@fuzdev/fuz_app 0.139.0 → 0.141.0

package/dist/auth/api_token_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api_token_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/api_token_queries.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,KAAK,UAAU,EAAmD,MAAM,kBAAkB,CAAC;AAEpG,yEAAyE;AACzE,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IACnD,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,0HAUoB,CAAC;AA6BnD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,IAAI,MAAM,EACV,YAAY,MAAM,EAClB,MAAM,MAAM,EACZ,YAAY,MAAM,EAClB,OAAO,UAAU,EACjB,aAAa,IAAI,GAAG,IAAI,KACtB,OAAO,CAAC,QAAQ,CAelB,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,wBAAwB,GACpC,MAAM,iBAAiB,EACvB,WAAW,MAAM,EACjB,IAAI,MAAM,GAAG,SAAS,EACtB,iBAAiB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,KAC/C,OAAO,CAAC,QAAQ,GAAG,SAAS,CAgC9B,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,SAAS,EACf,IAAI,MAAM,KACR,OAAO,CAAC,MAAM,GAAG,SAAS,CAM5B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uCAAuC,GACnD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kCAAkC,GAC9C,MAAM,SAAS,EACf,IAAI,MAAM,EACV,YAAY,MAAM,KAChB,OAAO,CAAC,OAAO,CAMjB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAM7C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,KAChB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAYvB,CAAC"}
+{"version":3,"file":"api_token_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/api_token_queries.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EAAE,KAAK,UAAU,EAAmD,MAAM,kBAAkB,CAAC;AAEpG;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG;IACzD,KAAK,EAAE,UAAU,CAAC;IAClB;;;;;OAKG;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,CAAC;AAEF,yEAAyE;AACzE,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IACnD,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,0HAUoB,CAAC;AA6BnD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,IAAI,MAAM,EACV,YAAY,MAAM,EAClB,MAAM,MAAM,EACZ,YAAY,MAAM,EAClB,OAAO,UAAU,EACjB,aAAa,IAAI,GAAG,IAAI,KACtB,OAAO,CAAC,QAAQ,CAelB,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wBAAwB,GACpC,MAAM,iBAAiB,EACvB,WAAW,MAAM,EACjB,IAAI,MAAM,GAAG,SAAS,EACtB,iBAAiB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,KAC/C,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAkCvC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,SAAS,EACf,IAAI,MAAM,KACR,OAAO,CAAC,MAAM,GAAG,SAAS,CAM5B,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uCAAuC,GACnD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kCAAkC,GAC9C,MAAM,SAAS,EACf,IAAI,MAAM,EACV,YAAY,MAAM,KAChB,OAAO,CAAC,OAAO,CAMjB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAM7C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,KAChB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAYvB,CAAC"}

package/dist/auth/api_token_queries.js

@@ -6,6 +6,7 @@
 import { assert_row } from '../db/assert_row.js';
 import { columns_sql, iso8601_timestamp_expr, omit_columns } from '../db/sql_columns.js';
 import { hash_api_token } from './api_token.js';
+import { EXPIRES_IN_MS_SQL } from './credential_deadline.js';
 import { parse_stored_token_scope, serialize_token_scope } from './token_scope.js';
 /**
  * The full `api_token` column set, named explicitly so a row read fails loud
@@ -74,23 +75,26 @@ export const query_create_api_token = async (deps, id, account_id, name, token_h
     return assert_row(row, 'INSERT INTO api_token');
 };
 /**
- * Validate a raw API token and return the token record.
+ * Validate a raw API token and return the token record with its scope parsed.
  *
  * Hashes the token with blake3, looks up the hash, and checks
- * expiration. Updates `last_used_at` and `last_used_ip` on success
+ * expiration, reading how long the token has left on the database clock in
+ * the same statement. A row whose stored scope is unreadable is refused like an
+ * unknown hash. Updates `last_used_at` and `last_used_ip` on success
  * (fire-and-forget — errors logged, never thrown).
  *
  * @param deps - query dependencies with logger
  * @param raw_token - the raw API token from the Authorization header
  * @param ip - the client IP address (for audit)
  * @param pending_effects - optional array to register the usage-tracking effect for later awaiting
- * @returns the token record if valid, or `undefined`
+ * @returns the token record with its parsed scope if valid, or `undefined`
  * @mutates `api_token` row - fire-and-forget UPDATE of `last_used_at` / `last_used_ip` on a valid token
  * @mutates `pending_effects` - pushes the in-flight tracking promise when provided
  */
 export const query_validate_api_token = async (deps, raw_token, ip, pending_effects) => {
     const token_hash = hash_api_token(raw_token);
-    const row = await deps.db.query_one(`SELECT ${columns_sql(API_TOKEN_COLUMNS, api_token_expr)} FROM api_token
+    const row = await deps.db.query_one(`SELECT ${columns_sql(API_TOKEN_COLUMNS, api_token_expr)}, ${EXPIRES_IN_MS_SQL} AS expires_in_ms
+		 FROM api_token
 		 WHERE token_hash = $1
 		   AND ${API_TOKEN_IS_LIVE}`, [token_hash]);
     if (!row)
@@ -99,7 +103,8 @@ export const query_validate_api_token = async (deps, raw_token, ip, pending_effe
     // outcome as an unknown token hash. The scope *is* the gate here, so a parse
     // failure must not fall through to full authority — that would hand a
     // narrowed token everything precisely when something is already wrong.
-    if (parse_stored_token_scope(row.scope) === null) {
+    const scope = parse_stored_token_scope(row.scope);
+    if (scope === null) {
         deps.log.warn(`api_token.scope is unreadable for ${row.id}; refusing the credential`);
         return undefined;
     }
@@ -114,7 +119,7 @@ export const query_validate_api_token = async (deps, raw_token, ip, pending_effe
         deps.log.error('Failed to update last_used_at:', err);
     });
     pending_effects?.push(p);
-    return row;
+    return { ...row, scope };
 };
 /**
  * Look up the owning account of a live API token — one that still exists and

