@fuzdev/fuz_app 0.118.0 → 0.119.0

package/dist/auth/resolved_auth.d.ts

@@ -0,0 +1,105 @@
+/**
+ * The account-grain credential a request resolved to, and the re-check a
+ * long-lived connection runs on it once it is registered.
+ *
+ * The auth middleware chain (daemon token → session cookie → bearer) resolves a
+ * credential and leaves it on the Hono context as separate keys.
+ * `ResolvedAuth` is that credential gathered into one value
+ * (`get_resolved_auth`), so the connections that outlive their request — a
+ * WebSocket, an SSE stream — can carry it past the handshake and re-read it
+ * with `revalidate_resolved_auth`.
+ *
+ * @module
+ */
+import type { Context } from 'hono';
+import type { QueryDeps } from '../db/query_deps.js';
+import { type CredentialType } from '../hono_context.js';
+/**
+ * An authenticated request's credential, account-grain — no actor.
+ *
+ * `token_hash` is set for a session, `api_token_id` for an API token, and both
+ * are `null` for a daemon token. The twin of the Rust spine's `ResolvedAuth`,
+ * which carries the account row and token scope as well; here those stay on
+ * the Hono context.
+ */
+export interface ResolvedAuth {
+    /** The authenticated account. */
+    account_id: string;
+    /** How the request was authenticated. */
+    credential_type: CredentialType;
+    /** Blake3 hash of the session token, or `null` for non-session credentials. */
+    token_hash: string | null;
+    /** `api_token.id` for a bearer credential, else `null`. */
+    api_token_id: string | null;
+}
+/**
+ * Gather the credential the auth middleware resolved for this request.
+ *
+ * Reads the keys the session, bearer, and daemon-token middleware set and
+ * keeps only the one that belongs to the winning credential type — a daemon
+ * token overrides a session cookie sent alongside it without clearing that
+ * session's hash, so the hash is carried for a session credential alone.
+ *
+ * @param c - the request context, after the auth middleware chain
+ * @returns the resolved credential, or `null` for an unauthenticated request
+ */
+export declare const get_resolved_auth: (c: Context) => ResolvedAuth | null;
+/**
+ * Re-check that a resolved credential still authenticates: `true` when it
+ * does, `false` when it has been revoked, has expired, or its account is gone.
+ *
+ * For a connection that outlives its request — a WebSocket, an SSE stream —
+ * and is authorized once, at open. Such a connection is closed on revocation
+ * by identity, but only once it is *registered*; between the credential read
+ * and the registration a revocation closes nothing. So the opener registers
+ * first (un-admitted — `BackendWebsocketTransport.register_pending` /
+ * `SubscriberRegistry.subscribe_pending`), then calls this, then admits. A
+ * revocation that committed before this read is seen by it; one whose close
+ * ran after the registration found the pending entry.
+ *
+ * That needs each statement here to see everything committed before it
+ * started, so `deps.db` must be the pool-level `Db` (autocommit) or a
+ * `READ COMMITTED` transaction — never a `REPEATABLE READ` / `SERIALIZABLE`
+ * transaction opened before the registration, whose snapshot would predate
+ * it.
+ *
+ * What is re-read, per credential — each through the same predicate the
+ * resolve path used, so the two cannot disagree about what "valid" means (the
+ * session and account legs call the middleware's own queries; the token leg
+ * shares its `WHERE` fragment):
+ *
+ * - **Session** — the `auth_session` row still exists, is unexpired, and
+ *   belongs to the resolved account.
+ * - **API token** — the `api_token` row still exists, is unexpired, and
+ *   belongs to the resolved account (by id; the raw token is not kept).
+ * - **Daemon token** — nothing of its own. The token has no row, and no
+ *   revocation event: rotation closes no connection, so there is no close an
+ *   opening connection could have missed. Its keeper account is still
+ *   re-read.
+ * - **Every credential** — the account row still exists and is not
+ *   soft-deleted.
+ *
+ * It re-checks the **credential**, not what a revocation chose to close: a
+ * `logout` closes every connection of the account but deletes only its own
+ * session, so another session's connection opening concurrently passes this
+ * check and is refused only if that account-wide close found its pending
+ * registration — the same two outcomes an already-open connection has.
+ *
+ * **No side effects.** Unlike the bearer middleware this never touches
+ * `api_token.last_used_at` / `last_used_ip` — re-checking a credential is not
+ * using it — and it writes nothing else.
+ *
+ * A `ResolvedAuth` whose credential type lacks its own key (a session with no
+ * `token_hash`, a bearer with no `api_token_id`) is a shape the middleware
+ * never builds; it is answered `false`.
+ *
+ * The twin of the Rust spine's `revalidate_resolved_auth`.
+ *
+ * @param deps - query dependencies; the pool-level `Db`, not a snapshot transaction
+ * @param resolved - the credential the request authenticated with
+ * @returns whether the credential still authenticates
+ * @throws Error propagated from the database. The caller must fail closed — an
+ *   unchecked credential is not a valid one.
+ */
+export declare const revalidate_resolved_auth: (deps: QueryDeps, resolved: ResolvedAuth) => Promise<boolean>;
+//# sourceMappingURL=resolved_auth.d.ts.map

