@fuzdev/fuz_app 0.139.0 → 0.141.0

package/dist/auth/credential_deadline.js

@@ -0,0 +1,139 @@
+/**
+ * The credential deadline — the moment a resolved credential stops
+ * authenticating, which a long-lived connection opened on it must not outlive.
+ *
+ * A WebSocket or an SSE stream is authorized once, at open, and closed on
+ * revocation by identity. Expiry has no revocation event: nothing is written
+ * when a session or token passes its `expires_at`. So the auth middleware
+ * computes the deadline once (`CREDENTIAL_DEADLINE_KEY`, gathered onto
+ * `ResolvedAuth.credential_deadline`) and the transport closes the connection
+ * when it arrives (`schedule_credential_deadline`).
+ *
+ * The deadline is the earliest of what the credential carries:
+ *
+ * - **Session** — the signed cookie's embedded expiry and the `auth_session`
+ *   row's `expires_at`.
+ * - **API token** — the `api_token` row's `expires_at`; an eternal token
+ *   (`expires_at IS NULL`) has none.
+ * - **Daemon token** — none: it has no row and no expiry, and a rotation
+ *   closes no connection.
+ *
+ * A row's expiry is read as **remaining time measured on the database clock**
+ * (`EXPIRES_IN_MS_SQL`, `expires_at - NOW()` in the same statement that checks
+ * `expires_at > NOW()`), then anchored to this process's monotonic clock
+ * (`performance.now()`) — so a skew between the database's clock and the
+ * server's moves no deadline. The cookie's expiry is a wall-clock second this
+ * server signed, read against the same wall clock the cookie check reads.
+ *
+ * The monotonic clock stops while the host is suspended, so a deadline on it
+ * alone would hold a connection past its credential by the time asleep. The
+ * wait (`schedule_credential_deadline`) therefore also carries the deadline on
+ * the wall clock (`Date.now()`), which keeps running through a suspend, and
+ * fires at whichever is reached first: after a resume, within one timer step
+ * (`CREDENTIAL_DEADLINE_TIMER_CAP_MS`, an hour). The wall deadline is taken
+ * from the time left when the wait starts, so a skew between the database's
+ * clock and the server's still moves nothing. A wall clock stepped forward
+ * can fire it early; the client reconnects through the gates, the fail-closed
+ * side of the trade.
+ *
+ * The twin of the Rust spine's `fuz_auth::ResolvedAuth::credential_deadline`
+ * and `fuz_realtime`'s deadline wait.
+ *
+ * @module
+ */
+/**
+ * SQL expression for a row's remaining lifetime in milliseconds, measured on
+ * the database clock — `NULL` when `expires_at` is `NULL` (an eternal API
+ * token). `float8`, so every driver reads it as a JS number.
+ */
+export const EXPIRES_IN_MS_SQL = '(EXTRACT(EPOCH FROM (expires_at - NOW())) * 1000)::float8';
+/**
+ * The longest single timer the deadline wait sets — one hour, far inside
+ * `setTimeout`'s ceiling (2^31 - 1 ms, about 24.8 days, past which a timer
+ * fires at once) and the Rust twin's tokio ceiling, and short enough that a
+ * resume from suspend is noticed within it. A longer deadline is reached
+ * through several.
+ */
+export const CREDENTIAL_DEADLINE_TIMER_CAP_MS = 3_600_000;
+/**
+ * The deadline `now` plus the shortest of `remaining_ms`, as a monotonic
+ * `performance.now()` timestamp, or `null` when no entry carries one.
+ *
+ * A negative or `NaN` entry — a row its own `expires_at > NOW()` check
+ * already refused, read at the boundary — counts as zero.
+ *
+ * @param remaining_ms - each source's remaining lifetime in ms, `null` for none
+ * @param now - the monotonic clock reading to anchor to
+ * @returns the deadline, or `null` for a credential with no expiry
+ */
+export const credential_deadline_after = (remaining_ms, now = performance.now()) => {
+    let shortest = null;
+    for (const ms of remaining_ms) {
+        if (ms === null)
+            continue;
+        const clamped = Number.isNaN(ms) ? 0 : Math.max(0, ms);
+        if (shortest === null || clamped < shortest)
+            shortest = clamped;
+    }
+    return shortest === null ? null : now + shortest;
+};
+/**
+ * The next timer toward `deadline` from `now`: what remains, capped at
+ * `CREDENTIAL_DEADLINE_TIMER_CAP_MS`, or `null` once the deadline is reached.
+ *
+ * @param deadline - the monotonic deadline
+ * @param now - the monotonic clock reading
+ * @returns the next delay in ms, or `null` when the deadline has passed
+ */
+export const next_credential_deadline_delay = (deadline, now) => {
+    const remaining = deadline - now;
+    if (!(remaining > 0))
+        return null;
+    return Math.min(remaining, CREDENTIAL_DEADLINE_TIMER_CAP_MS);
+};
+/**
+ * Call `on_expire` once `deadline` has passed, waiting in timers of at most
+ * `CREDENTIAL_DEADLINE_TIMER_CAP_MS`, each re-reading the clock against the
+ * absolute deadline — so a session's 30 days (past `setTimeout`'s ceiling)
+ * does not fire at once. Each wake-up also checks the same deadline on the
+ * wall clock, so a host suspend, which stops the monotonic clock, delays the
+ * close by at most one timer after the resume (module doc).
+ *
+ * A `null` deadline schedules nothing. The returned function cancels the wait
+ * and is safe to call more than once, before or after it fires.
+ *
+ * @param deadline - the monotonic deadline (`ResolvedAuth.credential_deadline`)
+ * @param on_expire - run once, when the deadline passes
+ * @returns a cancel function
+ */
+export const schedule_credential_deadline = (deadline, on_expire) => {
+    if (deadline === null)
+        return () => { };
+    // the same deadline on the wall clock, which a suspend does not stop
+    const wall_deadline = Date.now() + (deadline - performance.now());
+    let timer = null;
+    let cancelled = false;
+    const step = () => {
+        timer = null;
+        if (cancelled)
+            return;
+        const delay = next_credential_deadline_delay(deadline, performance.now());
+        if (delay === null || Date.now() >= wall_deadline) {
+            cancelled = true;
+            on_expire();
+            return;
+        }
+        timer = setTimeout(step, delay);
+        // a pending deadline never holds the process open on its own
+        if (typeof timer === 'object' && 'unref' in timer)
+            timer.unref();
+    };
+    step();
+    return () => {
+        cancelled = true;
+        if (timer !== null) {
+            clearTimeout(timer);
+            timer = null;
+        }
+    };
+};