package/dist/auth/audit_log_routes.d.ts

@@ -64,6 +64,16 @@ export interface AuditLogRouteOptions {
  * Rust spine's `audit_stream_router`, which registers before its role read
  * rather than repeating it.
  *
+ * ## Credential deadline
+ *
+ * Expiry writes nothing a revocation listener could hear, so an admitted
+ * stream watches its own credential's expiry
+ * (`ResolvedAuth.credential_deadline` — for the session-only stock route, the
+ * earlier of the cookie's and the row's) and is closed at it, as a revoked
+ * stream is: the body ends with no final frame, and the client's reconnect
+ * meets the gates. The wait is `schedule_credential_deadline`'s chain of
+ * bounded timers, cancelled when the stream closes.
+ *
  * @param options - optional stream wiring + role override
  * @returns the SSE route spec (when `options.stream` is provided) or an empty array
  */

package/dist/auth/audit_log_routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_log_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_log_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAUvD,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAU7E,yCAAyC;AACzC,MAAM,WAAW,oBAAoB;IACpC,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE;QACR,QAAQ,EAAE,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAC9C,GAAG,EAAE,MAAM,CAAC;KACZ,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,4BAA4B,GAAI,UAAU,oBAAoB,KAAG,KAAK,CAAC,SAAS,CAsG5F,CAAC"}
+{"version":3,"file":"audit_log_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_log_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAUvD,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAW7E,yCAAyC;AACzC,MAAM,WAAW,oBAAoB;IACpC,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE;QACR,QAAQ,EAAE,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAC9C,GAAG,EAAE,MAAM,CAAC;KACZ,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,eAAO,MAAM,4BAA4B,GAAI,UAAU,oBAAoB,KAAG,KAAK,CAAC,SAAS,CAmH5F,CAAC"}

package/dist/auth/audit_log_routes.js

@@ -17,6 +17,7 @@ import { create_audit_log_route_shape, DEFAULT_AUDIT_STREAM_ROLE } from './audit
 import { create_sse_response } from '../realtime/sse.js';
 import { AUTH_SESSION_TOKEN_HASH_KEY, has_scoped_role, refresh_role_grants, require_request_context } from './request_context.js';
 import { get_resolved_auth, revalidate_resolved_auth } from './resolved_auth.js';
+import { schedule_credential_deadline } from './credential_deadline.js';
 import { AUDIT_LOG_CHANNEL } from '../realtime/sse_auth_guard.js';
 /**
  * Create the optional audit-log SSE route spec.
@@ -50,6 +51,16 @@ import { AUDIT_LOG_CHANNEL } from '../realtime/sse_auth_guard.js';
  * Rust spine's `audit_stream_router`, which registers before its role read
  * rather than repeating it.
  *
+ * ## Credential deadline
+ *
+ * Expiry writes nothing a revocation listener could hear, so an admitted
+ * stream watches its own credential's expiry
+ * (`ResolvedAuth.credential_deadline` — for the session-only stock route, the
+ * earlier of the cookie's and the row's) and is closed at it, as a revoked
+ * stream is: the body ends with no final frame, and the client's reconnect
+ * meets the gates. The wait is `schedule_credential_deadline`'s chain of
+ * bounded timers, cancelled when the stream closes.
+ *
  * @param options - optional stream wiring + role override
  * @returns the SSE route spec (when `options.stream` is provided) or an empty array
  */
@@ -143,6 +154,15 @@ export const create_audit_log_route_specs = (options) => {
                         log.info('audit stream: closed before admission', ctx.account.id);
                         stream.close();
                     }
+                    else {
+                        // The stream ends when the credential it opened on expires —
+                        // closed as a revocation closes it (TSDoc, "Credential
+                        // deadline").
+                        stream.on_close(schedule_credential_deadline(get_resolved_auth(c)?.credential_deadline ?? null, () => {
+                            log.info('audit stream: credential expired', ctx.account.id);
+                            stream.close();
+                        }));
+                    }
                     return response;
                 }
                 finally {