package/dist/auth/resolved_auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolved_auth.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/resolved_auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAIN,KAAK,cAAc,EACnB,MAAM,oBAAoB,CAAC;AAM5B;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC5B,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,eAAe,EAAE,cAAc,CAAC;IAChC,+EAA+E;IAC/E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,2DAA2D;IAC3D,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAAI,GAAG,OAAO,KAAG,YAAY,GAAG,IAU7D,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,eAAO,MAAM,wBAAwB,GACpC,MAAM,SAAS,EACf,UAAU,YAAY,KACpB,OAAO,CAAC,OAAO,CAsBjB,CAAC"}

package/dist/auth/resolved_auth.js

@@ -0,0 +1,124 @@
+/**
+ * The account-grain credential a request resolved to, and the re-check a
+ * long-lived connection runs on it once it is registered.
+ *
+ * The auth middleware chain (daemon token → session cookie → bearer) resolves a
+ * credential and leaves it on the Hono context as separate keys.
+ * `ResolvedAuth` is that credential gathered into one value
+ * (`get_resolved_auth`), so the connections that outlive their request — a
+ * WebSocket, an SSE stream — can carry it past the handshake and re-read it
+ * with `revalidate_resolved_auth`.
+ *
+ * @module
+ */
+import { ACCOUNT_ID_KEY, AUTH_API_TOKEN_ID_KEY, CREDENTIAL_TYPE_KEY } from '../hono_context.js';
+import { query_account_by_id } from './account_queries.js';
+import { query_api_token_live_account } from './api_token_queries.js';
+import { AUTH_SESSION_TOKEN_HASH_KEY } from './request_context.js';
+import { query_session_get_valid } from './session_queries.js';
+/**
+ * Gather the credential the auth middleware resolved for this request.
+ *
+ * Reads the keys the session, bearer, and daemon-token middleware set and
+ * keeps only the one that belongs to the winning credential type — a daemon
+ * token overrides a session cookie sent alongside it without clearing that
+ * session's hash, so the hash is carried for a session credential alone.
+ *
+ * @param c - the request context, after the auth middleware chain
+ * @returns the resolved credential, or `null` for an unauthenticated request
+ */
+export const get_resolved_auth = (c) => {
+    const account_id = c.get(ACCOUNT_ID_KEY) ?? null;
+    const credential_type = c.get(CREDENTIAL_TYPE_KEY) ?? null;
+    if (account_id === null || credential_type === null)
+        return null;
+    return {
+        account_id,
+        credential_type,
+        token_hash: credential_type === 'session' ? (c.get(AUTH_SESSION_TOKEN_HASH_KEY) ?? null) : null,
+        api_token_id: credential_type === 'api_token' ? (c.get(AUTH_API_TOKEN_ID_KEY) ?? null) : null
+    };
+};
+/**
+ * Re-check that a resolved credential still authenticates: `true` when it
+ * does, `false` when it has been revoked, has expired, or its account is gone.
+ *
+ * For a connection that outlives its request — a WebSocket, an SSE stream —
+ * and is authorized once, at open. Such a connection is closed on revocation
+ * by identity, but only once it is *registered*; between the credential read
+ * and the registration a revocation closes nothing. So the opener registers
+ * first (un-admitted — `BackendWebsocketTransport.register_pending` /
+ * `SubscriberRegistry.subscribe_pending`), then calls this, then admits. A
+ * revocation that committed before this read is seen by it; one whose close
+ * ran after the registration found the pending entry.
+ *
+ * That needs each statement here to see everything committed before it
+ * started, so `deps.db` must be the pool-level `Db` (autocommit) or a
+ * `READ COMMITTED` transaction — never a `REPEATABLE READ` / `SERIALIZABLE`
+ * transaction opened before the registration, whose snapshot would predate
+ * it.
+ *
+ * What is re-read, per credential — each through the same predicate the
+ * resolve path used, so the two cannot disagree about what "valid" means (the
+ * session and account legs call the middleware's own queries; the token leg
+ * shares its `WHERE` fragment):
+ *
+ * - **Session** — the `auth_session` row still exists, is unexpired, and
+ *   belongs to the resolved account.
+ * - **API token** — the `api_token` row still exists, is unexpired, and
+ *   belongs to the resolved account (by id; the raw token is not kept).
+ * - **Daemon token** — nothing of its own. The token has no row, and no
+ *   revocation event: rotation closes no connection, so there is no close an
+ *   opening connection could have missed. Its keeper account is still
+ *   re-read.
+ * - **Every credential** — the account row still exists and is not
+ *   soft-deleted.
+ *
+ * It re-checks the **credential**, not what a revocation chose to close: a
+ * `logout` closes every connection of the account but deletes only its own
+ * session, so another session's connection opening concurrently passes this
+ * check and is refused only if that account-wide close found its pending
+ * registration — the same two outcomes an already-open connection has.
+ *
+ * **No side effects.** Unlike the bearer middleware this never touches
+ * `api_token.last_used_at` / `last_used_ip` — re-checking a credential is not
+ * using it — and it writes nothing else.
+ *
+ * A `ResolvedAuth` whose credential type lacks its own key (a session with no
+ * `token_hash`, a bearer with no `api_token_id`) is a shape the middleware
+ * never builds; it is answered `false`.
+ *
+ * The twin of the Rust spine's `revalidate_resolved_auth`.
+ *
+ * @param deps - query dependencies; the pool-level `Db`, not a snapshot transaction
+ * @param resolved - the credential the request authenticated with
+ * @returns whether the credential still authenticates
+ * @throws Error propagated from the database. The caller must fail closed — an
+ *   unchecked credential is not a valid one.
+ */
+export const revalidate_resolved_auth = async (deps, resolved) => {
+    const { account_id } = resolved;
+    let credential_is_live;
+    switch (resolved.credential_type) {
+        case 'session': {
+            if (resolved.token_hash === null)
+                return false;
+            const session = await query_session_get_valid(deps, resolved.token_hash);
+            credential_is_live = session?.account_id === account_id;
+            break;
+        }
+        case 'api_token': {
+            if (resolved.api_token_id === null)
+                return false;
+            const owner = await query_api_token_live_account(deps, resolved.api_token_id);
+            credential_is_live = owner === account_id;
+            break;
+        }
+        case 'daemon_token':
+            credential_is_live = true;
+            break;
+    }
+    if (!credential_is_live)
+        return false;
+    return (await query_account_by_id(deps, account_id)) !== undefined;
+};