package/dist/auth/daemon_token_middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon_token_middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/daemon_token_middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAWtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAIN,KAAK,gBAAgB,EACrB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,yBAAyB,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAEtF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,eAAO,MAAM,8BAA8B,GAC1C,OAAO,gBAAgB,EACvB,MAAM,SAAS,EACf,KAAK,MAAM,KACT,iBA0EF,CAAC"}
+{"version":3,"file":"daemon_token_middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/daemon_token_middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAYtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAIN,KAAK,gBAAgB,EACrB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,yBAAyB,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAEtF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,eAAO,MAAM,8BAA8B,GAC1C,OAAO,gBAAgB,EACvB,MAAM,SAAS,EACf,KAAK,MAAM,KACT,iBA6EF,CAAC"}

package/dist/auth/daemon_token_middleware.js

@@ -14,7 +14,7 @@
  * @module
  */
 import { DEV } from 'esm-env';
-import { ACCOUNT_ID_KEY, AUTH_API_TOKEN_ID_KEY, CREDENTIAL_TYPE_KEY, TOKEN_SCOPE_KEY } from '../hono_context.js';
+import { ACCOUNT_ID_KEY, AUTH_API_TOKEN_ID_KEY, CREDENTIAL_DEADLINE_KEY, CREDENTIAL_TYPE_KEY, TOKEN_SCOPE_KEY } from '../hono_context.js';
 import { token_scope_full } from './token_scope.js';
 import { is_browser_context } from '../http/origin.js';
 import { query_role_grant_find_account_id_for_role } from './role_grant_queries.js';
@@ -141,6 +141,9 @@ export const create_daemon_token_middleware = (state, deps, log) => {
         // narrowing could have been chosen.
         c.set(TOKEN_SCOPE_KEY, token_scope_full());
         c.set(AUTH_API_TOKEN_ID_KEY, null);
+        // No row, no expiry — and it overrides a session cookie sent beside it,
+        // whose deadline must not ride along.
+        c.set(CREDENTIAL_DEADLINE_KEY, null);
         await next();
     };
 };

