@fuzdev/fuz_app 0.140.0 → 0.142.0

package/dist/actions/CLAUDE.md

@@ -358,11 +358,12 @@ and `allow_fallback: boolean` (default `true`). Explicit
 
 ### WS close codes (`actions/transports.ts`)
 
-- `WS_CLOSE_SESSION_REVOKED = 4001` — server revoked auth (reason `WS_CLOSE_SESSION_REVOKED_REASON`, `Session revoked`); client enters permanent `revoked` state, no reconnect. Also the close for an upgrade refused at admission because its credential was revoked mid-upgrade — indistinguishable on the wire by design.
+- `WS_CLOSE_SESSION_REVOKED = 4001` — server revoked auth (reason `WS_CLOSE_SESSION_REVOKED_REASON`, `Session revoked`); client enters permanent `revoked` state, no reconnect. Also the close for an upgrade refused at admission because its credential was revoked mid-upgrade — indistinguishable on the wire by design — and for a socket whose credential expired while open, with reason `WS_CLOSE_CREDENTIAL_EXPIRED_REASON` (`Credential expired`), which the client treats as the same `revoked` state.
 - `WS_CLOSE_CLIENT_HEARTBEAT_TIMEOUT = 4002` — client observed receive-silence past its receive timeout (`resolve_heartbeat_receive_timeout`).
 - `WS_CLOSE_SERVER_HEARTBEAT_TIMEOUT = 4003` — server observed receive-silence past `DEFAULT_SERVER_HEARTBEAT_TIMEOUT` (60s).
 - `WS_CLOSE_CONNECTION_LIMIT = 4004` — server closed this socket to admit a newer one on the same account, past the per-account connection cap (reason `connection limit`). Not a revocation: the client stays `closed` with `superseded` set and no reconnect, until `connect()` is called. Twin of the Rust spine's constant.
 - `WS_CLOSE_OUTBOUND_OVERFLOW = 4005` — the server had more waiting to be written to this socket than its outbound budget holds (reason `WS_CLOSE_OUTBOUND_OVERFLOW_REASON`, `outbound queue overflow`); what was waiting is dropped. Not a revocation, and nothing took the connection's place: the client reconnects under its ordinary backoff. Twin of the Rust spine's constant.
+- `WS_CLOSE_PERMISSION_REVOKED = 4006` — the socket's account lost a role its endpoint's `required_roles` lists: a revoked global grant (reason `WS_CLOSE_PERMISSION_REVOKED_REASON`, `Permission revoked`), mid-life or at admission. Nothing is sent after it. Not a revocation of the credential: the client stays `closed` until `connect()` is called, without setting `revoked` or `superseded`, and rejects pending and queued requests `forbidden`. Twin of the Rust spine's constant.
 - `WS_CLOSE_GOING_AWAY = 1001` — the server is shutting down (reason `WS_CLOSE_GOING_AWAY_REASON`, `Server shutting down`): `close_all_sockets`, which `AppServer.close` runs. Also the close for an upgrade the shutdown refuses — pending at the close-all, or born closed after it. Not a revocation: the client reconnects under its ordinary backoff.
 - `WS_CLOSE_MESSAGE_TOO_BIG = 1009` — server received a message over its `max_message_bytes` cap (RFC 6455 "Message Too Big").
 - `WS_CLOSE_POLICY_VIOLATION = 1008` — a socket sent too much while it was still opening (before admission and `on_socket_open` completed): past `MAX_PRE_ADMISSION_FRAMES` frames or the `PRE_ADMISSION_QUEUE_BYTES_FACTOR` byte budget.
@@ -409,8 +410,10 @@ client; `null` skips the client-side measurement.
 One map keyed by `connection_id` (branded `Uuid`), in registration order:
 `#connections: Map<Uuid, ConnectionEntry>`, each entry `{ws, identity,
 admitted, abort_controller, writer}`. `identity` is the `ConnectionIdentity`
-`{token_hash, account_id, api_token_id}` (session sets `token_hash`, bearer
-sets `api_token_id`, daemon-token sets both null).
+`{token_hash, account_id, api_token_id, required_roles}` (session sets
+`token_hash`, bearer sets `api_token_id`, daemon-token sets both null;
+`required_roles` is what the endpoint gated the upgrade on, per registration,
+since endpoints with different gates can share one transport).
 
 The id is the connection's only handle — `register_pending` / `add_connection`
 return it and `admit` / `remove_connection` / `is_registered` take it. There is
@@ -426,7 +429,7 @@ revocation closes nothing and the socket is then admitted on a dead credential.
 The transport splits registration to close it (the twin of the Rust
 `fuz_realtime` `ConnectionRegistry`, same method names):
 
-- `register_pending(ws, token_hash, account_id, api_token_id?, abort_controller?)`
+- `register_pending(ws, token_hash, account_id, api_token_id?, abort_controller?, required_roles?)`
   inserts the entry **un-admitted**. Every `close_sockets_for_*` matches it
   from that instant. Otherwise it is inert: no `send` broadcast,
   `broadcast_filtered` (the predicate never sees it), `send_to_account`, or
@@ -434,6 +437,9 @@ The transport splits registration to close it (the twin of the Rust
   `is_ready`, and `is_registered` don't see it
   (`get_pending_connection_count` does); the cap neither counts nor evicts it.
 - the caller re-reads the credential (`revalidate_resolved_auth`).
+- `take_pending_close_code(connection_id)` — after a refused `admit`, the
+  close code the transport closed the pending entry with (4001, 4006, 1001),
+  read once; what `register_action_ws` logs the refusal by.
