;;GAEG;AACH,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,2EAA2E;IAC3E,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACxB,yCAAyC;IACzC,SAAS,EAAE,OAAO,CAAC;IACnB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3B,sCAAsC;IACtC,UAAU,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;CACnC;AAaD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,GAC3B,IAAI,EAAE,EACN,aAAa,KAAK,CAAC,kBAAkB,CAAC,KACpC,OAAO,CAAC,QAAQ,CAsGlB,CAAC;AAeF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAAI,QAAQ,QAAQ,KAAG,MA4CnD,CAAC"}

package/dist/db/status.js

@@ -12,15 +12,6 @@
  * @module
  */
 import { to_error_message } from '@fuzdev/fuz_util/error.ts';
-const has_table_column = async (db, table_name, column_name) => {
-    const row = await db.query_one(`SELECT EXISTS (
-			SELECT 1 FROM information_schema.columns
-			WHERE table_schema = 'public'
-			  AND table_name = $1
-			  AND column_name = $2
-		) as exists`, [table_name, column_name]);
-    return row?.exists ?? false;
-};
 const has_table = async (db, table_name) => {
     const row = await db.query_one(`SELECT EXISTS (
 			SELECT 1 FROM information_schema.tables
@@ -69,14 +60,9 @@ export const query_db_status = async (db, namespaces) => {
     }
     // check migration state
     const migrations = [];
-    let old_tracker_shape;
     if (namespaces?.length) {
         const sv_exists = await has_table(db, 'schema_version');
-        // pre-0.42 shape carries a `version` column; new shape carries `name`
-        const old_shape = sv_exists ? await has_table_column(db, 'schema_version', 'version') : false;
-        if (old_shape)
-            old_tracker_shape = true;
-        if (sv_exists && !old_shape) {
+        if (sv_exists) {
             for (const { namespace, migrations: ns_migrations } of namespaces) {
                 const rows = await db.query(`SELECT name FROM schema_version
 					 WHERE namespace = $1
@@ -118,7 +104,7 @@ export const query_db_status = async (db, namespaces) => {
             }
         }
         else {
-            // no tracker, or pre-0.42 shape — every namespace shows as "nothing applied yet"
+            // no tracker — every namespace shows as "nothing applied yet"
             for (const { namespace, migrations: ns_migrations } of namespaces) {
                 const code_names = ns_migrations.map((m) => m.name);
                 migrations.push({
@@ -134,8 +120,7 @@ export const query_db_status = async (db, namespaces) => {
         connected: true,
         table_count: tables.length,
         tables,
-        migrations,
-        ...(old_tracker_shape ? { old_tracker_shape: true } : {})
+        migrations
     };
 };
 /**
@@ -171,11 +156,6 @@ export const format_db_status = (status) => {
             lines.push(`    ${t.name.padEnd(max_name)}  ${t.row_count} rows`);
         }
     }
-    if (status.old_tracker_shape) {
-        lines.push('');
-        lines.push('  Migrations: pre-0.42 schema_version shape detected.');
-        lines.push('    Drop the table and re-run, or call `baseline()` first if preserving the schema.');
-    }
     if (status.migrations.length > 0) {
         lines.push('');
         lines.push('  Migrations:');

package/dist/runtime/deno.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deno.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/deno.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,WAAW,EAA6B,MAAM,WAAW,CAAC;AAoExE;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,aAAa,CAAC,MAAM,CAAC,KAAG,WAuKhE,CAAC"}
+{"version":3,"file":"deno.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/deno.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,WAAW,EAA6B,MAAM,WAAW,CAAC;AAyExE;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,aAAa,CAAC,MAAM,CAAC,KAAG,WA0KhE,CAAC"}