package/dist/auth/session_middleware.d.ts

@@ -62,7 +62,14 @@ export interface CreateSessionAndSetCookieOptions {
  * persists the session row, optionally enforces a per-account session limit,
  * and sets the signed cookie.
  *
+ * The cap deletes the sessions it evicts, but not the connections they
+ * opened. A caller that passes `max_sessions` closes the returned sessions'
+ * connections once its transaction commits — `queue_connection_close` with a
+ * `session` target, as `POST /login` does. A caller that mints for an account
+ * created in the same transaction (signup, bootstrap) evicts nothing.
+ *
+ * @returns the token hashes of the sessions the cap evicted, empty without a cap
  * @mutates `auth_session` table - inserts the new session row (and evicts older rows when `max_sessions` is set)
  */
-export declare const create_session_and_set_cookie: (options: CreateSessionAndSetCookieOptions) => Promise<void>;
+export declare const create_session_and_set_cookie: (options: CreateSessionAndSetCookieOptions) => Promise<Array<string>>;
 //# sourceMappingURL=session_middleware.d.ts.map

package/dist/auth/session_middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session_middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAGvD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACN,KAAK,cAAc,EAKnB,MAAM,qBAAqB,CAAC;AAQ7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD;;GAEG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,EACnC,GAAG,OAAO,EACV,SAAS,cAAc,CAAC,CAAC,CAAC,KACxB,MAAM,GAAG,SAEX,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,EACnC,GAAG,OAAO,EACV,OAAO,MAAM,EACb,SAAS,cAAc,CAAC,CAAC,CAAC,KACxB,IAOF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,cAAc,CAAC,CAAC,CAAC,KAAG,IAMhF,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,EAClD,SAAS,OAAO,EAChB,SAAS,cAAc,CAAC,SAAS,CAAC,KAChC,iBAcF,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAChD,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,IAAI,EAAE,SAAS,CAAC;IAChB,2CAA2C;IAC3C,CAAC,EAAE,OAAO,CAAC;IACX,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,gCAAgC,KACvC,OAAO,CAAC,IAAI,CAad,CAAC"}
+{"version":3,"file":"session_middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAGvD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACN,KAAK,cAAc,EAKnB,MAAM,qBAAqB,CAAC;AAQ7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD;;GAEG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,EACnC,GAAG,OAAO,EACV,SAAS,cAAc,CAAC,CAAC,CAAC,KACxB,MAAM,GAAG,SAEX,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,EACnC,GAAG,OAAO,EACV,OAAO,MAAM,EACb,SAAS,cAAc,CAAC,CAAC,CAAC,KACxB,IAOF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,cAAc,CAAC,CAAC,CAAC,KAAG,IAMhF,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,EAClD,SAAS,OAAO,EAChB,SAAS,cAAc,CAAC,SAAS,CAAC,KAChC,iBAcF,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAChD,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,IAAI,EAAE,SAAS,CAAC;IAChB,2CAA2C;IAC3C,CAAC,EAAE,OAAO,CAAC;IACX,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,gCAAgC,KACvC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAavB,CAAC"}

package/dist/auth/session_middleware.js

@@ -70,6 +70,13 @@ export const create_session_middleware = (keyring, options) => {
  * persists the session row, optionally enforces a per-account session limit,
  * and sets the signed cookie.
  *
+ * The cap deletes the sessions it evicts, but not the connections they
+ * opened. A caller that passes `max_sessions` closes the returned sessions'
+ * connections once its transaction commits — `queue_connection_close` with a
+ * `session` target, as `POST /login` does. A caller that mints for an account
+ * created in the same transaction (signup, bootstrap) evicts nothing.
+ *
+ * @returns the token hashes of the sessions the cap evicted, empty without a cap
  * @mutates `auth_session` table - inserts the new session row (and evicts older rows when `max_sessions` is set)
  */
 export const create_session_and_set_cookie = async (options) => {