package/dist/auth/middleware.d.ts

@@ -9,26 +9,36 @@
 import type { SessionOptions } from './session_cookie.js';
 import type { AppDeps } from './deps.js';
 import type { DaemonTokenState } from './daemon_token.js';
-import type { MiddlewareSpec } from '../http/middleware_spec.js';
+import type { MiddlewareCarveOut, MiddlewareSpec } from '../http/middleware_spec.js';
+import type { RouteSpec } from '../http/route_spec.js';
+/**
+ * The Hono path pattern the origin check mounts on — every path. A request to
+ * any route, the static fallback included, carrying a foreign `Origin` is
+ * refused; one with no `Origin` (a probe, a CLI client) passes. The only way
+ * out is a named carve-out with a reason (`AuthMiddlewareOptions.origin_carve_outs`).
+ * The Rust spine's `fuz_http::compose_stack` checks every route group the
+ * same way.
+ */
+export declare const ORIGIN_MIDDLEWARE_PATH = "*";
 /**
  * The Hono path pattern the auth middleware stack mounts on by default —
- * origin verification, session parsing, request context, bearer and daemon
- * token auth all run for the paths it matches, and no others.
+ * session parsing, request context, bearer and daemon token auth all run for
+ * the paths it matches, and no others (the origin check runs on every path,
+ * `ORIGIN_MIDDLEWARE_PATH`).
  *
  * `create_app_server` mounts the stack here, and refuses at assembly (via
  * `assert_endpoint_in_auth_scope`, which `create_test_app_surface_spec` also
  * runs) an `rpc_endpoints`, `ws_endpoints`, or bootstrap path the pattern does
  * not match (tested with `middleware_applies`, which follows Hono: `'/api/*'`
  * matches `/api` and everything under `/api/`): an endpoint outside it would
- * get no origin check or session parsing, so every call or upgrade would be
- * unauthenticated and any page could send it.
+ * get no session or bearer parsing, so every call or upgrade would be
+ * unauthenticated.
  */
 export declare const AUTH_MIDDLEWARE_PATH = "/api/*";
 /**
  * Throw when an endpoint path sits outside the auth middleware's scope
- * (`AUTH_MIDDLEWARE_PATH`) — there it would get no origin check and no
- * session or bearer parsing, so every call or upgrade would be
- * unauthenticated and any page could send it.
+ * (`AUTH_MIDDLEWARE_PATH`) — there it would get no session or bearer
+ * parsing, so every call or upgrade would be unauthenticated.
  * `middleware_applies` matches the way Hono matches the middleware's pattern.
  *
  * `create_app_server` calls it for every `rpc_endpoints` and `ws_endpoints`
@@ -41,6 +51,60 @@ export declare const AUTH_MIDDLEWARE_PATH = "/api/*";
  * @throws Error when `path` is outside `AUTH_MIDDLEWARE_PATH`
  */
 export declare const assert_endpoint_in_auth_scope: (option: "rpc_endpoints" | "ws_endpoints" | "bootstrap.route_prefix", path: string) => void;
+/**
+ * Throw when a route that reads or mints a credential sits outside the auth
+ * middleware's scope (`AUTH_MIDDLEWARE_PATH`). A route reads one when its
+ * `auth.account` is not `'none'`, or when it is marked `reads_credential` (a
+ * handler that reads the resolved account behind no gate: account status) —
+ * outside the scope no session or bearer parsing runs, so it would answer
+ * every caller as unauthenticated. A route
+ * mints one when it is marked `mints_credential` (login, signup, bootstrap) —
+ * outside the scope an origin carve-out could cover it
+ * (`assert_origin_carve_outs_valid` refuses one only inside), and a forged
+ * cross-site request to it is login CSRF.
+ *
+ * Account and signup route specs are relative and the consumer prefixes them,
+ * so this is what holds them inside the scope whatever prefix they get.
+ * `create_app_server` runs it over every route it registers, consumer and
+ * factory alike, and `create_test_app_surface_spec` does the same.
+ *
+ * @param route_specs - every route the server registers
+ * @throws Error naming the first route that reads or mints a credential outside `AUTH_MIDDLEWARE_PATH`
+ */
+export declare const assert_credential_routes_in_auth_scope: (route_specs: ReadonlyArray<RouteSpec>) => void;
+/**
+ * Throw unless every origin carve-out names a path and a reason, and stays
+ * off the auth middleware's scope: a path that starts with `/` (a Hono pattern
+ * like `/hooks/*` or `/health`), a non-blank reason — a carve-out is an
+ * argument someone wrote down, never an empty placeholder — and a pattern that
+ * matches nothing under `auth_path` (`middleware_paths_overlap`).
+ *
+ * The scope rule is what keeps a carve-out off every credentialed route.
+ * Assembly holds every route that reads a credential (`auth.account` not
+ * `'none'`, or `reads_credential`) or mints one (`mints_credential`: login,
+ * signup, bootstrap) inside
+ * `AUTH_MIDDLEWARE_PATH` (`assert_credential_routes_in_auth_scope`), and every
+ * RPC, WS, and bootstrap endpoint besides (`assert_endpoint_in_auth_scope`).
+ * The minting routes declare no auth but are what a forged cross-site request
+ * targets, so refusing by route `auth` would miss them; refusing by scope
+ * catches them. A route outside the scope reads no credential the auth
+ * middleware parses, and mints none, so a carve-out there removes no
+ * credentialed check.
+ *
+ * @param carve_outs - the carve-outs to check
+ * @param auth_path - the auth middleware's path pattern (default `AUTH_MIDDLEWARE_PATH`)
+ * @throws Error naming the first carve-out with no path, no reason, or a pattern overlapping `auth_path`
+ */
+export declare const assert_origin_carve_outs_valid: (carve_outs: ReadonlyArray<MiddlewareCarveOut>, auth_path?: string) => void;
+/**
+ * Copy origin carve-outs into a frozen array of frozen `{path, reason}`
+ * records, so a caller that mutates its own array or objects after assembly
+ * cannot change what was validated or what the check skips.
+ *
+ * @param carve_outs - the caller's carve-outs
+ * @returns the frozen copy
+ */
+export declare const freeze_origin_carve_outs: (carve_outs: ReadonlyArray<MiddlewareCarveOut>) => ReadonlyArray<MiddlewareCarveOut>;
 /**
  * Throw unless a middleware list still mounts every spec of the stack it was
  * built from — the trusted-proxy spec and the auth middleware — exactly once,
@@ -77,21 +141,35 @@ export declare const assert_middleware_stack_mounted: (stack_specs: ReadonlyArra
 export interface AuthMiddlewareOptions {
     allowed_origins: Array<RegExp>;
     session_options: SessionOptions<string>;
-    /** Path pattern for middleware (default: `AUTH_MIDDLEWARE_PATH`, `'/api/*'`). */
+    /**
+     * Path pattern for the session, request-context, bearer, and daemon-token
+     * layers (default: `AUTH_MIDDLEWARE_PATH`, `'/api/*'`). The origin check
+     * always mounts on every path (`ORIGIN_MIDDLEWARE_PATH`).
+     */
     path?: string;
+    /**
+     * Paths the origin check skips, each with its reason (default none). Copied
+     * at assembly (`freeze_origin_carve_outs`), then checked by
+     * `assert_origin_carve_outs_valid` — none may overlap `path`; recorded on
+     * the origin spec, so the generated surface leaves the check's `403` off
+     * the carved-out routes.
+     */
+    origin_carve_outs?: ReadonlyArray<MiddlewareCarveOut>;
     /** Daemon token state for keeper auth. Omit to disable daemon token middleware. */
     daemon_token_state?: DaemonTokenState;
 }
 /**
  * Create the auth middleware stack.
  *
- * Returns `[origin, session, request_context, bearer_auth]` middleware specs
- * for the given path pattern. When `daemon_token_state` is provided, appends
+ * Returns `[origin, session, request_context, bearer_auth]` middleware specs:
+ * the origin check on every path less its carve-outs, the rest for the given
+ * path pattern. When `daemon_token_state` is provided, appends
  * a `daemon_token` layer. Apps can append extra entries for non-standard
  * paths (e.g., tx's `/tx` binary endpoint).
  *
  * @param deps - stateless capabilities (keyring, db)
- * @param options - middleware configuration (allowed_origins, session_options, path, daemon_token_state)
+ * @param options - middleware configuration (allowed_origins, session_options, path, daemon_token_state, origin_carve_outs)
+ * @throws Error when an origin carve-out has no path or no reason, or overlaps `path`
  * @returns the middleware spec array
  */
 export declare const create_auth_middleware_specs: (deps: AppDeps, options: AuthMiddlewareOptions) => Promise<Array<MiddlewareSpec>>;