 - `admit(connection_id)` returns `false` when the entry is gone — a revocation
   closed it while pending — and evicts nothing; otherwise it enforces the cap
   (counting admitted connections only) and marks the entry admitted.
@@ -555,6 +561,11 @@ each closed connection's controller):
 - `close_sockets_for_token(api_token_id)`
 - `close_sockets_for_account(account_id)` — coarse, covers session + bearer + daemon-token
 
+`close_sockets_for_role(account_id, role)` closes the account's connections
+whose `required_roles` include `role`, pending included, with
+`WS_CLOSE_PERMISSION_REVOKED` instead — over-closing an any-of gate (the loss
+of any listed role closes, whether or not the account still holds another).
+
 `close_all_sockets()` closes every connection, pending and admitted, with
 `WS_CLOSE_GOING_AWAY` instead — the shutdown close, removing and aborting each
 the same way — and leaves the transport **closing** for good (`is_closing()`):
@@ -610,13 +621,17 @@ interface ConnectionCloser {
 	close_sockets_for_session: (session_token_hash: string) => number;
 	close_sockets_for_token: (api_token_id: string) => number;
 	close_sockets_for_account: (account_id: Uuid) => number;
+	close_sockets_for_role: (account_id: Uuid, role: string) => number; // a revoked global grant
 	close_all_sockets: () => number; // shutdown, never a revocation
 }
 ```
 
 `BackendWebsocketTransport` satisfies it structurally;
-`create_sse_connection_closer(registry)` (`realtime/sse_auth_guard.ts`) adapts
-a `SubscriberRegistry` (`close_all_sockets` is `SubscriberRegistry.close_all`).
+`create_sse_connection_closer(registry, required_role)` (`realtime/sse_auth_guard.ts`) adapts
+a `SubscriberRegistry` (`close_all_sockets` is `SubscriberRegistry.close_all`;
+`close_sockets_for_role` closes the account's streams when `role` is the
+registry's gating role). No handler closes for a role: a role revocation's
+closes come from the audit listeners alone.
 Closing is idempotent and synchronous. `close_all_sockets` is the one method no
 revocation calls: `AppServer.close` runs it on `deps.connection_closer` to end
 every live connection of the backend at shutdown, and it has no
@@ -626,15 +641,21 @@ closed) — so a closed transport or registry hosts nothing more. Its Rust
 counterpart is `ShutdownCloser::close_all_sockets`, a supertrait of
 `SocketRevoker`.
 
-**Every revocation closes after its commit.** A handler never calls a closer
-inline: it calls `queue_connection_close(ctx, deps.connection_closer, target)`,
+**Every revocation closes after its commit.** A handler inside a route or
+action transaction never calls a closer inline: it calls
+`queue_connection_close(ctx, deps.connection_closer, target)`,
 which puts the close on the request's post-commit queue (`emit_after_commit`).
 The close runs once the handler's transaction has committed and is discarded
 when the handler throws — a rolled-back revocation closes nothing. `target` is
 a `ConnectionCloseTarget` (`{kind: 'session', session_token_hash}` /
-`{kind: 'token', api_token_id}` / `{kind: 'account', account_id}`);
-`close_connections(closer, target)` is the immediate form the queue runs. Twin
-of `queue_socket_close` / `SocketCloseTarget`.
+`{kind: 'token', api_token_id}` / `{kind: 'account', account_id}` /
+`{kind: 'role', account_id, role}`);
+`close_connections(closer, target)` is the immediate form the queue runs. A
+handler with no wrapping transaction (`/login`, `/password`) opens its own
+around its writes and closes straight after that commit with
+`close_connections_after_commit(closer, target, log)`, which logs a failing
+close as the post-commit flush does. Twin of `queue_socket_close` /
+`SocketCloseTarget`.
 
 The order is load-bearing for admission: a connection registers, then re-reads
 its credential, so a close that missed the registration must belong to a
@@ -702,8 +723,14 @@ guard reads too — one declaration, so the two can't drift:
 - `account` (`session_revoke_all`, `token_revoke_all`, `password_change`,
   `logout`, `account_delete`, `account_purge`) →
   `close_sockets_for_account(target_account_id ?? account_id)`
-- `role` (`role_grant_revoke`) → nothing, deliberately: per-message dispatch
-  re-authorizes, so the next message is refused. The SSE guard closes here.
+- `role` (`role_grant_revoke`) → `close_sockets_for_role(target_account_id ??
+  account_id, metadata.role)` when the revoked grant was global
+  (`to_global_role_revocation`); a scoped revoke closes nothing. Per-message
+  dispatch re-authorizes each request against its own action, but nothing
+  re-checks what a socket admitted by a role gate receives — every push its
+  endpoint sends — so the socket closes, with `WS_CLOSE_PERMISSION_REVOKED`.
+  The SSE guard closes its streams on the same rows. No handler closes for a
+  role, so this guard is the one closer.
 - `none` → nothing — every other event, and any event type fuz_app doesn't
   define
 
@@ -774,9 +801,8 @@ Cross-surface collisions (same `GET <path>` on both `RouteSpec` and
 `GET /api/:resource` vs `/api/ws`) is not detected — Hono's specific-before-wildcard routing keeps
 those working but avoid the overlap.
