@fuzdev/fuz_app 0.127.0 → 0.129.0

package/dist/auth/audit_emitter.js

@@ -29,6 +29,8 @@
  *   the query layer, or the offer-expiry rows `auth/cleanup.ts` writes in
  *   its sweep transaction). Runs every registered listener; per-listener
  *   throws are isolated.
+ * - `drain_inflight()` — test-binary barrier: await every in-flight `emit`
+ *   write, on an emitter built with `track_inflight: true`.
  *
  * ## When listeners hear about a row
  *
@@ -56,9 +58,10 @@
  * registers additional listeners via `add_listener` after the backend is
  * built (the factory-managed audit-log SSE, per-endpoint WS auth guards, any
  * `extra_audit_handlers` on a `WsEndpointSpec`) before the first request
- * runs. Consumers can also register listeners directly on the emitter they
- * return from `audit_factory` for setups that don't pass through
- * `create_app_server`.
+ * runs, and removes each through the remover `add_listener` returns when its
+ * assembly fails or the server closes. Consumers can also register
+ * listeners directly on the emitter they return from `audit_factory` for
+ * setups that don't pass through `create_app_server`.
  *
  * @module
  */
@@ -75,18 +78,21 @@ import { builtin_audit_log_config } from './audit_log_schema.js';
  * @returns the bound emitter; closes over the pool + config + listener chain
  */
 export const create_audit_emitter = (options) => {
-    const { db, log, audit_log_config = builtin_audit_log_config, emit_decorator } = options;
+    const { db, log, audit_log_config = builtin_audit_log_config, emit_decorator, track_inflight = false } = options;
     // Closure-private listener list — no mutable array is exposed on the
     // returned (frozen) emitter; registration goes through `add_listener`.
+    // One entry object per registration, so a remover takes out its own
+    // registration even when the same function is registered twice.
     const listeners = [];
     if (options.on_audit_event)
-        listeners.push(options.on_audit_event);
+        listeners.push({ listener: options.on_audit_event });
     const notify = (event) => {
         // Snapshot-at-notify: iterate a copy so a listener that registers
         // another listener mid-fan-out doesn't have the newcomer fire for the
-        // in-flight event (it fires on the next `notify`). Converges with the
-        // Rust twin, which clones the listener vec before iterating.
-        for (const listener of [...listeners]) {
+        // in-flight event (it fires on the next `notify`), and one removed
+        // mid-fan-out still hears the in-flight event. Converges with the Rust
+        // twin, which clones the listener vec before iterating.
+        for (const { listener } of [...listeners]) {
             try {
                 listener(event);
             }
@@ -111,16 +117,41 @@ export const create_audit_emitter = (options) => {
         if (event)
             notify(event);
     };
+    // In-flight `emit` writes, when tracked — each removed as it settles, so
+    // the set is empty exactly when nothing is outstanding. Neither tracked
+    // promise rejects (`write` and `notify` log their failures).
+    const inflight = track_inflight ? new Set() : null;
+    const track = (promise) => {
+        if (inflight) {
+            inflight.add(promise);
+            const remove = () => {
+                inflight.delete(promise);
+            };
+            void promise.then(remove, remove);
+        }
+        return promise;
+    };
+    const drain_inflight = async () => {
+        if (!inflight)
+            return;
+        // Wait for zero, not for a snapshot: a write started while waiting —
+        // an emit from a post-commit thunk — joins the set and is awaited on
+        // the next pass. The removal reactions were registered before these,
+        // so a settled write is gone from the set by the time a pass resumes.
+        while (inflight.size > 0) {
+            await Promise.allSettled(inflight);
+        }
+    };
     const base_emit = (ctx, input) => {
         if (input.outcome === 'failure') {
             // an attempt happened whether or not the transaction commits
-            ctx.pending_effects.push(emit_pool(input));
+            ctx.pending_effects.push(track(emit_pool(input)));
             return;
         }
         // A success row is written now and announced after the commit — and
         // not at all on rollback, when the queue is discarded. See the module
         // doc, "When listeners hear about a row".
-        const written = write(input);
+        const written = track(write(input));
         ctx.pending_effects.push(written.then(() => undefined));
         emit_after_commit(ctx, async () => {
             const event = await written;
@@ -146,26 +177,31 @@ export const create_audit_emitter = (options) => {
         });
     };
     const add_listener = (listener) => {
-        listeners.push(listener);
+        const entry = { listener };
+        listeners.push(entry);
+        return () => {
+            const index = listeners.indexOf(entry);
+            if (index !== -1)
+                listeners.splice(index, 1);
+        };
     };
     const listener_count = () => listeners.length;
     // Freeze the slot layout so consumers cannot hot-patch `emit` /
-    // `emit_role_grant_target` / `emit_pool` / `notify` after construction.
-    // The previous test helper `patch_audit_emit_capture` did exactly this
-    // and only happened to work because the four slots were writable —
+    // `emit_role_grant_target` / `emit_pool` / `notify` after construction —
+    // a patched `emit` would miss role-grant-shape emits anyway, since
     // `emit_role_grant_target` calls the closed-over inner `emit`, not
-    // `this.emit`, so the patch silently bypassed role-grant-shape emits.
-    // Tests that need instrumentation pass `emit_decorator` so the wrap
-    // is captured by the closure before the freeze. The listener list stays
-    // closure-private; registration is append-only via `add_listener`
-    // (`create_app_server` registers its SSE + WS listeners post-assembly,
-    // by design).
+    // `this.emit`. Tests that need instrumentation pass `emit_decorator` so the
+    // wrap is captured by the closure before the freeze. The listener list stays
+    // closure-private; it changes only through `add_listener` and the remover
+    // it returns (`create_app_server` registers its SSE + WS listeners after
+    // the emitter is built, by design, and removes them on close).
     return Object.freeze({
         emit,
         emit_role_grant_target,
         emit_pool,
         notify,
         add_listener,
-        listener_count
+        listener_count,
+        drain_inflight
     });
 };