@@ -78,9 +85,8 @@ export const create_session_and_set_cookie = async (options) => {
     const token_hash = hash_session_token(session_token);
     const expires_at = new Date(Date.now() + AUTH_SESSION_LIFETIME_MS);
     await query_create_session(deps, token_hash, account_id, expires_at);
-    if (max_sessions != null) {
-        await query_session_enforce_limit(deps, account_id, max_sessions);
-    }
+    const evicted = max_sessions != null ? await query_session_enforce_limit(deps, account_id, max_sessions) : [];
     const cookie_value = await create_session_cookie_value(keyring, session_token, session_options);
     set_session_cookie(c, cookie_value, session_options);
+    return evicted;
 };

package/dist/auth/session_queries.d.ts

@@ -132,13 +132,19 @@ export declare const query_session_list_for_account: (deps: QueryDeps, account_i
  * Expired-but-unreaped rows count toward the cap (the predicate is `account_id`
  * alone). Matches the Rust twin `query_session_enforce_limit`.
  *
+ * Deleting a session row does not end the connections it opened: a WebSocket
+ * keeps the authority it resolved at upgrade and an SSE stream never rechecks.
+ * The returned ids are the token hashes those connections are registered
+ * under, so the caller closes them once the transaction commits
+ * (`queue_connection_close`) — `POST /login` does.
+ *
  * @param deps - query dependencies (must be transaction-scoped)
  * @param account_id - the account to enforce the limit for
  * @param max_sessions - maximum number of sessions to keep
- * @returns the number of sessions evicted
+ * @returns the evicted sessions' ids (their token hashes), empty when nothing was evicted
  * @mutates `auth_session` table - deletes the oldest rows past the cap
  */
-export declare const query_session_enforce_limit: (deps: QueryDeps, account_id: string, max_sessions: number) => Promise<number>;
+export declare const query_session_enforce_limit: (deps: QueryDeps, account_id: string, max_sessions: number) => Promise<Array<string>>;
 /**
  * List all active sessions across all accounts with usernames.
  *
@@ -153,10 +159,29 @@ export declare const query_session_list_all_active: (deps: QueryDeps, limit?: nu
     username: string;
 }>>;
 /**
- * Delete expired sessions.
- *
- * @returns the number of sessions cleaned up
+ * Delete every expired session, returning the ids (token hashes) of the rows
+ * it deleted.
+ *
+ * The ids are the keys `ConnectionCloser.close_sockets_for_session` closes by.
+ * A row past `expires_at` already fails `query_session_get_valid`, but
+ * deleting it does not end the connections it opened: a WebSocket keeps the
+ * authority it resolved at upgrade and an SSE stream never rechecks. The row
+ * was also the only per-session handle on those connections —
+ * `account_session_revoke` closes only for a row it deleted — so the caller
+ * closes each returned session's connections once the delete has committed.
+ * `cleanup_expired_sessions` (`auth/cleanup.ts`) is that caller; reach for it
+ * rather than this query.
+ *
+ * One statement, so the returned ids are exactly the rows this call removed:
+ * a concurrent pass gets a disjoint set. Run it in a transaction, as the
+ * caller above does, so the ids are in hand before the delete commits — on a
+ * pool-level `Db` a connection lost on the response leaves the rows deleted
+ * and their ids unread. Served by `idx_auth_session_expires`. Twin of the
+ * Rust `query_session_cleanup_expired`.
+ *
+ * @param deps - query dependencies (transaction-scoped, see above)
+ * @returns the deleted sessions' ids (their token hashes), empty when nothing had expired
  * @mutates `auth_session` table - deletes every row past `expires_at`
  */
-export declare const query_session_cleanup_expired: (deps: QueryDeps) => Promise<number>;
+export declare const query_session_cleanup_expired: (deps: QueryDeps) => Promise<Array<string>>;
 //# sourceMappingURL=session_queries.d.ts.map