 
-`auth_guard: true` does NOT close sockets on `role_grant_revoke`
-(deliberate — per-connection role tracking out of scope). Compose via
-`extra_audit_handlers` when needed. When multiple specs share a transport,
+`auth_guard` is also the one closer of a role revocation: with it off for a
+transport, a revoked role closes none of its sockets. When multiple specs share a transport,
 **any** spec with `auth_guard !== false` wires the guard for that
 transport (OR-semantics).
 
@@ -791,7 +817,7 @@ Composes the standard upgrade stack:
 1. `verify_request_source(allowed_origins)`
 2. `require_auth`
 3. `require_token_scope('surface:ws_upgrade')` — a narrowed token cannot hold a socket
-4. Upgrade-time authorization phase — resolves the acting actor, seeds `REQUEST_CONTEXT_KEY` for the inner `register_action_ws`
+4. Upgrade-time authorization phase — resolves the acting actor (`?acting=` through `parse_acting`; malformed reads as omitted), seeds `REQUEST_CONTEXT_KEY` for the inner `register_action_ws`
 5. Optional `require_role(required_roles)` — any-of disjunction (coarse upgrade-time gate; per-action `auth` in each spec still applies at dispatch time)
 6. Delegates to `register_action_ws`
 
@@ -829,7 +855,11 @@ audit stream shares, read off the keys the auth middleware set), then
 meanwhile, closes the socket with `WS_CLOSE_SESSION_REVOKED` and the reason a
 revoked socket gets; a re-check that throws closes it with
 `WS_CLOSE_INTERNAL_ERROR` (`internal error`) — fail closed, never admitted
-unchecked. During shutdown a refusal is the shutdown's instead: an upgrade
+unchecked. An endpoint with `required_roles` re-reads them beside the
+credential — the acting actor's grants afresh (`refresh_role_grants`), a global
+grant of any listed role admitting, as the gate in front did — and refuses a
+lost role with `WS_CLOSE_PERMISSION_REVOKED`; a failed role read is the same
+1011. During shutdown a refusal is the shutdown's instead: an upgrade
 pending at the close-all was closed by it with `WS_CLOSE_GOING_AWAY` and its
 controller aborted, so the refusal after the re-read — even one the closing
 database failed — writes nothing more; an upgrade that registers after it is
@@ -881,8 +911,9 @@ client withholds its close frame. So every server-side close removes the
 connection from the transport and aborts the socket's controller **at close
 time**: the transport does both for a revocation or a cap eviction, and
 `register_action_ws`'s `end_socket` does both — through
-`transport.close_connection` — for a heartbeat timeout, an
-oversized message, a failed `on_socket_open`, and a refused admission.
+`transport.close_connection` — for a heartbeat timeout, a credential
+expiry, an oversized message, a failed `on_socket_open`, and a refused
+admission.
 `onMessage` then drops any frame whose socket has ended — no dispatch, no
 error reply. A connection the transport no longer holds though nothing closed
 its socket (a bare `transport.remove_connection`; `transport.is_registered` is
@@ -895,7 +926,10 @@ heartbeat activity.
 **Per-message authorization phase.** `perform_action` calls
 `apply_authorization_phase` per-message (HTTP and WS uniformly). Role grant
 changes during a connection lifetime are picked up on the next message —
-no in-place refresh, no socket-close on `role_grant_revoke`. Authentication
+no in-place refresh. A revoked global grant of a role the endpoint's
+`required_roles` lists closes the socket (`WS_CLOSE_PERMISSION_REVOKED`,
+through `create_ws_auth_guard`), since nothing else re-checks what it
+receives. Authentication
 invalidation (a session or token revoke, `password_change`, a logout, an
 account delete, a cap eviction) still closes the socket — the revoking
 handler through `connection_closer`, `create_ws_auth_guard` again on the
@@ -953,6 +987,17 @@ Tick interval is `timeout / 2`, so event-loop blockage pauses the timer itself.
 A timeout unregisters the connection and aborts its signal along with the
 `WS_CLOSE_SERVER_HEARTBEAT_TIMEOUT` close.
 
+**Credential deadline.** From admission, a timer closes the socket when the
+credential it upgraded on expires (`ResolvedAuth.credential_deadline` — the
+earlier of a session's cookie and row expiry, an API token's row; none for an
+eternal token or the daemon token): `WS_CLOSE_SESSION_REVOKED` with
+`WS_CLOSE_CREDENTIAL_EXPIRED_REASON`, through `end_socket`. Expiry writes
+nothing a revocation listener hears, so the socket watches its own deadline.
+The wait is `schedule_credential_deadline`'s chain of timers of at most an
+hour (a 30-day session is past `setTimeout`'s ceiling), each also checking the
+wall clock so a host suspend does not extend the deadline, cancelled when the
+socket ends. Twin of the Rust loop's `WsLoopOptions::credential_deadline`.
+
 Two abort signals composed via `AbortSignal.any`:
 
 - `socket_abort_controller` — per-socket, fires when the socket ends: at the server's close (revocation, cap eviction, heartbeat timeout, …) or the client's. Registered with the transport, which aborts it on the closes it makes. Drives every handler's `ctx.signal`.
@@ -1049,11 +1094,16 @@ recent frame each way — every frame, including heartbeats and the responses
 Reconnect policy (exponential backoff): `delay = DEFAULT_RECONNECT_DELAY * DEFAULT_BACKOFF_FACTOR ** (attempts-1)`,
 capped at `DEFAULT_RECONNECT_DELAY_MAX`. Every other close reconnects —
 `WS_CLOSE_OUTBOUND_OVERFLOW` included, the server's notice that this client
-fell behind and missed messages. Two close codes never reconnect:
+fell behind and missed messages. Three close codes never reconnect:
 
 - `WS_CLOSE_SESSION_REVOKED` is **terminal** — sets `revoked`, no reconnect
   loop on 401, and `connect()` becomes a no-op. Pending and queued requests
   reject `unauthenticated`.
