@fuzdev/fuz_app 0.117.1 → 0.119.0

package/dist/auth/session_queries.d.ts

@@ -132,13 +132,19 @@ export declare const query_session_list_for_account: (deps: QueryDeps, account_i
  * Expired-but-unreaped rows count toward the cap (the predicate is `account_id`
  * alone). Matches the Rust twin `query_session_enforce_limit`.
  *
+ * Deleting a session row does not end the connections it opened: a WebSocket
+ * keeps the authority it resolved at upgrade and an SSE stream never rechecks.
+ * The returned ids are the token hashes those connections are registered
+ * under, so the caller closes them once the transaction commits
+ * (`queue_connection_close`) — `POST /login` does.
+ *
  * @param deps - query dependencies (must be transaction-scoped)
  * @param account_id - the account to enforce the limit for
  * @param max_sessions - maximum number of sessions to keep
- * @returns the number of sessions evicted
+ * @returns the evicted sessions' ids (their token hashes), empty when nothing was evicted
  * @mutates `auth_session` table - deletes the oldest rows past the cap
  */
-export declare const query_session_enforce_limit: (deps: QueryDeps, account_id: string, max_sessions: number) => Promise<number>;
+export declare const query_session_enforce_limit: (deps: QueryDeps, account_id: string, max_sessions: number) => Promise<Array<string>>;
 /**
  * List all active sessions across all accounts with usernames.
  *
@@ -153,10 +159,29 @@ export declare const query_session_list_all_active: (deps: QueryDeps, limit?: nu
     username: string;
 }>>;
 /**
- * Delete expired sessions.
- *
- * @returns the number of sessions cleaned up
+ * Delete every expired session, returning the ids (token hashes) of the rows
+ * it deleted.
+ *
+ * The ids are the keys `ConnectionCloser.close_sockets_for_session` closes by.
+ * A row past `expires_at` already fails `query_session_get_valid`, but
+ * deleting it does not end the connections it opened: a WebSocket keeps the
+ * authority it resolved at upgrade and an SSE stream never rechecks. The row
+ * was also the only per-session handle on those connections —
+ * `account_session_revoke` closes only for a row it deleted — so the caller
+ * closes each returned session's connections once the delete has committed.
+ * `cleanup_expired_sessions` (`auth/cleanup.ts`) is that caller; reach for it
+ * rather than this query.
+ *
+ * One statement, so the returned ids are exactly the rows this call removed:
+ * a concurrent pass gets a disjoint set. Run it in a transaction, as the
+ * caller above does, so the ids are in hand before the delete commits — on a
+ * pool-level `Db` a connection lost on the response leaves the rows deleted
+ * and their ids unread. Served by `idx_auth_session_expires`. Twin of the
+ * Rust `query_session_cleanup_expired`.
+ *
+ * @param deps - query dependencies (transaction-scoped, see above)
+ * @returns the deleted sessions' ids (their token hashes), empty when nothing had expired
  * @mutates `auth_session` table - deletes every row past `expires_at`
  */
-export declare const query_session_cleanup_expired: (deps: QueryDeps) => Promise<number>;
+export declare const query_session_cleanup_expired: (deps: QueryDeps) => Promise<Array<string>>;
 //# sourceMappingURL=session_queries.d.ts.map

package/dist/auth/session_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAA2B,CAAC;AAEjE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,KAAG,SAElD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAAO,MAEzC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,EAClB,YAAY,IAAI,KACd,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,2DAKoB,CAAC;AAQtD;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,WAAW,GAAG,SAAS,CAKjC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,IAAI,CAEd,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,KAChB,OAAO,CAAC,OAAO,CAMjB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAU,KACR,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAK5B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,2BAA2B,GACvC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAc,MAAM,KAClB,OAAO,CAAC,MAAM,CAYhB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,cAAW,KACT,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CASnD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,MAAM,CAKnF,CAAC"}
+{"version":3,"file":"session_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAA2B,CAAC;AAEjE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,KAAG,SAElD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAAO,MAEzC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,EAClB,YAAY,IAAI,KACd,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,2DAKoB,CAAC;AAQtD;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,WAAW,GAAG,SAAS,CAKjC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,IAAI,CAEd,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,KAChB,OAAO,CAAC,OAAO,CAMjB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAU,KACR,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAK5B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,eAAO,MAAM,2BAA2B,GACvC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAc,MAAM,KAClB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAYvB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,cAAW,KACT,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CASnD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,6BAA6B,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAK1F,CAAC"}