package/dist/auth/bearer_auth.d.ts

@@ -28,8 +28,9 @@ import type { QueryDeps } from '../db/query_deps.js';
  * (`invalid_token`, `account_not_found`) that could aid enumeration attacks,
  * and ensures public actions are not blocked by bad credentials.
  *
- * Rejects bearer tokens when an `Origin` or `Referer` header is present —
- * browsers must use cookie auth to reduce attack surface.
+ * Discards bearer tokens when an `Origin` or `Referer` header is present —
+ * `next()` with no identity, as for a bad token — so browsers must use cookie
+ * auth, reducing attack surface.
  * Auth scheme matching is case-insensitive per RFC 7235.
  * On success, sets `c.var.auth_account_id`, `CREDENTIAL_TYPE_KEY = 'api_token'`,
  * and `AUTH_API_TOKEN_ID_KEY`. Skips when an account is already authenticated

package/dist/auth/bearer_auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bearer_auth.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/bearer_auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAUtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAIrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,6BAA6B,GAAI,MAAM,SAAS,EAAE,KAAK,MAAM,KAAG,iBAuE5E,CAAC"}
+{"version":3,"file":"bearer_auth.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/bearer_auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAUtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAIrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,6BAA6B,GAAI,MAAM,SAAS,EAAE,KAAK,MAAM,KAAG,iBAuE5E,CAAC"}

package/dist/auth/bearer_auth.js

@@ -31,8 +31,9 @@ import { is_browser_context } from '../http/origin.js';
  * (`invalid_token`, `account_not_found`) that could aid enumeration attacks,
  * and ensures public actions are not blocked by bad credentials.
  *
- * Rejects bearer tokens when an `Origin` or `Referer` header is present —
- * browsers must use cookie auth to reduce attack surface.
+ * Discards bearer tokens when an `Origin` or `Referer` header is present —
+ * `next()` with no identity, as for a bad token — so browsers must use cookie
+ * auth, reducing attack surface.
  * Auth scheme matching is case-insensitive per RFC 7235.
  * On success, sets `c.var.auth_account_id`, `CREDENTIAL_TYPE_KEY = 'api_token'`,
  * and `AUTH_API_TOKEN_ID_KEY`. Skips when an account is already authenticated

package/dist/auth/middleware.d.ts

@@ -38,6 +38,36 @@ export declare const AUTH_MIDDLEWARE_PATH = "/api/*";
  * @throws Error when `path` is outside `AUTH_MIDDLEWARE_PATH`
  */
 export declare const assert_endpoint_in_auth_scope: (option: "rpc_endpoints" | "ws_endpoints", path: string) => void;
+/**
+ * Throw unless a middleware list still mounts every spec of the stack it was
+ * built from — the trusted-proxy spec and the auth middleware — exactly once,
+ * at its original path, in its original order.
+ *
+ * `create_app_server` and `create_test_app_surface_spec` run it on the list
+ * a `transform_middleware` option returns, against the stack they handed it
+ * (`[proxy, ...auth]`). The endpoint auth-scope check
+ * (`assert_endpoint_in_auth_scope`) assumes the auth stack is mounted at
+ * `AUTH_MIDDLEWARE_PATH`, and every IP-keyed rate limiter assumes the proxy
+ * spec ran first — without it `get_client_ip` answers `'unknown'` for every
+ * caller, collapsing each limiter into one shared bucket. So a transform that
+ * moves, drops, duplicates, reorders, wraps, or replaces a stack layer is
+ * refused. Other specs may sit anywhere, including before the proxy spec and
+ * between the auth layers. The check pins where the stack's layers sit, not
+ * what added layers do — a layer you add runs with full context access.
+ *
+ * Each stack spec is matched by its `handler` — the closure its factory built
+ * — not by `name`, which any spec can carry, so a same-named replacement or a
+ * wrapped handler counts as missing. A spread copy (`{...spec}`) keeps the
+ * handler and still matches. Its path is compared with the original's, so
+ * pass specs the transform could not reach: the assemblies hand the transform
+ * shallow copies in a fresh array and keep the originals here.
+ *
+ * @param stack_specs - the stack the transform was built from, in mount order
+ * @param middleware_specs - the middleware list the transform returned
+ * @throws Error when a stack spec is missing, mounted more than once, mounted
+ *   at another path, or out of order
+ */
+export declare const assert_middleware_stack_mounted: (stack_specs: ReadonlyArray<MiddlewareSpec>, middleware_specs: ReadonlyArray<MiddlewareSpec>) => void;
 /**
  * Per-factory configuration for the standard auth middleware stack.
  */

