@fuzdev/fuz_app 0.140.0 → 0.142.0

package/dist/testing/stubs.js

@@ -19,8 +19,9 @@ import { create_app_surface_spec } from '../http/surface.js';
 import { resolve_ws_endpoints } from '../actions/ws_endpoint_spec.js';
 import { AUDIT_LOG_SSE_MAX_PER_SCOPE } from '../realtime/sse_auth_guard.js';
 import { SubscriberRegistry } from '../realtime/subscriber_registry.js';
+import { ROLE_ADMIN } from '../auth/role_schema.js';
 import { BaseServerEnv } from '../server/env.js';
-import { AUTH_MIDDLEWARE_PATH, assert_endpoint_in_auth_scope, assert_middleware_stack_mounted } from '../auth/middleware.js';
+import { AUTH_MIDDLEWARE_PATH, ORIGIN_MIDDLEWARE_PATH, assert_credential_routes_in_auth_scope, assert_endpoint_in_auth_scope, assert_middleware_stack_mounted, assert_origin_carve_outs_valid, freeze_origin_carve_outs } from '../auth/middleware.js';
 /**
  * Create a Proxy that throws descriptive errors on any property access or method call.
  *
@@ -133,7 +134,8 @@ export const create_stub_audit_sse = () => {
     return {
         log: new Logger('test:audit_sse', { level: 'off' }),
         on_audit_event: () => { },
-        registry
+        registry,
+        required_role: ROLE_ADMIN
     };
 };
 /**
@@ -177,12 +179,15 @@ const create_stub_mw = () => async (_c, next) => next();
  * `assert_middleware_stack_mounted` can tell the layers apart by identity.
  */
 export const create_stub_api_middleware = (options) => {
+    const origin_carve_outs = freeze_origin_carve_outs(options?.origin_carve_outs ?? []);
+    assert_origin_carve_outs_valid(origin_carve_outs);
     const specs = [
         {
             name: 'origin',
-            path: AUTH_MIDDLEWARE_PATH,
+            path: ORIGIN_MIDDLEWARE_PATH,
             handler: create_stub_mw(),
-            errors: { 403: ApiError }
+            errors: { 403: ApiError },
+            ...(origin_carve_outs.length > 0 && { carve_outs: origin_carve_outs })
         },
         { name: 'session', path: AUTH_MIDDLEWARE_PATH, handler: create_stub_mw() },
         { name: 'request_context', path: AUTH_MIDDLEWARE_PATH, handler: create_stub_mw() },
@@ -258,7 +263,9 @@ const to_self_resolved_ws_endpoint = (endpoint) => {
  * `GET /api/surface` (with `surface_route: true`), then surface
  * generation — including its
  * refusal of an `rpc_endpoints` or `ws_endpoints` path outside the auth
- * middleware's scope (`assert_endpoint_in_auth_scope`) and of a
+ * middleware's scope (`assert_endpoint_in_auth_scope`), of a route that
+ * reads or mints a credential outside it
+ * (`assert_credential_routes_in_auth_scope`), and of a
  * `transform_middleware` that doesn't keep the proxy and auth stack mounted
  * (`assert_middleware_stack_mounted`). The middleware list mirrors the real
  * one: a stub `trusted_proxy` spec at `'*'`, then the stub auth stack (with
@@ -268,7 +275,8 @@ const to_self_resolved_ws_endpoint = (endpoint) => {
  *
  * @param options - surface spec options
  * @returns the surface spec for the standard suites
- * @throws Error when an endpoint path is outside `AUTH_MIDDLEWARE_PATH`, a
+ * @throws Error when an endpoint path, or a route that reads or mints a
+ *   credential, is outside `AUTH_MIDDLEWARE_PATH`, a
  *   `ws_endpoints` spec declares no `allowed_origins` and no `allowed_origins`
  *   option is given, or `transform_middleware` moves, drops, duplicates,
  *   reorders, wraps, or replaces the stub proxy spec or a stub auth spec
@@ -339,10 +347,15 @@ export const create_test_app_surface_spec = (options) => {
         ...rpc_route_specs,
         ...surface_route_specs
     ];
+    // refused like `create_app_server` refuses it
+    assert_credential_routes_in_auth_scope(route_specs);
     // mirrors `create_app_server`'s `[proxy_spec, ...auth_middleware]`
     const stack_specs = [
         { name: 'trusted_proxy', path: '*', handler: create_stub_mw() },
-        ...create_stub_api_middleware({ include_daemon_token: options.daemon_token })
+        ...create_stub_api_middleware({
+            include_daemon_token: options.daemon_token,
+            origin_carve_outs: options.origin_carve_outs
+        })
     ];
     let middleware_specs = stack_specs;
     if (options.transform_middleware) {