package/dist/auth/session_queries.js

@@ -165,10 +165,16 @@ export const query_session_list_for_account = async (deps, account_id, limit = 5
  * Expired-but-unreaped rows count toward the cap (the predicate is `account_id`
  * alone). Matches the Rust twin `query_session_enforce_limit`.
  *
+ * Deleting a session row does not end the connections it opened: a WebSocket
+ * keeps the authority it resolved at upgrade and an SSE stream never rechecks.
+ * The returned ids are the token hashes those connections are registered
+ * under, so the caller closes them once the transaction commits
+ * (`queue_connection_close`) — `POST /login` does.
+ *
  * @param deps - query dependencies (must be transaction-scoped)
  * @param account_id - the account to enforce the limit for
  * @param max_sessions - maximum number of sessions to keep
- * @returns the number of sessions evicted
+ * @returns the evicted sessions' ids (their token hashes), empty when nothing was evicted
  * @mutates `auth_session` table - deletes the oldest rows past the cap
  */
 export const query_session_enforce_limit = async (deps, account_id, max_sessions) => {
@@ -179,7 +185,7 @@ export const query_session_enforce_limit = async (deps, account_id, max_sessions
 		   ORDER BY created_at DESC, id DESC
 		   OFFSET $2
 		 ) RETURNING id`, [account_id, max_sessions]);
-    return rows.length;
+    return rows.map((row) => row.id);
 };
 /**
  * List all active sessions across all accounts with usernames.
@@ -199,12 +205,31 @@ export const query_session_list_all_active = async (deps, limit = 200) => {
 		 ORDER BY s.created_at DESC, s.id DESC LIMIT $1`, [limit]);
 };
 /**
- * Delete expired sessions.
- *
- * @returns the number of sessions cleaned up
+ * Delete every expired session, returning the ids (token hashes) of the rows
+ * it deleted.
+ *
+ * The ids are the keys `ConnectionCloser.close_sockets_for_session` closes by.
+ * A row past `expires_at` already fails `query_session_get_valid`, but
+ * deleting it does not end the connections it opened: a WebSocket keeps the
+ * authority it resolved at upgrade and an SSE stream never rechecks. The row
+ * was also the only per-session handle on those connections —
+ * `account_session_revoke` closes only for a row it deleted — so the caller
+ * closes each returned session's connections once the delete has committed.
+ * `cleanup_expired_sessions` (`auth/cleanup.ts`) is that caller; reach for it
+ * rather than this query.
+ *
+ * One statement, so the returned ids are exactly the rows this call removed:
+ * a concurrent pass gets a disjoint set. Run it in a transaction, as the
+ * caller above does, so the ids are in hand before the delete commits — on a
+ * pool-level `Db` a connection lost on the response leaves the rows deleted
+ * and their ids unread. Served by `idx_auth_session_expires`. Twin of the
+ * Rust `query_session_cleanup_expired`.
+ *
+ * @param deps - query dependencies (transaction-scoped, see above)
+ * @returns the deleted sessions' ids (their token hashes), empty when nothing had expired
  * @mutates `auth_session` table - deletes every row past `expires_at`
  */
 export const query_session_cleanup_expired = async (deps) => {
     const rows = await deps.db.query(`DELETE FROM auth_session WHERE expires_at <= NOW() RETURNING id`);
-    return rows.length;
+    return rows.map((row) => row.id);
 };