package/dist/auth/audit_log_schema.d.ts

@@ -60,12 +60,15 @@ export type AuditEventType = z.infer<typeof AuditEventType>;
  *   row's `metadata.token_id`.
  * - `account` — every connection of `target_account_id ?? account_id`.
  * - `role` — the target account's connections gated on the row's
- *   `metadata.role`.
+ *   `metadata.role`, when the revoked grant was global
+ *   (`to_global_role_revocation`).
  *
- * The scope says what the row invalidated, not what a transport must do about
- * it. The two listeners differ on `role` on purpose: a WebSocket message is
- * re-authorized per dispatch, so the socket stays open and its next message
- * is refused, while a stream is authorized once at open and must be closed.
+ * The scope says what the row invalidated; both listeners act on every scope
+ * alike. On `role` that matters for the WebSocket too: per-message dispatch
+ * re-authorizes each request against its own action, but a socket admitted by
+ * a role gate also receives every server push its endpoint sends, which no
+ * dispatch ever re-checks — so a socket that lost the gating role is closed,
+ * like a stream.
  *
  * Twin of the Rust spine's `RevocationScope`.
  */
@@ -97,6 +100,28 @@ export declare const audit_event_revocation_scopes: Readonly<Record<AuditEventTy
  * with `queue_connection_close`.
  */
 export declare const to_revocation_scope: (event_type: string) => RevocationScope;
+/**
+ * The account and role a successful `role`-scope row took away, when the
+ * revoked grant was **global** — `null` otherwise.
+ *
+ * A role gate (`register_ws_endpoint`'s `required_roles`, the audit stream's
+ * `require_role`) admits on global grants only, so revoking a scoped grant
+ * takes away nothing a gate admitted on and closes nothing. A row with no
+ * `metadata.scope_id` reads as global: when unsure, closing is the safe side.
+ * The target is `target_account_id ?? account_id`, as for the `account` scope.
+ * Both revocation listeners read it, so a socket and a stream gated on one
+ * role close on the same rows.
+ *
+ * Twin of the Rust spine's `global_role_revocation`.
+ *
+ * @param event - a row whose scope is `role` (the caller dispatched on it)
+ * @returns the account and role to close on, or `null` when the row names no
+ *   role or target, or revoked a scoped grant
+ */
+export declare const to_global_role_revocation: (event: AuditLogEvent) => {
+    account_id: Uuid;
+    role: string;
+} | null;
 /**
  * Letter start, then letters, digits, `_`, `.`, `/`, `-`. Accepts snake_case,
  * dotted, and namespaced consumer conventions; rejects empty strings, leading