package/dist/auth/session_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAA2B,CAAC;AAEjE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,KAAG,SAElD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAAO,MAEzC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,EAClB,YAAY,IAAI,KACd,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,2DAKoB,CAAC;AAQtD;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,WAAW,GAAG,SAAS,CAKjC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,IAAI,CAEd,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,KAChB,OAAO,CAAC,OAAO,CAMjB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAU,KACR,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAK5B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,2BAA2B,GACvC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAc,MAAM,KAClB,OAAO,CAAC,MAAM,CAYhB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,cAAW,KACT,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CASnD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,MAAM,CAKnF,CAAC"}
+{"version":3,"file":"session_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAA2B,CAAC;AAEjE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,KAAG,SAElD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAAO,MAEzC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,EAClB,YAAY,IAAI,KACd,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,2DAKoB,CAAC;AAQtD;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,WAAW,GAAG,SAAS,CAKjC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,IAAI,CAEd,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,KAChB,OAAO,CAAC,OAAO,CAMjB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAU,KACR,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAK5B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,eAAO,MAAM,2BAA2B,GACvC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAc,MAAM,KAClB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAYvB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,cAAW,KACT,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CASnD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,6BAA6B,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAK1F,CAAC"}

package/dist/auth/session_queries.js

@@ -165,10 +165,16 @@ export const query_session_list_for_account = async (deps, account_id, limit = 5
  * Expired-but-unreaped rows count toward the cap (the predicate is `account_id`
  * alone). Matches the Rust twin `query_session_enforce_limit`.
  *
+ * Deleting a session row does not end the connections it opened: a WebSocket
+ * keeps the authority it resolved at upgrade and an SSE stream never rechecks.
+ * The returned ids are the token hashes those connections are registered
+ * under, so the caller closes them once the transaction commits
+ * (`queue_connection_close`) — `POST /login` does.
+ *
  * @param deps - query dependencies (must be transaction-scoped)
  * @param account_id - the account to enforce the limit for
  * @param max_sessions - maximum number of sessions to keep
- * @returns the number of sessions evicted
+ * @returns the evicted sessions' ids (their token hashes), empty when nothing was evicted
  * @mutates `auth_session` table - deletes the oldest rows past the cap
  */
 export const query_session_enforce_limit = async (deps, account_id, max_sessions) => {
@@ -179,7 +185,7 @@ export const query_session_enforce_limit = async (deps, account_id, max_sessions
 		   ORDER BY created_at DESC, id DESC
 		   OFFSET $2
 		 ) RETURNING id`, [account_id, max_sessions]);
-    return rows.length;
+    return rows.map((row) => row.id);
 };
 /**
  * List all active sessions across all accounts with usernames.
@@ -199,12 +205,31 @@ export const query_session_list_all_active = async (deps, limit = 200) => {
 		 ORDER BY s.created_at DESC, s.id DESC LIMIT $1`, [limit]);
 };
 /**
- * Delete expired sessions.
- *
- * @returns the number of sessions cleaned up
+ * Delete every expired session, returning the ids (token hashes) of the rows
+ * it deleted.
+ *
+ * The ids are the keys `ConnectionCloser.close_sockets_for_session` closes by.
+ * A row past `expires_at` already fails `query_session_get_valid`, but
+ * deleting it does not end the connections it opened: a WebSocket keeps the
+ * authority it resolved at upgrade and an SSE stream never rechecks. The row
+ * was also the only per-session handle on those connections —
+ * `account_session_revoke` closes only for a row it deleted — so the caller
+ * closes each returned session's connections once the delete has committed.
+ * `cleanup_expired_sessions` (`auth/cleanup.ts`) is that caller; reach for it
+ * rather than this query.
+ *
+ * One statement, so the returned ids are exactly the rows this call removed:
+ * a concurrent pass gets a disjoint set. Run it in a transaction, as the
+ * caller above does, so the ids are in hand before the delete commits — on a
+ * pool-level `Db` a connection lost on the response leaves the rows deleted
+ * and their ids unread. Served by `idx_auth_session_expires`. Twin of the
+ * Rust `query_session_cleanup_expired`.
+ *
+ * @param deps - query dependencies (transaction-scoped, see above)
+ * @returns the deleted sessions' ids (their token hashes), empty when nothing had expired
  * @mutates `auth_session` table - deletes every row past `expires_at`
  */
 export const query_session_cleanup_expired = async (deps) => {
     const rows = await deps.db.query(`DELETE FROM auth_session WHERE expires_at <= NOW() RETURNING id`);
-    return rows.length;
+    return rows.map((row) => row.id);
 };