package/dist/auth/standard_rpc_actions.d.ts

@@ -10,9 +10,9 @@
  * Option routing: shared `roles` flows to both admin and role-grant-offer;
  * `default_ttl_ms` and `authorize` go to role-grant-offer only; `max_tokens`
  * goes to account only;
- * shared `connection_closer` flows to admin + account (role-grant-offer ignores);
  * `notification_sender` reaches role-grant-offer transparently (admin + account
- * ignore it).
+ * ignore it). `deps.connection_closer` is read by admin + account, whose
+ * revocation handlers close live connections through it.
  *
  * Paired with `create_admin_rpc_adapters` on the UI side.
  *
@@ -21,7 +21,7 @@
 import { type AdminActionOptions } from './admin_actions.js';
 import { type RoleGrantOfferActionOptions } from './role_grant_offer_actions.js';
 import { type AccountActionOptions } from './account_actions.js';
-import type { ActionFactoryDeps } from './deps.js';
+import type { RevokingActionFactoryDeps } from './deps.js';
 import type { NotificationSender } from './role_grant_offer_notifications.js';
 import type { RpcAction } from '../actions/action_rpc.js';
 /**
@@ -38,12 +38,12 @@ export interface StandardRpcActionsOptions extends AdminActionOptions, RoleGrant
 /**
  * Dependencies for `create_standard_rpc_actions`.
  *
- * Stack-standard `ActionFactoryDeps` (`log`, `audit`) plus an optional
- * `notification_sender` consumed only by the role-grant-offer sub-factory
- * for WS fan-out. Admin and account sub-factories ignore
- * `notification_sender`.
+ * Stack-standard `RevokingActionFactoryDeps` (`log`, `audit`,
+ * `connection_closer`) plus an optional `notification_sender` consumed only by the
+ * role-grant-offer sub-factory for WS fan-out. Admin and account
+ * sub-factories ignore `notification_sender`.
  */
-export interface StandardRpcActionsDeps extends ActionFactoryDeps {
+export interface StandardRpcActionsDeps extends RevokingActionFactoryDeps {
     notification_sender?: NotificationSender | null;
 }
 /**
@@ -54,7 +54,7 @@ export interface StandardRpcActionsDeps extends ActionFactoryDeps {
  * and `create_account_actions(deps, {max_tokens})`. The shared `roles`
  * option flows to admin + role-grant-offer.
  *
- * @param deps - `StandardRpcActionsDeps` (`log`, `audit` from `ActionFactoryDeps`; optional `notification_sender` for WS fan-out)
+ * @param deps - `StandardRpcActionsDeps` (`log`, `audit`, `connection_closer` from `RevokingActionFactoryDeps`; optional `notification_sender` for WS fan-out)
  * @param options - role schema, role-grant-offer config, account config
  * @returns RPC actions to pass as `rpc_endpoints` or spread into `create_rpc_endpoint`
  */

package/dist/auth/standard_rpc_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"standard_rpc_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/standard_rpc_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAEN,KAAK,2BAA2B,EAChC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAA0B,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACzF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE1D;;;;;;;;GAQG;AACH,MAAM,WAAW,yBAChB,SAAQ,kBAAkB,EAAE,2BAA2B,EAAE,oBAAoB;CAAG;AAEjF;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAuB,SAAQ,iBAAiB;IAChE,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAChD;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B,GACvC,MAAM,sBAAsB,EAC5B,UAAS,yBAA8B,KACrC,KAAK,CAAC,SAAS,CAIjB,CAAC"}
+{"version":3,"file":"standard_rpc_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/standard_rpc_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAEN,KAAK,2BAA2B,EAChC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAA0B,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACzF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE1D;;;;;;;;GAQG;AACH,MAAM,WAAW,yBAChB,SAAQ,kBAAkB,EAAE,2BAA2B,EAAE,oBAAoB;CAAG;AAEjF;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAuB,SAAQ,yBAAyB;IACxE,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAChD;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B,GACvC,MAAM,sBAAsB,EAC5B,UAAS,yBAA8B,KACrC,KAAK,CAAC,SAAS,CAIjB,CAAC"}