package/dist/auth/audit_log_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit_log_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_log_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,IAAI,EAAS,MAAM,yBAAyB,CAAC;AAkBtD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,6iBA6BnB,CAAC;AAEZ,wCAAwC;AACxC,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAA4B,CAAC;AACxD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAEhF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,6BAA6B,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,eAAe,CAAC,CA8BzF,CAAC;AAEJ;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,GAAI,YAAY,MAAM,KAAG,eAG/C,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,QAA+B,CAAC;AAExE,0DAA0D;AAC1D,eAAO,MAAM,kBAAkB,aAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,2CAA2C;AAC3C,eAAO,MAAM,YAAY;;;EAAiC,CAAC;AAC3D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkTW,CAAC;AAE/C,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GAAG;KAC7B,CAAC,IAAI,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;CAClE,CAAC;AAEF,oGAAoG;AACpG,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,IAAI,CAAC;IACT,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,kBAAkB,CAAC;IAC/B,OAAO,EAAE,YAAY,CAAC;IACtB;;;;;;;;;;;;;OAaG;IACH,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,iBAAiB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACzC;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,SAAS,cAAc,EAC1D,OAAO,aAAa,GAAG;IAAE,UAAU,EAAE,CAAC,CAAA;CAAE,KACtC,gBAAgB,CAAC,CAAC,CAAC,GAAG,IAExB,CAAC;AAEF,6CAA6C;AAC7C,MAAM,WAAW,aAAa,CAAC,CAAC,SAAS,MAAM,GAAG,cAAc;IAC/D,UAAU,EAAE,CAAC,CAAC;IACd,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,iBAAiB,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAChC,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,SAAS,cAAc,GAChC,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,GACtD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,cAAc;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CAC/D;AAED,4FAA4F;AAC5F,eAAO,MAAM,wBAAwB,EAAE,cAGrC,CAAC;AAEH,6CAA6C;AAC7C,MAAM,WAAW,2BAA2B;IAC3C;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC;CAC1D;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,GAAI,UAAU,2BAA2B,KAAG,cA6B/E,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,6CAA6C;AAC7C,MAAM,WAAW,mBAAmB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,0GAA0G;IAC1G,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;kBAY5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,+DAA+D;AAC/D,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;kBAGzC,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAE5F,wEAAwE;AACxE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;kBAGpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,iEAAiE;AACjE,eAAO,MAAM,gBAAgB;;;;;;kBAE3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}
+{"version":3,"file":"audit_log_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/audit_log_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,IAAI,EAAS,MAAM,yBAAyB,CAAC;AAkBtD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,6iBA6BnB,CAAC;AAEZ,wCAAwC;AACxC,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAA4B,CAAC;AACxD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAEhF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,6BAA6B,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,eAAe,CAAC,CA8BzF,CAAC;AAEJ;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,GAAI,YAAY,MAAM,KAAG,eAG/C,CAAC;AAEX;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,yBAAyB,GACrC,OAAO,aAAa,KAClB;IAAE,UAAU,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAQvC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,QAA+B,CAAC;AAExE,0DAA0D;AAC1D,eAAO,MAAM,kBAAkB,aAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,2CAA2C;AAC3C,eAAO,MAAM,YAAY;;;EAAiC,CAAC;AAC3D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkTW,CAAC;AAE/C,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GAAG;KAC7B,CAAC,IAAI,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;CAClE,CAAC;AAEF,oGAAoG;AACpG,MAAM,WAAW,aAAa;IAC7B,EAAE,EAAE,IAAI,CAAC;IACT,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,kBAAkB,CAAC;IAC/B,OAAO,EAAE,YAAY,CAAC;IACtB;;;;;;;;;;;;;OAaG;IACH,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,iBAAiB,EAAE,IAAI,GAAG,IAAI,CAAC;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACzC;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,SAAS,cAAc,EAC1D,OAAO,aAAa,GAAG;IAAE,UAAU,EAAE,CAAC,CAAA;CAAE,KACtC,gBAAgB,CAAC,CAAC,CAAC,GAAG,IAExB,CAAC;AAEF,6CAA6C;AAC7C,MAAM,WAAW,aAAa,CAAC,CAAC,SAAS,MAAM,GAAG,cAAc;IAC/D,UAAU,EAAE,CAAC,CAAC;IACd,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,iBAAiB,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAChC,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,SAAS,cAAc,GAChC,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,GACtD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,cAAc;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CAC/D;AAED,4FAA4F;AAC5F,eAAO,MAAM,wBAAwB,EAAE,cAGrC,CAAC;AAEH,6CAA6C;AAC7C,MAAM,WAAW,2BAA2B;IAC3C;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC;CAC1D;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,GAAI,UAAU,2BAA2B,KAAG,cA6B/E,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,6CAA6C;AAC7C,MAAM,WAAW,mBAAmB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,0GAA0G;IAC1G,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;kBAY5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,+DAA+D;AAC/D,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;kBAGzC,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAE5F,wEAAwE;AACxE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;kBAGpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,iEAAiE;AACjE,eAAO,MAAM,gBAAgB;;;;;;kBAE3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}

package/dist/auth/audit_log_schema.js

@@ -119,6 +119,36 @@ export const audit_event_revocation_scopes = Object.freeze({
 export const to_revocation_scope = (event_type) => Object.hasOwn(audit_event_revocation_scopes, event_type)
     ? audit_event_revocation_scopes[event_type]
     : 'none';
+/**
+ * The account and role a successful `role`-scope row took away, when the
+ * revoked grant was **global** — `null` otherwise.
+ *
+ * A role gate (`register_ws_endpoint`'s `required_roles`, the audit stream's
+ * `require_role`) admits on global grants only, so revoking a scoped grant
+ * takes away nothing a gate admitted on and closes nothing. A row with no
+ * `metadata.scope_id` reads as global: when unsure, closing is the safe side.
+ * The target is `target_account_id ?? account_id`, as for the `account` scope.
+ * Both revocation listeners read it, so a socket and a stream gated on one
+ * role close on the same rows.
+ *
+ * Twin of the Rust spine's `global_role_revocation`.
+ *
+ * @param event - a row whose scope is `role` (the caller dispatched on it)
+ * @returns the account and role to close on, or `null` when the row names no
+ *   role or target, or revoked a scoped grant
+ */
+export const to_global_role_revocation = (event) => {
+    const role = event.metadata?.role;
+    if (typeof role !== 'string' || role.length === 0)
+        return null;
+    const scope_id = event.metadata?.scope_id;
+    if (scope_id !== undefined && scope_id !== null)
+        return null;
+    const account_id = event.target_account_id ?? event.account_id;
+    if (!account_id)
+        return null;
+    return { account_id, role };
+};
 /**
  * Letter start, then letters, digits, `_`, `.`, `/`, `-`. Accepts snake_case,
  * dotted, and namespaced consumer conventions; rejects empty strings, leading