package/dist/auth/standard_rpc_actions.d.ts

@@ -10,9 +10,9 @@
  * Option routing: shared `roles` flows to both admin and role-grant-offer;
  * `default_ttl_ms` and `authorize` go to role-grant-offer only; `max_tokens`
  * goes to account only;
- * shared `connection_closer` flows to admin + account (role-grant-offer ignores);
  * `notification_sender` reaches role-grant-offer transparently (admin + account
- * ignore it).
+ * ignore it). `deps.connection_closer` is read by admin + account, whose
+ * revocation handlers close live connections through it.
  *
  * Paired with `create_admin_rpc_adapters` on the UI side.
  *
@@ -21,7 +21,7 @@
 import { type AdminActionOptions } from './admin_actions.js';
 import { type RoleGrantOfferActionOptions } from './role_grant_offer_actions.js';
 import { type AccountActionOptions } from './account_actions.js';
-import type { ActionFactoryDeps } from './deps.js';
+import type { RevokingActionFactoryDeps } from './deps.js';
 import type { NotificationSender } from './role_grant_offer_notifications.js';
 import type { RpcAction } from '../actions/action_rpc.js';
 /**
@@ -38,12 +38,12 @@ export interface StandardRpcActionsOptions extends AdminActionOptions, RoleGrant
 /**
  * Dependencies for `create_standard_rpc_actions`.
  *
- * Stack-standard `ActionFactoryDeps` (`log`, `audit`) plus an optional
- * `notification_sender` consumed only by the role-grant-offer sub-factory
- * for WS fan-out. Admin and account sub-factories ignore
- * `notification_sender`.
+ * Stack-standard `RevokingActionFactoryDeps` (`log`, `audit`,
+ * `connection_closer`) plus an optional `notification_sender` consumed only by the
+ * role-grant-offer sub-factory for WS fan-out. Admin and account
+ * sub-factories ignore `notification_sender`.
  */
-export interface StandardRpcActionsDeps extends ActionFactoryDeps {
+export interface StandardRpcActionsDeps extends RevokingActionFactoryDeps {
     notification_sender?: NotificationSender | null;
 }
 /**
@@ -54,7 +54,7 @@ export interface StandardRpcActionsDeps extends ActionFactoryDeps {
  * and `create_account_actions(deps, {max_tokens})`. The shared `roles`
  * option flows to admin + role-grant-offer.
  *
- * @param deps - `StandardRpcActionsDeps` (`log`, `audit` from `ActionFactoryDeps`; optional `notification_sender` for WS fan-out)
+ * @param deps - `StandardRpcActionsDeps` (`log`, `audit`, `connection_closer` from `RevokingActionFactoryDeps`; optional `notification_sender` for WS fan-out)
  * @param options - role schema, role-grant-offer config, account config
  * @returns RPC actions to pass as `rpc_endpoints` or spread into `create_rpc_endpoint`
  */