package/dist/runtime/deno.js

@@ -8,7 +8,7 @@
  * @module
  */
 import { to_error_message } from '@fuzdev/fuz_util/error.ts';
-import { assert_secure_mode, assert_secure_size, read_secure_bounded } from './secure_file.js';
+import { assert_secure_mode, assert_secure_regular_file, assert_secure_size, read_secure_bounded } from './secure_file.js';
 /**
  * Create a runtime backed by Deno APIs.
  *
@@ -46,17 +46,20 @@ export const create_deno_runtime = (args) => ({
     read_text_file: (path) => Deno.readTextFile(path),
     read_file: (path) => Deno.readFile(path),
     read_secure_file: async (path) => {
-        // Deno exposes no O_NOFOLLOW, so the symlink check is a pre-open lstat
-        // (a TOCTOU window the Node impl doesn't have — the mode check below
-        // still runs on the open descriptor, so a post-open swap can't defeat
-        // it). The checks themselves are the shared `runtime/secure_file.ts`
-        // helpers, same as `load_secure_file_node`.
+        // Deno exposes no O_NOFOLLOW or O_NONBLOCK, so the symlink and
+        // regular-file checks are a pre-open lstat (a TOCTOU window the Node
+        // impl doesn't have — a FIFO swapped in after it would block the open;
+        // the checks below still run on the open descriptor, so a post-open swap
+        // can't defeat them). The checks themselves are the shared
+        // `runtime/secure_file.ts` helpers, same as `load_secure_file_node`.
         const l = await Deno.lstat(path);
         if (l.isSymlink)
             throw new Error(`secure file is a symlink: ${path}`);
+        assert_secure_regular_file(path, l.isFile);
         const file = await Deno.open(path, { read: true });
         try {
             const s = await file.stat();
+            assert_secure_regular_file(path, s.isFile);
             // `mode` is null where POSIX modes don't apply (Windows).
             if (s.mode !== null)
                 assert_secure_mode(path, s.mode);

package/dist/runtime/deps.d.ts

@@ -103,8 +103,9 @@ export interface WriteFileOptions {
  */
 export interface FsSecureReadDeps {
     /**
-     * Read a small secret file with fail-loud checks: rejects symlinks, any
-     * group/other-accessible mode (must be `0600`/`0400`; skipped where POSIX
+     * Read a small secret file with fail-loud checks: rejects symlinks,
+     * non-regular files (FIFO, device, directory — real runtimes only; the mock
+     * has no file types), any group/other-accessible mode (must be `0600`/`0400`; skipped where POSIX
      * modes don't apply), and files over a 4 KiB cap. Permission checks run on
      * the open descriptor where the platform allows, so the file can't be
      * swapped between check and read. Throws on any refusal — a refused secret

