@fuzdev/fuz_app 0.140.0 → 0.141.0

package/dist/auth/resolved_auth.js

@@ -6,12 +6,12 @@
  * credential and leaves it on the Hono context as separate keys.
  * `ResolvedAuth` is that credential gathered into one value
  * (`get_resolved_auth`), so the connections that outlive their request — a
- * WebSocket, an SSE stream — can carry it past the handshake and re-read it
- * with `revalidate_resolved_auth`.
+ * WebSocket, an SSE stream — can carry it past the handshake, re-read it with
+ * `revalidate_resolved_auth`, and close at its `credential_deadline`.
  *
  * @module
  */
-import { ACCOUNT_ID_KEY, AUTH_API_TOKEN_ID_KEY, CREDENTIAL_TYPE_KEY } from '../hono_context.js';
+import { ACCOUNT_ID_KEY, AUTH_API_TOKEN_ID_KEY, CREDENTIAL_DEADLINE_KEY, CREDENTIAL_TYPE_KEY } from '../hono_context.js';
 import { query_account_by_id } from './account_queries.js';
 import { query_api_token_live_account } from './api_token_queries.js';
 import { AUTH_SESSION_TOKEN_HASH_KEY } from './request_context.js';
@@ -36,7 +36,8 @@ export const get_resolved_auth = (c) => {
         account_id,
         credential_type,
         token_hash: credential_type === 'session' ? (c.get(AUTH_SESSION_TOKEN_HASH_KEY) ?? null) : null,
-        api_token_id: credential_type === 'api_token' ? (c.get(AUTH_API_TOKEN_ID_KEY) ?? null) : null
+        api_token_id: credential_type === 'api_token' ? (c.get(AUTH_API_TOKEN_ID_KEY) ?? null) : null,
+        credential_deadline: credential_type === 'daemon_token' ? null : (c.get(CREDENTIAL_DEADLINE_KEY) ?? null)
     };
 };
 /**

package/dist/auth/session_cookie.d.ts

@@ -104,6 +104,8 @@ export interface ParsedSession<TIdentity> {
     identity: TIdentity;
     /** Index of the key that verified the signature (0 = primary). */
     key_index: number;
+    /** The signed expiry, in seconds since the Unix epoch — later than the parse. */
+    expires_at: number;
 }
 /**
  * Parse a signed session cookie value.
@@ -141,6 +143,8 @@ export interface ProcessSessionResult<TIdentity> {
     action: 'none' | 'clear';
     /** The decoded identity if the cookie was valid. */
     identity?: TIdentity;
+    /** The cookie's signed expiry, epoch seconds, if the cookie was valid. */
+    expires_at?: number;
 }
 /**
  * Create a session config for raw session token identity.

package/dist/auth/session_cookie.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session_cookie.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_cookie.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,QAAoB,CAAC;AAQjD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,oBAMpC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,WAAW,cAAc,CAAC,SAAS;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/D,iFAAiF;IACjF,eAAe,EAAE,CAAC,QAAQ,EAAE,SAAS,KAAK,MAAM,CAAC;IACjD,mEAAmE;IACnE,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,GAAG,IAAI,CAAC;CACvD;AAED;;GAEG;AACH,MAAM,WAAW,aAAa,CAAC,SAAS;IACvC,4BAA4B;IAC5B,QAAQ,EAAE,SAAS,CAAC;IACpB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,aAAa,GAAU,SAAS,EAC5C,cAAc,MAAM,GAAG,SAAS,EAChC,SAAS,OAAO,EAChB,SAAS,cAAc,CAAC,SAAS,CAAC,EAClC,cAAc,MAAM,KAClB,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,IAAI,GAAG,SAAS,CA+BrD,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B,GAAU,SAAS,EAC1D,SAAS,OAAO,EAChB,UAAU,SAAS,EACnB,SAAS,cAAc,CAAC,SAAS,CAAC,EAClC,cAAc,MAAM,KAClB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAoB,CAAC,SAAS;IAC9C,oCAAoC;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,sCAAsC;IACtC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,SAAS,CAAC;CACrB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,GAAI,aAAa,MAAM,KAAG,cAAc,CAAC,MAAM,CAK/E,CAAC;AAEH,iDAAiD;AACjD,eAAO,MAAM,kBAAkB,EAAE,cAAc,CAAC,MAAM,CAAwC,CAAC;AAE/F;;;;;;;;;;;;;;;;;GAiBG;AAEH,eAAO,MAAM,sBAAsB,GAAU,SAAS,EACrD,cAAc,MAAM,GAAG,SAAS,EAChC,SAAS,OAAO,EAChB,SAAS,cAAc,CAAC,SAAS,CAAC,EAClC,cAAc,MAAM,KAClB,OAAO,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAgBzC,CAAC"}
+{"version":3,"file":"session_cookie.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_cookie.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,QAAoB,CAAC;AAQjD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,EAAE,oBAMpC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,WAAW,cAAc,CAAC,SAAS;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/D,iFAAiF;IACjF,eAAe,EAAE,CAAC,QAAQ,EAAE,SAAS,KAAK,MAAM,CAAC;IACjD,mEAAmE;IACnE,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,GAAG,IAAI,CAAC;CACvD;AAED;;GAEG;AACH,MAAM,WAAW,aAAa,CAAC,SAAS;IACvC,4BAA4B;IAC5B,QAAQ,EAAE,SAAS,CAAC;IACpB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,UAAU,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,aAAa,GAAU,SAAS,EAC5C,cAAc,MAAM,GAAG,SAAS,EAChC,SAAS,OAAO,EAChB,SAAS,cAAc,CAAC,SAAS,CAAC,EAClC,cAAc,MAAM,KAClB,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,IAAI,GAAG,SAAS,CAgCrD,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B,GAAU,SAAS,EAC1D,SAAS,OAAO,EAChB,UAAU,SAAS,EACnB,SAAS,cAAc,CAAC,SAAS,CAAC,EAClC,cAAc,MAAM,KAClB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAoB,CAAC,SAAS;IAC9C,oCAAoC;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,sCAAsC;IACtC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,GAAI,aAAa,MAAM,KAAG,cAAc,CAAC,MAAM,CAK/E,CAAC;AAEH,iDAAiD;AACjD,eAAO,MAAM,kBAAkB,EAAE,cAAc,CAAC,MAAM,CAAwC,CAAC;AAE/F;;;;;;;;;;;;;;;;;GAiBG;AAEH,eAAO,MAAM,sBAAsB,GAAU,SAAS,EACrD,cAAc,MAAM,GAAG,SAAS,EAChC,SAAS,OAAO,EAChB,SAAS,cAAc,CAAC,SAAS,CAAC,EAClC,cAAc,MAAM,KAClB,OAAO,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAgBzC,CAAC"}

