@fuzdev/fuz_app 0.54.0 → 0.56.0

package/dist/testing/db.js

@@ -164,8 +164,8 @@ export const AUTH_TRUNCATE_TABLES = [
     'invite',
     'api_token',
     'auth_session',
-    'permit',
-    'permit_offer',
+    'role_grant',
+    'role_grant_offer',
     'actor',
     'account',
 ];
@@ -192,8 +192,8 @@ export const AUTH_DROP_TABLES = [
     'audit_log',
     'api_token',
     'auth_session',
-    'permit',
-    'permit_offer',
+    'role_grant',
+    'role_grant_offer',
     'actor',
     'account',
     'bootstrap_lock',

package/dist/testing/db_entities.d.ts

@@ -0,0 +1,22 @@
+import './assert_dev_env.js';
+import type { Account, Actor } from '../auth/account_schema.js';
+import type { Db } from '../db/db.js';
+/** The `{account, actor}` row pair returned by `create_test_account_with_actor`. */
+export interface TestAccountWithActor {
+    account: Account;
+    actor: Actor;
+}
+/**
+ * Create an `account` + `actor` row pair in the database for tests.
+ *
+ * Wraps `query_create_account_with_actor` with a default `password_hash`
+ * so suites that don't exercise password verification can stay terse.
+ * Replaces the per-file `create_user` / `create_test_actor` /
+ * `create_test_account` helpers that had accumulated across the auth
+ * test suite.
+ */
+export declare const create_test_account_with_actor: (db: Db, options: {
+    username: string;
+    password_hash?: string;
+}) => Promise<TestAccountWithActor>;
+//# sourceMappingURL=db_entities.d.ts.map

package/dist/testing/db_entities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db_entities.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/db_entities.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAoB7B,OAAO,KAAK,EAAC,OAAO,EAAE,KAAK,EAAC,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAC,EAAE,EAAC,MAAM,aAAa,CAAC;AAEpC,oFAAoF;AACpF,MAAM,WAAW,oBAAoB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;CACb;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,GAC1C,IAAI,EAAE,EACN,SAAS;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAC,KACjD,OAAO,CAAC,oBAAoB,CAI7B,CAAC"}

package/dist/testing/db_entities.js

@@ -0,0 +1,28 @@
+import './assert_dev_env.js';
+/**
+ * DB-backed entity factories for tests that need real `account` + `actor`
+ * rows in the database.
+ *
+ * Companion to `entities.ts` — that file ships in-memory factories
+ * (`create_test_account`, `create_test_actor`) for tests that mock the
+ * DB; this file ships factories that hit a real `Db` so query-level
+ * tests don't reimplement the same `query_create_account_with_actor`
+ * wrapper in every file.
+ *
+ * For full-fledged test accounts that also need an API token + signed
+ * session cookie + role_grants, use `bootstrap_test_account` from
+ * `app_server.ts` instead.
+ *
+ * @module
+ */
+import { query_create_account_with_actor } from '../auth/account_queries.js';
+/**
+ * Create an `account` + `actor` row pair in the database for tests.
+ *
+ * Wraps `query_create_account_with_actor` with a default `password_hash`
+ * so suites that don't exercise password verification can stay terse.
+ * Replaces the per-file `create_user` / `create_test_actor` /
+ * `create_test_account` helpers that had accumulated across the auth
+ * test suite.
+ */
+export const create_test_account_with_actor = async (db, options) => query_create_account_with_actor({ db }, { username: options.username, password_hash: options.password_hash ?? 'hash' });