package/dist/auth/standard_rpc_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"standard_rpc_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/standard_rpc_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAEN,KAAK,2BAA2B,EAChC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAA0B,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACzF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE1D;;;;;;;;GAQG;AACH,MAAM,WAAW,yBAChB,SAAQ,kBAAkB,EAAE,2BAA2B,EAAE,oBAAoB;CAAG;AAEjF;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAuB,SAAQ,iBAAiB;IAChE,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAChD;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B,GACvC,MAAM,sBAAsB,EAC5B,UAAS,yBAA8B,KACrC,KAAK,CAAC,SAAS,CAIjB,CAAC"}
+{"version":3,"file":"standard_rpc_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/standard_rpc_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAwB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAEN,KAAK,2BAA2B,EAChC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAA0B,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACzF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAE1D;;;;;;;;GAQG;AACH,MAAM,WAAW,yBAChB,SAAQ,kBAAkB,EAAE,2BAA2B,EAAE,oBAAoB;CAAG;AAEjF;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAuB,SAAQ,yBAAyB;IACxE,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAChD;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B,GACvC,MAAM,sBAAsB,EAC5B,UAAS,yBAA8B,KACrC,KAAK,CAAC,SAAS,CAIjB,CAAC"}

package/dist/auth/standard_rpc_actions.js

@@ -10,9 +10,9 @@
  * Option routing: shared `roles` flows to both admin and role-grant-offer;
  * `default_ttl_ms` and `authorize` go to role-grant-offer only; `max_tokens`
  * goes to account only;
- * shared `connection_closer` flows to admin + account (role-grant-offer ignores);
  * `notification_sender` reaches role-grant-offer transparently (admin + account
- * ignore it).
+ * ignore it). `deps.connection_closer` is read by admin + account, whose
+ * revocation handlers close live connections through it.
  *
  * Paired with `create_admin_rpc_adapters` on the UI side.
  *
@@ -29,7 +29,7 @@ import { create_account_actions } from './account_actions.js';
  * and `create_account_actions(deps, {max_tokens})`. The shared `roles`
  * option flows to admin + role-grant-offer.
  *
- * @param deps - `StandardRpcActionsDeps` (`log`, `audit` from `ActionFactoryDeps`; optional `notification_sender` for WS fan-out)
+ * @param deps - `StandardRpcActionsDeps` (`log`, `audit`, `connection_closer` from `RevokingActionFactoryDeps`; optional `notification_sender` for WS fan-out)
  * @param options - role schema, role-grant-offer config, account config
  * @returns RPC actions to pass as `rpc_endpoints` or spread into `create_rpc_endpoint`
  */

package/dist/db/CLAUDE.md

@@ -50,7 +50,13 @@ the code.
   `fact`'s store rows are the deliberate exception: `PgFactStore` feeds
   `FactMeta.created_at`, a `Date` in the `@fuzdev/fuz_util` `FactStore`
   contract, and nothing serializes it.
-- `status.ts` — CLI DB status utility.
+- `status.ts` — CLI DB status utility: `query_db_status` (read-only;
+  per-namespace applied/pending plus name-divergence, mirroring the
+  runner's boot check), `format_db_status` (the report body — the
+  `database status` / `url:` header is the calling script's, using
+  `display_db_url`, which renders the URL from its parse without the
+  password or query). The connected body is byte-identical with the Rust
+  `fuz_db` twin's; `src/test/db/status.test.ts` pins the shared fixture.
 - `schema_ready.ts` — `/ready` deploy-gate core: `query_public_columns`
   (keeps `schema_version`, unlike `query_schema_snapshot`), pure
   `check_schema_drift` / `format_schema_drift`, `READY_ERROR`. Column-presence