package/dist/auth/session_cookie.js

@@ -78,7 +78,8 @@ export const parse_session = async (signed_value, keyring, options, now_seconds)
         return null;
     return {
         identity,
-        key_index: result.key_index
+        key_index: result.key_index,
+        expires_at
     };
 };
 /**
@@ -147,5 +148,5 @@ export const process_session_cookie = async (signed_value, keyring, options, now
         // Invalid cookie - should be cleared
         return { valid: false, action: 'clear' };
     }
-    return { valid: true, action: 'none', identity: parsed.identity };
+    return { valid: true, action: 'none', identity: parsed.identity, expires_at: parsed.expires_at };
 };

package/dist/auth/session_middleware.d.ts

@@ -35,7 +35,7 @@ export declare const clear_session_cookie: <T>(c: Context, options: SessionOptio
  *
  * @param keyring - key ring for cookie verification
  * @param options - session configuration
- * @mutates Hono context - sets `options.context_key` and may clear the session cookie
+ * @mutates Hono context - sets `options.context_key` and `SESSION_COOKIE_EXPIRES_AT_KEY`, and may clear the session cookie
  */
 export declare const create_session_middleware: <TIdentity>(keyring: Keyring, options: SessionOptions<TIdentity>) => MiddlewareHandler;
 /**

package/dist/auth/session_middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session_middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAGvD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACN,KAAK,cAAc,EAKnB,MAAM,qBAAqB,CAAC;AAQ7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD;;GAEG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,EACnC,GAAG,OAAO,EACV,SAAS,cAAc,CAAC,CAAC,CAAC,KACxB,MAAM,GAAG,SAEX,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,EACnC,GAAG,OAAO,EACV,OAAO,MAAM,EACb,SAAS,cAAc,CAAC,CAAC,CAAC,KACxB,IAOF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,cAAc,CAAC,CAAC,CAAC,KAAG,IAMhF,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,EAClD,SAAS,OAAO,EAChB,SAAS,cAAc,CAAC,SAAS,CAAC,KAChC,iBAcF,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAChD,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,IAAI,EAAE,SAAS,CAAC;IAChB,2CAA2C;IAC3C,CAAC,EAAE,OAAO,CAAC;IACX,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,gCAAgC,KACvC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAavB,CAAC"}
+{"version":3,"file":"session_middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAGvD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACN,KAAK,cAAc,EAKnB,MAAM,qBAAqB,CAAC;AAQ7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGrD;;GAEG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,EACnC,GAAG,OAAO,EACV,SAAS,cAAc,CAAC,CAAC,CAAC,KACxB,MAAM,GAAG,SAEX,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,EACnC,GAAG,OAAO,EACV,OAAO,MAAM,EACb,SAAS,cAAc,CAAC,CAAC,CAAC,KACxB,IAOF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,cAAc,CAAC,CAAC,CAAC,KAAG,IAMhF,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,GAAI,SAAS,EAClD,SAAS,OAAO,EAChB,SAAS,cAAc,CAAC,SAAS,CAAC,KAChC,iBAgBF,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAChD,kCAAkC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,IAAI,EAAE,SAAS,CAAC;IAChB,2CAA2C;IAC3C,CAAC,EAAE,OAAO,CAAC;IACX,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,6BAA6B,GACzC,SAAS,gCAAgC,KACvC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAavB,CAAC"}

package/dist/auth/session_middleware.js

@@ -7,6 +7,7 @@
 import { getCookie, setCookie, deleteCookie } from 'hono/cookie';
 import { session_cookie_options, process_session_cookie, create_session_cookie_value } from './session_cookie.js';
 import { generate_session_token, hash_session_token, AUTH_SESSION_LIFETIME_MS, query_create_session, query_session_enforce_limit } from './session_queries.js';
+import { SESSION_COOKIE_EXPIRES_AT_KEY } from '../hono_context.js';
 /**
  * Read the session cookie value from a request.
  */
@@ -49,7 +50,7 @@ export const clear_session_cookie = (c, options) => {
  *
  * @param keyring - key ring for cookie verification
  * @param options - session configuration
- * @mutates Hono context - sets `options.context_key` and may clear the session cookie
+ * @mutates Hono context - sets `options.context_key` and `SESSION_COOKIE_EXPIRES_AT_KEY`, and may clear the session cookie
  */
 export const create_session_middleware = (keyring, options) => {
     return async (c, next) => {
@@ -57,6 +58,8 @@ export const create_session_middleware = (keyring, options) => {
         const result = await process_session_cookie(signed_value, keyring, options);
         // Always set identity (null when invalid/missing) for type-safe reads
         c.set(options.context_key, result.identity ?? null);
+        // the signed expiry rides beside it, for the credential deadline
+        c.set(SESSION_COOKIE_EXPIRES_AT_KEY, result.expires_at ?? null);
         if (result.action === 'clear') {
             clear_session_cookie(c, options);
         }