package/dist/auth/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAIjE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,6BAA6B,GACzC,QAAQ,eAAe,GAAG,cAAc,EACxC,MAAM,MAAM,KACV,IAOF,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;CACtC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CA4E/B,CAAC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAIjE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,6BAA6B,GACzC,QAAQ,eAAe,GAAG,cAAc,EACxC,MAAM,MAAM,KACV,IAOF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,+BAA+B,GAC3C,aAAa,aAAa,CAAC,cAAc,CAAC,EAC1C,kBAAkB,aAAa,CAAC,cAAc,CAAC,KAC7C,IA+BF,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;CACtC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CA4E/B,CAAC"}

package/dist/auth/middleware.js

@@ -41,6 +41,65 @@ export const assert_endpoint_in_auth_scope = (option, path) => {
             `(${AUTH_MIDDLEWARE_PATH}) — it would see every caller as unauthenticated — mount it under /api/`);
     }
 };
+/**
+ * Throw unless a middleware list still mounts every spec of the stack it was
+ * built from — the trusted-proxy spec and the auth middleware — exactly once,
+ * at its original path, in its original order.
+ *
+ * `create_app_server` and `create_test_app_surface_spec` run it on the list
+ * a `transform_middleware` option returns, against the stack they handed it
+ * (`[proxy, ...auth]`). The endpoint auth-scope check
+ * (`assert_endpoint_in_auth_scope`) assumes the auth stack is mounted at
+ * `AUTH_MIDDLEWARE_PATH`, and every IP-keyed rate limiter assumes the proxy
+ * spec ran first — without it `get_client_ip` answers `'unknown'` for every
+ * caller, collapsing each limiter into one shared bucket. So a transform that
+ * moves, drops, duplicates, reorders, wraps, or replaces a stack layer is
+ * refused. Other specs may sit anywhere, including before the proxy spec and
+ * between the auth layers. The check pins where the stack's layers sit, not
+ * what added layers do — a layer you add runs with full context access.
+ *
+ * Each stack spec is matched by its `handler` — the closure its factory built
+ * — not by `name`, which any spec can carry, so a same-named replacement or a
+ * wrapped handler counts as missing. A spread copy (`{...spec}`) keeps the
+ * handler and still matches. Its path is compared with the original's, so
+ * pass specs the transform could not reach: the assemblies hand the transform
+ * shallow copies in a fresh array and keep the originals here.
+ *
+ * @param stack_specs - the stack the transform was built from, in mount order
+ * @param middleware_specs - the middleware list the transform returned
+ * @throws Error when a stack spec is missing, mounted more than once, mounted
+ *   at another path, or out of order
+ */
+export const assert_middleware_stack_mounted = (stack_specs, middleware_specs) => {
+    let previous_index = -1;
+    for (const stack_spec of stack_specs) {
+        let index = -1;
+        let count = 0;
+        for (let i = 0; i < middleware_specs.length; i++) {
+            if (middleware_specs[i].handler === stack_spec.handler) {
+                if (count === 0)
+                    index = i;
+                count++;
+            }
+        }
+        const found = count === 0
+            ? 'missing'
+            : count > 1
+                ? `mounted ${count} times`
+                : middleware_specs[index].path !== stack_spec.path
+                    ? `mounted at ${middleware_specs[index].path}`
+                    : index < previous_index
+                        ? 'out of order'
+                        : null;
+        if (found) {
+            throw new Error(`transform_middleware must keep the middleware '${stack_spec.name}' mounted once ` +
+                `at ${stack_spec.path} in its original order (${found}) — endpoint auth-scope checks ` +
+                'and client-IP rate limiting assume it; add layers around the stack, ' +
+                "don't move, drop, wrap, or replace it");
+        }
+        previous_index = index;
+    }
+};
 /**
  * Create the auth middleware stack.
  *

package/dist/auth/request_context.d.ts

@@ -251,7 +251,7 @@ export declare const create_request_context_middleware: (deps: QueryDeps, sessio
  * across route-spec declarations and direct calls alike, and the twin of the
  * Rust signature. It needs no parse: the surface arm's identifier is pure label,
  * since rule 3 never asks *which* surface. And it is deliberately not narrowed
- * to the spine's four — the name decides nothing, so there is nothing for a
+ * to the spine's own — the name decides nothing, so there is nothing for a
  * closed set to protect, while a consumer surface would have nothing to pass.
  * fuz_app's own uses are pinned two ways by the surface census: the exact call
  * site, and the scan asserting every `'surface:<name>'` literal in `src/lib`