package/dist/runtime/deps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deps.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;GAEG;AACH,MAAM,WAAW,UAAU;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IACjC,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,yCAAyC;IACzC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAC9C,mCAAmC;IACnC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACxC,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAChC;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAChC;;;;;;;OAOG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IAC1B,+DAA+D;IAC/D,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnD,8DAA8D;IAC9D,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,+DAA+D;IAC/D,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,qBAAqB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC3F,8FAA8F;IAC9F,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;CAClD;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,sFAAsF;IACtF,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,6EAA6E;IAC7E,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9F,6BAA6B;IAC7B,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,4BAA4B;IAC5B,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;;;;;;;;;;OAUG;IACH,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC5B;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;IACxE;;;;;OAKG;IACH,iBAAiB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrF;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B,kCAAkC;IAClC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B;;;;;;;OAOG;IACH,WAAW,EAAE,CACZ,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EACnB,OAAO,CAAC,EAAE,iBAAiB,KACvB,OAAO,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACzB,yDAAyD;IACzD,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,6BAA6B;IAC7B,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B,6BAA6B;IAC7B,YAAY,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,6CAA6C;IAC7C,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC3D;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,oCAAoC;IACpC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAChB,SACC,OAAO,EACP,UAAU,EACV,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,SAAS,EACT,YAAY,EACZ,WAAW,EACX,OAAO;IACR,qCAAqC;IACrC,OAAO,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC,qCAAqC;IACrC,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,qFAAqF;IACrF,mBAAmB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3E"}
+{"version":3,"file":"deps.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/deps.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;GAEG;AACH,MAAM,WAAW,UAAU;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IACjC,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,yCAAyC;IACzC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAC9C,mCAAmC;IACnC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACxC,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAChC;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAChC;;;;;;;;OAQG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IAC1B,+DAA+D;IAC/D,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnD,8DAA8D;IAC9D,cAAc,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,+DAA+D;IAC/D,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,qBAAqB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC3F,8FAA8F;IAC9F,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;CAClD;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,sFAAsF;IACtF,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,6EAA6E;IAC7E,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9F,6BAA6B;IAC7B,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,4BAA4B;IAC5B,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;;;;;;;;;;OAUG;IACH,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IAC5B;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;IACxE;;;;;OAKG;IACH,iBAAiB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrF;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B,kCAAkC;IAClC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B;;;;;;;OAOG;IACH,WAAW,EAAE,CACZ,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EACnB,OAAO,CAAC,EAAE,iBAAiB,KACvB,OAAO,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACzB,yDAAyD;IACzD,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,6BAA6B;IAC7B,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC5B,6BAA6B;IAC7B,YAAY,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,6CAA6C;IAC7C,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC3D;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,oCAAoC;IACpC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAChB,SACC,OAAO,EACP,UAAU,EACV,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,SAAS,EACT,YAAY,EACZ,WAAW,EACX,OAAO;IACR,qCAAqC;IACrC,OAAO,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC,qCAAqC;IACrC,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,qFAAqF;IACrF,mBAAmB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3E"}

package/dist/runtime/secure_file.d.ts

@@ -4,18 +4,20 @@
  *
  * The file this guards is typically the highest-value credential on the host
  * (the bootstrap token mints the keeper account), so the read fails loud
- * rather than degrading: a symlink, a group/other-accessible mode, or an
- * oversized file is refused, never returned. The deploy recipe places the
- * token at `0600`, so the check ratifies the shape zap produces; a
- * hand-placed `0644` file fails at boot instead of being read.
+ * rather than degrading: a symlink, a non-regular file (FIFO, device node,
+ * directory), a group/other-accessible mode, or an oversized file is refused,
+ * never returned. The deploy recipe places the token at `0600`, so the check
+ * ratifies the shape zap produces; a hand-placed `0644` file fails at boot
+ * instead of being read.
  *
  * The Node implementation lives here (`load_secure_file_node`, wired as
  * `create_node_runtime().read_secure_file`); the Deno runtime implements the
  * same contract over `Deno.open` in `runtime/deno.ts`, and the mock honors
- * the mode/size checks over its in-memory map. All three refuse through the
- * shared `assert_secure_mode` / `assert_secure_size` / `read_secure_bounded`
- * helpers so the checks — and their operator-facing messages — can't drift
- * between runtimes.
+ * the mode/size checks over its in-memory map (it has no file types). The real
+ * runtimes refuse through the shared `assert_secure_regular_file` /
+ * `assert_secure_mode` / `assert_secure_size` / `read_secure_bounded` helpers,
+ * and the mock through the mode and size ones, so the checks — and their
+ * operator-facing messages — can't drift between runtimes.
  *
  * @module
  */
@@ -25,6 +27,13 @@
  * `MAX_SECURE_FILE_SIZE`.
  */
 export declare const MAX_SECURE_FILE_SIZE = 4096;
+/**
+ * Refuse anything but a regular file — a FIFO, device node, socket, or
+ * directory at the secret's path.
+ *
+ * @throws Error naming the path
+ */
+export declare const assert_secure_regular_file: (path: string, is_file: boolean) => void;
 /**
  * Refuse any group/other-accessible mode (only `0600`/`0400` pass).
  *
@@ -57,6 +66,11 @@ export declare const read_secure_bounded: (path: string, read_chunk: (target: Ui
  * Read a secret file with fail-loud checks (Node implementation).
  *
  * - `O_NOFOLLOW` atomically rejects symlinks during open (no TOCTOU window)
+ * - `O_NONBLOCK` keeps the open from waiting on a FIFO that has no writer (it
+ *   has no effect on a regular file); the regular-file check on the open
+ *   descriptor then refuses it, a device node, or a directory
+ * - `O_NOCTTY` keeps a terminal device at the path from becoming the process's
+ *   controlling terminal in the moment before that check refuses it
  * - the permission check runs on the open descriptor, not the path, so the
  *   file can't be swapped between check and read — any group/other access
  *   (not `0600`/`0400`) is refused
@@ -65,7 +79,7 @@ export declare const read_secure_bounded: (path: string, read_chunk: (target: Ui
  *
  * @param path - path to the secret file
  * @returns the file's bytes
- * @throws Error on a missing file, symlink, permissive mode, oversized file, or I/O failure
+ * @throws Error on a missing file, symlink, non-regular file, permissive mode, oversized file, or I/O failure
  */
 export declare const load_secure_file_node: (path: string) => Promise<Uint8Array>;
 //# sourceMappingURL=secure_file.d.ts.map