package/dist/auth/session_queries.d.ts

@@ -55,12 +55,29 @@ export declare const query_create_session: (deps: QueryDeps, token_hash: string,
  */
 export declare const AUTH_SESSION_COLUMNS: readonly ["id", "account_id", "created_at", "expires_at"];
 /**
- * Get a session if it exists, is not expired, and has not been revoked.
+ * A live `auth_session` row as `query_session_get_valid` returns it, with how
+ * long it has left.
+ */
+export interface ValidAuthSession extends AuthSession {
+    /**
+     * Milliseconds until the session expires — `expires_at - NOW()`, measured on
+     * the database clock in the statement that found it unexpired
+     * (`EXPIRES_IN_MS_SQL`).
+     */
+    expires_in_ms: number;
+}
+/**
+ * Get a session if it exists, is not expired, and has not been revoked, with
+ * how long it has left.
+ *
+ * The remaining lifetime is read in the same statement that checks the
+ * expiry, on the database clock, so it agrees with the check whatever the
+ * server's clock says (`auth/credential_deadline.ts`).
  *
  * @param deps - query dependencies
  * @param token_hash - blake3 hash of the session token
  */
-export declare const query_session_get_valid: (deps: QueryDeps, token_hash: string) => Promise<AuthSession | undefined>;
+export declare const query_session_get_valid: (deps: QueryDeps, token_hash: string) => Promise<ValidAuthSession | undefined>;
 /**
  * Revoke (delete) a session by its token hash, with no account scoping.
  *

package/dist/auth/session_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAA2B,CAAC;AAEjE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,KAAG,SAElD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAAO,MAEzC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,EAClB,YAAY,IAAI,KACd,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,2DAKoB,CAAC;AAQtD;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,WAAW,GAAG,SAAS,CAKjC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,IAAI,CAEd,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,KAChB,OAAO,CAAC,OAAO,CAMjB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAU,KACR,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAK5B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,eAAO,MAAM,2BAA2B,GACvC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAc,MAAM,KAClB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAYvB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,cAAW,KACT,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CASnD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,6BAA6B,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAK1F,CAAC"}
+{"version":3,"file":"session_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/session_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGlE;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAA2B,CAAC;AAEjE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,MAAM,KAAG,SAElD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,QAAO,MAEzC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,EAClB,YAAY,IAAI,KACd,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,2DAKoB,CAAC;AAQtD;;;GAGG;AACH,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACpD;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAKtC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qCAAqC,GACjD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,IAAI,CAEd,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,YAAY,MAAM,KAChB,OAAO,CAAC,OAAO,CAMjB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,MAAM,CAMhB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAU,KACR,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAK5B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,eAAO,MAAM,2BAA2B,GACvC,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,cAAc,MAAM,KAClB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAYvB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,cAAW,KACT,OAAO,CAAC,KAAK,CAAC,WAAW,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CASnD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,6BAA6B,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAK1F,CAAC"}

package/dist/auth/session_queries.js

@@ -9,6 +9,7 @@
 import { hash_blake3 } from '@fuzdev/fuz_util/hash_blake3.ts';
 import { generate_random_base64url } from '../crypto.js';
 import { columns_sql, iso8601_timestamp_expr, qualify_columns } from '../db/sql_columns.js';
+import { EXPIRES_IN_MS_SQL } from './credential_deadline.js';
 /**
  * Session lifetime in milliseconds (30 days).
  *
@@ -76,13 +77,18 @@ const auth_session_expr = iso8601_timestamp_expr(AUTH_SESSION_COLUMNS, [
     'expires_at'
 ]);
 /**
- * Get a session if it exists, is not expired, and has not been revoked.
+ * Get a session if it exists, is not expired, and has not been revoked, with
+ * how long it has left.
+ *
+ * The remaining lifetime is read in the same statement that checks the
+ * expiry, on the database clock, so it agrees with the check whatever the
+ * server's clock says (`auth/credential_deadline.ts`).
  *
  * @param deps - query dependencies
  * @param token_hash - blake3 hash of the session token
  */
 export const query_session_get_valid = async (deps, token_hash) => {
-    return deps.db.query_one(`SELECT ${columns_sql(AUTH_SESSION_COLUMNS, auth_session_expr(''))} FROM auth_session WHERE id = $1 AND expires_at > NOW()`, [token_hash]);
+    return deps.db.query_one(`SELECT ${columns_sql(AUTH_SESSION_COLUMNS, auth_session_expr(''))}, ${EXPIRES_IN_MS_SQL} AS expires_in_ms FROM auth_session WHERE id = $1 AND expires_at > NOW()`, [token_hash]);
 };
 /**
  * Revoke (delete) a session by its token hash, with no account scoping.

package/dist/auth/signup_route_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signup_route_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/signup_route_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAQvD,wHAAwH;AACxH,eAAO,MAAM,WAAW;;;;kBAItB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;GAMG;AACH,eAAO,MAAM,YAAY;;;;;;;;;kBAIvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,4EAA4E;AAC5E,MAAM,WAAW,uBAAuB;IACvC,iFAAiF;IACjF,2BAA2B,EAAE,OAAO,CAAC;CACrC;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,GACrC,SAAS,uBAAuB,KAC9B,IAAI,CAAC,SAAS,EAAE,SAAS,CAgB1B,CAAC"}
+{"version":3,"file":"signup_route_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/signup_route_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAQvD,wHAAwH;AACxH,eAAO,MAAM,WAAW;;;;kBAItB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;GAMG;AACH,eAAO,MAAM,YAAY;;;;;;;;;kBAIvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,4EAA4E;AAC5E,MAAM,WAAW,uBAAuB;IACvC,iFAAiF;IACjF,2BAA2B,EAAE,OAAO,CAAC;CACrC;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,GACrC,SAAS,uBAAuB,KAC9B,IAAI,CAAC,SAAS,EAAE,SAAS,CAiB1B,CAAC"}