package/dist/auth/standard_rpc_actions.js

@@ -10,9 +10,9 @@
  * Option routing: shared `roles` flows to both admin and role-grant-offer;
  * `default_ttl_ms` and `authorize` go to role-grant-offer only; `max_tokens`
  * goes to account only;
- * shared `connection_closer` flows to admin + account (role-grant-offer ignores);
  * `notification_sender` reaches role-grant-offer transparently (admin + account
- * ignore it).
+ * ignore it). `deps.connection_closer` is read by admin + account, whose
+ * revocation handlers close live connections through it.
  *
  * Paired with `create_admin_rpc_adapters` on the UI side.
  *
@@ -29,7 +29,7 @@ import { create_account_actions } from './account_actions.js';
  * and `create_account_actions(deps, {max_tokens})`. The shared `roles`
  * option flows to admin + role-grant-offer.
  *
- * @param deps - `StandardRpcActionsDeps` (`log`, `audit` from `ActionFactoryDeps`; optional `notification_sender` for WS fan-out)
+ * @param deps - `StandardRpcActionsDeps` (`log`, `audit`, `connection_closer` from `RevokingActionFactoryDeps`; optional `notification_sender` for WS fan-out)
  * @param options - role schema, role-grant-offer config, account config
  * @returns RPC actions to pass as `rpc_endpoints` or spread into `create_rpc_endpoint`
  */

package/dist/db/CLAUDE.md

@@ -50,7 +50,13 @@ the code.
   `fact`'s store rows are the deliberate exception: `PgFactStore` feeds
   `FactMeta.created_at`, a `Date` in the `@fuzdev/fuz_util` `FactStore`
   contract, and nothing serializes it.
-- `status.ts` — CLI DB status utility.
+- `status.ts` — CLI DB status utility: `query_db_status` (read-only;
+  per-namespace applied/pending plus name-divergence, mirroring the
+  runner's boot check), `format_db_status` (the report body — the
+  `database status` / `url:` header is the calling script's, using
+  `display_db_url`, which renders the URL from its parse without the
+  password or query). The connected body is byte-identical with the Rust
+  `fuz_db` twin's; `src/test/db/status.test.ts` pins the shared fixture.
 - `schema_ready.ts` — `/ready` deploy-gate core: `query_public_columns`
   (keeps `schema_version`, unlike `query_schema_snapshot`), pure
   `check_schema_drift` / `format_schema_drift`, `READY_ERROR`. Column-presence