package/dist/runtime/secure_file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secure_file.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/secure_file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAMH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAUzC;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG,IAM/D,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG,IAI/D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,MAAM,EACZ,YAAY,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,KACxD,OAAO,CAAC,UAAU,CAUpB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,GAAU,MAAM,MAAM,KAAG,OAAO,CAAC,UAAU,CAuB5E,CAAC"}
+{"version":3,"file":"secure_file.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/runtime/secure_file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAUzC;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,GAAI,MAAM,MAAM,EAAE,SAAS,OAAO,KAAG,IAI3E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG,IAM/D,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG,IAI/D,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,MAAM,EACZ,YAAY,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,KACxD,OAAO,CAAC,UAAU,CAUpB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,GAAU,MAAM,MAAM,KAAG,OAAO,CAAC,UAAU,CA2B5E,CAAC"}

package/dist/runtime/secure_file.js

@@ -4,18 +4,20 @@
  *
  * The file this guards is typically the highest-value credential on the host
  * (the bootstrap token mints the keeper account), so the read fails loud
- * rather than degrading: a symlink, a group/other-accessible mode, or an
- * oversized file is refused, never returned. The deploy recipe places the
- * token at `0600`, so the check ratifies the shape zap produces; a
- * hand-placed `0644` file fails at boot instead of being read.
+ * rather than degrading: a symlink, a non-regular file (FIFO, device node,
+ * directory), a group/other-accessible mode, or an oversized file is refused,
+ * never returned. The deploy recipe places the token at `0600`, so the check
+ * ratifies the shape zap produces; a hand-placed `0644` file fails at boot
+ * instead of being read.
  *
  * The Node implementation lives here (`load_secure_file_node`, wired as
  * `create_node_runtime().read_secure_file`); the Deno runtime implements the
  * same contract over `Deno.open` in `runtime/deno.ts`, and the mock honors
- * the mode/size checks over its in-memory map. All three refuse through the
- * shared `assert_secure_mode` / `assert_secure_size` / `read_secure_bounded`
- * helpers so the checks — and their operator-facing messages — can't drift
- * between runtimes.
+ * the mode/size checks over its in-memory map (it has no file types). The real
+ * runtimes refuse through the shared `assert_secure_regular_file` /
+ * `assert_secure_mode` / `assert_secure_size` / `read_secure_bounded` helpers,
+ * and the mock through the mode and size ones, so the checks — and their
+ * operator-facing messages — can't drift between runtimes.
  *
  * @module
  */
@@ -35,6 +37,17 @@ export const MAX_SECURE_FILE_SIZE = 4096;
  * The mock runtime checks unconditionally — its modes are simulated.
  */
 const modes_apply = process.platform !== 'win32';
+/**
+ * Refuse anything but a regular file — a FIFO, device node, socket, or
+ * directory at the secret's path.
+ *
+ * @throws Error naming the path
+ */
+export const assert_secure_regular_file = (path, is_file) => {
+    if (!is_file) {
+        throw new Error(`not a regular file: ${path}`);
+    }
+};
 /**
  * Refuse any group/other-accessible mode (only `0600`/`0400` pass).
  *