package/dist/auth/request_context.js

@@ -281,7 +281,7 @@ const token_scope_denial = (c, capability) => {
  * across route-spec declarations and direct calls alike, and the twin of the
  * Rust signature. It needs no parse: the surface arm's identifier is pure label,
  * since rule 3 never asks *which* surface. And it is deliberately not narrowed
- * to the spine's four — the name decides nothing, so there is nothing for a
+ * to the spine's own — the name decides nothing, so there is nothing for a
  * closed set to protect, while a consumer surface would have nothing to pass.
  * fuz_app's own uses are pinned two ways by the surface census: the exact call
  * site, and the scan asserting every `'surface:<name>'` literal in `src/lib`

package/dist/auth/token_scope.d.ts

@@ -106,7 +106,9 @@ export declare const token_scope_admits_method: (scope: TokenScope, method: stri
 export declare const token_scope_admits_non_rpc: (scope: TokenScope) => boolean;
 /**
  * The non-RPC surfaces the **spine itself** mounts (rule 3). Twin of the Rust
- * `TokenSurface` enum, name for name.
+ * `TokenSurface` enum, name for name, except `app_surface` — the opt-in
+ * `GET /api/surface` explorer (`server/surface_route.ts`), which only the TS
+ * spine serves.
  *
  * Not a registry a consumer registers into. `RouteAuth.required_scope` accepts
  * any well-formed `surface:<name>` (see `parse_token_scope_capability`), so a
@@ -120,7 +122,7 @@ export declare const token_scope_admits_non_rpc: (scope: TokenScope) => boolean;
  * refused, in the `required_scope` a denial reports. That is the same field
  * whose `rpc:<method>` arm has always carried arbitrary consumer method names.
  */
-export declare const TOKEN_SURFACES: readonly ["db_admin", "fact_bare", "audit_stream", "ws_upgrade"];
+export declare const TOKEN_SURFACES: readonly ["db_admin", "fact_bare", "audit_stream", "ws_upgrade", "app_surface"];
 export type TokenSurface = (typeof TOKEN_SURFACES)[number];
 /**
  * Is `value` one of the surfaces the spine mounts?

package/dist/auth/token_scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token_scope.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/token_scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;;GAGG;AACH,eAAO,MAAM,qBAAqB,QAAW,CAAC;AAE9C;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,UAAU;;;;;;;;;4BAYrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;;4BAG1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,kDAAkD;AAClD,eAAO,MAAM,gBAAgB,QAAO,UAGlC,CAAC;AAEH,uCAAuC;AACvC,eAAO,MAAM,mBAAmB,GAAI,SAAS,KAAK,CAAC,MAAM,CAAC,KAAG,UAI3D,CAAC;AAEH,qDAAqD;AACrD,eAAO,MAAM,sBAAsB,GAAI,OAAO,eAAe,KAAG,UACgB,CAAC;AAEjF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,GAAI,OAAO,UAAU,EAAE,QAAQ,MAAM,KAAG,OACtB,CAAC;AAEzD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,0BAA0B,GAAI,OAAO,UAAU,KAAG,OAAgC,CAAC;AAEhG;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,cAAc,kEAAmE,CAAC;AAC/F,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,GAAI,OAAO,MAAM,KAAG,KAAK,IAAI,YACA,CAAC;AAE3D;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAAgC,CAAC;AAQtE;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,GAAI,QAAQ,MAAM,KAAG,MAC3B,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,oBAAoB,GAC/B;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/F;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,4BAA4B,GAAI,OAAO,MAAM,KAAG,oBAAoB,GAAG,IAUnF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,GACzC,OAAO,UAAU,EACjB,YAAY,oBAAoB,KAC9B,OAGkC,CAAC;AAEtC;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,GACnC,YAAY,MAAM,KAChB;IAAE,KAAK,EAAE,sBAAsB,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAGxD,CAAC;AAEH,4CAA4C;AAC5C,eAAO,MAAM,iBAAiB,GAAI,OAAO,UAAU,KAAG,MAGrD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,KAAG,UAAU,GAAG,IAU5D,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GAAI,OAAO,UAAU,KAAG,MAQzD,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,GAAI,OAAO,OAAO,KAAG,UAAU,GAAG,IAQtE,CAAC"}
+{"version":3,"file":"token_scope.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/token_scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;;GAGG;AACH,eAAO,MAAM,qBAAqB,QAAW,CAAC;AAE9C;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,UAAU;;;;;;;;;4BAYrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;;4BAG1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,kDAAkD;AAClD,eAAO,MAAM,gBAAgB,QAAO,UAGlC,CAAC;AAEH,uCAAuC;AACvC,eAAO,MAAM,mBAAmB,GAAI,SAAS,KAAK,CAAC,MAAM,CAAC,KAAG,UAI3D,CAAC;AAEH,qDAAqD;AACrD,eAAO,MAAM,sBAAsB,GAAI,OAAO,eAAe,KAAG,UACgB,CAAC;AAEjF;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,GAAI,OAAO,UAAU,EAAE,QAAQ,MAAM,KAAG,OACtB,CAAC;AAEzD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,0BAA0B,GAAI,OAAO,UAAU,KAAG,OAAgC,CAAC;AAEhG;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,iFAMjB,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,GAAI,OAAO,MAAM,KAAG,KAAK,IAAI,YACA,CAAC;AAE3D;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,QAAgC,CAAC;AAQtE;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,GAAI,QAAQ,MAAM,KAAG,MAC3B,CAAC;AAErC;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,oBAAoB,GAC/B;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/F;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,4BAA4B,GAAI,OAAO,MAAM,KAAG,oBAAoB,GAAG,IAUnF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,GACzC,OAAO,UAAU,EACjB,YAAY,oBAAoB,KAC9B,OAGkC,CAAC;AAEtC;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,GACnC,YAAY,MAAM,KAChB;IAAE,KAAK,EAAE,sBAAsB,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAGxD,CAAC;AAEH,4CAA4C;AAC5C,eAAO,MAAM,iBAAiB,GAAI,OAAO,UAAU,KAAG,MAGrD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,KAAG,UAAU,GAAG,IAU5D,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GAAI,OAAO,UAAU,KAAG,MAQzD,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,GAAI,OAAO,OAAO,KAAG,UAAU,GAAG,IAQtE,CAAC"}