package/dist/testing/surface_invariants.js

@@ -17,7 +17,7 @@ import './assert_dev_env.js';
  * @module
  */
 import { assert } from 'vitest';
-import { middleware_applies } from '../http/schema_helpers.js';
+import { middleware_spec_applies } from '../http/schema_helpers.js';
 import { filter_protected_routes, filter_role_routes, filter_keeper_routes, filter_credential_gated_routes, filter_routes_with_input, filter_routes_with_params, filter_routes_with_query, filter_public_routes, format_route_key } from '../http/surface_query.js';
 import { PROTOCOL_ACTION_METHODS } from '../actions/action_codegen.js';
 // --- Structural invariants ---
@@ -100,7 +100,7 @@ export const assert_middleware_errors_propagated = (surface) => {
     const middleware_with_errors = surface.middleware.filter((m) => m.error_schemas !== null);
     for (const route of surface.routes) {
         for (const mw of middleware_with_errors) {
-            if (!middleware_applies(mw.path, route.path))
+            if (!middleware_spec_applies(mw, route.path))
                 continue;
             for (const status of Object.keys(mw.error_schemas)) {
                 assert.ok(route.error_schemas && status in route.error_schemas, `${format_route_key(route)} missing status ${status} from middleware '${mw.name}'`);

package/dist/ui/auth_state.svelte.d.ts

@@ -32,6 +32,16 @@
  * @module
  */
 import { type ActorSummaryJson, type RoleGrantSummaryJson, type SessionAccount } from '../auth/account_schema.js';
+/**
+ * The message a `429` shows, from its `retry_after` (seconds).
+ *
+ * A short wait reads as one — the spines answer `retry_after: 1` when the cap
+ * is held only by attempts still in flight — rather than rounding up to a
+ * minute; a missing value reads as a minute.
+ *
+ * @param retry_after - the response's `retry_after`, when it carried one
+ */
+export declare const format_rate_limit_message: (retry_after: unknown) => string;
 /**
  * Svelte context for `AuthState`.
  * Use `auth_state_context.set(state)` in the provider and `auth_state_context.get()` to access.

package/dist/ui/auth_state.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/auth_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAMH,OAAO,EACN,KAAK,gBAAgB,EAErB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,MAAM,2BAA2B,CAAC;AAGnC;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;CAA8B,CAAC;AAE9D,qBAAa,SAAS;IACrB,SAAS,UAAqB;IAC9B,QAAQ,UAAqB;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC/C,OAAO,EAAE,cAAc,GAAG,IAAI,CAAoB;IAClD,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAoB;IAClD,WAAW,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAkB;IAC1D;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAEtD;IACF;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAExC;IACF,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAA+C;IAEzE,gEAAgE;IAChE,eAAe,UAAqB;IAEpC;;;;;;OAMG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAItC;;;;;;;;OAQG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IA6BpC;;;;;;;OAOG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA0CjE;;;;;OAKG;IACG,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiCpF;;;;;;;OAOG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA8ClF;;;;;OAKG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAe7B"}
+{"version":3,"file":"auth_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/auth_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAMH,OAAO,EACN,KAAK,gBAAgB,EAErB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,MAAM,2BAA2B,CAAC;AAGnC;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,GAAI,aAAa,OAAO,KAAG,MAShE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;CAA8B,CAAC;AAE9D,qBAAa,SAAS;IACrB,SAAS,UAAqB;IAC9B,QAAQ,UAAqB;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC/C,OAAO,EAAE,cAAc,GAAG,IAAI,CAAoB;IAClD,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAoB;IAClD,WAAW,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAkB;IAC1D;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAEtD;IACF;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAExC;IACF,wFAAwF;IACxF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAA+C;IAEzE,gEAAgE;IAChE,eAAe,UAAqB;IAEpC;;;;;;OAMG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAItC;;;;;;;;OAQG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IA6BpC;;;;;;;OAOG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAuCjE;;;;;OAKG;IACG,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiCpF;;;;;;;OAOG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2ClF;;;;;OAKG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAe7B"}