package/dist/auth/signup_route_schema.js

@@ -43,6 +43,7 @@ export const create_signup_route_shape = (options) => ({
     method: 'POST',
     path: '/signup',
     auth: { account: 'none', actor: 'none' },
+    mints_credential: true,
     description: 'Create account (invite-gated or open signup)',
     transaction: false, // manages its own transaction for TOCTOU safety
     input: SignupInput,

package/dist/hono_context.d.ts

@@ -57,6 +57,25 @@ export declare const TOKEN_SCOPE_KEY = "token_scope";
  * read it directly.
  */
 export declare const ACCOUNT_ID_KEY = "auth_account_id";
+/**
+ * Hono context variable name for the credential's deadline — when it stops
+ * authenticating, as a monotonic `performance.now()` timestamp
+ * (`auth/credential_deadline.ts`), or `null` for one with no expiry (a daemon
+ * token, an eternal API token) and for an unauthenticated request.
+ *
+ * Set by every auth middleware that resolves a credential: session (the
+ * earlier of the signed cookie's expiry and the row's), bearer (the row's),
+ * daemon token (`null`). A long-lived connection opened on the credential
+ * closes at it (`ResolvedAuth.credential_deadline`).
+ */
+export declare const CREDENTIAL_DEADLINE_KEY = "credential_deadline";
+/**
+ * Hono context variable name for the session cookie's signed expiry, in
+ * seconds since the Unix epoch — set by the session middleware on a cookie
+ * that verified and has not expired, `null` otherwise. The request-context
+ * middleware folds it into `CREDENTIAL_DEADLINE_KEY`.
+ */
+export declare const SESSION_COOKIE_EXPIRES_AT_KEY = "auth_session_cookie_expires_at";
 /**
  * Hono context variable name for the test-harness pre-baked context flag.
  *
@@ -112,6 +131,10 @@ declare module 'hono' {
          * up the token.
          */
         auth_api_token_id: string | null;
+        /** The credential's deadline (`CREDENTIAL_DEADLINE_KEY`). */
+        credential_deadline: number | null;
+        /** The session cookie's signed expiry, epoch seconds (`SESSION_COOKIE_EXPIRES_AT_KEY`). */
+        auth_session_cookie_expires_at: number | null;
         /**
          * Eager fire-and-forget pool writes for this request — audit emits,
          * session-touch UPDATE, api-token usage tracking. Producers push the

package/dist/hono_context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hono_context.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/hono_context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAOhE;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,mDAInB,CAAC;AAEX,yDAAyD;AACzD,eAAO,MAAM,cAAc;;;;EAA2B,CAAC;AACvD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,0DAA0D;AAC1D,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAE7C;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,oBAAoB,CAAC;AAEhD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D,OAAO,QAAQ,MAAM,CAAC;IACrB,UAAU,kBAAkB;QAC3B,+DAA+D;QAC/D,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,eAAe,EAAE,cAAc,GAAG,IAAI,CAAC;QACvC,eAAe,EAAE,OAAO,CAAC;QACzB,gBAAgB,EAAE,OAAO,CAAC;QAC1B,eAAe,EAAE,OAAO,CAAC;QACzB,2FAA2F;QAC3F,eAAe,EAAE,cAAc,GAAG,IAAI,CAAC;QACvC;;;;;;WAMG;QACH,WAAW,EAAE,UAAU,GAAG,SAAS,CAAC;QACpC;;;;;WAKG;QACH,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B;;;;;WAKG;QACH,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;QACvC;;;;;;WAMG;QACH,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC;;;;;;;WAOG;QACH,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC;;;;;;;;;;;;WAYG;QACH,mBAAmB,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD;;;;WAIG;QACH,mBAAmB,EAAE,OAAO,CAAC;KAC7B;CACD"}
+{"version":3,"file":"hono_context.d.ts","sourceRoot":"../src/lib/","sources":["../src/lib/hono_context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAOhE;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,mDAInB,CAAC;AAEX,yDAAyD;AACzD,eAAO,MAAM,cAAc;;;;EAA2B,CAAC;AACvD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,0DAA0D;AAC1D,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAE7C;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,oBAAoB,CAAC;AAEhD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,mCAAmC,CAAC;AAE9E;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAE7D,OAAO,QAAQ,MAAM,CAAC;IACrB,UAAU,kBAAkB;QAC3B,+DAA+D;QAC/D,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,eAAe,EAAE,cAAc,GAAG,IAAI,CAAC;QACvC,eAAe,EAAE,OAAO,CAAC;QACzB,gBAAgB,EAAE,OAAO,CAAC;QAC1B,eAAe,EAAE,OAAO,CAAC;QACzB,2FAA2F;QAC3F,eAAe,EAAE,cAAc,GAAG,IAAI,CAAC;QACvC;;;;;;WAMG;QACH,WAAW,EAAE,UAAU,GAAG,SAAS,CAAC;QACpC;;;;;WAKG;QACH,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B;;;;;WAKG;QACH,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;QACvC;;;;;;WAMG;QACH,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,6DAA6D;QAC7D,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;QACnC,2FAA2F;QAC3F,8BAA8B,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9C;;;;;;;WAOG;QACH,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC;;;;;;;;;;;;WAYG;QACH,mBAAmB,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD;;;;WAIG;QACH,mBAAmB,EAAE,OAAO,CAAC;KAC7B;CACD"}

package/dist/hono_context.js

@@ -55,6 +55,25 @@ export const TOKEN_SCOPE_KEY = 'token_scope';
  * read it directly.
  */
 export const ACCOUNT_ID_KEY = 'auth_account_id';
+/**
+ * Hono context variable name for the credential's deadline — when it stops
+ * authenticating, as a monotonic `performance.now()` timestamp
+ * (`auth/credential_deadline.ts`), or `null` for one with no expiry (a daemon
+ * token, an eternal API token) and for an unauthenticated request.
+ *
+ * Set by every auth middleware that resolves a credential: session (the
+ * earlier of the signed cookie's expiry and the row's), bearer (the row's),
+ * daemon token (`null`). A long-lived connection opened on the credential
+ * closes at it (`ResolvedAuth.credential_deadline`).
+ */
+export const CREDENTIAL_DEADLINE_KEY = 'credential_deadline';
+/**
+ * Hono context variable name for the session cookie's signed expiry, in
+ * seconds since the Unix epoch — set by the session middleware on a cookie
+ * that verified and has not expired, `null` otherwise. The request-context
+ * middleware folds it into `CREDENTIAL_DEADLINE_KEY`.
+ */
+export const SESSION_COOKIE_EXPIRES_AT_KEY = 'auth_session_cookie_expires_at';
 /**
  * Hono context variable name for the test-harness pre-baked context flag.
  *