package/dist/auth/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAIjE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,6BAA6B,GACzC,QAAQ,eAAe,GAAG,cAAc,GAAG,wBAAwB,EACnE,MAAM,MAAM,KACV,IAQF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,+BAA+B,GAC3C,aAAa,aAAa,CAAC,cAAc,CAAC,EAC1C,kBAAkB,aAAa,CAAC,cAAc,CAAC,KAC7C,IA+BF,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;CACtC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CA4E/B,CAAC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACrF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAIvD;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,6BAA6B,GACzC,QAAQ,eAAe,GAAG,cAAc,GAAG,wBAAwB,EACnE,MAAM,MAAM,KACV,IAQF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,sCAAsC,GAClD,aAAa,aAAa,CAAC,SAAS,CAAC,KACnC,IAcF,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,8BAA8B,GAC1C,YAAY,aAAa,CAAC,kBAAkB,CAAC,EAC7C,YAAW,MAA6B,KACtC,IAsBF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,GACpC,YAAY,aAAa,CAAC,kBAAkB,CAAC,KAC3C,aAAa,CAAC,kBAAkB,CACkD,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,+BAA+B,GAC3C,aAAa,aAAa,CAAC,cAAc,CAAC,EAC1C,kBAAkB,aAAa,CAAC,cAAc,CAAC,KAC7C,IA+BF,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;IACtD,mFAAmF;IACnF,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;CACtC;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAgF/B,CAAC"}

