@fuzdev/fuz_app 0.117.1 → 0.119.0

package/dist/auth/audit_emitter.js

@@ -11,7 +11,8 @@
  * transactional `db` (which would be rolled back with the parent on a
  * handler throw).
  *
- * Four methods cover every fan-out shape the auth domain needs:
+ * These methods cover every fan-out shape the auth domain needs
+ * (`add_listener` and `listener_count` manage the listener chain):
  *
  * - `emit(ctx, input)` — fire-and-forget pool write. Pushes the in-flight
  *   promise onto `ctx.pending_effects` for post-response flushing. Errors are
@@ -22,23 +23,46 @@
  *   `actor_id` / `account_id` / `ip` boilerplate every role-grant-shape audit
  *   site repeated. Delegates to `emit`.
  * - `emit_pool(input)` — awaitable pool write for code paths without a
- *   `pending_effects` queue (cleanup sweeps, ad-hoc maintenance scripts).
- *   Same write-then-notify semantics as `emit`, just synchronous-with-await.
+ *   request context (ad-hoc maintenance scripts). Writes, then notifies.
  * - `notify(event)` — fan out an already-written audit row (e.g. rows
  *   returned by `query_accept_offer` that were inserted in-transaction by
- *   the query layer). Runs every registered listener; per-listener throws
- *   are isolated.
+ *   the query layer, or the offer-expiry rows `auth/cleanup.ts` writes in
+ *   its sweep transaction). Runs every registered listener; per-listener
+ *   throws are isolated.
+ *
+ * ## When listeners hear about a row
+ *
+ * `emit` writes the row at once, on the pool, whatever its outcome — the write
+ * is outside the request's transaction, so it survives a rollback. Listener
+ * fan-out is a separate step, and it depends on the outcome:
+ *
+ * - A **failure** row is announced as soon as it is written. It records an
+ *   attempt, which happened whether or not the request's transaction commits.
+ * - A **success** row is announced only after the request's transaction
+ *   commits, and never when the handler throws: the fan-out is queued on
+ *   `ctx.post_commit_effects` and awaits the write. A success row reports a
+ *   state change, and the listeners act on it — the revocation listeners close
+ *   connections, the audit stream broadcasts it. Announced before the commit,
+ *   a close could run while the revoked credential still reads as valid, and a
+ *   rolled-back revocation would close connections anyway.
+ *
+ * A success row emitted by a handler that later throws is still in the table —
+ * the write is outside the transaction — but is never announced.
+ *
+ * The Rust spine reaches the same order by writing a success row inside the
+ * transaction and queueing its fan-out behind the commit.
  *
  * Listeners are a documented registration seam — `create_app_server`
  * registers additional listeners via `add_listener` after the backend is
- * built (the factory-managed audit-log SSE, per-endpoint WS auth guards and
- * logout closers, any `extra_audit_handlers` on a `WsEndpointSpec`) before
- * the first request runs. Consumers can also register listeners directly on
- * the emitter they return from `audit_factory` for setups that don't pass
- * through `create_app_server`.
+ * built (the factory-managed audit-log SSE, per-endpoint WS auth guards, any
+ * `extra_audit_handlers` on a `WsEndpointSpec`) before the first request
+ * runs. Consumers can also register listeners directly on the emitter they
+ * return from `audit_factory` for setups that don't pass through
+ * `create_app_server`.
  *
  * @module
  */
+import { emit_after_commit } from '../http/pending_effects.js';
 import { query_audit_log } from './audit_log_queries.js';
 import { builtin_audit_log_config } from './audit_log_schema.js';
 /**
@@ -71,17 +95,38 @@ export const create_audit_emitter = (options) => {
             }
         }
     };
-    const emit_pool = async (input) => {
+    // The pool write. Never rejects: a failed write is logged and resolves
+    // `null`, so there is no row to announce.
+    const write = async (input) => {
         try {
-            const event = await query_audit_log({ db }, input, audit_log_config);
-            notify(event);
+            return await query_audit_log({ db }, input, audit_log_config);
         }
         catch (err) {
             log.error('Audit log write failed:', err);
+            return null;
         }
     };
+    const emit_pool = async (input) => {
+        const event = await write(input);
+        if (event)
+            notify(event);
+    };
     const base_emit = (ctx, input) => {
-        ctx.pending_effects.push(emit_pool(input));
+        if (input.outcome === 'failure') {
+            // an attempt happened whether or not the transaction commits
+            ctx.pending_effects.push(emit_pool(input));
+            return;
+        }
+        // A success row is written now and announced after the commit — and
+        // not at all on rollback, when the queue is discarded. See the module
+        // doc, "When listeners hear about a row".
+        const written = write(input);
+        ctx.pending_effects.push(written.then(() => undefined));
+        emit_after_commit(ctx, async () => {
+            const event = await written;
+            if (event)
+                notify(event);
+        });
     };
     // The decorated `emit` is what `emit_role_grant_target` captures below
     // and what gets exposed on the returned object — both call shapes
@@ -111,8 +156,7 @@ export const create_audit_emitter = (options) => {
     // `emit_role_grant_target` calls the closed-over inner `emit`, not
     // `this.emit`, so the patch silently bypassed role-grant-shape emits.
     // Tests that need instrumentation pass `emit_decorator` so the wrap
-    // is captured by the closure before the freeze (see
-    // `create_emit_ordering_audit_factory`). The listener list stays
+    // is captured by the closure before the freeze. The listener list stays
     // closure-private; registration is append-only via `add_listener`
     // (`create_app_server` registers its SSE + WS listeners post-assembly,
     // by design).