package/dist/http/CLAUDE.md

@@ -25,7 +25,7 @@ effects, see ../../../docs/architecture.md.
 - `http/proxy.ts` — trusted-proxy middleware, CIDR parsing, rightmost-first XFF resolution. Pulls `hono/utils/ipaddr` for CIDR matching.
 - `http/client_ip.ts` — `get_client_ip(c)` — reads the resolved IP off the context (set by `proxy.ts`'s middleware). Split out of `proxy.ts` so it's hono-free: dispatch + route modules that only _read_ the IP don't pull `hono/utils/ipaddr`, keeping cross-process test surfaces free of the optional `hono` peer.
 - `http/ip_canonical.ts` — RFC 5952 IPv6 canonicalization + IPv4-mapped collapse; `IP_LITERAL_CHARS` regex.
-- `http/origin.ts` — origin allowlist middleware with wildcard patterns (Origin-only).
+- `http/origin.ts` — origin allowlist: the strict pattern grammar shared with the Rust spine, typed refusals, and the Origin-only middleware.
 - `http/jsonrpc.ts` — JSON-RPC 2.0 envelope schemas (MCP superset), `JsonrpcErrorCode`, `_meta`.
 - `http/jsonrpc_errors.ts` — `ThrownJsonrpcError`, `jsonrpc_errors` throwers, HTTP-status mappings.
 - `http/jsonrpc_helpers.ts` — message builders, type guards, input/result normalizers.
@@ -51,6 +51,8 @@ consumers.
 - `query?: z.ZodObject` — strict-object schema for URL query string
 - `input: z.ZodType` — request body schema; `z.null()` for no-body (GET/DELETE)
 - `output: z.ZodType` — success response schema
+- `mints_credential?: boolean` — the route issues a session cookie while declaring no auth (login, signup, bootstrap); assembly refuses it outside `AUTH_MIDDLEWARE_PATH`, as it does any route whose `auth.account` is not `'none'` (`assert_credential_routes_in_auth_scope` in `auth/middleware.ts`)
+- `reads_credential?: boolean` — the handler reads the resolved account while the route declares no auth gate, answering an anonymous caller itself (account status, the cell-scoped fact read, `create_rpc_endpoint`'s pair, whose dispatcher gates per action); held inside `AUTH_MIDDLEWARE_PATH` by the same assertion
 - `rate_limit?: RateLimitKey` — metadata only (`'ip' | 'account' | 'both'`); auto-derives 429
 - `errors?: RouteErrorSchemas` — handler-specific error schemas keyed by HTTP status
 - `transaction?: boolean` — declarative transaction wrapping (see below)
@@ -237,6 +239,7 @@ Key helpers:
 - `is_strict_object_schema(schema)` — detects `z.strictObject()` by checking `schema.def.catchall instanceof z.ZodNever`
 - `schema_to_surface(schema)` — Zod → JSON Schema, with `$schema` and `default` keys stripped recursively (defaults may be non-deterministic; `$schema` is snapshot noise)
 - `middleware_applies(mw_path, route_path)` — Hono pattern matching: `'*'`, exact, `'/api/*'` prefix (handles `prefix.slice(0, -1)` so `/api/*` also matches the bare `/api`)
+- `middleware_spec_applies(spec, route_path)` — the layer runs on the route: its `path` applies and none of its `carve_outs` does; what surface generation merges middleware errors by
 - `merge_error_schemas(spec, middleware_errors?)` — the three-layer merge described above
 
 ## Surface Generation
@@ -327,9 +330,10 @@ operator configuration in practice.
 Origin allowlisting for locally-running services — **not** the CSRF layer.
 CSRF is handled by `SameSite: strict` on session cookies (`auth/session_middleware.ts`).
 
-- `parse_allowed_origins(env_value)` — comma-separated patterns → `Array<RegExp>`
-- `should_allow_origin(origin, patterns)` — case-insensitive match
-- `verify_request_source(allowed_patterns)` — Hono handler: `Origin` present → must match allowlist or 403 `ERROR_FORBIDDEN_ORIGIN`; no `Origin` → allow through (curl, CLI, token auth is primary control)
+- `parse_allowed_origins(raw)` — comma-separated entries → `Result<{origins: Array<RegExp>}, {errors: Array<AllowedOriginsError>}>`; every refused entry is reported (`{kind, index, entry}`, 1-based), a blank value is `{kind: 'no_origins'}`
+- `OriginPatternErrorKind` / `AllowedOriginsErrorKind` — the refusal kinds, wire names shared with the Rust spine; `ALLOWED_ORIGINS_ERROR_MESSAGES` the reason per kind, `format_allowed_origins_error` one refusal as a boot-error line (entry quoted and escaped)
+- `should_allow_origin(origin, patterns)` — case-insensitive match; a value that isn't visible ASCII matches nothing
+- `verify_request_source(allowed_patterns, carve_outs?)` — Hono handler: `Origin` present → must match allowlist or 403 `ERROR_FORBIDDEN_ORIGIN`; no `Origin` → allow through (curl, CLI, token auth is primary control). A repeated `Origin` reaches it joined (`a, b`) and is refused. A request whose path a `carve_outs` entry (`MiddlewareCarveOut`, `{path, reason}`) matches passes unchecked
 - `is_browser_context(c)` — true when `Origin` or `Referer` is present (`!== undefined`, so empty-string counts). The bearer + daemon-token middleware discard their credential when true; twin of the Rust spine's `bearer_auth::is_browser_context`. Distinct from `verify_request_source` (allowlist gate) — this only detects browser context
 