package/dist/auth/bearer_auth.d.ts

@@ -20,7 +20,7 @@ import type { QueryDeps } from '../db/query_deps.js';
 /**
  * Create middleware that authenticates via bearer token.
  *
- * Soft-fails for invalid, expired, or empty tokens — calls `next()` without
+ * Soft-fails for malformed, invalid, expired, or empty tokens — calls `next()` without
  * setting account identity, letting downstream auth enforcement (the RPC
  * dispatcher's pre-authorization / post-authorization auth gates or
  * `require_auth`) return a consistent JSON-RPC or route-level error. This
@@ -31,6 +31,8 @@ import type { QueryDeps } from '../db/query_deps.js';
  * Discards bearer tokens when an `Origin` or `Referer` header is present —
  * `next()` with no identity, as for a bad token — so browsers must use cookie
  * auth, reducing attack surface.
+ * A token that fails the `is_api_token_shaped` precheck soft-fails before
+ * the database is touched.
  * Auth scheme matching is case-insensitive per RFC 7235.
  * On success, sets `c.var.auth_account_id`, `CREDENTIAL_TYPE_KEY = 'api_token'`,
  * and `AUTH_API_TOKEN_ID_KEY`. Skips when an account is already authenticated
@@ -48,7 +50,7 @@ import type { QueryDeps } from '../db/query_deps.js';
  *
  * @param deps - query dependencies (pool-level db for middleware)
  * @param log - the logger instance
- * @mutates Hono context - sets `ACCOUNT_ID_KEY`, `CREDENTIAL_TYPE_KEY`, and `AUTH_API_TOKEN_ID_KEY` on success
+ * @mutates Hono context - sets `ACCOUNT_ID_KEY`, `CREDENTIAL_TYPE_KEY`, `AUTH_API_TOKEN_ID_KEY`, and `CREDENTIAL_DEADLINE_KEY` on success
  */
 export declare const create_bearer_auth_middleware: (deps: QueryDeps, log: Logger) => MiddlewareHandler;
 //# sourceMappingURL=bearer_auth.d.ts.map

package/dist/auth/bearer_auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bearer_auth.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/bearer_auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAUtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAIrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,6BAA6B,GAAI,MAAM,SAAS,EAAE,KAAK,MAAM,KAAG,iBAuE5E,CAAC"}
+{"version":3,"file":"bearer_auth.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/bearer_auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAYtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAIrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,6BAA6B,GAAI,MAAM,SAAS,EAAE,KAAK,MAAM,KAAG,iBAgF5E,CAAC"}