package/dist/ui/auth_state.svelte.js

@@ -36,6 +36,26 @@ import { create_context } from '@fuzdev/fuz_ui/context_helpers.ts';
 import { ui_fetch } from './ui_fetch.js';
 import { is_role_grant_active } from '../auth/account_schema.js';
 import { ROLE_ADMIN } from '../auth/role_schema.js';
+/**
+ * The message a `429` shows, from its `retry_after` (seconds).
+ *
+ * A short wait reads as one — the spines answer `retry_after: 1` when the cap
+ * is held only by attempts still in flight — rather than rounding up to a
+ * minute; a missing value reads as a minute.
+ *
+ * @param retry_after - the response's `retry_after`, when it carried one
+ */
+export const format_rate_limit_message = (retry_after) => {
+    const seconds = typeof retry_after === 'number' && retry_after > 0 ? retry_after : 60;
+    if (seconds <= 5)
+        return 'Too many attempts. Try again in a moment.';
+    if (seconds < 60) {
+        const whole = Math.ceil(seconds);
+        return `Too many attempts. Try again in ${whole} second${whole === 1 ? '' : 's'}.`;
+    }
+    const minutes = Math.ceil(seconds / 60);
+    return `Too many attempts. Try again in ${minutes} minute${minutes === 1 ? '' : 's'}.`;
+};
 /**
  * Svelte context for `AuthState`.
  * Use `auth_state_context.set(state)` in the provider and `auth_state_context.get()` to access.
@@ -145,8 +165,7 @@ export class AuthState {
             if (response.status === 429) {
                 try {
                     const data = await response.json();
-                    const minutes = Math.ceil((data.retry_after ?? 60) / 60);
-                    this.verify_error = `Too many attempts. Try again in ${minutes} minute${minutes === 1 ? '' : 's'}.`;
+                    this.verify_error = format_rate_limit_message(data.retry_after);
                 }
                 catch {
                     this.verify_error = 'Too many attempts. Try again later.';
@@ -234,8 +253,7 @@ export class AuthState {
             if (response.status === 429) {
                 try {
                     const data = await response.json();
-                    const minutes = Math.ceil((data.retry_after ?? 60) / 60);
-                    this.verify_error = `Too many attempts. Try again in ${minutes} minute${minutes === 1 ? '' : 's'}.`;
+                    this.verify_error = format_rate_limit_message(data.retry_after);
                 }
                 catch {
                     this.verify_error = 'Too many attempts. Try again later.';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.140.0",
+  "version": "0.142.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",

package/dist/db/cell_history_ddl.d.ts

@@ -1,38 +0,0 @@
-/**
- * Cell history PG schema (schema only).
- *
- * Lightweight references to cell state snapshots. Heavy data (serialized
- * cell bytes) lives in the fact store; `fact_hash` points there. The
- * snapshot lifecycle (when to serialize, hash, store, and record) is
- * deferred to a future iteration — this only stages the table so
- * downstream code can target a stable schema. The table ships
- * present-but-unwritten.
- *
- * `fact_hash` is intentionally **not** a foreign key to `fact(hash)` —
- * snapshots may be evicted by GC policy while history rows remain as audit
- * traces, and federation may target facts on another instance.
- *
- * Depends on `CELL_MIGRATION_NS` (FK on `cell.id`).
- *
- * @module
- */
-import type { Migration, MigrationNamespace } from './migrate.js';
-/** `cell_history` table — append-only log of cell snapshot references. */
-export declare const CELL_HISTORY_SCHEMA = "\nCREATE TABLE IF NOT EXISTS cell_history (\n\tid BIGSERIAL PRIMARY KEY,\n\tcell_id UUID NOT NULL REFERENCES cell(id) ON DELETE CASCADE,\n\tfact_hash TEXT NOT NULL,\n\taction_id UUID,\n\tcreated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()\n)";
-/**
- * Cell-history indexes.
- *
- * - `idx_cell_history_cell`: per-cell timeline reads (newest first).
- * - `idx_cell_history_fact`: fact → cells reverse lookup for GC liveness
- *   and provenance queries.
- */
-export declare const CELL_HISTORY_INDEXES: Array<string>;
-/** Tables created by `CELL_HISTORY_MIGRATION_NS`, in drop order. */
-export declare const CELL_HISTORY_DROP_TABLES: readonly ["cell_history"];
-/** Cell-history migrations. */
-export declare const CELL_HISTORY_MIGRATIONS: Array<Migration>;
-/** Namespace identifier for cell-history migrations. */
-export declare const CELL_HISTORY_MIGRATION_NAMESPACE = "fuz_cell_history";
-/** Migration namespace consumed by `run_migrations`. */
-export declare const CELL_HISTORY_MIGRATION_NS: MigrationNamespace;
-//# sourceMappingURL=cell_history_ddl.d.ts.map