package/dist/auth/audit_log_route_schema.js

@@ -32,13 +32,13 @@ export const create_audit_log_route_shape = (required_role = DEFAULT_AUDIT_STREA
         account: 'required',
         actor: 'required',
         roles: [required_role],
-        // The stream is a session channel. A bearer that opens one cannot be
-        // closed when it is revoked: `token_revoke` closes WS sockets keyed by
-        // token, and SSE subscribers are not keyed that way, so a revoked
-        // token would keep receiving audit rows for the life of the
-        // connection. Gating the channel is what makes
-        // `realtime/sse_auth_guard.ts`'s omission of `token_revoke` correct
-        // rather than merely asserted.
+        // The stream is a session channel: a long-lived, instance-wide admin
+        // feed is not handed to a credential channel the deployment never
+        // chose. Widening the gate loses no close — the handler registers a
+        // bearer's stream under its API token id, and a token revocation closes
+        // by that id (`create_sse_connection_closer`, and the `token` scope in
+        // `create_sse_auth_guard`) — so widening is a consumer's explicit
+        // choice about the channel, not a hole in revocation.
         credential_types: ['session'],
         // Rule 3 — a narrowed token holds no audit feed. Same reasoning as the
         // WS upgrade: this is a long-lived server→client stream whose contents

package/dist/auth/audit_log_routes.d.ts

@@ -13,19 +13,22 @@
  */
 import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import type { RouteSpec } from '../http/route_spec.js';
-import { type SseStream, type SseNotification } from '../realtime/sse.js';
-import type { SubscribeOptions } from '../realtime/subscriber_registry.js';
+import { type SseNotification } from '../realtime/sse.js';
+import type { SubscriberRegistry } from '../realtime/subscriber_registry.js';
 /** Options for audit log route specs. */
 export interface AuditLogRouteOptions {
     /** Role required to access audit routes. Default `'admin'`. */
     required_role?: string;
     /**
-     * When provided, includes an SSE route at `/audit/stream` for realtime audit events.
-     * The `subscribe` function receives the stream, channels, and the subscriber's `account_id`
-     * as an identity key — enabling `close_by_identity()` for auth revocation.
+     * When provided, includes an SSE route at `/audit/stream` for realtime audit
+     * events. The route registers each stream on `registry` under the
+     * subscriber's session hash (`scope`) and account id (`groups`, with the
+     * API token id beside it for a bearer) — the keys `close_by_identity()`
+     * closes on for auth revocation. An `AuditLogSse`
+     * (`create_audit_log_sse`, or `AppServerContext.audit_sse`) satisfies it.
      */
     stream?: {
-        subscribe: (stream: SseStream<SseNotification>, options?: SubscribeOptions) => () => void;
+        registry: SubscriberRegistry<SseNotification>;
         log: Logger;
     };
 }
@@ -35,6 +38,28 @@ export interface AuditLogRouteOptions {
  * Returns an empty array when `options.stream` is not set — no REST routes
  * live here apart from the stream.
  *
+ * ## Admission
+ *
+ * A stream is authorized once, so the handler must not open one on a
+ * credential or role revoked while the request was in flight. The route's
+ * gates (401, credential channel, token scope, acting actor, role) run in the
+ * route-spec pipeline, before the handler and so before any stream is
+ * registered — a revocation landing after them would close nothing. So the
+ * handler registers the stream **pending**
+ * (`SubscriberRegistry.subscribe_pending`), then re-reads the credential
+ * (`revalidate_resolved_auth`) and the acting actor's role grants, and only
+ * then admits (`SubscriberRegistry.admit`). A revocation that committed before
+ * those reads is seen by them — `401 authentication_required` for a dead
+ * credential, `403 insufficient_permissions` for a lost role — and one whose
+ * close ran after the registration found the pending entry: admission then
+ * fails, and the response is a `200` whose body is the connect comment and
+ * nothing else — to an `EventSource`, a stream closed an instant after it
+ * opened (the client's reconnect is answered by the gates, with the precise
+ * status). A pending registration receives no audit row, counts toward no cap,
+ * and is removed when a re-read refuses the request. The twin of the Rust
+ * spine's `audit_stream_router`, which registers before its role read rather
+ * than repeating it.
+ *
  * @param options - optional stream wiring + role override
  * @returns the SSE route spec (when `options.stream` is provided) or an empty array
  */

package/dist/auth/audit_log_routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_log_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_log_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAAuB,KAAK,SAAS,EAAE,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAI3E,yCAAyC;AACzC,MAAM,WAAW,oBAAoB;IACpC,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,MAAM,CAAC,EAAE;QACR,SAAS,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,EAAE,gBAAgB,KAAK,MAAM,IAAI,CAAC;QAC1F,GAAG,EAAE,MAAM,CAAC;KACZ,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,GAAI,UAAU,oBAAoB,KAAG,KAAK,CAAC,SAAS,CA4B5F,CAAC"}
+{"version":3,"file":"audit_log_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_log_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAUvD,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAU7E,yCAAyC;AACzC,MAAM,WAAW,oBAAoB;IACpC,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE;QACR,QAAQ,EAAE,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAC9C,GAAG,EAAE,MAAM,CAAC;KACZ,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,4BAA4B,GAAI,UAAU,oBAAoB,KAAG,KAAK,CAAC,SAAS,CAgF5F,CAAC"}