+- `WS_CLOSE_PERMISSION_REVOKED` is **closed until the user acts** too — status
+  `closed`, no reconnect scheduled (a reconnect would be refused at the role
+  gate), neither `revoked` nor `superseded` set (the credential is still
+  good), pending and queued requests reject `forbidden`. `last_close_code`
+  says why; `connect()` reopens.
 - `WS_CLOSE_CONNECTION_LIMIT` is **closed until the user acts** — sets
   `superseded` (reactive), status `closed`, no reconnect scheduled: the server
   closed this socket to admit a newer one on the same account, and

package/dist/actions/action_rpc.d.ts

@@ -286,7 +286,11 @@ export interface CreateRpcEndpointOptions {
  *
  * The RouteSpecs use `auth: {type: 'none'}` because auth is checked per-action
  * inside the dispatcher, and `transaction: false` because transaction scope
- * is per-action (mutations get a transaction, reads get pool).
+ * is per-action (mutations get a transaction, reads get pool). They are
+ * marked `reads_credential`, since the dispatcher reads the resolved
+ * credential, so assembly refuses the pair mounted outside the auth
+ * middleware's scope (`assert_credential_routes_in_auth_scope`) whether it
+ * arrives as `rpc_endpoints` or through `create_route_specs`.
  *
  * @param options - endpoint path, actions, logger, and the two action rate limiters
  * @returns route specs (GET + POST) ready for `apply_route_specs`

package/dist/actions/action_rpc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action_rpc.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/action_rpc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAqB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAE1E,OAAO,EAEN,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAKN,KAAK,cAAc,EACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAGN,KAAK,gBAAgB,EAErB,MAAM,oBAAoB,CAAC;AAQ5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC7B,+DAA+D;IAC/D,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;IAC5B,iDAAiD;IACjD,UAAU,EAAE,gBAAgB,CAAC;IAC7B;;;;OAIG;IACH,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B;;;;;OAKG;IACH,EAAE,EAAE,EAAE,CAAC;IACP;;;;;OAKG;IACH,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC;;;;;OAKG;IACH,mBAAmB,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD;;;;;;;OAOG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,eAAe,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;OAQG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD;;;;;OAKG;IACH,MAAM,EAAE,WAAW,CAAC;CACpB;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,CACxD,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,aAAa,KACd,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;IACrE,IAAI,EAAE,cAAc,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,CAC5D,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,iBAAiB,KAClB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAmB,SAAQ,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;IACtE,IAAI,EAAE,mBAAmB,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,CAC7D,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,kBAAkB,KACnB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,yBAAyB,CAAC;IAChC,OAAO,EAAE,aAAa,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,cAAc,CAAC,KAAK,SAAS,yBAAyB,IAAI;IACrE,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;CACtB,SAAS,CAAC,UAAU,CAAC,GACnB,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GACrE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,GAC9C,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GACpE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,UAAU,GAAI,KAAK,SAAS,yBAAyB,EACjE,MAAM,KAAK,EACX,SAAS,cAAc,CAAC,KAAK,CAAC,KAC5B,SAGD,CAAC;AAEH,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACxC,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1B,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;OAQG;IACH,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C;;;;;;;OAOG;IACH,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,eAAO,MAAM,mBAAmB,GAAI,SAAS,wBAAwB,KAAG,KAAK,CAAC,SAAS,CA6NtF,CAAC"}
+{"version":3,"file":"action_rpc.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/action_rpc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAqB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAE1E,OAAO,EAEN,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAKN,KAAK,cAAc,EACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAGN,KAAK,gBAAgB,EAErB,MAAM,oBAAoB,CAAC;AAQ5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC7B,+DAA+D;IAC/D,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;IAC5B,iDAAiD;IACjD,UAAU,EAAE,gBAAgB,CAAC;IAC7B;;;;OAIG;IACH,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B;;;;;OAKG;IACH,EAAE,EAAE,EAAE,CAAC;IACP;;;;;OAKG;IACH,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC;;;;;OAKG;IACH,mBAAmB,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD;;;;;;;OAOG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,eAAe,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;OAQG;IACH,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD;;;;;OAKG;IACH,MAAM,EAAE,WAAW,CAAC;CACpB;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,CACxD,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,aAAa,KACd,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAkB,SAAQ,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;IACrE,IAAI,EAAE,cAAc,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,CAC5D,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,iBAAiB,KAClB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAmB,SAAQ,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC;IACtE,IAAI,EAAE,mBAAmB,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,CAC7D,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,kBAAkB,KACnB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,yBAAyB,CAAC;IAChC,OAAO,EAAE,aAAa,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,cAAc,CAAC,KAAK,SAAS,yBAAyB,IAAI;IACrE,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;CACtB,SAAS,CAAC,UAAU,CAAC,GACnB,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GACrE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,GAC9C,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GACpE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,UAAU,GAAI,KAAK,SAAS,yBAAyB,EACjE,MAAM,KAAK,EACX,SAAS,cAAc,CAAC,KAAK,CAAC,KAC5B,SAGD,CAAC;AAEH,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACxC,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1B,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;OAQG;IACH,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C;;;;;;;OAOG;IACH,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,eAAO,MAAM,mBAAmB,GAAI,SAAS,wBAAwB,KAAG,KAAK,CAAC,SAAS,CAiOtF,CAAC"}

package/dist/actions/action_rpc.js

@@ -114,7 +114,11 @@ const jsonrpc_error_envelope = (id, error) => ({
  *
  * The RouteSpecs use `auth: {type: 'none'}` because auth is checked per-action
  * inside the dispatcher, and `transaction: false` because transaction scope
- * is per-action (mutations get a transaction, reads get pool).