package/dist/db/migrate.d.ts

@@ -86,7 +86,7 @@ export interface MigrationResult {
  * Callers branch on `.kind` rather than matching error messages — message
  * text is for operators, not control flow.
  */
-export type MigrationErrorKind = 'binary-older-than-db' | 'name-divergence-at-N' | 'old-tracker-shape' | 'migration-failed' | 'baseline-name-not-in-code' | 'baseline-name-out-of-order' | 'baseline-namespace-already-populated';
+export type MigrationErrorKind = 'binary-older-than-db' | 'name-divergence-at-N' | 'migration-failed' | 'baseline-name-not-in-code' | 'baseline-name-out-of-order' | 'baseline-namespace-already-populated';
 /** Structured context passed alongside a `MigrationError`. */
 export interface MigrationErrorContext {
     namespace?: string;
@@ -137,26 +137,22 @@ export declare class MigrationError extends Error {
  *   namespaces are omitted)
  * @mutates schema_version - inserts one row per applied migration
  * @throws MigrationError with `kind` of `binary-older-than-db`,
- *   `name-divergence-at-N`, `old-tracker-shape`, or `migration-failed`
+ *   `name-divergence-at-N`, or `migration-failed`
  */
 export declare const run_migrations: (db: Db, namespaces: Array<MigrationNamespace>) => Promise<Array<MigrationResult>>;
 /**
  * Insert tracker rows for the named migrations of a namespace **without
  * executing them**.
  *
- * Used to promote an existing schema (e.g. produced by a pre-0.42 build,
- * preserved through a tracker-shape upgrade) into the new identity tracker.
+ * Used to promote an existing schema (e.g. produced by an out-of-band
+ * bootstrap, or a hand-applied DDL set) into the identity tracker.
  * `baseline()` trusts the operator-supplied list — it does not verify that
  * the schema actually matches what the named migrations would have produced.
  * Pair with a schema-assertion script post-baseline before re-enabling traffic.
  *
  * Contract:
- * - Probes for the pre-0.42 tracker shape; throws `old-tracker-shape` if
- *   found (DDL with `IF NOT EXISTS` would otherwise no-op against the old
- *   table and the INSERT would fail with a confusing column-not-found).
- * - Creates the new-shape `schema_version` table if missing — cutover
- *   scripts that just dropped the old-shape table can call `baseline()`
- *   directly with no separate DDL step.
+ * - Creates the `schema_version` table if missing — a promotion script can
+ *   call `baseline()` against a fresh tracker with no separate DDL step.
  * - Acquires the same per-namespace advisory lock as `run_migrations` (with
  *   the same try/catch fallback for environments lacking `pg_advisory_lock`).
  * - Refuses if any tracker rows already exist *for this namespace* — lets
@@ -172,9 +168,8 @@ export declare const run_migrations: (db: Db, namespaces: Array<MigrationNamespa
  * @param names - prefix of `ns.migrations[].name` to record as already-applied
  * @mutates schema_version - inserts tracker rows for `names` without running
  *   the corresponding migration bodies
- * @throws MigrationError with `kind` of `old-tracker-shape`,
- *   `baseline-name-not-in-code`, `baseline-name-out-of-order`, or
- *   `baseline-namespace-already-populated`
+ * @throws MigrationError with `kind` of `baseline-name-not-in-code`,
+ *   `baseline-name-out-of-order`, or `baseline-namespace-already-populated`
  */
 export declare const baseline: (db: Db, ns: MigrationNamespace, names: ReadonlyArray<string>) => Promise<void>;
 //# sourceMappingURL=migrate.d.ts.map

package/dist/db/migrate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/migrate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAIH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAElC;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;CAC7B;AAED,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAC3B,sBAAsB,GACtB,sBAAsB,GACtB,mBAAmB,GACnB,kBAAkB,GAClB,2BAA2B,GAC3B,4BAA4B,GAC5B,sCAAsC,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,WAAW,qBAAqB;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;gBAEnC,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB;CAQtF;AA6ED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,cAAc,GAC1B,IAAI,EAAE,EACN,YAAY,KAAK,CAAC,kBAAkB,CAAC,KACnC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAuFhC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,eAAO,MAAM,QAAQ,GACpB,IAAI,EAAE,EACN,IAAI,kBAAkB,EACtB,OAAO,aAAa,CAAC,MAAM,CAAC,KAC1B,OAAO,CAAC,IAAI,CA+Dd,CAAC"}
+{"version":3,"file":"migrate.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/migrate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAIH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAElC;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;CAC7B;AAED,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAC3B,sBAAsB,GACtB,sBAAsB,GACtB,kBAAkB,GAClB,2BAA2B,GAC3B,4BAA4B,GAC5B,sCAAsC,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,WAAW,qBAAqB;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,KAAK,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;gBAEnC,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB;CAQtF;AAsDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,cAAc,GAC1B,IAAI,EAAE,EACN,YAAY,KAAK,CAAC,kBAAkB,CAAC,KACnC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAmFhC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,QAAQ,GACpB,IAAI,EAAE,EACN,IAAI,kBAAkB,EACtB,OAAO,aAAa,CAAC,MAAM,CAAC,KAC1B,OAAO,CAAC,IAAI,CA2Dd,CAAC"}