package/dist/auth/audit_log_routes.js

@@ -11,9 +11,12 @@
  *
  * @module
  */
-import { create_audit_log_route_shape } from './audit_log_route_schema.js';
+import { ERROR_AUTHENTICATION_REQUIRED, ERROR_INSUFFICIENT_PERMISSIONS } from '../http/error_schemas.js';
+import { AUTH_API_TOKEN_ID_KEY, TEST_CONTEXT_PRESET_KEY } from '../hono_context.js';
+import { create_audit_log_route_shape, DEFAULT_AUDIT_STREAM_ROLE } from './audit_log_route_schema.js';
 import { create_sse_response } from '../realtime/sse.js';
-import { AUTH_SESSION_TOKEN_HASH_KEY, require_request_context } from './request_context.js';
+import { AUTH_SESSION_TOKEN_HASH_KEY, has_scoped_role, refresh_role_grants, require_request_context } from './request_context.js';
+import { get_resolved_auth, revalidate_resolved_auth } from './resolved_auth.js';
 import { AUDIT_LOG_CHANNEL } from '../realtime/sse_auth_guard.js';
 /**
  * Create the optional audit-log SSE route spec.
@@ -21,17 +24,40 @@ import { AUDIT_LOG_CHANNEL } from '../realtime/sse_auth_guard.js';
  * Returns an empty array when `options.stream` is not set — no REST routes
  * live here apart from the stream.
  *
+ * ## Admission
+ *
+ * A stream is authorized once, so the handler must not open one on a
+ * credential or role revoked while the request was in flight. The route's
+ * gates (401, credential channel, token scope, acting actor, role) run in the
+ * route-spec pipeline, before the handler and so before any stream is
+ * registered — a revocation landing after them would close nothing. So the
+ * handler registers the stream **pending**
+ * (`SubscriberRegistry.subscribe_pending`), then re-reads the credential
+ * (`revalidate_resolved_auth`) and the acting actor's role grants, and only
+ * then admits (`SubscriberRegistry.admit`). A revocation that committed before
+ * those reads is seen by them — `401 authentication_required` for a dead
+ * credential, `403 insufficient_permissions` for a lost role — and one whose
+ * close ran after the registration found the pending entry: admission then
+ * fails, and the response is a `200` whose body is the connect comment and
+ * nothing else — to an `EventSource`, a stream closed an instant after it
+ * opened (the client's reconnect is answered by the gates, with the precise
+ * status). A pending registration receives no audit row, counts toward no cap,
+ * and is removed when a re-read refuses the request. The twin of the Rust
+ * spine's `audit_stream_router`, which registers before its role read rather
+ * than repeating it.
+ *
  * @param options - optional stream wiring + role override
  * @returns the SSE route spec (when `options.stream` is provided) or an empty array
  */
 export const create_audit_log_route_specs = (options) => {
     if (!options?.stream)
         return [];
-    const { subscribe, log } = options.stream;
+    const { registry, log } = options.stream;
+    const required_role = options.required_role ?? DEFAULT_AUDIT_STREAM_ROLE;
     return [
         {
-            ...create_audit_log_route_shape(options.required_role),
-            handler: (c) => {
+            ...create_audit_log_route_shape(required_role),
+            handler: async (c, route) => {
                 // Rule 3 is declared on the route shape's `auth.required_scope`,
                 // so a narrowed token is refused ahead of the role gate rather
                 // than here.
@@ -39,16 +65,64 @@ export const create_audit_log_route_specs = (options) => {
                 // scope = session hash (capped → tabs-per-session limit and
                 // session-specific `session_revoke` close). groups = [account_id]
                 // (uncapped → coarse close on role_grant_revoke / session_revoke_all
-                // / password_change).
+                // / password_change / account delete). The route shape admits
+                // sessions only, so `api_token_id` is null here; it is registered