 **Origin-only by design.** Fetch spec mandates `Origin` on every unsafe
@@ -337,17 +341,39 @@ method, so a real browser request on any state-changing surface always
 carries it. Non-browser clients don't ship auto-attached session cookies,
 so CSRF isn't the relevant threat there — auth (bearer / daemon token) is
 the actual control. A `Referer` fallback would only widen the
-accepted-shape envelope without closing a real CSRF hole. Mirrors
-`zzz_server::auth::is_request_origin_allowed`.
-
-Pattern syntax: exact `https://api.fuz.dev`; wildcard subdomain
-`https://*.fuz.dev` (matches `api.fuz.dev`, NOT `fuz.dev`); multiple
-wildcards `https://*.*.corp.fuz.dev`; port wildcard `http://localhost:*`
-(optional port); IPv6 `http://[::1]:3000`, `https://[2001:db8::1]` (no
-wildcards inside brackets). Patterns normalize through `URL` constructor.
-IPv6 zone identifiers (`%eth0`) not supported. Throws on paths, partial
-wildcards (`*fuz.dev`), wildcards inside IPv6 brackets, or missing
-protocol.
+accepted-shape envelope without closing a real CSRF hole. The Rust
+spine's `origin_layer` is the twin.
+
+**Every path by default.** `create_app_server` mounts the check at `'*'`
+(`ORIGIN_MIDDLEWARE_PATH`), the static fallback included, so a foreign page is
+refused wherever it points — the Rust spine's `fuz_http::compose_stack` checks
+every route group and its fallback the same way. Probes and CLI clients send no
+`Origin` and pass. A path leaves the check only by a named carve-out with its
+reason (`AppServerOptions.origin_carve_outs`), for a route that refuses browser
+callers by other means; one overlapping the auth middleware's scope
+(`AUTH_MIDDLEWARE_PATH`, where every route that reads or mints a credential
+sits) is refused at assembly. A carve-out skips every path it matches, routed
+or not, so an unrouted path under it reaches the static fallback unchecked;
+the Rust stack checks unrouted paths in its fallback group whatever a
+carve-out names.
+
+**Grammar** (shared with the Rust spine's `AllowedOrigins::parse`, pinned by
+`testing/cross_backend/origin_conformance.json`): entries are trimmed of ASCII
+whitespace and written as a browser writes an `Origin` — exact
+`https://api.fuz.dev`; wildcard label `https://*.fuz.dev` (one label in any
+position — matches `api.fuz.dev`, NOT `fuz.dev` or `a.b.fuz.dev`); several
+`https://*.*.corp.fuz.dev`; port wildcard `http://localhost:*` (any port or
+none); IPv6 `http://[::1]:3000` (exact, no wildcard inside the brackets).
+**Nothing is normalized** — the matcher is built from the entry as written, so
+an entry a browser would never send is refused rather than rewritten: non-ASCII
+(punycode an IDN host), a scheme other than http/https (`null`, `file://`,
+`chrome-extension://`), a path/query/fragment/trailing slash, userinfo, a
+character no hostname holds (`%`, `\`, `^`, `|`, `<`, `>`, `[`, `]`), a partial
+wildcard, an IPv4 address not written as four canonical decimal numbers, an IPv6
+address not in the browser's form (the URL parser serves as the serializer and
+any difference refuses), a port outside `1..=65535` or with leading zeros, the
+scheme's default port, and an empty entry. The checks run in a fixed order so
+both spines name the same kind for the same entry.
 
 ## JSON-RPC (`http/jsonrpc.ts`, `http/jsonrpc_errors.ts`, `http/jsonrpc_helpers.ts`)
 

package/dist/http/middleware_spec.d.ts

@@ -8,6 +8,16 @@
  */
 import type { MiddlewareHandler } from 'hono';
 import type { RouteErrorSchemas } from './error_schemas.js';
+/**
+ * Paths a middleware layer explicitly does not run on, and why — the named
+ * exception to a layer that covers every path by default (the origin check).
+ */
+export interface MiddlewareCarveOut {
+    /** Hono-style pattern (`/hooks/*`, `/health`), matched like `MiddlewareSpec.path`. */
+    readonly path: string;
+    /** Why these paths are safe without the layer — required, so a carve-out is an argument, not an omission. */
+    readonly reason: string;
+}
 /** A named middleware layer. */
 export interface MiddlewareSpec {
     name: string;
@@ -15,5 +25,11 @@ export interface MiddlewareSpec {
     handler: MiddlewareHandler;
     /** Error response schemas this middleware can produce, keyed by HTTP status code. */
     errors?: RouteErrorSchemas;
+    /**
+     * Paths under `path` the layer does not run on. The handler enforces them
+     * itself (Hono mounts by `path` alone); the field is what keeps the
+     * generated surface from claiming the layer's errors on those routes.
+     */
+    carve_outs?: ReadonlyArray<MiddlewareCarveOut>;
 }
 //# sourceMappingURL=middleware_spec.d.ts.map

package/dist/http/middleware_spec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware_spec.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/middleware_spec.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,gCAAgC;AAChC,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,iBAAiB,CAAC;IAC3B,qFAAqF;IACrF,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC3B"}
+{"version":3,"file":"middleware_spec.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/middleware_spec.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAClC,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6GAA6G;IAC7G,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED,gCAAgC;AAChC,MAAM,WAAW,cAAc;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,iBAAiB,CAAC;IAC3B,qFAAqF;IACrF,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B;;;;OAIG;IACH,UAAU,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CAC/C"}