package/dist/auth/bearer_auth.js

@@ -15,15 +15,16 @@
  * @module
  */
 import { DEV } from 'esm-env';
-import { AUTH_API_TOKEN_ID_KEY, ACCOUNT_ID_KEY, CREDENTIAL_TYPE_KEY, TOKEN_SCOPE_KEY } from '../hono_context.js';
-import { parse_stored_token_scope, token_scope_full } from './token_scope.js';
+import { AUTH_API_TOKEN_ID_KEY, ACCOUNT_ID_KEY, CREDENTIAL_DEADLINE_KEY, CREDENTIAL_TYPE_KEY, TOKEN_SCOPE_KEY } from '../hono_context.js';
+import { credential_deadline_after } from './credential_deadline.js';
+import { is_api_token_shaped } from './api_token.js';
 import { query_validate_api_token } from './api_token_queries.js';
 import { get_client_ip } from '../http/client_ip.js';
 import { is_browser_context } from '../http/origin.js';
 /**
  * Create middleware that authenticates via bearer token.
  *
- * Soft-fails for invalid, expired, or empty tokens — calls `next()` without
+ * Soft-fails for malformed, invalid, expired, or empty tokens — calls `next()` without
  * setting account identity, letting downstream auth enforcement (the RPC
  * dispatcher's pre-authorization / post-authorization auth gates or
  * `require_auth`) return a consistent JSON-RPC or route-level error. This
@@ -34,6 +35,8 @@ import { is_browser_context } from '../http/origin.js';
  * Discards bearer tokens when an `Origin` or `Referer` header is present —
  * `next()` with no identity, as for a bad token — so browsers must use cookie
  * auth, reducing attack surface.
+ * A token that fails the `is_api_token_shaped` precheck soft-fails before
+ * the database is touched.
  * Auth scheme matching is case-insensitive per RFC 7235.
  * On success, sets `c.var.auth_account_id`, `CREDENTIAL_TYPE_KEY = 'api_token'`,
  * and `AUTH_API_TOKEN_ID_KEY`. Skips when an account is already authenticated
@@ -51,7 +54,7 @@ import { is_browser_context } from '../http/origin.js';
  *
  * @param deps - query dependencies (pool-level db for middleware)
  * @param log - the logger instance
- * @mutates Hono context - sets `ACCOUNT_ID_KEY`, `CREDENTIAL_TYPE_KEY`, and `AUTH_API_TOKEN_ID_KEY` on success
+ * @mutates Hono context - sets `ACCOUNT_ID_KEY`, `CREDENTIAL_TYPE_KEY`, `AUTH_API_TOKEN_ID_KEY`, and `CREDENTIAL_DEADLINE_KEY` on success
  */
 export const create_bearer_auth_middleware = (deps, log) => {
     return async (c, next) => {
@@ -92,6 +95,13 @@ export const create_bearer_auth_middleware = (deps, log) => {
             await next();
             return;
         }
+        // A value that cannot be a token soft-fails before any database work —
+        // no pool checkout, no query — so junk bearers cost nothing to refuse.
+        if (!is_api_token_shaped(raw_token)) {
+            log.debug('bearer auth soft-fail: malformed token');
+            await next();
+            return;
+        }
         // `ip` feeds the token's `last_used_ip` bookkeeping, not a limiter.
         const ip = get_client_ip(c);
         const api_token = await query_validate_api_token({ ...deps, log }, raw_token, ip, c.var.pending_effects);
@@ -105,10 +115,11 @@ export const create_bearer_auth_middleware = (deps, log) => {
         c.set(ACCOUNT_ID_KEY, api_token.account_id);
         c.set(CREDENTIAL_TYPE_KEY, 'api_token');
         c.set(AUTH_API_TOKEN_ID_KEY, api_token.id);
-        // `query_validate_api_token` is fail-closed on an unreadable scope, so a
-        // token that got this far has a readable one. The `?? token_scope_full()`
-        // is unreachable defensive cover, not a fallback with meaning.
-        c.set(TOKEN_SCOPE_KEY, parse_stored_token_scope(api_token.scope) ?? token_scope_full());
+        // Parsed by the query, which refuses a token whose stored scope is
+        // unreadable — there is no default to fall back to.
+        c.set(TOKEN_SCOPE_KEY, api_token.scope);
+        // the row's expiry, read on the database clock; none for an eternal token
+        c.set(CREDENTIAL_DEADLINE_KEY, credential_deadline_after([api_token.expires_in_ms]));
         await next();
     };
 };

package/dist/auth/bootstrap_route_schema.d.ts

@@ -46,6 +46,7 @@ export declare const bootstrap_route_shape: {
         account: "none";
         actor: "none";
     };
+    mints_credential: true;
     description: string;
     transaction: false;
     input: z.ZodObject<{

package/dist/auth/bootstrap_route_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap_route_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/bootstrap_route_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB,gFAAgF;AAChF,eAAO,MAAM,cAAc;;;;kBAIzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,iFAAiF;AACjF,eAAO,MAAM,eAAe;;;;;;;;;kBAI1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiBI,CAAC"}
+{"version":3,"file":"bootstrap_route_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/bootstrap_route_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB,gFAAgF;AAChF,eAAO,MAAM,cAAc;;;;kBAIzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,iFAAiF;AACjF,eAAO,MAAM,eAAe;;;;;;;;;kBAI1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkBI,CAAC"}

package/dist/auth/bootstrap_route_schema.js

@@ -39,6 +39,7 @@ export const bootstrap_route_shape = {
     method: 'POST',
     path: '/bootstrap',
     auth: { account: 'none', actor: 'none' },
+    mints_credential: true,
     description: 'Create initial keeper account (one-shot)',
     transaction: false, // bootstrap_account manages its own transaction
     input: BootstrapInput,