+                // when present so that a consumer widening the credential gate
+                // still has a revoked token's stream closed by `token_revoke`.
                 const token_hash = c.get(AUTH_SESSION_TOKEN_HASH_KEY) ?? null;
-                const { response, stream } = create_sse_response(c, log);
-                const unsubscribe = subscribe(stream, {
+                const api_token_id = c.get(AUTH_API_TOKEN_ID_KEY) ?? null;
+                // Register pending first: from here every revocation finds the
+                // stream (TSDoc, "Admission").
+                const pending = registry.subscribe_pending({
                     channels: [AUDIT_LOG_CHANNEL],
                     scope: token_hash ?? undefined,
-                    groups: [ctx.account.id]
+                    groups: api_token_id === null ? [ctx.account.id] : [ctx.account.id, api_token_id]
                 });
-                stream.on_close(unsubscribe);
-                return response;
+                // The pending registration is released on every path that does not
+                // admit it — a refusal, a failed re-read, a throw while building the
+                // response — so none of them can leak an entry nothing delivers to.
+                let admitted = false;
+                try {
+                    // Re-read what the gates read, now that the stream is registered:
+                    // a revocation that closed before the registration is committed,
+                    // so these see it. A throw here fails closed — no stream opens
+                    // unchecked. Skipped under the test-preset escape hatch, whose
+                    // pre-baked context has no rows behind it to re-read.
+                    if (!c.get(TEST_CONTEXT_PRESET_KEY)) {
+                        const resolved = get_resolved_auth(c);
+                        const credential_is_live = resolved !== null && (await revalidate_resolved_auth(route, resolved));
+                        if (!credential_is_live) {
+                            log.info('audit stream: credential revoked during the request', ctx.account.id);
+                            return c.json({ error: ERROR_AUTHENTICATION_REQUIRED }, 401);
+                        }
+                        // Global grants only, like the `require_role` gate that ran in
+                        // the pipeline — a scoped grant must not open the instance-wide
+                        // stream.
+                        if (!has_scoped_role(await refresh_role_grants(ctx, route), required_role, null)) {
+                            log.info('audit stream: role revoked during the request', ctx.account.id);
+                            return c.json({ error: ERROR_INSUFFICIENT_PERMISSIONS, required_roles: [required_role] }, 403);
+                        }
+                    }
+                    // Admit — the cap's eviction happens here, after every gate. A
+                    // registration a revocation closed while it was pending is not
+                    // admitted: the stream is closed at once, so the body is the
+                    // connect comment and nothing else, and the client reconnects
+                    // into the gates.
+                    const { response, stream } = create_sse_response(c, log);
+                    admitted = registry.admit(pending, stream);
+                    if (admitted) {
+                        stream.on_close(pending.unsubscribe);
+                    }
+                    else {
+                        log.info('audit stream: closed by a revocation before admission', ctx.account.id);
+                        stream.close();
+                    }
+                    return response;
+                }
+                finally {
+                    if (!admitted)
+                        pending.unsubscribe();
+                }
             }
         }
     ];