package/dist/testing/entities.d.ts

@@ -1,5 +1,5 @@
 import './assert_dev_env.js';
-import type { Account, Actor, Permit } from '../auth/account_schema.js';
+import type { Account, Actor, RoleGrant } from '../auth/account_schema.js';
 import type { AuditLogEvent } from '../auth/audit_log_schema.js';
 import type { RequestContext } from '../auth/request_context.js';
 /** Override type for `create_test_account` — id-like fields accept plain `string`. */
@@ -18,25 +18,27 @@ export type TestActorOverrides = Partial<Omit<Actor, 'id' | 'account_id' | 'upda
 };
 /** Create a test `Actor` with sensible defaults. */
 export declare const create_test_actor: (overrides?: TestActorOverrides) => Actor;
-/** Override type for `create_test_permit` — id-like fields accept plain `string`. */
-export type TestPermitOverrides = Partial<Omit<Permit, 'id' | 'actor_id' | 'scope_id' | 'revoked_by' | 'granted_by' | 'source_offer_id'>> & {
+/** Override type for `create_test_role_grant` — id-like fields accept plain `string`. */
+export type TestRoleGrantOverrides = Partial<Omit<RoleGrant, 'id' | 'actor_id' | 'scope_kind' | 'scope_id' | 'revoked_by' | 'granted_by' | 'source_offer_id'>> & {
     id?: string;
     actor_id?: string;
+    scope_kind?: string | null;
     scope_id?: string | null;
     revoked_by?: string | null;
     granted_by?: string | null;
     source_offer_id?: string | null;
 };
-/** Create a test `Permit` with sensible defaults. */
-export declare const create_test_permit: (overrides?: TestPermitOverrides) => Permit;
-/** Create a test `RequestContext` with permits from partial overrides. */
-export declare const create_test_context: (permits?: Array<TestPermitOverrides>) => RequestContext;
+/** Create a test `RoleGrant` with sensible defaults. */
+export declare const create_test_role_grant: (overrides?: TestRoleGrantOverrides) => RoleGrant;
+/** Create a test `RequestContext` with role_grants from partial overrides. */
+export declare const create_test_context: (role_grants?: Array<TestRoleGrantOverrides>) => RequestContext;
 /** Override type for `create_test_audit_event` — id-like fields accept plain `string`. */
-export type TestAuditEventOverrides = Partial<Omit<AuditLogEvent, 'id' | 'actor_id' | 'account_id' | 'target_account_id'>> & {
+export type TestAuditEventOverrides = Partial<Omit<AuditLogEvent, 'id' | 'actor_id' | 'account_id' | 'target_account_id' | 'target_actor_id'>> & {
     id?: string;
     actor_id?: string | null;
     account_id?: string | null;
     target_account_id?: string | null;
+    target_actor_id?: string | null;
 };
 /** Create a test `AuditLogEvent` with sensible defaults. */
 export declare const create_test_audit_event: (overrides?: TestAuditEventOverrides) => AuditLogEvent;

package/dist/testing/entities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entities.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/entities.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAiB7B,OAAO,KAAK,EAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAC,MAAM,2BAA2B,CAAC;AACtE,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,4BAA4B,CAAC;AAE/D,sFAAsF;AACtF,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,YAAY,GAAG,YAAY,CAAC,CAAC,GAAG;IAC/F,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,sDAAsD;AACtD,eAAO,MAAM,mBAAmB,GAAI,YAAY,oBAAoB,KAAG,OAWrE,CAAC;AAEH,oFAAoF;AACpF,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,YAAY,GAAG,YAAY,CAAC,CAAC,GAAG;IAC3F,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,oDAAoD;AACpD,eAAO,MAAM,iBAAiB,GAAI,YAAY,kBAAkB,KAAG,KAQjE,CAAC;AAEH,qFAAqF;AACrF,MAAM,MAAM,mBAAmB,GAAG,OAAO,CACxC,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,YAAY,GAAG,iBAAiB,CAAC,CAC9F,GAAG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAEF,qDAAqD;AACrD,eAAO,MAAM,kBAAkB,GAAI,YAAY,mBAAmB,KAAG,MAanE,CAAC;AAEH,0EAA0E;AAC1E,eAAO,MAAM,mBAAmB,GAC/B,UAAS,KAAK,CAAC,mBAAmB,CAAQ,KACxC,cAID,CAAC;AAEH,0FAA0F;AAC1F,MAAM,MAAM,uBAAuB,GAAG,OAAO,CAC5C,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,UAAU,GAAG,YAAY,GAAG,mBAAmB,CAAC,CAC3E,GAAG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,GAAI,YAAY,uBAAuB,KAAG,aAY5E,CAAC"}
+{"version":3,"file":"entities.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/entities.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAiB7B,OAAO,KAAK,EAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAC,MAAM,2BAA2B,CAAC;AACzE,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,4BAA4B,CAAC;AAE/D,sFAAsF;AACtF,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,GAAG,YAAY,GAAG,YAAY,CAAC,CAAC,GAAG;IAC/F,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,sDAAsD;AACtD,eAAO,MAAM,mBAAmB,GAAI,YAAY,oBAAoB,KAAG,OAWrE,CAAC;AAEH,oFAAoF;AACpF,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,GAAG,YAAY,GAAG,YAAY,CAAC,CAAC,GAAG;IAC3F,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,oDAAoD;AACpD,eAAO,MAAM,iBAAiB,GAAI,YAAY,kBAAkB,KAAG,KAQjE,CAAC;AAEH,yFAAyF;AACzF,MAAM,MAAM,sBAAsB,GAAG,OAAO,CAC3C,IAAI,CACH,SAAS,EACT,IAAI,GAAG,UAAU,GAAG,YAAY,GAAG,UAAU,GAAG,YAAY,GAAG,YAAY,GAAG,iBAAiB,CAC/F,CACD,GAAG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,sBAAsB,GAAI,YAAY,sBAAsB,KAAG,SAgB3E,CAAC;AAEF,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,GAC/B,cAAa,KAAK,CAAC,sBAAsB,CAAQ,KAC/C,cAID,CAAC;AAEH,0FAA0F;AAC1F,MAAM,MAAM,uBAAuB,GAAG,OAAO,CAC5C,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,UAAU,GAAG,YAAY,GAAG,mBAAmB,GAAG,iBAAiB,CAAC,CAC/F,GAAG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,GAAI,YAAY,uBAAuB,KAAG,aAa5E,CAAC"}