@@ -86,6 +99,11 @@ export const read_secure_bounded = async (path, read_chunk) => {
  * Read a secret file with fail-loud checks (Node implementation).
  *
  * - `O_NOFOLLOW` atomically rejects symlinks during open (no TOCTOU window)
+ * - `O_NONBLOCK` keeps the open from waiting on a FIFO that has no writer (it
+ *   has no effect on a regular file); the regular-file check on the open
+ *   descriptor then refuses it, a device node, or a directory
+ * - `O_NOCTTY` keeps a terminal device at the path from becoming the process's
+ *   controlling terminal in the moment before that check refuses it
  * - the permission check runs on the open descriptor, not the path, so the
  *   file can't be swapped between check and read — any group/other access
  *   (not `0600`/`0400`) is refused
@@ -94,12 +112,12 @@ export const read_secure_bounded = async (path, read_chunk) => {
  *
  * @param path - path to the secret file
  * @returns the file's bytes
- * @throws Error on a missing file, symlink, permissive mode, oversized file, or I/O failure
+ * @throws Error on a missing file, symlink, non-regular file, permissive mode, oversized file, or I/O failure
  */
 export const load_secure_file_node = async (path) => {
     let handle;
     try {
-        handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+        handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK | constants.O_NOCTTY);
     }
     catch (err) {
         // ELOOP means the path was a symlink (O_NOFOLLOW refused it).
@@ -110,6 +128,7 @@ export const load_secure_file_node = async (path) => {
     }
     try {
         const s = await handle.stat();
+        assert_secure_regular_file(path, s.isFile());
         if (modes_apply)
             assert_secure_mode(path, s.mode);
         assert_secure_size(path, s.size);

package/dist/server/app_backend.d.ts

@@ -85,7 +85,7 @@ export interface CreateAppBackendOptions {
     /**
      * Hardened secret-file read for the bootstrap token — pass the runtime's
      * `read_secure_file` (see `FsSecureReadDeps`). Rejects symlinks,
-     * group/other-accessible modes, and oversized files.
+     * non-regular files, group/other-accessible modes, and oversized files.
      */
     read_secure_file: (path: string) => Promise<Uint8Array>;
     /** Delete a file. */

package/dist/testing/audit_drift_guard.d.ts

@@ -60,9 +60,8 @@ export interface RecordingAuditEmitter {
  * `listener_count` reports (registered listeners never fire — this emitter
  * captures `emit` shapes, not fan-out).
  *
- * `emit` AND `emit_pool` both append to `calls` so cleanup-sweep tests
- * (which use `emit_pool` exclusively — see `auth/cleanup.ts`) can also
- * read assertions off the same array.
+ * `emit` AND `emit_pool` both append to `calls`, so a test reads either
+ * entry point's writes off the same array.
  *
  * Pass `calls_ref` to write into a caller-owned array (callers that
  * declared `const events: Array<AuditLogInput> = []` and want to keep
@@ -99,8 +98,7 @@ export declare const create_recording_audit_emitter: (calls_ref?: Array<AuditLog
  * role-grant-shape emissions land in `events_ref` alongside bare `emit`
  * calls. `emit_pool` and `notify` are not decorated — they take
  * `AuditLogInput` / `AuditLogEvent` directly without going through
- * `emit`, so handler-side `emit_pool` writes (today only
- * `auth/cleanup.ts`) skip capture. Close-firing handlers all reach for
+ * `emit`, so `emit_pool` writes skip capture. Close-firing handlers all reach for
  * `emit` or `emit_role_grant_target`, so the ordering test sees them
  * regardless of which entry point a future refactor picks.
  *