package/dist/auth/audit_log_schema.d.ts

@@ -49,6 +49,54 @@ export declare const AuditEventType: z.ZodEnum<{
     db_admin_row_delete: "db_admin_row_delete";
 }>;
 export type AuditEventType = z.infer<typeof AuditEventType>;
+/**
+ * What a **successful** audit row invalidates — the axis both revocation
+ * listeners (`create_ws_auth_guard`, `create_sse_auth_guard`) dispatch on.
+ *
+ * - `none` — the row invalidates no live connection.
+ * - `session` — one session: the connections whose session-token hash equals
+ *   the row's `metadata.session_id`.
+ * - `token` — one API token: the connections whose `api_token.id` equals the
+ *   row's `metadata.token_id`.
+ * - `account` — every connection of `target_account_id ?? account_id`.
+ * - `role` — the target account's connections gated on the row's
+ *   `metadata.role`.
+ *
+ * The scope says what the row invalidated, not what a transport must do about
+ * it. The two listeners differ on `role` on purpose: a WebSocket message is
+ * re-authorized per dispatch, so the socket stays open and its next message
+ * is refused, while a stream is authorized once at open and must be closed.
+ *
+ * Twin of the Rust spine's `RevocationScope`.
+ */
+export type RevocationScope = 'none' | 'session' | 'token' | 'account' | 'role';
+/**
+ * The `RevocationScope` of every builtin audit event — declared once, so the
+ * WebSocket and SSE revocation listeners read one answer instead of keeping a
+ * list each. Typed over `AuditEventType`, so a new event type does not compile
+ * until it declares its scope here.
+ *
+ * A scope other than `none` marks an event whose success invalidates a live
+ * connection's credential or access: `logout`, `password_change`,
+ * `session_revoke_all`, `token_revoke_all`, `account_delete`, and
+ * `account_purge` are account-wide, `session_revoke` and `token_revoke` name
+ * the one credential they ended, and `role_grant_revoke` names the lost role.
+ * Granting access revokes nothing, and neither does an event about a subject
+ * other than a connection's identity.
+ *
+ * Twin of the `revocation_scope` column of the Rust spine's
+ * `AUDIT_EVENT_SPECS`.
+ */
+export declare const audit_event_revocation_scopes: Readonly<Record<AuditEventType, RevocationScope>>;
+/**
+ * The `RevocationScope` of an `audit_log.event_type` string.
+ *
+ * An event type with no builtin entry — a consumer's own event — resolves to
+ * `none`: an event fuz_app has never heard of must not close connections. A
+ * consumer whose own event revokes closes the connections from its handler,
+ * with `queue_connection_close`.
+ */
+export declare const to_revocation_scope: (event_type: string) => RevocationScope;
 /**
  * Letter start, then letters, digits, `_`, `.`, `/`, `-`. Accepts snake_case,
  * dotted, and namespaced consumer conventions; rejects empty strings, leading