package/dist/testing/entities.js

@@ -22,26 +22,29 @@ export const create_test_actor = (overrides) => ({
     updated_by: null,
     ...overrides,
 });
-/** Create a test `Permit` with sensible defaults. */
-export const create_test_permit = (overrides) => ({
-    id: 'permit-test',
-    actor_id: 'actor-test',
-    role: 'admin',
-    scope_id: null,
-    created_at: '2024-01-01T00:00:00Z',
-    expires_at: null,
-    revoked_at: null,
-    revoked_by: null,
-    revoked_reason: null,
-    granted_by: null,
-    source_offer_id: null,
-    ...overrides,
-});
-/** Create a test `RequestContext` with permits from partial overrides. */
-export const create_test_context = (permits = [{}]) => ({
+/** Create a test `RoleGrant` with sensible defaults. */
+export const create_test_role_grant = (overrides) => {
+    const base = {
+        id: 'role-grant-test',
+        actor_id: 'actor-test',
+        role: 'admin',
+        scope_kind: null,
+        scope_id: null,
+        created_at: '2024-01-01T00:00:00Z',
+        expires_at: null,
+        revoked_at: null,
+        revoked_by: null,
+        revoked_reason: null,
+        granted_by: null,
+        source_offer_id: null,
+    };
+    return overrides ? { ...base, ...overrides } : base;
+};
+/** Create a test `RequestContext` with role_grants from partial overrides. */
+export const create_test_context = (role_grants = [{}]) => ({
     account: create_test_account(),
     actor: create_test_actor(),
-    permits: permits.map((p) => create_test_permit(p)),
+    role_grants: role_grants.map((p) => create_test_role_grant(p)),
 });
 /** Create a test `AuditLogEvent` with sensible defaults. */
 export const create_test_audit_event = (overrides) => ({
@@ -52,6 +55,7 @@ export const create_test_audit_event = (overrides) => ({
     actor_id: 'actor-test',
     account_id: 'acct-test',
     target_account_id: null,
+    target_actor_id: null,
     ip: '127.0.0.1',
     created_at: '2024-01-01T00:00:00Z',
     metadata: null,

package/dist/testing/integration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAsB7B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAA6C,KAAK,eAAe,EAAC,MAAM,iBAAiB,CAAC;AACjG,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,SAAS,CAAC;AAOjB,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAqB1B;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC9C,4CAA4C;IAC5C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,wDAAwD;IACxD,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,iDAAiD;IACjD,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;OAGG;IACH,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAChC;;;;;;;;;;;;;;;;OAgBG;IACH,aAAa,EAAE,uBAAuB,CAAC;CACvC;AAsBD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,mCAAmC,GAC/C,SAAS,8BAA8B,KACrC,IAg8CF,CAAC"}
+{"version":3,"file":"integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAsB7B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAA6C,KAAK,eAAe,EAAC,MAAM,iBAAiB,CAAC;AACjG,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,SAAS,CAAC;AAOjB,OAAO,EAKN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAsB1B;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC9C,4CAA4C;IAC5C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,wDAAwD;IACxD,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,iDAAiD;IACjD,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;OAGG;IACH,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAChC;;;;;;;;;;;;;;;;OAgBG;IACH,aAAa,EAAE,uBAAuB,CAAC;CACvC;AAsBD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,mCAAmC,GAC/C,SAAS,8BAA8B,KACrC,IA87CF,CAAC"}