package/dist/auth/cleanup.d.ts

@@ -22,12 +22,12 @@
  * stream ends). Otherwise a swept session's connections would be reachable
  * only by an account-wide revocation.
  *
- * The contract that follows: **a connection outlives its session's expiry by
- * at most one cleanup interval** (plus the pass itself). In a process that
- * does not schedule the sweep, expiry ends no connection at all. The contract
- * is for sessions only: an expired API token's row is not swept, so nothing
- * here closes a connection opened on one — and `account_token_revoke` still
- * finds the row to close for.
+ * The sweep's close is the second on expiry, not the first: every connection
+ * already closes at its credential's deadline (`auth/credential_deadline.ts`)
+ * in the process holding it, whether or not a sweep runs. The sweep is for
+ * sessions only: an expired API token's row is not swept — its connections
+ * close at their deadline, and `account_token_revoke` still finds the row to
+ * close for.
  *
  * The closes run after the delete's commit, which is the rule every
  * revocation close keeps (see `actions/connection_closer.ts`). An expired
@@ -118,9 +118,9 @@ import type { AuditEmitter } from './audit_emitter.js';
  * `DEFAULT_AUTH_CLEANUP_INTERVAL`.
  *
  * An expired session or offer is already refused by every check that reads
- * it, so the interval bounds three things: how long a connection outlives
- * the expiry of the session it opened on, how late an offer expiry's audit
- * row lands, and how long dead rows linger.
+ * it, and a connection closes at its credential's deadline on its own, so the
+ * interval bounds two things: how late an offer expiry's audit row lands, and
+ * how long dead rows linger.
  */
 export declare const DEFAULT_AUTH_CLEANUP_INTERVAL_MS: number;
 /**

package/dist/auth/cleanup.js

@@ -22,12 +22,12 @@
  * stream ends). Otherwise a swept session's connections would be reachable
  * only by an account-wide revocation.
  *
- * The contract that follows: **a connection outlives its session's expiry by
- * at most one cleanup interval** (plus the pass itself). In a process that
- * does not schedule the sweep, expiry ends no connection at all. The contract
- * is for sessions only: an expired API token's row is not swept, so nothing
- * here closes a connection opened on one — and `account_token_revoke` still
- * finds the row to close for.
+ * The sweep's close is the second on expiry, not the first: every connection
+ * already closes at its credential's deadline (`auth/credential_deadline.ts`)
+ * in the process holding it, whether or not a sweep runs. The sweep is for
+ * sessions only: an expired API token's row is not swept — its connections
+ * close at their deadline, and `account_token_revoke` still finds the row to
+ * close for.
  *
  * The closes run after the delete's commit, which is the rule every
  * revocation close keeps (see `actions/connection_closer.ts`). An expired
@@ -117,9 +117,9 @@ import { query_audit_log } from './audit_log_queries.js';
  * `DEFAULT_AUTH_CLEANUP_INTERVAL`.
  *
  * An expired session or offer is already refused by every check that reads
- * it, so the interval bounds three things: how long a connection outlives
- * the expiry of the session it opened on, how late an offer expiry's audit
- * row lands, and how long dead rows linger.
+ * it, and a connection closes at its credential's deadline on its own, so the
+ * interval bounds two things: how late an offer expiry's audit row lands, and
+ * how long dead rows linger.
  */
 export const DEFAULT_AUTH_CLEANUP_INTERVAL_MS = 10 * 60 * 1000;
 /**