+ * is per-action (mutations get a transaction, reads get pool). They are
+ * marked `reads_credential`, since the dispatcher reads the resolved
+ * credential, so assembly refuses the pair mounted outside the auth
+ * middleware's scope (`assert_credential_routes_in_auth_scope`) whether it
+ * arrives as `rpc_endpoints` or through `create_route_specs`.
  *
  * @param options - endpoint path, actions, logger, and the two action rate limiters
  * @returns route specs (GET + POST) ready for `apply_route_specs`
@@ -260,6 +264,9 @@ export const create_rpc_endpoint = (options) => {
             method: 'POST',
             path: endpoint_path,
             auth: { account: 'none', actor: 'none' }, // per-action auth inside dispatcher
+            // the dispatcher reads the resolved credential per action, so the
+            // endpoint stays inside the auth middleware's scope however it mounts
+            reads_credential: true,
             handler: post_handler,
             description: `JSON-RPC 2.0 endpoint — ${actions.length} method${actions.length === 1 ? '' : 's'}`,
             input: z.null(), // dispatcher owns body parsing; rpc_endpoints surface has the real schemas
@@ -270,6 +277,7 @@ export const create_rpc_endpoint = (options) => {
             method: 'GET',
             path: endpoint_path,
             auth: { account: 'none', actor: 'none' }, // per-action auth inside dispatcher
+            reads_credential: true,
             handler: get_handler,
             description: `JSON-RPC 2.0 endpoint (cacheable reads) — ${actions.length} method${actions.length === 1 ? '' : 's'}`,
             input: z.null(), // params from query string, validated by dispatcher

package/dist/actions/connection_closer.d.ts

@@ -9,7 +9,10 @@
  * something closes it. `ConnectionCloser` is that capability, and every
  * revocation handler holds one: the session and token revokes, the revoke-alls,
  * account delete and purge, `/logout`, `/password`, and the session and token
- * caps for what they evict. The auth cleanup holds one too
+ * caps for what they evict. A role revocation is the exception: it closes
+ * only the connections an endpoint gated on that role, and only through the
+ * audit listeners (`create_ws_auth_guard`, `create_sse_auth_guard`) — no
+ * handler holds a closer for it. The auth cleanup holds one too
  * (`AuthCleanupDeps.connection_closer`): its session sweep closes the
  * connections of each expired session it deletes, after that delete commits.
  *
@@ -43,6 +46,7 @@
  * @module
  */
 import type { Uuid } from '../primitive_schemas.js';
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import { type EmitAfterCommitContext } from '../http/pending_effects.js';
 /**
  * Close live connections by identity, or all of them.
@@ -70,6 +74,20 @@ export interface ConnectionCloser {
      * credentials.
      */
     close_sockets_for_account: (account_id: Uuid) => number;
+    /**
+     * Close the connections of `account_id` whose endpoint gated them on
+     * `role` — the close for a revoked **global** grant of that role (a scoped
+     * grant never admits at a role gate, so revoking one closes nothing; the
+     * caller filters, `to_global_role_revocation`). A WebSocket gets
+     * `WS_CLOSE_PERMISSION_REVOKED`, not a revocation's code: the credential is
+     * still good.
+     *
+     * **Over-closes an any-of gate**: a connection whose endpoint listed
+     * several roles closes on the loss of any of them, whether or not the
+     * account still holds another. The client reconnects into the gate if it
+     * still qualifies.
+     */
+    close_sockets_for_role: (account_id: Uuid, role: string) => number;
     /**
      * Close every connection, whoever opened it — the shutdown close
      * `AppServer.close` runs. Not a revocation: a WebSocket gets
@@ -82,8 +100,10 @@ export interface ConnectionCloser {
 }
 /**
  * Which connections a revocation closes — the argument of
- * `queue_connection_close`, one variant per credential close of
+ * `queue_connection_close`, one variant per revocation close of
  * `ConnectionCloser` (`close_all_sockets` is shutdown, never a revocation).
+ * No handler queues `role` today: the audit listeners are a role's only
+ * closer.
  */
 export type ConnectionCloseTarget = {
     kind: 'session';
@@ -94,6 +114,10 @@ export type ConnectionCloseTarget = {
 } | {
     kind: 'account';
     account_id: Uuid;
+} | {
+    kind: 'role';
+    account_id: Uuid;
+    role: string;
 };
 /**
  * Close the connections `target` names, now.
@@ -104,6 +128,21 @@ export type ConnectionCloseTarget = {
  * @returns how many connections closed
  */
 export declare const close_connections: (closer: ConnectionCloser, target: ConnectionCloseTarget) => number;
+/**
+ * Close the connections `target` names, now, for a revocation that has
+ * already committed — logging a close that throws instead of throwing it.
+ *
+ * For a handler with no route transaction, closing straight after its own
+ * commit: a throw there would fail a request whose revocation stands, and skip
+ * the work after the close (the response, the audit row). A closer over several
+ * transports closes the rest before it rethrows, so catching loses no close.