package/dist/auth/middleware.js

@@ -7,26 +7,35 @@
  * @module
  */
 import { ApiError } from '../http/error_schemas.js';
-import { middleware_applies } from '../http/schema_helpers.js';
+import { middleware_applies, middleware_paths_overlap } from '../http/schema_helpers.js';
+/**
+ * The Hono path pattern the origin check mounts on — every path. A request to
+ * any route, the static fallback included, carrying a foreign `Origin` is
+ * refused; one with no `Origin` (a probe, a CLI client) passes. The only way
+ * out is a named carve-out with a reason (`AuthMiddlewareOptions.origin_carve_outs`).
+ * The Rust spine's `fuz_http::compose_stack` checks every route group the
+ * same way.
+ */
+export const ORIGIN_MIDDLEWARE_PATH = '*';
 /**
  * The Hono path pattern the auth middleware stack mounts on by default —
- * origin verification, session parsing, request context, bearer and daemon
- * token auth all run for the paths it matches, and no others.
+ * session parsing, request context, bearer and daemon token auth all run for
+ * the paths it matches, and no others (the origin check runs on every path,
+ * `ORIGIN_MIDDLEWARE_PATH`).
  *
  * `create_app_server` mounts the stack here, and refuses at assembly (via
  * `assert_endpoint_in_auth_scope`, which `create_test_app_surface_spec` also
  * runs) an `rpc_endpoints`, `ws_endpoints`, or bootstrap path the pattern does
  * not match (tested with `middleware_applies`, which follows Hono: `'/api/*'`
  * matches `/api` and everything under `/api/`): an endpoint outside it would
- * get no origin check or session parsing, so every call or upgrade would be
- * unauthenticated and any page could send it.
+ * get no session or bearer parsing, so every call or upgrade would be
+ * unauthenticated.
  */
 export const AUTH_MIDDLEWARE_PATH = '/api/*';
 /**
  * Throw when an endpoint path sits outside the auth middleware's scope
- * (`AUTH_MIDDLEWARE_PATH`) — there it would get no origin check and no
- * session or bearer parsing, so every call or upgrade would be
- * unauthenticated and any page could send it.
+ * (`AUTH_MIDDLEWARE_PATH`) — there it would get no session or bearer
+ * parsing, so every call or upgrade would be unauthenticated.
  * `middleware_applies` matches the way Hono matches the middleware's pattern.
  *
  * `create_app_server` calls it for every `rpc_endpoints` and `ws_endpoints`
@@ -41,10 +50,94 @@ export const AUTH_MIDDLEWARE_PATH = '/api/*';
 export const assert_endpoint_in_auth_scope = (option, path) => {
     if (!middleware_applies(AUTH_MIDDLEWARE_PATH, path)) {
         throw new Error(`${option} path ${path} is outside the auth middleware's scope ` +
-            `(${AUTH_MIDDLEWARE_PATH}) — it would skip the origin check and see every caller ` +
-            `as unauthenticated — mount it under /api/`);
+            `(${AUTH_MIDDLEWARE_PATH}) — it would see every caller as unauthenticated — ` +
+            `mount it under /api/`);
     }
 };
+/**
+ * Throw when a route that reads or mints a credential sits outside the auth
+ * middleware's scope (`AUTH_MIDDLEWARE_PATH`). A route reads one when its
+ * `auth.account` is not `'none'`, or when it is marked `reads_credential` (a
+ * handler that reads the resolved account behind no gate: account status) —
+ * outside the scope no session or bearer parsing runs, so it would answer
+ * every caller as unauthenticated. A route
+ * mints one when it is marked `mints_credential` (login, signup, bootstrap) —
+ * outside the scope an origin carve-out could cover it
+ * (`assert_origin_carve_outs_valid` refuses one only inside), and a forged
+ * cross-site request to it is login CSRF.
+ *
+ * Account and signup route specs are relative and the consumer prefixes them,
+ * so this is what holds them inside the scope whatever prefix they get.
+ * `create_app_server` runs it over every route it registers, consumer and
+ * factory alike, and `create_test_app_surface_spec` does the same.
+ *
+ * @param route_specs - every route the server registers
+ * @throws Error naming the first route that reads or mints a credential outside `AUTH_MIDDLEWARE_PATH`
+ */
+export const assert_credential_routes_in_auth_scope = (route_specs) => {
+    for (const spec of route_specs) {
+        const reads = spec.auth.account !== 'none' || spec.reads_credential === true;
+        if (!reads && !spec.mints_credential)
+            continue;
+        if (middleware_applies(AUTH_MIDDLEWARE_PATH, spec.path))
+            continue;
+        throw new Error(`route ${spec.method} ${spec.path} ${reads ? 'reads' : 'mints'} a credential but is ` +
+            `outside the auth middleware's scope (${AUTH_MIDDLEWARE_PATH}) — ` +
+            (reads
+                ? 'it would see every caller as unauthenticated'
+                : 'an origin carve-out could leave it open to cross-site requests') +
+            ' — mount it under /api/');
+    }
+};
+/**
+ * Throw unless every origin carve-out names a path and a reason, and stays
+ * off the auth middleware's scope: a path that starts with `/` (a Hono pattern
+ * like `/hooks/*` or `/health`), a non-blank reason — a carve-out is an
+ * argument someone wrote down, never an empty placeholder — and a pattern that
+ * matches nothing under `auth_path` (`middleware_paths_overlap`).
+ *
+ * The scope rule is what keeps a carve-out off every credentialed route.
+ * Assembly holds every route that reads a credential (`auth.account` not
+ * `'none'`, or `reads_credential`) or mints one (`mints_credential`: login,
+ * signup, bootstrap) inside
+ * `AUTH_MIDDLEWARE_PATH` (`assert_credential_routes_in_auth_scope`), and every
+ * RPC, WS, and bootstrap endpoint besides (`assert_endpoint_in_auth_scope`).
+ * The minting routes declare no auth but are what a forged cross-site request
+ * targets, so refusing by route `auth` would miss them; refusing by scope
+ * catches them. A route outside the scope reads no credential the auth
+ * middleware parses, and mints none, so a carve-out there removes no
+ * credentialed check.
+ *
+ * @param carve_outs - the carve-outs to check
+ * @param auth_path - the auth middleware's path pattern (default `AUTH_MIDDLEWARE_PATH`)
+ * @throws Error naming the first carve-out with no path, no reason, or a pattern overlapping `auth_path`
+ */
+export const assert_origin_carve_outs_valid = (carve_outs, auth_path = AUTH_MIDDLEWARE_PATH) => {
+    for (const carve_out of carve_outs) {
+        if (!carve_out.path.startsWith('/')) {
+            throw new Error(`origin carve-out path ${JSON.stringify(carve_out.path)} must start with / ` +
+                '(a Hono pattern like /hooks/* or /health)');
+        }
+        if (carve_out.reason.trim() === '') {
+            throw new Error(`origin carve-out ${carve_out.path} needs a reason — say why the paths are safe ` +
+                'without the origin check');
+        }
+        if (middleware_paths_overlap(carve_out.path, auth_path)) {
+            throw new Error(`origin carve-out ${carve_out.path} overlaps the auth middleware's scope ` +
+                `(${auth_path}) — the routes there read or mint credentials and always take ` +
+                'the origin check; carve out a path outside it');
+        }
+    }
+};
+/**
+ * Copy origin carve-outs into a frozen array of frozen `{path, reason}`
+ * records, so a caller that mutates its own array or objects after assembly
+ * cannot change what was validated or what the check skips.
+ *
+ * @param carve_outs - the caller's carve-outs
+ * @returns the frozen copy
+ */
+export const freeze_origin_carve_outs = (carve_outs) => Object.freeze(carve_outs.map(({ path, reason }) => Object.freeze({ path, reason })));
 /**
  * Throw unless a middleware list still mounts every spec of the stack it was
  * built from — the trusted-proxy spec and the auth middleware — exactly once,
@@ -107,18 +200,23 @@ export const assert_middleware_stack_mounted = (stack_specs, middleware_specs) =
 /**
  * Create the auth middleware stack.
  *
- * Returns `[origin, session, request_context, bearer_auth]` middleware specs
- * for the given path pattern. When `daemon_token_state` is provided, appends
+ * Returns `[origin, session, request_context, bearer_auth]` middleware specs:
+ * the origin check on every path less its carve-outs, the rest for the given
+ * path pattern. When `daemon_token_state` is provided, appends
  * a `daemon_token` layer. Apps can append extra entries for non-standard
  * paths (e.g., tx's `/tx` binary endpoint).
  *
  * @param deps - stateless capabilities (keyring, db)
- * @param options - middleware configuration (allowed_origins, session_options, path, daemon_token_state)
+ * @param options - middleware configuration (allowed_origins, session_options, path, daemon_token_state, origin_carve_outs)
+ * @throws Error when an origin carve-out has no path or no reason, or overlaps `path`
  * @returns the middleware spec array
  */
 export const create_auth_middleware_specs = async (deps, options) => {
     const { keyring, db } = deps;
     const { allowed_origins, session_options, path = AUTH_MIDDLEWARE_PATH, daemon_token_state } = options;
+    // copied before it is checked, so what is checked is what runs
+    const origin_carve_outs = freeze_origin_carve_outs(options.origin_carve_outs ?? []);
+    assert_origin_carve_outs_valid(origin_carve_outs, path);
     const query_deps = { db };
     // Dynamic imports preserve the bundle-split for type-only consumers of
     // this module (`MiddlewareSpec`, `AuthMiddlewareOptions`, etc.). The
@@ -137,9 +235,10 @@ export const create_auth_middleware_specs = async (deps, options) => {
     const specs = [
         {
             name: 'origin',
-            path,
-            handler: verify_request_source(allowed_origins),
-            errors: { 403: ApiError }
+            path: ORIGIN_MIDDLEWARE_PATH,
+            handler: verify_request_source(allowed_origins, origin_carve_outs),
+            errors: { 403: ApiError },
+            ...(origin_carve_outs.length > 0 && { carve_outs: origin_carve_outs })
         },
         { name: 'session', path, handler: session_middleware },
         { name: 'request_context', path, handler: request_context_middleware },