package/dist/auth/token_scope.js

@@ -112,7 +112,9 @@ export const token_scope_admits_method = (scope, method) => scope.kind === 'full
 export const token_scope_admits_non_rpc = (scope) => scope.kind === 'full';
 /**
  * The non-RPC surfaces the **spine itself** mounts (rule 3). Twin of the Rust
- * `TokenSurface` enum, name for name.
+ * `TokenSurface` enum, name for name, except `app_surface` — the opt-in
+ * `GET /api/surface` explorer (`server/surface_route.ts`), which only the TS
+ * spine serves.
  *
  * Not a registry a consumer registers into. `RouteAuth.required_scope` accepts
  * any well-formed `surface:<name>` (see `parse_token_scope_capability`), so a
@@ -126,7 +128,13 @@ export const token_scope_admits_non_rpc = (scope) => scope.kind === 'full';
  * refused, in the `required_scope` a denial reports. That is the same field
  * whose `rpc:<method>` arm has always carried arbitrary consumer method names.
  */
-export const TOKEN_SURFACES = ['db_admin', 'fact_bare', 'audit_stream', 'ws_upgrade'];
+export const TOKEN_SURFACES = [
+    'db_admin',
+    'fact_bare',
+    'audit_stream',
+    'ws_upgrade',
+    'app_surface'
+];
 /**
  * Is `value` one of the surfaces the spine mounts?
  *

package/dist/http/CLAUDE.md

@@ -28,7 +28,7 @@ effects, see ../../../docs/architecture.md.
 - `http/jsonrpc.ts` — JSON-RPC 2.0 envelope schemas (MCP superset), `JsonrpcErrorCode`, `_meta`.
 - `http/jsonrpc_errors.ts` — `ThrownJsonrpcError`, `jsonrpc_errors` throwers, HTTP-status mappings.
 - `http/jsonrpc_helpers.ts` — message builders, type guards, input/result normalizers.
-- `http/common_routes.ts` — health check + readiness probe (`/ready` schema-drift deploy gate) + authenticated server-status + surface route specs.
+- `http/common_routes.ts` — health check + readiness probe (`/ready` schema-drift deploy gate) + authenticated server-status route specs (the surface explorer route lives in `server/surface_route.ts`).
 - `http/db_routes.ts` — allowlist-gated keeper-only table browser route specs (`public` schema, minus the `NON_BROWSABLE_TABLES` credential floor).
 - `http/pending_effects.ts` — `emit_after_commit` + `dispatch_with_post_commit_rollback` (the shared rollback-discard wrapper both dispatch sites use) + `flush_pending_effects` + `flush_post_commit_effects` + `EmitAfterCommitContext`.
 
@@ -484,13 +484,12 @@ at send time.
 
 ## Common Routes
 
-`http/common_routes.ts` exposes four generic route-spec factories with no
+`http/common_routes.ts` exposes three generic route-spec factories with no
 auth-domain dependencies:
 
 - `create_health_route_spec()` — `GET /health`, public, returns `{status: 'ok'}`. Infrastructure endpoint for uptime monitors
-- `create_ready_route_spec({expected, log})` — `GET /ready`, public, the deploy gate. Introspects the live DB's columns (`db/schema_ready.ts`) and compares against the committed `expected` column map: `200 {ready: true}` on match, else `503 {error: 'schema_drift' | 'db_unreachable'}`. Detailed drift logs server-side only (minimal body — no schema leak, mirrors why `/api/surface` is authenticated). Throws at assembly on an empty `expected` (fail-loud). Opt-in like `/health`; pair with `load_expected_schema(url)` — loads + URL-caches a consumer's committed `expected_schema.json` and throws on an empty map
+- `create_ready_route_spec({expected, log})` — `GET /ready`, public, the deploy gate. Introspects the live DB's columns (`db/schema_ready.ts`) and compares against the committed `expected` column map: `200 {ready: true}` on match, else `503 {error: 'schema_drift' | 'db_unreachable'}`. Detailed drift logs server-side only (minimal body — no schema leak, mirrors why `/api/surface` is admin-only). Throws at assembly on an empty `expected` (fail-loud). Opt-in like `/health`; pair with `load_expected_schema(url)` — loads + URL-caches a consumer's committed `expected_schema.json` and throws on an empty map
 - `create_server_status_route_spec({version, get_uptime_ms})` — `GET /api/server/status`, authenticated, returns `{version, uptime_ms}`
-- `create_surface_route_spec({surface})` — `GET /api/surface`, authenticated, serves the `AppSurface` JSON. Authenticated because surface data reveals API structure (schemas, auth, routes)
 