package/dist/testing/integration.js

@@ -26,6 +26,7 @@ import { RateLimiter } from '../rate_limiter.js';
 import { run_migrations } from '../db/migrate.js';
 import { ErrorCoverageCollector, assert_error_coverage, DEFAULT_INTEGRATION_ERROR_COVERAGE, } from './error_coverage.js';
 import { ApiError, ERROR_FORBIDDEN_ORIGIN } from '../http/error_schemas.js';
+import { is_public_auth } from '../http/auth_shape.js';
 import { account_verify_action_spec, account_session_list_action_spec, account_session_revoke_action_spec, account_session_revoke_all_action_spec, account_token_create_action_spec, account_token_list_action_spec, account_token_revoke_action_spec, } from '../auth/account_action_specs.js';
 import { invite_create_action_spec } from '../auth/admin_action_specs.js';
 /**
@@ -93,7 +94,7 @@ export const describe_standard_integration_tests = (options) => {
                 // dilute the coverage percentage; admin-role routes are scoped
                 // to the admin suite instead.
                 const auth_routes = captured_route_specs.filter((s) => {
-                    if (s.auth.type === 'role' && s.auth.role === 'admin')
+                    if (s.auth.roles?.includes('admin') ?? false)
                         return false;
                     const rest_suffixes = ['/login', '/logout', '/password', '/signup', '/bootstrap'];
                     if (rest_suffixes.some((suffix) => s.path.endsWith(suffix)))
@@ -645,7 +646,7 @@ export const describe_standard_integration_tests = (options) => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
                 // admin routes are optional in the base suite — admin-specific coverage
                 // lives in describe_standard_admin_integration_tests
-                const admin_route = test_app.route_specs.find((s) => s.auth.type === 'role' && s.auth.role === 'admin');
+                const admin_route = test_app.route_specs.find((s) => s.auth.roles?.includes('admin') ?? false);
                 if (!admin_route)
                     return;
                 const res = await test_app.app.request(admin_route.path, {
@@ -788,11 +789,9 @@ export const describe_standard_integration_tests = (options) => {
         // --- 9. Response body validation ---
         describe('response body validation', () => {
             // `assert_response_matches_spec` validates REST `RouteSpec` outputs.
-            // The account REST routes that used to cover this (/verify, /sessions,
-            // /tokens, /tokens/create) moved to RPC in the 2026-04-23 migration,
-            // so we exercise the remaining REST endpoints (/login, /logout,
-            // /password) against their declared schemas. RPC output validation is
-            // covered by `describe_rpc_round_trip_tests`.
+            // Session/token CRUD lives on the RPC surface; only /login, /logout,
+            // /password remain as REST routes whose responses we exercise here.
+            // RPC output validation is covered by `describe_rpc_round_trip_tests`.
             test('POST /login 401 response matches declared error schema', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
                 const login_route = find_auth_route(test_app.route_specs, '/login', 'POST');
@@ -1091,12 +1090,12 @@ export const describe_standard_integration_tests = (options) => {
         describe('signup invite edge cases', () => {
             test('signup with non-matching email cannot claim another email invite', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
-                const signup_route = test_app.route_specs.find((s) => s.method === 'POST' && s.path.endsWith('/signup') && s.auth.type === 'none');
+                const signup_route = test_app.route_specs.find((s) => s.method === 'POST' && s.path.endsWith('/signup') && is_public_auth(s.auth));
                 if (!signup_route)
                     return; // signup is optional
-                // `invite_create` became RPC-only in the 2026-04-23 migration.
-                // Consumers that don't wire admin RPC actions can't exercise invites;
-                // skip the test rather than fail.
+                // `invite_create` lives on the RPC surface; consumers that don't
+                // wire admin RPC actions can't exercise invites — skip the test
+                // rather than fail.
                 if (!find_rpc_action(rpc_endpoints_for_setup, invite_create_action_spec.method))
                     return;
                 // Create an admin to manage invites
@@ -1137,11 +1136,11 @@ export const describe_standard_integration_tests = (options) => {
             test('no-invite and conflict failure responses are structurally identical', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
                 // Find signup route (POST ending in /signup, public)
-                const signup_route = test_app.route_specs.find((s) => s.method === 'POST' && s.path.endsWith('/signup') && s.auth.type === 'none');
+                const signup_route = test_app.route_specs.find((s) => s.method === 'POST' && s.path.endsWith('/signup') && is_public_auth(s.auth));
                 if (!signup_route)
                     return; // signup is optional
-                // `invite_create` became RPC-only in the 2026-04-23 migration.
-                // Consumers that don't wire admin RPC actions can't exercise invites.
+                // `invite_create` lives on the RPC surface; consumers that don't
+                // wire admin RPC actions can't exercise invites.
                 if (!find_rpc_action(rpc_endpoints_for_setup, invite_create_action_spec.method))
                     return;
                 // We need admin access — create an admin account