package/dist/auth/request_context.d.ts

@@ -222,7 +222,9 @@ export declare const resolve_acting_actor: (deps: QueryDeps, account_id: string,
  *
  * Reads the session identity (set by session middleware), looks up the
  * `auth_session`, and on a valid session sets `c.var.auth_account_id`,
- * `CREDENTIAL_TYPE_KEY = 'session'`, and `AUTH_SESSION_TOKEN_HASH_KEY`.
+ * `CREDENTIAL_TYPE_KEY = 'session'`, `AUTH_SESSION_TOKEN_HASH_KEY`, and
+ * `CREDENTIAL_DEADLINE_KEY` — the earlier of the cookie's signed expiry
+ * (`SESSION_COOKIE_EXPIRES_AT_KEY`) and the row's.
  * Touches the session (fire-and-forget). Does not load actor or role_grants;
  * `REQUEST_CONTEXT_KEY` is left null — the route-spec / RPC dispatcher
  * authorization phase resolves the acting actor and builds the full
@@ -233,7 +235,7 @@ export declare const resolve_acting_actor: (deps: QueryDeps, account_id: string,
  *
  * @param deps - query dependencies (pool-level db for middleware)
  * @param session_context_key - the Hono context key where session middleware stored the session token
- * @mutates Hono context - sets `ACCOUNT_ID_KEY`, `CREDENTIAL_TYPE_KEY`, `AUTH_SESSION_TOKEN_HASH_KEY`, and `AUTH_API_TOKEN_ID_KEY`
+ * @mutates Hono context - sets `ACCOUNT_ID_KEY`, `CREDENTIAL_TYPE_KEY`, `AUTH_SESSION_TOKEN_HASH_KEY`, `AUTH_API_TOKEN_ID_KEY`, and `CREDENTIAL_DEADLINE_KEY`
  */
 export declare const create_request_context_middleware: (deps: QueryDeps, session_context_key?: string) => MiddlewareHandler;
 /**