 Auth-aware variants (account status, bootstrap status) live in `auth/` —
 `http/common_routes.ts` stays generic.

package/dist/http/auth_shape.d.ts

@@ -141,8 +141,9 @@ export declare const RouteAuth: z.ZodObject<{
      *
      * - `surface:<name>` — a non-RPC surface, refused to every narrowed token
      *   whatever its method list says (token scoping's rule that a narrowed
-     *   token is RPC-only). `surface:audit_stream` and `surface:fact_bare` are
-     *   the spine's; a consumer names its own without registering it.
+     *   token is RPC-only). `surface:audit_stream`, `surface:fact_bare`, and
+     *   `surface:app_surface` are the spine's route-spec ones; a consumer names
+     *   its own without registering it.
      * - `rpc:<method>` — one action method, refused unless the token lists it.
      *   What a route bridged from an `ActionSpec` declares: it carries the
      *   method's identity but never reaches the dispatcher's per-method gate.

package/dist/http/auth_shape.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth_shape.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/auth_shape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,WAAW,6DAGtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,OAAO,KAAG,MAAM,GAAG,SAGtD,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,aAAa;;;;EAA2C,CAAC;AACtE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;IAMpB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;;kBAyCF,CAAC;AACJ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAUlD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,MAAM,SAAS,KAAG,OACA,CAAC;AAElD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,SAAS,KAAG,OAAgC,CAAC;AAE/E;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,SAAS,KAAG,OAAkC,CAAC;AAEnF,wEAAwE;AACxE,eAAO,MAAM,YAAY,GAAI,MAAM,SAAS,KAAG,OAA+B,CAAC;AAE/E,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB,GAAI,MAAM,SAAS,KAAG,OAC3B,CAAC;AAEjC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,GAAI,MAAM,SAAS,KAAG,OACQ,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B,GAAI,MAAM,SAAS,KAAG,OACwB,CAAC;AAYvF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GAAI,QAAQ,CAAC,CAAC,OAAO,KAAG,OAIhE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC3B,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sCAAsC,GAClD,MAAM,SAAS,EACf,OAAO,WAAW,EAClB,SAAS,MAAM,KACb,IAmBF,CAAC"}
+{"version":3,"file":"auth_shape.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/auth_shape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,WAAW,6DAGtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,OAAO,KAAG,MAAM,GAAG,SAGtD,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,aAAa;;;;EAA2C,CAAC;AACtE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;IAMpB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;;kBAyCF,CAAC;AACJ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAUlD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,MAAM,SAAS,KAAG,OACA,CAAC;AAElD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,SAAS,KAAG,OAAgC,CAAC;AAE/E;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,SAAS,KAAG,OAAkC,CAAC;AAEnF,wEAAwE;AACxE,eAAO,MAAM,YAAY,GAAI,MAAM,SAAS,KAAG,OAA+B,CAAC;AAE/E,8FAA8F;AAC9F,eAAO,MAAM,wBAAwB,GAAI,MAAM,SAAS,KAAG,OAC3B,CAAC;AAEjC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,GAAI,MAAM,SAAS,KAAG,OACQ,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B,GAAI,MAAM,SAAS,KAAG,OACwB,CAAC;AAYvF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GAAI,QAAQ,CAAC,CAAC,OAAO,KAAG,OAIhE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC3B,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,sCAAsC,GAClD,MAAM,SAAS,EACf,OAAO,WAAW,EAClB,SAAS,MAAM,KACb,IAmBF,CAAC"}

package/dist/http/auth_shape.js

@@ -135,8 +135,9 @@ export const RouteAuth = z
      *
      * - `surface:<name>` — a non-RPC surface, refused to every narrowed token
      *   whatever its method list says (token scoping's rule that a narrowed
-     *   token is RPC-only). `surface:audit_stream` and `surface:fact_bare` are
-     *   the spine's; a consumer names its own without registering it.
+     *   token is RPC-only). `surface:audit_stream`, `surface:fact_bare`, and
+     *   `surface:app_surface` are the spine's route-spec ones; a consumer names
+     *   its own without registering it.
      * - `rpc:<method>` — one action method, refused unless the token lists it.
      *   What a route bridged from an `ActionSpec` declares: it carries the
      *   method's identity but never reaches the dispatcher's per-method gate.