package/dist/testing/integration_helpers.d.ts

@@ -12,10 +12,10 @@ import type { TestApp, TestAccount } from './app_server.js';
  */
 export declare const find_route_spec: (specs: Array<RouteSpec>, method: string, path: string) => RouteSpec | undefined;
 /**
- * REST auth route suffixes still on the account/bootstrap surface after the
- * 2026-04-22 RPC migration. `find_auth_route` rejects any other suffix at
- * runtime — session/token CRUD, admin operations, and permit flows live on
- * the RPC surface and should be reached via `rpc_call`.
+ * REST auth route suffixes on the account/bootstrap surface — the only
+ * routes still REST. `find_auth_route` rejects any other suffix at runtime;
+ * session/token CRUD, admin operations, and role_grant flows live on the RPC
+ * surface and should be reached via `rpc_call`.
  */
 export declare const REST_AUTH_ROUTE_SUFFIXES: readonly ["/login", "/logout", "/password", "/verify", "/signup", "/bootstrap"];
 export type RestAuthRouteSuffix = (typeof REST_AUTH_ROUTE_SUFFIXES)[number];
@@ -59,11 +59,13 @@ export declare const check_error_response_fields: (body: Record<string, unknown>
  * Assert that an error response contains no leaky field values.
  *
  * Checks both field names and string values for patterns indicating
- * stack traces, SQL, or internal paths.
+ * stack traces, SQL, or internal paths. Accepts `unknown` so callers
+ * pass response bodies / nested envelope fields directly without
+ * intermediate `as` casts; non-object bodies skip the field-name check.
  *
  * @param context - description for error messages
  */
-export declare const assert_no_error_info_leakage: (body: Record<string, unknown>, context: string) => void;
+export declare const assert_no_error_info_leakage: (body: unknown, context: string) => void;
 /**
  * Assert that a 429 response includes a valid `Retry-After` header
  * matching the JSON body's `retry_after` field.