+ * The twin of the post-commit flush, which catches and logs the same way.
+ *
+ * @param closer - the closer to run, `deps.connection_closer` in a handler
+ * @param target - the connections to close
+ * @param log - where a failing close is reported
+ */
+export declare const close_connections_after_commit: (closer: ConnectionCloser, target: ConnectionCloseTarget, log: Logger) => void;
 /**
  * Queue a connection close on `ctx`'s post-commit queue, so it runs only after
  * the request's transaction commits and never when the handler throws.
@@ -112,8 +151,9 @@ export declare const close_connections: (closer: ConnectionCloser, target: Conne
  * why an in-transaction revocation must not close inline.
  *
  * In a handler with no wrapping transaction a throw still drops the queued
- * close while an autocommit write stays; close with `close_connections`
- * straight after the write there.
+ * close while an autocommit write stays; such a handler closes inline straight
+ * after its own commit instead, with `close_connections_after_commit`, which
+ * catches and logs a failing close as the post-commit flush does.
  *
  * @param ctx - the route or action context of the request doing the revoking
  * @param closer - the closer to run, `deps.connection_closer` in a handler

package/dist/actions/connection_closer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection_closer.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/connection_closer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAGpD,OAAO,EAAqB,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAE5F;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAChC,qGAAqG;IACrG,yBAAyB,EAAE,CAAC,kBAAkB,EAAE,MAAM,KAAK,MAAM,CAAC;IAClE,4EAA4E;IAC5E,uBAAuB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;IAC1D;;;;OAIG;IACH,yBAAyB,EAAE,CAAC,UAAU,EAAE,IAAI,KAAK,MAAM,CAAC;IACxD;;;;;;;OAOG;IACH,iBAAiB,EAAE,MAAM,MAAM,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAC9B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,IAAI,CAAA;CAAE,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAC7B,QAAQ,gBAAgB,EACxB,QAAQ,qBAAqB,KAC3B,MAWF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,GAClC,KAAK,sBAAsB,EAC3B,QAAQ,gBAAgB,EACxB,QAAQ,qBAAqB,KAC3B,IAIF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,gBAKnC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,cAAe,SAAQ,gBAAgB;IACvD;;;;;;;;;;;;;;;OAeG;IACH,GAAG,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,MAAM,IAAI,CAAC;IAC9C,2EAA2E;IAC3E,YAAY,EAAE,MAAM,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,QAAO,cA4CzC,CAAC"}
+{"version":3,"file":"connection_closer.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/connection_closer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAAqB,KAAK,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAE5F;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAChC,qGAAqG;IACrG,yBAAyB,EAAE,CAAC,kBAAkB,EAAE,MAAM,KAAK,MAAM,CAAC;IAClE,4EAA4E;IAC5E,uBAAuB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;IAC1D;;;;OAIG;IACH,yBAAyB,EAAE,CAAC,UAAU,EAAE,IAAI,KAAK,MAAM,CAAC;IACxD;;;;;;;;;;;;OAYG;IACH,sBAAsB,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACnE;;;;;;;OAOG;IACH,iBAAiB,EAAE,MAAM,MAAM,CAAC;CAChC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAC9B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,IAAI,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpD;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAC7B,QAAQ,gBAAgB,EACxB,QAAQ,qBAAqB,KAC3B,MAaF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,8BAA8B,GAC1C,QAAQ,gBAAgB,EACxB,QAAQ,qBAAqB,EAC7B,KAAK,MAAM,KACT,IAMF,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,sBAAsB,GAClC,KAAK,sBAAsB,EAC3B,QAAQ,gBAAgB,EACxB,QAAQ,qBAAqB,KAC3B,IAIF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,gBAMnC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,cAAe,SAAQ,gBAAgB;IACvD;;;;;;;;;;;;;;;OAeG;IACH,GAAG,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,MAAM,IAAI,CAAC;IAC9C,2EAA2E;IAC3E,YAAY,EAAE,MAAM,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,QAAO,cA8CzC,CAAC"}

package/dist/actions/connection_closer.js

@@ -9,7 +9,10 @@
  * something closes it. `ConnectionCloser` is that capability, and every
  * revocation handler holds one: the session and token revokes, the revoke-alls,
  * account delete and purge, `/logout`, `/password`, and the session and token
- * caps for what they evict. The auth cleanup holds one too
+ * caps for what they evict. A role revocation is the exception: it closes
+ * only the connections an endpoint gated on that role, and only through the
+ * audit listeners (`create_ws_auth_guard`, `create_sse_auth_guard`) — no
+ * handler holds a closer for it. The auth cleanup holds one too
  * (`AuthCleanupDeps.connection_closer`): its session sweep closes the
  * connections of each expired session it deletes, after that delete commits.
  *
@@ -60,10 +63,34 @@ export const close_connections = (closer, target) => {
             return closer.close_sockets_for_token(target.api_token_id);
         case 'account':
             return closer.close_sockets_for_account(target.account_id);
+        case 'role':
+            return closer.close_sockets_for_role(target.account_id, target.role);
         default:
             throw new UnreachableError(target);
     }
 };
+/**
+ * Close the connections `target` names, now, for a revocation that has
+ * already committed — logging a close that throws instead of throwing it.
+ *
+ * For a handler with no route transaction, closing straight after its own
+ * commit: a throw there would fail a request whose revocation stands, and skip
+ * the work after the close (the response, the audit row). A closer over several
+ * transports closes the rest before it rethrows, so catching loses no close.