package/dist/http/common_routes.d.ts

@@ -8,7 +8,6 @@
  */
 import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import type { RouteSpec } from './route_spec.js';
-import type { AppSurface } from './surface.js';
 import { type ExpectedSchema } from '../db/schema_ready.js';
 /**
  * Create a public health check route spec.
@@ -57,7 +56,7 @@ export interface ReadyRouteOptions {
  * else `503 {error}` (`schema_drift` when columns are missing, `db_unreachable`
  * when the introspection query throws). The detailed drift goes to the server
  * log only — the public body stays a minimal code so the endpoint doesn't leak
- * schema structure (mirrors why `/api/surface` is authenticated). A deploy poll
+ * schema structure (mirrors why `/api/surface` is admin-only). A deploy poll
  * treats `503` as a failed release and rolls back, turning a silent
  * schema-drift auth outage into a loud blocked deploy. See `db/schema_ready.ts`
  * for the column-presence rationale and `auth/migrations.ts` for the
@@ -78,16 +77,4 @@ export interface ServerStatusOptions {
  * this requires authentication.
  */
 export declare const create_server_status_route_spec: (options: ServerStatusOptions) => RouteSpec;
-/** Options for the surface explorer route. */
-export interface SurfaceRouteOptions {
-    /** The generated app surface to serve. */
-    surface: AppSurface;
-}
-/**
- * Create an authenticated route spec that serves the `AppSurface` as JSON.
- *
- * Surface data reveals API structure (routes, auth, schemas), so this
- * requires authentication like the server status route.
- */
-export declare const create_surface_route_spec: (options: SurfaceRouteOptions) => RouteSpec;
 //# sourceMappingURL=common_routes.d.ts.map

package/dist/http/common_routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"common_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/common_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAIN,KAAK,cAAc,EACnB,MAAM,uBAAuB,CAAC;AAE/B;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,QAAO,SAQ1C,CAAC;AAKH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,oBAAoB,GAAI,KAAK,GAAG,GAAG,MAAM,KAAG,cAkBxD,CAAC;AAEF,6CAA6C;AAC7C,MAAM,WAAW,iBAAiB;IACjC;;;;OAIG;IACH,QAAQ,EAAE,cAAc,CAAC;IACzB,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,GAAI,SAAS,iBAAiB,KAAG,SAoCpE,CAAC;AAEF,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IACnC,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,aAAa,EAAE,MAAM,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,GAAI,SAAS,mBAAmB,KAAG,SAQ7E,CAAC;AAEH,8CAA8C;AAC9C,MAAM,WAAW,mBAAmB;IACnC,0CAA0C;IAC1C,OAAO,EAAE,UAAU,CAAC;CACpB;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,mBAAmB,KAAG,SAWvE,CAAC"}
+{"version":3,"file":"common_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/common_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAIN,KAAK,cAAc,EACnB,MAAM,uBAAuB,CAAC;AAE/B;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,QAAO,SAQ1C,CAAC;AAKH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,oBAAoB,GAAI,KAAK,GAAG,GAAG,MAAM,KAAG,cAkBxD,CAAC;AAEF,6CAA6C;AAC7C,MAAM,WAAW,iBAAiB;IACjC;;;;OAIG;IACH,QAAQ,EAAE,cAAc,CAAC;IACzB,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,GAAI,SAAS,iBAAiB,KAAG,SAoCpE,CAAC;AAEF,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IACnC,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,aAAa,EAAE,MAAM,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,GAAI,SAAS,mBAAmB,KAAG,SAQ7E,CAAC"}

package/dist/http/common_routes.js

@@ -71,7 +71,7 @@ export const load_expected_schema = (url) => {
  * else `503 {error}` (`schema_drift` when columns are missing, `db_unreachable`
  * when the introspection query throws). The detailed drift goes to the server
  * log only — the public body stays a minimal code so the endpoint doesn't leak
- * schema structure (mirrors why `/api/surface` is authenticated). A deploy poll
+ * schema structure (mirrors why `/api/surface` is admin-only). A deploy poll
  * treats `503` as a failed release and rolls back, turning a silent
  * schema-drift auth outage into a loud blocked deploy. See `db/schema_ready.ts`
  * for the column-presence rationale and `auth/migrations.ts` for the
@@ -129,21 +129,3 @@ export const create_server_status_route_spec = (options) => ({
     input: z.null(),
     output: z.looseObject({ version: z.string(), uptime_ms: z.number() })
 });
-/**
- * Create an authenticated route spec that serves the `AppSurface` as JSON.
- *
- * Surface data reveals API structure (routes, auth, schemas), so this
- * requires authentication like the server status route.
- */
-export const create_surface_route_spec = (options) => ({
-    method: 'GET',
-    path: '/api/surface',
-    auth: { account: 'required', actor: 'none' },
-    handler: (c) => c.json(options.surface),
-    description: 'Application surface (routes, middleware, schemas)',
-    input: z.null(),
-    output: z.looseObject({
-        routes: z.array(z.looseObject({})),
-        middleware: z.array(z.looseObject({}))
-    })
-});

package/dist/http/ip_canonical.d.ts

@@ -12,7 +12,7 @@
  * IPv6 forms (`::ffff:127.0.0.1` vs `0:0:0:0:0:ffff:7f00:1` vs the
  * bare `127.0.0.1`) — three keys for one address.
  *
- * Canonicalization runs through {@link canonicalize_ip} which:
+ * Canonicalization runs through `canonicalize_ip` which:
  *
  * 1. Lowercases and char-set filters (`IP_LITERAL_CHARS`) — non-IP
  *    strings (`'unknown'`, `'attacker:controlled'`, `'::1\n'`) pass