package/dist/http/origin.d.ts

@@ -1,7 +1,7 @@
 /**
  * Request source verification middleware for API protection.
  *
- * Verifies requests are coming from expected origins/referers.
+ * Verifies requests carry an `Origin` the server allows, or none.
  * CSRF protection is `SameSite: strict` on session cookies
  * (see `auth/session_middleware.ts`) plus the CORS simple-request refusal
  * (`http/simple_request.ts`) — `SameSite` alone admits same-site pages, which
@@ -10,9 +10,18 @@
  * from making requests as the user browses the web — and is the only gate on
  * the WebSocket upgrade, which is never preflighted.
  *
+ * The allowlist grammar is shared with the Rust spine entry for entry:
+ * `parse_allowed_origins` accepts and refuses the same entries, naming each
+ * refusal with the same `AllowedOriginsErrorKind` string, and an accepted list
+ * matches the same origins. The shared conformance table
+ * (`testing/cross_backend/origin_conformance.json`) pins both.
+ *
  * @module
  */
+import type { Result } from '@fuzdev/fuz_util/result.ts';
 import type { Context, Handler } from 'hono';
+import { z } from 'zod';
+import type { MiddlewareCarveOut } from './middleware_spec.js';
 /**
  * True when the request looks like it originated from a browser context — it
  * carries an `Origin` or `Referer` header. Browsers attach these
@@ -31,29 +40,106 @@ import type { Context, Handler } from 'hono';
  */
 export declare const is_browser_context: (c: Context) => boolean;
 /**
- * Parses FUZ_ALLOWED_ORIGINS env var into regex matchers for request source verification.
+ * Why one allowlist entry was refused. The wire names both spines emit — the
+ * Rust spine's `OriginPatternError::kind` returns the same strings.
+ */
+export declare const OriginPatternErrorKind: z.ZodEnum<{
+    empty_entry: "empty_entry";
+    not_printable_ascii: "not_printable_ascii";
+    missing_scheme: "missing_scheme";
+    unsupported_scheme: "unsupported_scheme";
+    has_path: "has_path";
+    has_userinfo: "has_userinfo";
+    missing_host: "missing_host";
+    invalid_host_char: "invalid_host_char";
+    unbracketed_ipv6: "unbracketed_ipv6";
+    partial_wildcard: "partial_wildcard";
+    non_canonical_ipv4: "non_canonical_ipv4";
+    unclosed_ipv6: "unclosed_ipv6";
+    invalid_ipv6: "invalid_ipv6";
+    invalid_after_ipv6: "invalid_after_ipv6";
+    invalid_port: "invalid_port";
+    default_port: "default_port";
+}>;
+export type OriginPatternErrorKind = z.infer<typeof OriginPatternErrorKind>;
+/** Why an allowlist value was refused: `no_origins` (a blank value) or an entry's kind. */
+export declare const AllowedOriginsErrorKind: z.ZodEnum<{
+    empty_entry: "empty_entry";
+    not_printable_ascii: "not_printable_ascii";
+    missing_scheme: "missing_scheme";
+    unsupported_scheme: "unsupported_scheme";
+    has_path: "has_path";
+    has_userinfo: "has_userinfo";
+    missing_host: "missing_host";
+    invalid_host_char: "invalid_host_char";
+    unbracketed_ipv6: "unbracketed_ipv6";
+    partial_wildcard: "partial_wildcard";
+    non_canonical_ipv4: "non_canonical_ipv4";
+    unclosed_ipv6: "unclosed_ipv6";
+    invalid_ipv6: "invalid_ipv6";
+    invalid_after_ipv6: "invalid_after_ipv6";
+    invalid_port: "invalid_port";
+    default_port: "default_port";
+    no_origins: "no_origins";
+}>;
+export type AllowedOriginsErrorKind = z.infer<typeof AllowedOriginsErrorKind>;
+/** The operator-facing reason for each refusal kind. */
+export declare const ALLOWED_ORIGINS_ERROR_MESSAGES: Readonly<Record<AllowedOriginsErrorKind, string>>;
+/** One reason `parse_allowed_origins` refused a value. */
+export interface AllowedOriginsError {
+    readonly kind: AllowedOriginsErrorKind;
+    /** The refused entry's 1-based position; absent for `no_origins`. */
+    readonly index?: number;
+    /** The refused entry as given, trimmed; absent for `no_origins`. */
+    readonly entry?: string;
+}
+/**
+ * Render one refusal for a boot error — the entry in double quotes with every
+ * character but visible ASCII and the space escaped as `\uXXXX` (and `"` and
+ * `\` backslash-escaped), so an env value can't put a control, bidi, or other
+ * non-printing character in a log, nor close the quotes it is shown in.
+ *
+ * @param error - one of `parse_allowed_origins`'s errors
+ * @returns the reason as one line
+ */
+export declare const format_allowed_origins_error: (error: AllowedOriginsError) => string;
+/**
+ * Parses an allowlist value (conventionally the `FUZ_ALLOWED_ORIGINS` env var)
+ * into regex matchers for request source verification.
  * Origin allowlisting for locally-running services — not the CSRF layer
  * (that's `SameSite: strict` on session cookies plus `http/simple_request.ts`).
  *
- * Accepts comma-separated patterns with limited wildcards:
- * - Exact origins: `https://api.fuz.dev`
- * - Wildcard subdomains: `https://*.fuz.dev` (matches exactly one subdomain level)
- * - Multiple wildcards: `https://*.staging.*.fuz.dev` (for deep subdomains)
- * - Wildcard ports: `http://localhost:*` (matches any port or no port)
- * - IPv6 addresses: `http://[::1]:3000`, `https://[2001:db8::1]`
+ * Entries are comma-separated and trimmed of ASCII whitespace. Each is written
+ * the way a browser writes an `Origin` — `scheme://host[:port]` — where a whole
+ * host label or the port may be `*`:
+ * - Exact origins: `https://api.fuz.dev`, `http://localhost:3000`
+ * - Wildcard labels: `https://*.fuz.dev` (each `*` is exactly one label, in any
+ *   position — `api.fuz.dev` matches, `fuz.dev` and `a.b.fuz.dev` don't)
+ * - Wildcard ports: `http://localhost:*` (any port or none)
+ * - IPv6 addresses: `http://[::1]:3000`, `https://[2001:db8::1]` (exact)
  * - Combined: `https://*.fuz.dev:*`
  *
- * Examples:
- * - `http://localhost:3000,https://prod.fuz.dev`
- * - `https://*.api.fuz.dev,http://127.0.0.1:*`
- * - `http://[::1]:*,https://*.*.corp.fuz.dev:*`
+ * Refused, nothing normalized: anything but printable ASCII (punycode an
+ * international hostname), a scheme other than http or https (`null`,
+ * `file://`, `chrome-extension://`), a path, query, fragment or trailing
+ * slash, userinfo, a character no hostname holds, a partial wildcard, an IPv4
+ * address not written as four canonical decimal numbers (`127.1`), an IPv6
+ * address not in the form a browser sends, a port outside `1..=65535` or with
+ * leading zeros, the scheme's default port, and an empty entry. Every refused
+ * entry is reported, not just the first.
  *
- * @throws Error if any individual pattern is invalid (missing protocol, partial wildcards, etc.)
+ * @param raw - the comma-separated allowlist value
+ * @returns the matchers, or every refusal — `no_origins` when the value is blank
  */
-export declare const parse_allowed_origins: (env_value: string | undefined) => Array<RegExp>;
+export declare const parse_allowed_origins: (raw: string) => Result<{
+    origins: Array<RegExp>;
+}, {
+    errors: Array<AllowedOriginsError>;
+}>;
 /**
- * Tests if a request source (origin or referer) matches any of the allowed patterns.
- * Pattern matching is case-insensitive for domains (as per web standards).
+ * Tests if an `Origin` value matches any of the allowed patterns.
+ * Pattern matching is case-insensitive (web hosts and schemes are). A value
+ * that isn't visible ASCII matches nothing — a browser never sends one.
  */
 export declare const should_allow_origin: (origin: string, allowed_patterns: ReadonlyArray<RegExp>) => boolean;
 /**
@@ -63,6 +149,9 @@ export declare const should_allow_origin: (origin: string, allowed_patterns: Rea
  * plus `http/simple_request.ts`):
  * - Checks the `Origin` header (if present) against the allowlist
  * - Allows requests without an `Origin` header (direct access, curl, etc.)
+ * - Refuses an `Origin` that isn't visible ASCII, and a duplicated one — the
+ *   runtimes join a repeated header into one value (`a, b`), which carries a
+ *   space and so matches nothing
  *
  * Origin-only by design — Fetch spec mandates `Origin` on every unsafe
  * method (POST / PUT / DELETE / PATCH) regardless of `Referrer-Policy`,
@@ -71,9 +160,15 @@ export declare const should_allow_origin: (origin: string, allowed_patterns: Rea
  * attached session cookies, so CSRF isn't the relevant threat there —
  * auth (bearer / daemon token) is the actual control. A Referer fallback
  * would only widen the accepted-shape envelope without closing a real
- * CSRF hole; mirrors `zzz_server::auth::is_request_origin_allowed`.
+ * CSRF hole. The Rust spine's `origin_layer` is the twin.
+ *
+ * `create_app_server` mounts it on every path (`ORIGIN_MIDDLEWARE_PATH`); a
+ * request whose path a `carve_outs` entry matches passes unchecked — the named,
+ * explicit exception, each with its reason, as the Rust stack's
+ * `origin_carve_out` is.
  *
  * @param allowed_patterns - compiled regex patterns from `parse_allowed_origins`
+ * @param carve_outs - paths the check skips, matched like a middleware path (`middleware_applies`)
  */
-export declare const verify_request_source: (allowed_patterns: ReadonlyArray<RegExp>) => Handler;
+export declare const verify_request_source: (allowed_patterns: ReadonlyArray<RegExp>, carve_outs?: ReadonlyArray<MiddlewareCarveOut>) => Handler;
 //# sourceMappingURL=origin.d.ts.map