package/dist/auth/audit_log_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_log_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_log_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAmB9C;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,6iBA6BnB,CAAC;AAEZ,wCAAwC;AACxC,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAA4B,CAAC;AACxD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,QAA+B,CAAC;AAExE,0DAA0D;AAC1D,eAAO,MAAM,kBAAkB,aAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,2CAA2C;AAC3C,eAAO,MAAM,YAAY;;;EAAiC,CAAC;AAC3D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkTW,CAAC;AAE/C,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GAAG;KAC7B,CAAC,IAAI,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;CAClE,CAAC;AAEF,oGAAoG;AACpG,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,IAAI,CAAC;IACT,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,kBAAkB,CAAC;IAC/B,OAAO,EAAE,YAAY,CAAC;IACtB;;;;;;;;;;;;;OAaG;IACH,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,iBAAiB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACzC;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,SAAS,cAAc,EAC1D,OAAO,aAAa,GAAG;IAAE,UAAU,EAAE,CAAC,CAAA;CAAE,KACtC,gBAAgB,CAAC,CAAC,CAAC,GAAG,IAExB,CAAC;AAEF,6CAA6C;AAC7C,MAAM,WAAW,aAAa,CAAC,CAAC,SAAS,MAAM,GAAG,cAAc;IAC/D,UAAU,EAAE,CAAC,CAAC;IACd,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,iBAAiB,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAChC,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,SAAS,cAAc,GAChC,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,GACtD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,cAAc;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CAC/D;AAED,4FAA4F;AAC5F,eAAO,MAAM,wBAAwB,EAAE,cAGrC,CAAC;AAEH,6CAA6C;AAC7C,MAAM,WAAW,2BAA2B;IAC3C;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC;CAC1D;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,GAAI,UAAU,2BAA2B,KAAG,cA6B/E,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,6CAA6C;AAC7C,MAAM,WAAW,mBAAmB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,0GAA0G;IAC1G,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;kBAY5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,+DAA+D;AAC/D,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;kBAGzC,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAE5F,wEAAwE;AACxE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;kBAGpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,iEAAiE;AACjE,eAAO,MAAM,gBAAgB;;;;;;kBAE3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}
+{"version":3,"file":"audit_log_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_log_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAmB9C;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,6iBA6BnB,CAAC;AAEZ,wCAAwC;AACxC,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAA4B,CAAC;AACxD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAEhF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,6BAA6B,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,eAAe,CAAC,CA8BzF,CAAC;AAEJ;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,GAAI,YAAY,MAAM,KAAG,eAG/C,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,QAA+B,CAAC;AAExE,0DAA0D;AAC1D,eAAO,MAAM,kBAAkB,aAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,2CAA2C;AAC3C,eAAO,MAAM,YAAY;;;EAAiC,CAAC;AAC3D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkTW,CAAC;AAE/C,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GAAG;KAC7B,CAAC,IAAI,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;CAClE,CAAC;AAEF,oGAAoG;AACpG,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,IAAI,CAAC;IACT,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,kBAAkB,CAAC;IAC/B,OAAO,EAAE,YAAY,CAAC;IACtB;;;;;;;;;;;;;OAaG;IACH,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,iBAAiB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACzC;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,SAAS,cAAc,EAC1D,OAAO,aAAa,GAAG;IAAE,UAAU,EAAE,CAAC,CAAA;CAAE,KACtC,gBAAgB,CAAC,CAAC,CAAC,GAAG,IAExB,CAAC;AAEF,6CAA6C;AAC7C,MAAM,WAAW,aAAa,CAAC,CAAC,SAAS,MAAM,GAAG,cAAc;IAC/D,UAAU,EAAE,CAAC,CAAC;IACd,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,iBAAiB,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAChC,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,SAAS,cAAc,GAChC,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,GACtD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,cAAc;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CAC/D;AAED,4FAA4F;AAC5F,eAAO,MAAM,wBAAwB,EAAE,cAGrC,CAAC;AAEH,6CAA6C;AAC7C,MAAM,WAAW,2BAA2B;IAC3C;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC;CAC1D;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,GAAI,UAAU,2BAA2B,KAAG,cA6B/E,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,6CAA6C;AAC7C,MAAM,WAAW,mBAAmB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,0GAA0G;IAC1G,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;kBAY5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,+DAA+D;AAC/D,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;kBAGzC,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAE5F,wEAAwE;AACxE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;kBAGpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,iEAAiE;AACjE,eAAO,MAAM,gBAAgB;;;;;;kBAE3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}