package/dist/http/ip_canonical.js

@@ -12,7 +12,7 @@
  * IPv6 forms (`::ffff:127.0.0.1` vs `0:0:0:0:0:ffff:7f00:1` vs the
  * bare `127.0.0.1`) — three keys for one address.
  *
- * Canonicalization runs through {@link canonicalize_ip} which:
+ * Canonicalization runs through `canonicalize_ip` which:
  *
  * 1. Lowercases and char-set filters (`IP_LITERAL_CHARS`) — non-IP
  *    strings (`'unknown'`, `'attacker:controlled'`, `'::1\n'`) pass

package/dist/realtime/sse_auth_guard.d.ts

@@ -118,7 +118,9 @@ export declare const AUDIT_LOG_SSE_MAX_PER_SCOPE = 10;
  * connection closer.
  *
  * Combines `SubscriberRegistry`, `create_sse_auth_guard`, and the broadcast
- * call into a single object, and adds the registry to `connection_closer`.
+ * call into a single object, and adds the registry to `connection_closer` for
+ * good — the remover `add` returns is dropped, so a caller that must take the
+ * registry out again passes `null` and adds it itself.
  * The result satisfies `AuditLogRouteOptions['stream']`
  * and provides the `on_audit_event` listener for the audit emitter.
  *
@@ -164,7 +166,9 @@ export declare const create_audit_log_sse: (options: {
      * Required so it can't be forgotten: without it a revoked credential's
      * streams close only through the audit listener, which a failed audit write
      * or a cap eviction never reaches. Pass `null` only for a registry no
-     * revocation has to reach (tests of the registry itself).
+     * revocation has to reach (tests of the registry itself), or when the
+     * caller adds `create_sse_connection_closer(registry)` itself — as
+     * `create_app_server` does, to hold the remover `add` returns.
      */
     connection_closer: RealtimeCloser | null;
     /**

package/dist/realtime/sse_auth_guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sse_auth_guard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/realtime/sse_auth_guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGtD,OAAO,EAIN,KAAK,aAAa,EAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE3D,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GAAI,CAAC,EAC7C,UAAU,kBAAkB,CAAC,CAAC,CAAC,KAC7B,gBAKD,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,qBAAqB,GAAI,CAAC,EACtC,UAAU,kBAAkB,CAAC,CAAC,CAAC,EAC/B,eAAe,MAAM,GAAG,IAAI,EAC5B,KAAK,MAAM,KACT,CAAC,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CA4DjC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC3B;;;;;OAKG;IACH,QAAQ,EAAE,kBAAkB,CAAC,eAAe,CAAC,CAAC;IAC9C,kFAAkF;IAClF,GAAG,EAAE,MAAM,CAAC;IACZ,yJAAyJ;IACzJ,cAAc,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;CAC/C;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,SAAS,CAOlD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,oBAAoB,GAAI,SAAS;IAC7C,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,iBAAiB,EAAE,cAAc,GAAG,IAAI,CAAC;IACzC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,KAAG,WAgBH,CAAC"}
+{"version":3,"file":"sse_auth_guard.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/realtime/sse_auth_guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGtD,OAAO,EAIN,KAAK,aAAa,EAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE3D,2DAA2D;AAC3D,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GAAI,CAAC,EAC7C,UAAU,kBAAkB,CAAC,CAAC,CAAC,KAC7B,gBAKD,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,qBAAqB,GAAI,CAAC,EACtC,UAAU,kBAAkB,CAAC,CAAC,CAAC,EAC/B,eAAe,MAAM,GAAG,IAAI,EAC5B,KAAK,MAAM,KACT,CAAC,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CA4DjC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC3B;;;;;OAKG;IACH,QAAQ,EAAE,kBAAkB,CAAC,eAAe,CAAC,CAAC;IAC9C,kFAAkF;IAClF,GAAG,EAAE,MAAM,CAAC;IACZ,yJAAyJ;IACzJ,cAAc,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;CAC/C;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,SAAS,CAOlD,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,eAAO,MAAM,oBAAoB,GAAI,SAAS;IAC7C,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;;OASG;IACH,iBAAiB,EAAE,cAAc,GAAG,IAAI,CAAC;IACzC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B,KAAG,WAgBH,CAAC"}

package/dist/realtime/sse_auth_guard.js

@@ -164,7 +164,9 @@ export const AUDIT_LOG_SSE_MAX_PER_SCOPE = 10;
  * connection closer.
  *
  * Combines `SubscriberRegistry`, `create_sse_auth_guard`, and the broadcast
- * call into a single object, and adds the registry to `connection_closer`.
+ * call into a single object, and adds the registry to `connection_closer` for
+ * good — the remover `add` returns is dropped, so a caller that must take the
+ * registry out again passes `null` and adds it itself.
  * The result satisfies `AuditLogRouteOptions['stream']`
  * and provides the `on_audit_event` listener for the audit emitter.
  *