package/dist/db/migrate.js

@@ -83,24 +83,6 @@ CREATE TABLE IF NOT EXISTS schema_version (
   PRIMARY KEY (namespace, name),
   UNIQUE (namespace, sequence)
 )`;
-/**
- * Detect the pre-0.42 `schema_version` shape (`namespace`, `version`,
- * `applied_at`). The new-shape DDL uses `IF NOT EXISTS` and would silently
- * no-op against the old table, so this probe runs before DDL and before any
- * per-namespace lock.
- */
-const detect_old_tracker = async (db) => {
-    const row = await db.query_one(`SELECT EXISTS (
-			SELECT 1 FROM information_schema.columns
-			WHERE table_schema = 'public'
-			  AND table_name = 'schema_version'
-			  AND column_name = 'version'
-		) as exists`);
-    return row?.exists ?? false;
-};
-const OLD_TRACKER_HINT = 'Detected fuz_app < 0.42 tracker shape (schema_version.version column exists). ' +
-    'Hint: `DROP TABLE schema_version` and re-run, or call `baseline()` first if ' +
-    'preserving an existing schema.';
 /**
  * Compute a stable int32 advisory lock key from a namespace string.
  *
@@ -171,12 +153,9 @@ const with_namespace_lock = async (db, namespace, fn) => {
  *   namespaces are omitted)
  * @mutates schema_version - inserts one row per applied migration
  * @throws MigrationError with `kind` of `binary-older-than-db`,
- *   `name-divergence-at-N`, `old-tracker-shape`, or `migration-failed`
+ *   `name-divergence-at-N`, or `migration-failed`
  */
 export const run_migrations = async (db, namespaces) => {
-    if (await detect_old_tracker(db)) {
-        throw new MigrationError('old-tracker-shape', OLD_TRACKER_HINT);
-    }
     await db.query(SCHEMA_VERSION_DDL);
     const results = [];
     for (const { namespace, migrations } of namespaces) {
@@ -206,10 +185,10 @@ export const run_migrations = async (db, namespaces) => {
                         `that follow it, or delete from row ${i} onward to re-apply the tail).`, { namespace, at_index: i });
                 }
             }
-            // Step 5: up-to-date case
+            // up-to-date case
             if (applied.length === migrations.length)
                 return;
-            // Step 6: run pending tail in a single chain-tx
+            // Step 5: run pending tail in a single chain-tx
             let next_sequence = applied.length > 0 ? applied[applied.length - 1].sequence + 1 : 0;
             const applied_names = [];
             await db.transaction(async (tx) => {
@@ -240,19 +219,15 @@ export const run_migrations = async (db, namespaces) => {
  * Insert tracker rows for the named migrations of a namespace **without
  * executing them**.
  *
- * Used to promote an existing schema (e.g. produced by a pre-0.42 build,
- * preserved through a tracker-shape upgrade) into the new identity tracker.
+ * Used to promote an existing schema (e.g. produced by an out-of-band
+ * bootstrap, or a hand-applied DDL set) into the identity tracker.
  * `baseline()` trusts the operator-supplied list — it does not verify that
  * the schema actually matches what the named migrations would have produced.
  * Pair with a schema-assertion script post-baseline before re-enabling traffic.
  *
  * Contract:
- * - Probes for the pre-0.42 tracker shape; throws `old-tracker-shape` if
- *   found (DDL with `IF NOT EXISTS` would otherwise no-op against the old
- *   table and the INSERT would fail with a confusing column-not-found).
- * - Creates the new-shape `schema_version` table if missing — cutover
- *   scripts that just dropped the old-shape table can call `baseline()`
- *   directly with no separate DDL step.
+ * - Creates the `schema_version` table if missing — a promotion script can
+ *   call `baseline()` against a fresh tracker with no separate DDL step.
  * - Acquires the same per-namespace advisory lock as `run_migrations` (with
  *   the same try/catch fallback for environments lacking `pg_advisory_lock`).
  * - Refuses if any tracker rows already exist *for this namespace* — lets
@@ -268,14 +243,10 @@ export const run_migrations = async (db, namespaces) => {
  * @param names - prefix of `ns.migrations[].name` to record as already-applied
  * @mutates schema_version - inserts tracker rows for `names` without running
  *   the corresponding migration bodies
- * @throws MigrationError with `kind` of `old-tracker-shape`,
- *   `baseline-name-not-in-code`, `baseline-name-out-of-order`, or
- *   `baseline-namespace-already-populated`
+ * @throws MigrationError with `kind` of `baseline-name-not-in-code`,
+ *   `baseline-name-out-of-order`, or `baseline-namespace-already-populated`
  */
 export const baseline = async (db, ns, names) => {
-    if (await detect_old_tracker(db)) {
-        throw new MigrationError('old-tracker-shape', OLD_TRACKER_HINT, { namespace: ns.namespace });
-    }
     await db.query(SCHEMA_VERSION_DDL);
     const code_names = ns.migrations.map((m) => m.name);
     // Validate every supplied name exists in code (catches drift between cutover