package/dist/auth/credential_deadline.d.ts

@@ -0,0 +1,95 @@
+/**
+ * The credential deadline — the moment a resolved credential stops
+ * authenticating, which a long-lived connection opened on it must not outlive.
+ *
+ * A WebSocket or an SSE stream is authorized once, at open, and closed on
+ * revocation by identity. Expiry has no revocation event: nothing is written
+ * when a session or token passes its `expires_at`. So the auth middleware
+ * computes the deadline once (`CREDENTIAL_DEADLINE_KEY`, gathered onto
+ * `ResolvedAuth.credential_deadline`) and the transport closes the connection
+ * when it arrives (`schedule_credential_deadline`).
+ *
+ * The deadline is the earliest of what the credential carries:
+ *
+ * - **Session** — the signed cookie's embedded expiry and the `auth_session`
+ *   row's `expires_at`.
+ * - **API token** — the `api_token` row's `expires_at`; an eternal token
+ *   (`expires_at IS NULL`) has none.
+ * - **Daemon token** — none: it has no row and no expiry, and a rotation
+ *   closes no connection.
+ *
+ * A row's expiry is read as **remaining time measured on the database clock**
+ * (`EXPIRES_IN_MS_SQL`, `expires_at - NOW()` in the same statement that checks
+ * `expires_at > NOW()`), then anchored to this process's monotonic clock
+ * (`performance.now()`) — so a skew between the database's clock and the
+ * server's moves no deadline. The cookie's expiry is a wall-clock second this
+ * server signed, read against the same wall clock the cookie check reads.
+ *
+ * The monotonic clock stops while the host is suspended, so a deadline on it
+ * alone would hold a connection past its credential by the time asleep. The
+ * wait (`schedule_credential_deadline`) therefore also carries the deadline on
+ * the wall clock (`Date.now()`), which keeps running through a suspend, and
+ * fires at whichever is reached first: after a resume, within one timer step
+ * (`CREDENTIAL_DEADLINE_TIMER_CAP_MS`, an hour). The wall deadline is taken
+ * from the time left when the wait starts, so a skew between the database's
+ * clock and the server's still moves nothing. A wall clock stepped forward
+ * can fire it early; the client reconnects through the gates, the fail-closed
+ * side of the trade.
+ *
+ * The twin of the Rust spine's `fuz_auth::ResolvedAuth::credential_deadline`
+ * and `fuz_realtime`'s deadline wait.
+ *
+ * @module
+ */
+/**
+ * SQL expression for a row's remaining lifetime in milliseconds, measured on
+ * the database clock — `NULL` when `expires_at` is `NULL` (an eternal API
+ * token). `float8`, so every driver reads it as a JS number.
+ */
+export declare const EXPIRES_IN_MS_SQL = "(EXTRACT(EPOCH FROM (expires_at - NOW())) * 1000)::float8";
+/**
+ * The longest single timer the deadline wait sets — one hour, far inside
+ * `setTimeout`'s ceiling (2^31 - 1 ms, about 24.8 days, past which a timer
+ * fires at once) and the Rust twin's tokio ceiling, and short enough that a
+ * resume from suspend is noticed within it. A longer deadline is reached
+ * through several.
+ */
+export declare const CREDENTIAL_DEADLINE_TIMER_CAP_MS = 3600000;
+/**
+ * The deadline `now` plus the shortest of `remaining_ms`, as a monotonic
+ * `performance.now()` timestamp, or `null` when no entry carries one.
+ *
+ * A negative or `NaN` entry — a row its own `expires_at > NOW()` check
+ * already refused, read at the boundary — counts as zero.
+ *
+ * @param remaining_ms - each source's remaining lifetime in ms, `null` for none
+ * @param now - the monotonic clock reading to anchor to
+ * @returns the deadline, or `null` for a credential with no expiry
+ */
+export declare const credential_deadline_after: (remaining_ms: ReadonlyArray<number | null>, now?: number) => number | null;
+/**
+ * The next timer toward `deadline` from `now`: what remains, capped at
+ * `CREDENTIAL_DEADLINE_TIMER_CAP_MS`, or `null` once the deadline is reached.
+ *
+ * @param deadline - the monotonic deadline
+ * @param now - the monotonic clock reading
+ * @returns the next delay in ms, or `null` when the deadline has passed
+ */
+export declare const next_credential_deadline_delay: (deadline: number, now: number) => number | null;
+/**
+ * Call `on_expire` once `deadline` has passed, waiting in timers of at most
+ * `CREDENTIAL_DEADLINE_TIMER_CAP_MS`, each re-reading the clock against the
+ * absolute deadline — so a session's 30 days (past `setTimeout`'s ceiling)
+ * does not fire at once. Each wake-up also checks the same deadline on the
+ * wall clock, so a host suspend, which stops the monotonic clock, delays the
+ * close by at most one timer after the resume (module doc).
+ *
+ * A `null` deadline schedules nothing. The returned function cancels the wait
+ * and is safe to call more than once, before or after it fires.
+ *
+ * @param deadline - the monotonic deadline (`ResolvedAuth.credential_deadline`)
+ * @param on_expire - run once, when the deadline passes
+ * @returns a cancel function
+ */
+export declare const schedule_credential_deadline: (deadline: number | null, on_expire: () => void) => (() => void);
+//# sourceMappingURL=credential_deadline.d.ts.map

package/dist/auth/credential_deadline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential_deadline.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/credential_deadline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,8DAA8D,CAAC;AAE7F;;;;;;GAMG;AACH,eAAO,MAAM,gCAAgC,UAAY,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,GACrC,cAAc,aAAa,CAAC,MAAM,GAAG,IAAI,CAAC,EAC1C,MAAK,MAA0B,KAC7B,MAAM,GAAG,IAQX,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,GAAI,UAAU,MAAM,EAAE,KAAK,MAAM,KAAG,MAAM,GAAG,IAIvF,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,4BAA4B,GACxC,UAAU,MAAM,GAAG,IAAI,EACvB,WAAW,MAAM,IAAI,KACnB,CAAC,MAAM,IAAI,CA2Bb,CAAC"}