package/dist/testing/audit_drift_guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_drift_guard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/audit_drift_guard.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAU7B,OAAO,EAEN,KAAK,YAAY,EACjB,KAAK,yBAAyB,EAC9B,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAiB,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,yBAAyB,QAAO,IAiB5C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACX;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,YAAY,CAAC;IACtB,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,8BAA8B,GAC1C,YAAY,KAAK,CAAC,aAAa,CAAC,KAC9B,qBA8BF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,kCAAkC,GAAI,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EACxF,SAAS;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,EAC1B,YAAY,KAAK,CAAC,eAAe,GAAG,CAAC,CAAC,EACtC,gBAAgB,IAAI,CAAC,yBAAyB,EAAE,IAAI,GAAG,KAAK,GAAG,gBAAgB,CAAC,KAC9E,YAWF,CAAC"}
+{"version":3,"file":"audit_drift_guard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/audit_drift_guard.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAU7B,OAAO,EAEN,KAAK,YAAY,EACjB,KAAK,yBAAyB,EAC9B,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAiB,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,yBAAyB,QAAO,IAiB5C,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACX;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,YAAY,CAAC;IACtB,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,8BAA8B,GAC1C,YAAY,KAAK,CAAC,aAAa,CAAC,KAC9B,qBA8BF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,kCAAkC,GAAI,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EACxF,SAAS;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,EAC1B,YAAY,KAAK,CAAC,eAAe,GAAG,CAAC,CAAC,EACtC,gBAAgB,IAAI,CAAC,yBAAyB,EAAE,IAAI,GAAG,KAAK,GAAG,gBAAgB,CAAC,KAC9E,YAWF,CAAC"}

package/dist/testing/audit_drift_guard.js

@@ -48,9 +48,8 @@ export const install_audit_drift_guard = () => {
  * `listener_count` reports (registered listeners never fire — this emitter
  * captures `emit` shapes, not fan-out).
  *
- * `emit` AND `emit_pool` both append to `calls` so cleanup-sweep tests
- * (which use `emit_pool` exclusively — see `auth/cleanup.ts`) can also
- * read assertions off the same array.
+ * `emit` AND `emit_pool` both append to `calls`, so a test reads either
+ * entry point's writes off the same array.
  *
  * Pass `calls_ref` to write into a caller-owned array (callers that
  * declared `const events: Array<AuditLogInput> = []` and want to keep
@@ -117,8 +116,7 @@ export const create_recording_audit_emitter = (calls_ref) => {
  * role-grant-shape emissions land in `events_ref` alongside bare `emit`
  * calls. `emit_pool` and `notify` are not decorated — they take
  * `AuditLogInput` / `AuditLogEvent` directly without going through
- * `emit`, so handler-side `emit_pool` writes (today only
- * `auth/cleanup.ts`) skip capture. Close-firing handlers all reach for
+ * `emit`, so `emit_pool` writes skip capture. Close-firing handlers all reach for
  * `emit` or `emit_role_grant_target`, so the ordering test sees them
  * regardless of which entry point a future refactor picks.
  *

package/dist/testing/cross_backend/expected_schema.json

@@ -101,6 +101,7 @@
 		"created_at",
 		"decline_reason",
 		"declined_at",
+		"expire_audited_at",
 		"expires_at",
 		"from_actor_id",
 		"id",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.117.1",
+  "version": "0.118.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",
@@ -78,7 +78,7 @@
     "@fuzdev/fuz_css": "^0.64.0",
     "@fuzdev/fuz_ui": "^0.208.0",
     "@fuzdev/fuz_util": "^0.69.0",
-    "@fuzdev/gro": "^0.212.0",
+    "@fuzdev/gro": "^0.213.0",
     "@fuzdev/mdz": "^0.3.0",
     "@hono/node-server": "^1.19.14",
     "@hono/node-ws": "^1.3.1",