package/dist/db/status.d.ts

@@ -82,12 +82,6 @@ export interface DbStatus {
     tables: Array<TableStatus>;
     /** Per-namespace migration status. */
     migrations: Array<MigrationStatus>;
-    /**
-     * True if the pre-0.42 `schema_version` shape (with a `version` column)
-     * was detected. The runner refuses to start in this state — operators
-     * see this flag as their cue to drop the table or call `baseline()`.
-     */
-    old_tracker_shape?: boolean;
 }
 /**
  * Query database status including connectivity, tables, and migration state.
@@ -103,10 +97,67 @@ export interface DbStatus {
  */
 export declare const query_db_status: (db: Db, namespaces?: Array<MigrationNamespace>) => Promise<DbStatus>;
 /**
- * Format a `DbStatus` as a human-readable string for CLI output.
+ * Format a `DbStatus` as the body of the human-facing operator report.
+ *
+ * A `tables:` count with one aligned `name  N rows` line per table, then a
+ * `migrations:` header (always printed, even with no namespaces) and one
+ * aligned line per namespace: its state (`up-to-date`, `PENDING <n>`, or
+ * `DIVERGED`), `applied/declared`, and the latest applied name (`(none)` when
+ * nothing is applied). A diverged namespace adds a `diverged:` line, a pending
+ * one a `pending:` line naming the tail. A failed connection renders the single
+ * line `connection: FAILED (<error>)`. Every line ends in a newline.
+ *
+ * The body only — the `database status` / `url:` header belongs to the CLI
+ * script, which holds the URL a `DbStatus` never sees. For a connected status
+ * the output is byte-identical with the Rust twin's `format_db_status`; both
+ * test suites pin the same fixture report.
  *
  * @param status - the status to format
  * @returns multi-line string suitable for console output
  */
 export declare const format_db_status: (status: DbStatus) => string;
+/**
+ * Render a database URL for printing from the parse node-postgres dials —
+ * `new URL`, with pg-connection-string's precedence, where a `user`, `host`, or
+ * `port` query parameter overrides the URL's own — so the line names the server
+ * dialed and no credential can leak however the input spells it.
+ *
+ * A `postgres://` or `postgresql://` URL renders as
+ * `postgres://[user@]host:port[/dbname]`: never the password, and never the
+ * query or fragment (`sslmode` and the like are dropped by design). The scheme
+ * always prints as `postgres://`. The port always prints, `5432` when the URL
+ * names none. The user and database name print percent-encoded with
+ * `encodeURIComponent`, so no control character, escape sequence, or bidi
+ * override reaches the terminal and an `@` can't pose as the separator; each
+ * prints only when non-empty. An IP-literal host prints canonically (IPv6
+ * bracketed); a Unix-socket directory prints with each `/` as `%2F`. A PGlite
+ * `file://` or `memory://` URL prints as scheme, host, and path.
+ *
+ * The whole line is `(not a URL; hidden)` for any other scheme, when `new URL`
+ * rejects the input, when it holds a malformed percent-escape (`%ZZ`), when
+ * there is no host, when the host is neither an IP literal, a hostname of
+ * `A-Z a-z 0-9 . _ -`, nor a socket directory of those characters and `/`, when
+ * the user holds `?`, `=`, `&`, `/`, or `#`, or when the port isn't a number up
+ * to 65535. The host and user rules match the Rust twin's, where they catch
+ * tokio-postgres's split at the first `@`.
+ *
+ * Twin of the Rust `fuz_db` CLI's `display_db_url`, byte-identical on the URLs
+ * both drivers read alike. They part where the drivers do: a `host=` or `port=`
+ * query parameter overrides the URL's here (tokio-postgres appends it to a list
+ * whose first entry the pool dials); a `dbname=` query parameter, which
+ * tokio-postgres honours and node-postgres ignores, and a `#…` fragment, which
+ * tokio-postgres keeps as part of the database name; tokio-postgres also
+ * accepts `key=value` strings, host lists, and an unencoded `/` or `?` in the
+ * password (here, the placeholder); an unencoded `@` in the userinfo splits at
+ * the last `@` here, rendering the user and host node-postgres dials, where the
+ * Rust twin prints the placeholder; node-postgres decodes the database name
+ * with `decodeURI`, so a reserved-character escape such as `%2F` stays literal
+ * and prints as `%252F`; an IPv4-mapped IPv6 address serializes differently;
+ * and tokio-postgres refuses an unknown query parameter (`sslpassword=`) that
+ * node-postgres passes.
+ *
+ * @param url - the database URL
+ * @returns the URL without its password, query, or fragment, or the placeholder
+ */
+export declare const display_db_url: (url: string) => string;
 //# sourceMappingURL=status.d.ts.map