package/dist/db/status.d.ts

@@ -97,10 +97,67 @@ export interface DbStatus {
  */
 export declare const query_db_status: (db: Db, namespaces?: Array<MigrationNamespace>) => Promise<DbStatus>;
 /**
- * Format a `DbStatus` as a human-readable string for CLI output.
+ * Format a `DbStatus` as the body of the human-facing operator report.
+ *
+ * A `tables:` count with one aligned `name  N rows` line per table, then a
+ * `migrations:` header (always printed, even with no namespaces) and one
+ * aligned line per namespace: its state (`up-to-date`, `PENDING <n>`, or
+ * `DIVERGED`), `applied/declared`, and the latest applied name (`(none)` when
+ * nothing is applied). A diverged namespace adds a `diverged:` line, a pending
+ * one a `pending:` line naming the tail. A failed connection renders the single
+ * line `connection: FAILED (<error>)`. Every line ends in a newline.
+ *
+ * The body only — the `database status` / `url:` header belongs to the CLI
+ * script, which holds the URL a `DbStatus` never sees. For a connected status
+ * the output is byte-identical with the Rust twin's `format_db_status`; both
+ * test suites pin the same fixture report.
  *
  * @param status - the status to format
  * @returns multi-line string suitable for console output
  */
 export declare const format_db_status: (status: DbStatus) => string;
+/**
+ * Render a database URL for printing from the parse node-postgres dials —
+ * `new URL`, with pg-connection-string's precedence, where a `user`, `host`, or
+ * `port` query parameter overrides the URL's own — so the line names the server
+ * dialed and no credential can leak however the input spells it.
+ *
+ * A `postgres://` or `postgresql://` URL renders as
+ * `postgres://[user@]host:port[/dbname]`: never the password, and never the
+ * query or fragment (`sslmode` and the like are dropped by design). The scheme
+ * always prints as `postgres://`. The port always prints, `5432` when the URL
+ * names none. The user and database name print percent-encoded with
+ * `encodeURIComponent`, so no control character, escape sequence, or bidi
+ * override reaches the terminal and an `@` can't pose as the separator; each
+ * prints only when non-empty. An IP-literal host prints canonically (IPv6
+ * bracketed); a Unix-socket directory prints with each `/` as `%2F`. A PGlite
+ * `file://` or `memory://` URL prints as scheme, host, and path.
+ *
+ * The whole line is `(not a URL; hidden)` for any other scheme, when `new URL`
+ * rejects the input, when it holds a malformed percent-escape (`%ZZ`), when
+ * there is no host, when the host is neither an IP literal, a hostname of
+ * `A-Z a-z 0-9 . _ -`, nor a socket directory of those characters and `/`, when
+ * the user holds `?`, `=`, `&`, `/`, or `#`, or when the port isn't a number up
+ * to 65535. The host and user rules match the Rust twin's, where they catch
+ * tokio-postgres's split at the first `@`.
+ *
+ * Twin of the Rust `fuz_db` CLI's `display_db_url`, byte-identical on the URLs
+ * both drivers read alike. They part where the drivers do: a `host=` or `port=`
+ * query parameter overrides the URL's here (tokio-postgres appends it to a list
+ * whose first entry the pool dials); a `dbname=` query parameter, which
+ * tokio-postgres honours and node-postgres ignores, and a `#…` fragment, which
+ * tokio-postgres keeps as part of the database name; tokio-postgres also
+ * accepts `key=value` strings, host lists, and an unencoded `/` or `?` in the
+ * password (here, the placeholder); an unencoded `@` in the userinfo splits at
+ * the last `@` here, rendering the user and host node-postgres dials, where the
+ * Rust twin prints the placeholder; node-postgres decodes the database name
+ * with `decodeURI`, so a reserved-character escape such as `%2F` stays literal
+ * and prints as `%252F`; an IPv4-mapped IPv6 address serializes differently;
+ * and tokio-postgres refuses an unknown query parameter (`sslpassword=`) that
+ * node-postgres passes.
+ *
+ * @param url - the database URL
+ * @returns the URL without its password, query, or fragment, or the placeholder
+ */
+export declare const display_db_url: (url: string) => string;
 //# sourceMappingURL=status.d.ts.map

package/dist/db/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GACnB;IACA,mEAAmE;IACnE,IAAI,EAAE,eAAe,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;CAChB,GACD;IACA,kEAAkE;IAClE,IAAI,EAAE,cAAc,CAAC;IACrB,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;CAChB,CAAC;AAEL;;GAEG;AACH,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,2EAA2E;IAC3E,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACxB,yCAAyC;IACzC,SAAS,EAAE,OAAO,CAAC;IACnB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3B,sCAAsC;IACtC,UAAU,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;CACnC;AAaD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,GAC3B,IAAI,EAAE,EACN,aAAa,KAAK,CAAC,kBAAkB,CAAC,KACpC,OAAO,CAAC,QAAQ,CAsGlB,CAAC;AAeF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAAI,QAAQ,QAAQ,KAAG,MA4CnD,CAAC"}
+{"version":3,"file":"status.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GACnB;IACA,mEAAmE;IACnE,IAAI,EAAE,eAAe,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;CAChB,GACD;IACA,kEAAkE;IAClE,IAAI,EAAE,cAAc,CAAC;IACrB,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;CAChB,CAAC;AAEL;;GAEG;AACH,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,2EAA2E;IAC3E,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACxB,yCAAyC;IACzC,SAAS,EAAE,OAAO,CAAC;IACnB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3B,sCAAsC;IACtC,UAAU,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;CACnC;AA6DD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,GAC3B,IAAI,EAAE,EACN,aAAa,KAAK,CAAC,kBAAkB,CAAC,KACpC,OAAO,CAAC,QAAQ,CA2DlB,CAAC;AA0BF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gBAAgB,GAAI,QAAQ,QAAQ,KAAG,MAmCnD,CAAC;AA8BF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,eAAO,MAAM,cAAc,GAAI,KAAK,MAAM,KAAG,MAoC5C,CAAC"}