+ * The twin of the post-commit flush, which catches and logs the same way.
+ *
+ * @param closer - the closer to run, `deps.connection_closer` in a handler
+ * @param target - the connections to close
+ * @param log - where a failing close is reported
+ */
+export const close_connections_after_commit = (closer, target, log) => {
+    try {
+        close_connections(closer, target);
+    }
+    catch (err) {
+        log.error('connection close after commit failed:', err);
+    }
+};
 /**
  * Queue a connection close on `ctx`'s post-commit queue, so it runs only after
  * the request's transaction commits and never when the handler throws.
@@ -72,8 +99,9 @@ export const close_connections = (closer, target) => {
  * why an in-transaction revocation must not close inline.
  *
  * In a handler with no wrapping transaction a throw still drops the queued
- * close while an autocommit write stays; close with `close_connections`
- * straight after the write there.
+ * close while an autocommit write stays; such a handler closes inline straight
+ * after its own commit instead, with `close_connections_after_commit`, which
+ * catches and logs a failing close as the post-commit flush does.
  *
  * @param ctx - the route or action context of the request doing the revoking
  * @param closer - the closer to run, `deps.connection_closer` in a handler
@@ -93,6 +121,7 @@ export const noop_connection_closer = Object.freeze({
     close_sockets_for_session: () => 0,
     close_sockets_for_token: () => 0,
     close_sockets_for_account: () => 0,
+    close_sockets_for_role: () => 0,
     close_all_sockets: () => 0
 });
 /**
@@ -150,6 +179,7 @@ export const create_realtime_closer = () => {
         close_sockets_for_session: (session_token_hash) => fan_out((member) => member.close_sockets_for_session(session_token_hash)),
         close_sockets_for_token: (api_token_id) => fan_out((member) => member.close_sockets_for_token(api_token_id)),
         close_sockets_for_account: (account_id) => fan_out((member) => member.close_sockets_for_account(account_id)),
+        close_sockets_for_role: (account_id, role) => fan_out((member) => member.close_sockets_for_role(account_id, role)),
         close_all_sockets: () => fan_out((member) => member.close_all_sockets())
     });
 };

package/dist/actions/perform_action.d.ts

@@ -163,6 +163,16 @@ export type PerformActionResult = {
  * the harness omits `account_id`.
  */
 export declare const perform_action: (input: PerformActionInput, deps: PerformActionDeps) => Promise<PerformActionResult>;
+/**
+ * The credential-type 403 — one builder, so the dispatcher's gate below and a
+ * handler that gates a credential channel on its input (`account_delete`'s
+ * self path) emit a byte-identical error. Twin of the Rust
+ * `fuz_auth::credential_type_required`.
+ *
+ * @param required_credential_types - the channels that would be admitted
+ * @returns the `forbidden` error object with reason `credential_type_required`
+ */
+export declare const credential_type_required_error: (required_credential_types: ReadonlyArray<string>) => JsonrpcErrorObject;
 /**
  * Build a JSON-RPC response envelope from a `PerformActionResult` for
  * transports that wire over the JSON-RPC 2.0 message shape (HTTP RPC + WS).

package/dist/actions/perform_action.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"perform_action.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/perform_action.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAGtC,OAAO,EAEN,KAAK,gBAAgB,EAErB,KAAK,kBAAkB,EACvB,MAAM,oBAAoB,CAAC;AAc5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAgC,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAGN,KAAK,UAAU,EACf,MAAM,wBAAwB,CAAC;AAEhC;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAClC,kEAAkE;IAClE,MAAM,EAAE,SAAS,CAAC;IAClB,mGAAmG;IACnG,UAAU,EAAE,OAAO,CAAC;IACpB,sDAAsD;IACtD,UAAU,EAAE,gBAAgB,CAAC;IAC7B,yDAAyD;IACzD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uEAAuE;IACvE,eAAe,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC;;;;;OAKG;IACH,WAAW,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,MAAM,EAAE,WAAW,CAAC;IACpB,sFAAsF;IACtF,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD,uDAAuD;IACvD,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B;;;;OAIG;IACH,MAAM,CAAC,EAAE;QAAE,eAAe,EAAE,cAAc,GAAG,IAAI,CAAA;KAAE,CAAC;CACpD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IACjC,gGAAgG;IAChG,EAAE,EAAE,EAAE,CAAC;IACP;;;OAGG;IACH,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC;;;OAGG;IACH,mBAAmB,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C,uEAAuE;IACvE,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAC9B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhG;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,GAC1B,OAAO,kBAAkB,EACzB,MAAM,iBAAiB,KACrB,OAAO,CAAC,mBAAmB,CAmL7B,CAAC;AAuHF;;;GAGG;AACH,eAAO,MAAM,iCAAiC,GAC7C,IAAI,gBAAgB,EACpB,QAAQ,mBAAmB,KACzB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,gBAAgB,CAAA;CAAE,GAAG,CAC9C;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAMnD,CAAC"}