package/dist/db/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GACnB;IACA,mEAAmE;IACnE,IAAI,EAAE,eAAe,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;CAChB,GACD;IACA,kEAAkE;IAClE,IAAI,EAAE,cAAc,CAAC;IACrB,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;CAChB,CAAC;AAEL;;GAEG;AACH,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,2EAA2E;IAC3E,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACxB,yCAAyC;IACzC,SAAS,EAAE,OAAO,CAAC;IACnB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3B,sCAAsC;IACtC,UAAU,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IACnC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC5B;AA8BD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,GAC3B,IAAI,EAAE,EACN,aAAa,KAAK,CAAC,kBAAkB,CAAC,KACpC,OAAO,CAAC,QAAQ,CA2GlB,CAAC;AAeF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAAI,QAAQ,QAAQ,KAAG,MAoDnD,CAAC"}
+{"version":3,"file":"status.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GACnB;IACA,mEAAmE;IACnE,IAAI,EAAE,eAAe,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;CAChB,GACD;IACA,kEAAkE;IAClE,IAAI,EAAE,cAAc,CAAC;IACrB,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;CAChB,CAAC;AAEL;;GAEG;AACH,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,2EAA2E;IAC3E,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACxB,yCAAyC;IACzC,SAAS,EAAE,OAAO,CAAC;IACnB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3B,sCAAsC;IACtC,UAAU,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;CACnC;AA6DD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,GAC3B,IAAI,EAAE,EACN,aAAa,KAAK,CAAC,kBAAkB,CAAC,KACpC,OAAO,CAAC,QAAQ,CA2DlB,CAAC;AA0BF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gBAAgB,GAAI,QAAQ,QAAQ,KAAG,MAmCnD,CAAC;AA8BF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,eAAO,MAAM,cAAc,GAAI,KAAK,MAAM,KAAG,MAoC5C,CAAC"}