package/dist/db/cell_history_ddl.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cell_history_ddl.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_history_ddl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElE,0EAA0E;AAC1E,eAAO,MAAM,mBAAmB,gPAO9B,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAK9C,CAAC;AAEF,oEAAoE;AACpE,eAAO,MAAM,wBAAwB,2BAA4B,CAAC;AAElE,+BAA+B;AAC/B,eAAO,MAAM,uBAAuB,EAAE,KAAK,CAAC,SAAS,CAUpD,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,gCAAgC,qBAAqB,CAAC;AAEnE,wDAAwD;AACxD,eAAO,MAAM,yBAAyB,EAAE,kBAGvC,CAAC"}

package/dist/db/cell_history_ddl.js

@@ -1,61 +0,0 @@
-/**
- * Cell history PG schema (schema only).
- *
- * Lightweight references to cell state snapshots. Heavy data (serialized
- * cell bytes) lives in the fact store; `fact_hash` points there. The
- * snapshot lifecycle (when to serialize, hash, store, and record) is
- * deferred to a future iteration — this only stages the table so
- * downstream code can target a stable schema. The table ships
- * present-but-unwritten.
- *
- * `fact_hash` is intentionally **not** a foreign key to `fact(hash)` —
- * snapshots may be evicted by GC policy while history rows remain as audit
- * traces, and federation may target facts on another instance.
- *
- * Depends on `CELL_MIGRATION_NS` (FK on `cell.id`).
- *
- * @module
- */
-/** `cell_history` table — append-only log of cell snapshot references. */
-export const CELL_HISTORY_SCHEMA = `
-CREATE TABLE IF NOT EXISTS cell_history (
-	id BIGSERIAL PRIMARY KEY,
-	cell_id UUID NOT NULL REFERENCES cell(id) ON DELETE CASCADE,
-	fact_hash TEXT NOT NULL,
-	action_id UUID,
-	created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
-)`;
-/**
- * Cell-history indexes.
- *
- * - `idx_cell_history_cell`: per-cell timeline reads (newest first).
- * - `idx_cell_history_fact`: fact → cells reverse lookup for GC liveness
- *   and provenance queries.
- */
-export const CELL_HISTORY_INDEXES = [
-    `CREATE INDEX IF NOT EXISTS idx_cell_history_cell
-		ON cell_history(cell_id, created_at DESC)`,
-    `CREATE INDEX IF NOT EXISTS idx_cell_history_fact
-		ON cell_history(fact_hash)`
-];
-/** Tables created by `CELL_HISTORY_MIGRATION_NS`, in drop order. */
-export const CELL_HISTORY_DROP_TABLES = ['cell_history'];
-/** Cell-history migrations. */
-export const CELL_HISTORY_MIGRATIONS = [
-    {
-        name: 'full_cell_history_schema',
-        up: async (db) => {
-            await db.query(CELL_HISTORY_SCHEMA);
-            for (const sql of CELL_HISTORY_INDEXES) {
-                await db.query(sql);
-            }
-        }
-    }
-];
-/** Namespace identifier for cell-history migrations. */
-export const CELL_HISTORY_MIGRATION_NAMESPACE = 'fuz_cell_history';
-/** Migration namespace consumed by `run_migrations`. */
-export const CELL_HISTORY_MIGRATION_NS = {
-    namespace: CELL_HISTORY_MIGRATION_NAMESPACE,
-    migrations: CELL_HISTORY_MIGRATIONS
-};