package/dist/http/origin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"origin.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAI7C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,kBAAkB,GAAI,GAAG,OAAO,KAAG,OAC8B,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,qBAAqB,GAAI,WAAW,MAAM,GAAG,SAAS,KAAG,KAAK,CAAC,MAAM,CAO5E,CAAC;AAEP;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAC/B,QAAQ,MAAM,EACd,kBAAkB,aAAa,CAAC,MAAM,CAAC,KACrC,OAAuD,CAAC;AAE3D;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,GAChC,kBAAkB,aAAa,CAAC,MAAM,CAAC,KAAG,OAgB1C,CAAC"}
+{"version":3,"file":"origin.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAG/D;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,kBAAkB,GAAI,GAAG,OAAO,KAAG,OAC8B,CAAC;AAE/E;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;EAiBjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,2FAA2F;AAC3F,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;EAA4D,CAAC;AACjG,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E,wDAAwD;AACxD,eAAO,MAAM,8BAA8B,EAAE,QAAQ,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAwB5F,CAAC;AAEF,0DAA0D;AAC1D,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,qEAAqE;IACrE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACxB;AAKD;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,GAAI,OAAO,mBAAmB,KAAG,MAOzE,CAAC;AAwBF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,qBAAqB,GACjC,KAAK,MAAM,KACT,MAAM,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;CAAE,EAAE;IAAE,MAAM,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAA;CAAE,CAgB3E,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC/B,QAAQ,MAAM,EACd,kBAAkB,aAAa,CAAC,MAAM,CAAC,KACrC,OAAqF,CAAC;AAEzF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,qBAAqB,GAEhC,kBAAkB,aAAa,CAAC,MAAM,CAAC,EACvC,aAAY,aAAa,CAAC,kBAAkB,CAAM,KAChD,OAaF,CAAC"}