+{"version":3,"file":"perform_action.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/perform_action.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAItC,OAAO,EAEN,KAAK,gBAAgB,EAErB,KAAK,kBAAkB,EACvB,MAAM,oBAAoB,CAAC;AAc5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,KAAK,EAAgC,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAGN,KAAK,UAAU,EACf,MAAM,wBAAwB,CAAC;AAEhC;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAClC,kEAAkE;IAClE,MAAM,EAAE,SAAS,CAAC;IAClB,mGAAmG;IACnG,UAAU,EAAE,OAAO,CAAC;IACpB,sDAAsD;IACtD,UAAU,EAAE,gBAAgB,CAAC;IAC7B,yDAAyD;IACzD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uEAAuE;IACvE,eAAe,EAAE,cAAc,GAAG,IAAI,CAAC;IACvC;;;;;OAKG;IACH,WAAW,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,oGAAoG;IACpG,MAAM,EAAE,WAAW,CAAC;IACpB,sFAAsF;IACtF,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IAClD,uDAAuD;IACvD,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B;;;;OAIG;IACH,MAAM,CAAC,EAAE;QAAE,eAAe,EAAE,cAAc,GAAG,IAAI,CAAA;KAAE,CAAC;CACpD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IACjC,gGAAgG;IAChG,EAAE,EAAE,EAAE,CAAC;IACP;;;OAGG;IACH,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC;;;OAGG;IACH,mBAAmB,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3C,uEAAuE;IACvE,2BAA2B,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAC9B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhG;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,GAC1B,OAAO,kBAAkB,EACzB,MAAM,iBAAiB,KACrB,OAAO,CAAC,mBAAmB,CAsL7B,CAAC;AA6DF;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,GAC1C,2BAA2B,aAAa,CAAC,MAAM,CAAC,KAC9C,kBAIA,CAAC;AAyDJ;;;GAGG;AACH,eAAO,MAAM,iCAAiC,GAC7C,IAAI,gBAAgB,EACpB,QAAQ,mBAAmB,KACzB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,gBAAgB,CAAA;CAAE,GAAG,CAC9C;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAMnD,CAAC"}

package/dist/actions/perform_action.js

@@ -58,6 +58,7 @@ import { DEV } from 'esm-env';
 import { apply_authorization_phase, has_any_scoped_role } from '../auth/request_context.js';
 import {} from '../hono_context.js';
 import { to_input_params } from '../http/schema_helpers.js';
+import { rate_limit_ip_key } from '../http/ip_canonical.js';
 import { dispatch_with_post_commit_rollback } from '../http/pending_effects.js';
 import { JSONRPC_VERSION } from '../http/jsonrpc.js';
 import { jsonrpc_error_messages, jsonrpc_error_code_to_http_status, http_status_to_jsonrpc_error_code, JSONRPC_ERROR_CODES, dev_only } from '../http/jsonrpc_errors.js';
@@ -119,14 +120,17 @@ export const perform_action = async (input, deps) => {
     // budget it should, and so a throttled caller pays no schema work.
     const rate_limit = spec.rate_limit;
     if (rate_limit) {
-        const ip_check = action_ip_rate_limiter && (rate_limit === 'ip' || rate_limit === 'both');
+        const ip_limiter = rate_limit === 'ip' || rate_limit === 'both' ? action_ip_rate_limiter : null;
         const account_keyed_context = action_account_rate_limiter &&
             request_context !== null &&
             (rate_limit === 'account' || rate_limit === 'both')
             ? request_context
             : null;
-        if (ip_check) {
-            const result = action_ip_rate_limiter.check(client_ip);
+        // keyed by the address's rate-limit key (an IPv6 client's /64); the
+        // audit trail keeps `client_ip` whole
+        const ip_key = ip_limiter ? rate_limit_ip_key(client_ip) : '';
+        if (ip_limiter) {
+            const result = ip_limiter.check(ip_key);
             if (!result.allowed)
                 return rate_limited_result(result.retry_after);
         }
@@ -135,8 +139,8 @@ export const perform_action = async (input, deps) => {
             if (!result.allowed)
                 return rate_limited_result(result.retry_after);
         }
-        if (ip_check)
-            action_ip_rate_limiter.record(client_ip);
+        if (ip_limiter)
+            ip_limiter.record(ip_key);
         if (account_keyed_context) {
             action_account_rate_limiter.record(account_keyed_context.account.id);
         }
@@ -262,6 +266,19 @@ const check_action_auth_pre_authorization = (auth, account_id) => {
     }
     return null;
 };
+/**
+ * The credential-type 403 — one builder, so the dispatcher's gate below and a
+ * handler that gates a credential channel on its input (`account_delete`'s
+ * self path) emit a byte-identical error. Twin of the Rust
+ * `fuz_auth::credential_type_required`.
+ *
+ * @param required_credential_types - the channels that would be admitted
+ * @returns the `forbidden` error object with reason `credential_type_required`
+ */
+export const credential_type_required_error = (required_credential_types) => jsonrpc_error_messages.forbidden('forbidden', {
+    reason: ERROR_CREDENTIAL_TYPE_REQUIRED,
+    required_credential_types
+});
 /**
  * Post-authorization auth gate — fires after the authorization phase
  * resolved the actor + role_grants. Enforces `auth.credential_types` and
@@ -289,10 +306,7 @@ const check_action_auth_pre_authorization = (auth, account_id) => {
 const check_action_auth_post_authorization = (auth, request_context, credential_type, method, token_scope) => {
     if (auth.credential_types?.length) {
         if (!credential_type || !auth.credential_types.includes(credential_type)) {
-            return jsonrpc_error_messages.forbidden('forbidden', {
-                reason: ERROR_CREDENTIAL_TYPE_REQUIRED,
-                required_credential_types: auth.credential_types
-            });
+            return credential_type_required_error(auth.credential_types);
         }
     }
     // Token-scope gate — second of three. See the doc comment for why the order