package/dist/auth/audit_log_schema.js

@@ -62,6 +62,64 @@ export const AUDIT_EVENT_TYPES = Object.freeze([
 ]);
 /** Zod schema for audit event types. */
 export const AuditEventType = z.enum(AUDIT_EVENT_TYPES);
+/**
+ * The `RevocationScope` of every builtin audit event — declared once, so the
+ * WebSocket and SSE revocation listeners read one answer instead of keeping a
+ * list each. Typed over `AuditEventType`, so a new event type does not compile
+ * until it declares its scope here.
+ *
+ * A scope other than `none` marks an event whose success invalidates a live
+ * connection's credential or access: `logout`, `password_change`,
+ * `session_revoke_all`, `token_revoke_all`, `account_delete`, and
+ * `account_purge` are account-wide, `session_revoke` and `token_revoke` name
+ * the one credential they ended, and `role_grant_revoke` names the lost role.
+ * Granting access revokes nothing, and neither does an event about a subject
+ * other than a connection's identity.
+ *
+ * Twin of the `revocation_scope` column of the Rust spine's
+ * `AUDIT_EVENT_SPECS`.
+ */
+export const audit_event_revocation_scopes = Object.freeze({
+    login: 'none',
+    logout: 'account',
+    bootstrap: 'none',
+    signup: 'none',
+    password_change: 'account',
+    session_revoke: 'session',
+    session_revoke_all: 'account',
+    token_create: 'none',
+    token_revoke: 'token',
+    token_revoke_all: 'account',
+    role_grant_create: 'none',
+    role_grant_revoke: 'role',
+    role_grant_offer_create: 'none',
+    role_grant_offer_accept: 'none',
+    role_grant_offer_decline: 'none',
+    role_grant_offer_retract: 'none',
+    role_grant_offer_expire: 'none',
+    role_grant_offer_supersede: 'none',
+    invite_create: 'none',
+    invite_delete: 'none',
+    account_delete: 'account',
+    account_purge: 'account',
+    account_undelete: 'none',
+    actor_delete: 'none',
+    actor_purge: 'none',
+    actor_undelete: 'none',
+    app_settings_update: 'none',
+    db_admin_row_delete: 'none'
+});
+/**
+ * The `RevocationScope` of an `audit_log.event_type` string.
+ *
+ * An event type with no builtin entry — a consumer's own event — resolves to
+ * `none`: an event fuz_app has never heard of must not close connections. A
+ * consumer whose own event revokes closes the connections from its handler,
+ * with `queue_connection_close`.
+ */
+export const to_revocation_scope = (event_type) => Object.hasOwn(audit_event_revocation_scopes, event_type)
+    ? audit_event_revocation_scopes[event_type]
+    : 'none';
 /**
  * Letter start, then letters, digits, `_`, `.`, `/`, `-`. Accepts snake_case,
  * dotted, and namespaced consumer conventions; rejects empty strings, leading