package/dist/auth/request_context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request_context.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/request_context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAEvD,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,KAAK,EAEV,KAAK,SAAS,EACd,MAAM,qBAAqB,CAAC;AAQ7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAgBrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAA6C,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElG,OAAO,EAIN,oBAAoB,EACpB,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,EACtB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;CAC9B;AAED,0DAA0D;AAC1D,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,GAAG,OAAO,KAAG,cAAc,GAAG,IAEjE,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,GAAI,GAAG,OAAO,KAAG,cAQpD,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAoB,SAAQ,cAAc;IAC1D,KAAK,EAAE,KAAK,CAAC;CACb;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,QAAQ,GACpB,KAAK,cAAc,GAAG,IAAI,EAC1B,MAAM,MAAM,EACZ,MAAK,IAAiB,KACpB,OACoF,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,eAAe,GAC3B,KAAK,cAAc,GAAG,IAAI,EAC1B,MAAM,MAAM,EACZ,UAAU,MAAM,GAAG,IAAI,EACvB,MAAK,IAAiB,KACpB,OAKF,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,cAAc,GAAG,IAAI,EAC1B,OAAO,aAAa,CAAC,MAAM,CAAC,EAC5B,UAAU,MAAM,GAAG,IAAI,EACvB,MAAK,IAAiB,KACpB,OAMF,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAClC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,SAAS,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GACvF;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,iBAAiB,MAAM,GAAG,SAAS,KACjC,OAAO,CAAC,wBAAwB,CAclC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iCAAiC,GAC7C,MAAM,SAAS,EACf,4BAAuC,KACrC,iBA6BF,CAAC;AAuBF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,0BAA0B,GAAI,GAAG,OAAO,EAAE,YAAY,MAAM,KAAG,QAAQ,GAAG,IAChC,CAAC;AAExD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,GAAI,YAAY,MAAM,KAAG,iBAYxD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,iBAK1B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,aAAa,CAAC,MAAM,CAAC,KAAG,iBAW3D,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,wBAAwB,GACpC,kBAAkB,aAAa,CAAC,MAAM,CAAC,KACrC,iBAiBF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,cAAc,EACnB,MAAM,SAAS,KACb,OAAO,CAAC,cAAc,CAQxB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,UAAU,MAAM,KACd,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAUpC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,cAAc,GAAG,IAAI,CAI/B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,wBAAwB,GACjC;IAAE,KAAK,EAAE,OAAO,oBAAoB,CAAC;IAAC,SAAS,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GACtF;IAAE,KAAK,EAAE,OAAO,0BAA0B,CAAA;CAAE,GAC5C;IAAE,KAAK,EAAE,OAAO,0BAA0B,CAAA;CAAE,GAC5C;IAAE,KAAK,EAAE,OAAO,sBAAsB,CAAA;CAAE,CAAC;AAE5C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,mBAAmB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,eAAe,EAAE,cAAc,GAAG,IAAI,CAAA;CAAE,GACpD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,IAAI,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,YAAY,MAAM,GAAG,IAAI,EACzB,MAAM,SAAS,EACf,cAAc,MAAM,GAAG,SAAS,KAC9B,OAAO,CAAC,mBAAmB,CAwC7B,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,KACb,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAoB5D,CAAC"}
+{"version":3,"file":"request_context.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/request_context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAEvD,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,KAAK,EAEV,KAAK,SAAS,EACd,MAAM,qBAAqB,CAAC;AAQ7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAmBrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAA6C,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElG,OAAO,EAIN,oBAAoB,EACpB,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,EACtB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;CAC9B;AAED,0DAA0D;AAC1D,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,4BAA4B,CAAC;AAErE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,GAAG,OAAO,KAAG,cAAc,GAAG,IAEjE,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,GAAI,GAAG,OAAO,KAAG,cAQpD,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAoB,SAAQ,cAAc;IAC1D,KAAK,EAAE,KAAK,CAAC;CACb;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,QAAQ,GACpB,KAAK,cAAc,GAAG,IAAI,EAC1B,MAAM,MAAM,EACZ,MAAK,IAAiB,KACpB,OACoF,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,eAAe,GAC3B,KAAK,cAAc,GAAG,IAAI,EAC1B,MAAM,MAAM,EACZ,UAAU,MAAM,GAAG,IAAI,EACvB,MAAK,IAAiB,KACpB,OAKF,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,cAAc,GAAG,IAAI,EAC1B,OAAO,aAAa,CAAC,MAAM,CAAC,EAC5B,UAAU,MAAM,GAAG,IAAI,EACvB,MAAK,IAAiB,KACpB,OAMF,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAClC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,SAAS,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GACvF;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,iBAAiB,MAAM,GAAG,SAAS,KACjC,OAAO,CAAC,wBAAwB,CAclC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,iCAAiC,GAC7C,MAAM,SAAS,EACf,4BAAuC,KACrC,iBAwCF,CAAC;AAuBF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,0BAA0B,GAAI,GAAG,OAAO,EAAE,YAAY,MAAM,KAAG,QAAQ,GAAG,IAChC,CAAC;AAExD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,GAAI,YAAY,MAAM,KAAG,iBAYxD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,iBAK1B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,aAAa,CAAC,MAAM,CAAC,KAAG,iBAW3D,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,wBAAwB,GACpC,kBAAkB,aAAa,CAAC,MAAM,CAAC,KACrC,iBAiBF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,GAC/B,KAAK,cAAc,EACnB,MAAM,SAAS,KACb,OAAO,CAAC,cAAc,CAQxB,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,UAAU,MAAM,KACd,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAUpC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qBAAqB,GACjC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,cAAc,GAAG,IAAI,CAI/B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,wBAAwB,GACjC;IAAE,KAAK,EAAE,OAAO,oBAAoB,CAAC;IAAC,SAAS,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GACtF;IAAE,KAAK,EAAE,OAAO,0BAA0B,CAAA;CAAE,GAC5C;IAAE,KAAK,EAAE,OAAO,0BAA0B,CAAA;CAAE,GAC5C;IAAE,KAAK,EAAE,OAAO,sBAAsB,CAAA;CAAE,CAAC;AAE5C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,mBAAmB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,eAAe,EAAE,cAAc,GAAG,IAAI,CAAA;CAAE,GACpD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,IAAI,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,YAAY,MAAM,GAAG,IAAI,EACzB,MAAM,SAAS,EACf,cAAc,MAAM,GAAG,SAAS,KAC9B,OAAO,CAAC,mBAAmB,CAwC7B,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,KACb,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAoB5D,CAAC"}

package/dist/auth/request_context.js

@@ -38,7 +38,8 @@ import { is_role_grant_active } from './account_schema.js';
 import { hash_session_token, query_session_get_valid } from './session_queries.js';
 import { query_account_by_id, query_actor_by_id, query_active_actors_by_account } from './account_queries.js';
 import { query_role_grant_find_active_for_actor } from './role_grant_queries.js';
-import { ACCOUNT_ID_KEY, AUTH_API_TOKEN_ID_KEY, CREDENTIAL_TYPE_KEY, TOKEN_SCOPE_KEY, TEST_CONTEXT_PRESET_KEY } from '../hono_context.js';
+import { ACCOUNT_ID_KEY, AUTH_API_TOKEN_ID_KEY, CREDENTIAL_DEADLINE_KEY, CREDENTIAL_TYPE_KEY, SESSION_COOKIE_EXPIRES_AT_KEY, TOKEN_SCOPE_KEY, TEST_CONTEXT_PRESET_KEY } from '../hono_context.js';
+import { credential_deadline_after } from './credential_deadline.js';
 import { parse_token_scope_capability, token_scope_admits_capability, token_scope_denied_body, token_scope_full } from './token_scope.js';
 import { is_public_auth, needs_actor, parse_acting } from '../http/auth_shape.js';
 import { is_null_schema } from '../http/schema_helpers.js';
@@ -207,7 +208,9 @@ export const resolve_acting_actor = async (deps, account_id, acting_actor_id) =>
  *
  * Reads the session identity (set by session middleware), looks up the
  * `auth_session`, and on a valid session sets `c.var.auth_account_id`,
- * `CREDENTIAL_TYPE_KEY = 'session'`, and `AUTH_SESSION_TOKEN_HASH_KEY`.
+ * `CREDENTIAL_TYPE_KEY = 'session'`, `AUTH_SESSION_TOKEN_HASH_KEY`, and
+ * `CREDENTIAL_DEADLINE_KEY` — the earlier of the cookie's signed expiry
+ * (`SESSION_COOKIE_EXPIRES_AT_KEY`) and the row's.
  * Touches the session (fire-and-forget). Does not load actor or role_grants;
  * `REQUEST_CONTEXT_KEY` is left null — the route-spec / RPC dispatcher
  * authorization phase resolves the acting actor and builds the full
@@ -218,7 +221,7 @@ export const resolve_acting_actor = async (deps, account_id, acting_actor_id) =>
  *
  * @param deps - query dependencies (pool-level db for middleware)
  * @param session_context_key - the Hono context key where session middleware stored the session token
- * @mutates Hono context - sets `ACCOUNT_ID_KEY`, `CREDENTIAL_TYPE_KEY`, `AUTH_SESSION_TOKEN_HASH_KEY`, and `AUTH_API_TOKEN_ID_KEY`
+ * @mutates Hono context - sets `ACCOUNT_ID_KEY`, `CREDENTIAL_TYPE_KEY`, `AUTH_SESSION_TOKEN_HASH_KEY`, `AUTH_API_TOKEN_ID_KEY`, and `CREDENTIAL_DEADLINE_KEY`
  */
 export const create_request_context_middleware = (deps, session_context_key = 'auth_session_id') => {
     return async (c, next) => {
@@ -227,6 +230,7 @@ export const create_request_context_middleware = (deps, session_context_key = 'a
         c.set(CREDENTIAL_TYPE_KEY, null);
         c.set(AUTH_SESSION_TOKEN_HASH_KEY, null);
         c.set(AUTH_API_TOKEN_ID_KEY, null);
+        c.set(CREDENTIAL_DEADLINE_KEY, null);
         const session_token = c.get(session_context_key) ?? null;
         if (!session_token) {
             await next();
@@ -243,6 +247,13 @@ export const create_request_context_middleware = (deps, session_context_key = 'a
         // A session is full account authority by construction.
         c.set(TOKEN_SCOPE_KEY, token_scope_full());
         c.set(AUTH_SESSION_TOKEN_HASH_KEY, token_hash);
+        // The earlier of the signed cookie's expiry (this server's wall clock,
+        // which signed it) and the row's (read on the database clock).
+        const cookie_expires_at = c.get(SESSION_COOKIE_EXPIRES_AT_KEY) ?? null;
+        c.set(CREDENTIAL_DEADLINE_KEY, credential_deadline_after([
+            cookie_expires_at === null ? null : cookie_expires_at * 1000 - Date.now(),
+            session.expires_in_ms
+        ]));
         await next();
     };
 };

package/dist/auth/resolved_auth.d.ts

@@ -6,8 +6,8 @@
  * credential and leaves it on the Hono context as separate keys.
  * `ResolvedAuth` is that credential gathered into one value
  * (`get_resolved_auth`), so the connections that outlive their request — a
- * WebSocket, an SSE stream — can carry it past the handshake and re-read it
- * with `revalidate_resolved_auth`.
+ * WebSocket, an SSE stream — can carry it past the handshake, re-read it with
+ * `revalidate_resolved_auth`, and close at its `credential_deadline`.
  *
  * @module
  */
@@ -31,6 +31,17 @@ export interface ResolvedAuth {
     token_hash: string | null;
     /** `api_token.id` for a bearer credential, else `null`. */
     api_token_id: string | null;
+    /**
+     * When the credential stops authenticating, as a monotonic
+     * `performance.now()` timestamp — the moment a long-lived connection opened
+     * on it is closed (`schedule_credential_deadline`), since expiry writes
+     * nothing a revocation listener could hear. The earliest of what the
+     * credential carries: a session's cookie and row expiry, an API token's row
+     * expiry (`null` for an eternal one); `null` for the daemon token. A row's
+     * expiry is read as time remaining on the database clock
+     * (`auth/credential_deadline.ts`). The Rust twin's `credential_deadline`.
+     */
+    credential_deadline: number | null;
 }
 /**
  * Gather the credential the auth middleware resolved for this request.

package/dist/auth/resolved_auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolved_auth.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/resolved_auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAIN,KAAK,cAAc,EACnB,MAAM,oBAAoB,CAAC;AAM5B;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC5B,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,eAAe,EAAE,cAAc,CAAC;IAChC,+EAA+E;IAC/E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,2DAA2D;IAC3D,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAAI,GAAG,OAAO,KAAG,YAAY,GAAG,IAU7D,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,eAAO,MAAM,wBAAwB,GACpC,MAAM,SAAS,EACf,UAAU,YAAY,KACpB,OAAO,CAAC,OAAO,CAsBjB,CAAC"}
+{"version":3,"file":"resolved_auth.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/resolved_auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAKN,KAAK,cAAc,EACnB,MAAM,oBAAoB,CAAC;AAM5B;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC5B,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,eAAe,EAAE,cAAc,CAAC;IAChC,+EAA+E;IAC/E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,2DAA2D;IAC3D,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;;;;;;OASG;IACH,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAAI,GAAG,OAAO,KAAG,YAAY,GAAG,IAY7D,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,eAAO,MAAM,wBAAwB,GACpC,MAAM,SAAS,EACf,UAAU,YAAY,KACpB,OAAO,CAAC,OAAO,CAsBjB,CAAC"}