package/dist/auth/bootstrap_account.d.ts

@@ -53,8 +53,9 @@ export interface BootstrapAccountDeps {
     token_path: string;
     /**
      * Hardened secret-file read (see `FsSecureReadDeps.read_secure_file`) —
-     * the token mints the keeper account, so a symlinked, group/other-readable,
-     * or oversized file must refuse rather than be honored. Throws on refusal;
+     * the token mints the keeper account, so a symlinked, non-regular,
+     * group/other-readable, or oversized file must refuse rather than be
+     * honored. Throws on refusal;
      * every throw reads as `TOKEN_FILE_MISSING` upstream.
      */
     read_secure_file: (path: string) => Promise<Uint8Array>;

package/dist/auth/bootstrap_account.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap_account.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/bootstrap_account.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACN,mBAAmB,EACnB,0BAA0B,EAC1B,wBAAwB,EACxB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGrE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,gDAAgD;AAChD,MAAM,WAAW,qBAAqB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,6DAA6D;AAC7D,MAAM,WAAW,uBAAuB;IACvC,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,SAAS,CAAA;KAAE,CAAC;IACrD,wFAAwF;IACxF,kBAAkB,EAAE,OAAO,CAAC;CAC5B;AAED,gCAAgC;AAChC,MAAM,MAAM,uBAAuB,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,0BAA0B,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,GACpE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,wBAAwB,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,GAClE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,mBAAmB,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AAEjE,qFAAqF;AACrF,MAAM,MAAM,sBAAsB,GAAG,uBAAuB,GAAG,uBAAuB,CAAC;AAEvF;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,EAAE,EAAE,EAAE,CAAC;IACP,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,qBAAqB;IACrB,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,6EAA6E;IAC7E,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;IAClD,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,oBAAoB,EAC1B,gBAAgB,MAAM,EACtB,OAAO,qBAAqB,KAC1B,OAAO,CAAC,sBAAsB,CA2EhC,CAAC"}
+{"version":3,"file":"bootstrap_account.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/bootstrap_account.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EACN,mBAAmB,EACnB,0BAA0B,EAC1B,wBAAwB,EACxB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGrE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEtC,gDAAgD;AAChD,MAAM,WAAW,qBAAqB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,6DAA6D;AAC7D,MAAM,WAAW,uBAAuB;IACvC,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE;QAAE,MAAM,EAAE,SAAS,CAAC;QAAC,KAAK,EAAE,SAAS,CAAA;KAAE,CAAC;IACrD,wFAAwF;IACxF,kBAAkB,EAAE,OAAO,CAAC;CAC5B;AAED,gCAAgC;AAChC,MAAM,MAAM,uBAAuB,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,0BAA0B,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,GACpE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,wBAAwB,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,GAClE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,mBAAmB,CAAC;IAAC,MAAM,EAAE,GAAG,CAAA;CAAE,CAAC;AAEjE,qFAAqF;AACrF,MAAM,MAAM,sBAAsB,GAAG,uBAAuB,GAAG,uBAAuB,CAAC;AAEvF;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,EAAE,EAAE,EAAE,CAAC;IACP,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,qBAAqB;IACrB,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,6EAA6E;IAC7E,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;IAClD,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,oBAAoB,EAC1B,gBAAgB,MAAM,EACtB,OAAO,qBAAqB,KAC1B,OAAO,CAAC,sBAAsB,CA2EhC,CAAC"}

package/dist/auth/bootstrap_account.js

@@ -36,9 +36,9 @@ import { query_create_role_grant } from './role_grant_queries.js';
 export const bootstrap_account = async (deps, provided_token, input) => {
     const { db, token_path, read_secure_file, delete_file, password, log } = deps;
     // 1. Read and verify token (non-destructive, before transaction). The
-    // secure read fails loud on a symlink / permissive mode / oversized file —
-    // every refusal masks as the same TOKEN_FILE_MISSING the wire always
-    // carried, with the specific reason logged for the operator.
+    // secure read fails loud on a symlink / non-regular file / permissive mode /
+    // oversized file — every refusal masks as the same TOKEN_FILE_MISSING the
+    // wire always carried, with the specific reason logged for the operator.
     let expected_token;
     try {
         expected_token = new TextDecoder().decode(await read_secure_file(token_path)).trim();