package/dist/testing/integration_helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integration_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAU7B,OAAO,KAAK,EAAC,SAAS,EAAE,WAAW,EAAC,MAAM,uBAAuB,CAAC;AAElE,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAA8B,KAAK,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAE3F,OAAO,KAAK,EAAC,OAAO,EAAE,WAAW,EAAC,MAAM,iBAAiB,CAAC;AAE1D;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,GAC3B,OAAO,KAAK,CAAC,SAAS,CAAC,EACvB,QAAQ,MAAM,EACd,MAAM,MAAM,KACV,SAAS,GAAG,SAad,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,iFAO3B,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,GAC3B,OAAO,KAAK,CAAC,SAAS,CAAC,EACvB,QAAQ,mBAAmB,EAC3B,QAAQ,WAAW,KACjB,SAAS,GAAG,SAOd,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,GACxC,aAAa,KAAK,CAAC,SAAS,CAAC,EAC7B,QAAQ,MAAM,EACd,MAAM,MAAM,EACZ,UAAU,QAAQ,KAChB,OAAO,CAAC,IAAI,CAmDd,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B,GACtC,SAAS,OAAO,EAChB,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,OAAO,CAAC,MAAM,CAGhB,CAAC;AAgCF;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,GAAI,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,KAAK,CAAC,MAAM,CAQvF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,MAAM,KACb,IAkBF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,oCAAoC,GAChD,UAAU,QAAQ,EAClB,MAAM;IAAC,WAAW,EAAE,MAAM,CAAA;CAAC,KACzB,IAUF,CAAC;AAIF,oEAAoE;AACpE,eAAO,MAAM,yBAAyB,EAAE,aAAa,CAAC,MAAM,CAAmC,CAAC;AAEhG,0EAA0E;AAC1E,eAAO,MAAM,0BAA0B,EAAE,aAAa,CAAC,MAAM,CAAgC,CAAC;AAE9F;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,GAAI,OAAO,OAAO,KAAG,GAAG,CAAC,MAAM,CAetE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,GAC9C,MAAM,OAAO,EACb,WAAW,aAAa,CAAC,MAAM,CAAC,EAChC,SAAS,MAAM,KACb,IAKF,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,UAAU,OAAO,EACjB,gBAAgB,WAAW,EAC3B,eAAe,WAAW,KACxB,MAAM,CAAC,MAAM,EAAE,MAAM,CAcvB,CAAC"}
+{"version":3,"file":"integration_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAU7B,OAAO,KAAK,EAAC,SAAS,EAAE,WAAW,EAAC,MAAM,uBAAuB,CAAC;AAGlE,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAA8B,KAAK,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAE3F,OAAO,KAAK,EAAC,OAAO,EAAE,WAAW,EAAC,MAAM,iBAAiB,CAAC;AAE1D;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,GAC3B,OAAO,KAAK,CAAC,SAAS,CAAC,EACvB,QAAQ,MAAM,EACd,MAAM,MAAM,KACV,SAAS,GAAG,SAad,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,iFAO3B,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,GAC3B,OAAO,KAAK,CAAC,SAAS,CAAC,EACvB,QAAQ,mBAAmB,EAC3B,QAAQ,WAAW,KACjB,SAAS,GAAG,SAOd,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,GACxC,aAAa,KAAK,CAAC,SAAS,CAAC,EAC7B,QAAQ,MAAM,EACd,MAAM,MAAM,EACZ,UAAU,QAAQ,KAChB,OAAO,CAAC,IAAI,CAmDd,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,0BAA0B,GACtC,SAAS,OAAO,EAChB,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,OAAO,CAAC,MAAM,CAGhB,CAAC;AAgCF;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,GAAI,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,KAAK,CAAC,MAAM,CAQvF,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,GAAI,MAAM,OAAO,EAAE,SAAS,MAAM,KAAG,IAoB7E,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,oCAAoC,GAChD,UAAU,QAAQ,EAClB,MAAM;IAAC,WAAW,EAAE,MAAM,CAAA;CAAC,KACzB,IAUF,CAAC;AAIF,oEAAoE;AACpE,eAAO,MAAM,yBAAyB,EAAE,aAAa,CAAC,MAAM,CAAmC,CAAC;AAEhG,0EAA0E;AAC1E,eAAO,MAAM,0BAA0B,EAAE,aAAa,CAAC,MAAM,CAAgC,CAAC;AAE9F;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,GAAI,OAAO,OAAO,KAAG,GAAG,CAAC,MAAM,CAetE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,GAC9C,MAAM,OAAO,EACb,WAAW,aAAa,CAAC,MAAM,CAAC,EAChC,SAAS,MAAM,KACb,IAKF,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,UAAU,OAAO,EACjB,gBAAgB,WAAW,EAC3B,eAAe,WAAW,KACxB,MAAM,CAAC,MAAM,EAAE,MAAM,CAevB,CAAC"}

package/dist/testing/integration_helpers.js

@@ -6,6 +6,7 @@ import './assert_dev_env.js';
  */
 import { assert } from 'vitest';
 import { is_null_schema, merge_error_schemas } from '../http/schema_helpers.js';
+import { is_public_auth } from '../http/auth_shape.js';
 import { create_session_cookie_value } from '../auth/session_cookie.js';
 import { ROLE_ADMIN } from '../auth/role_schema.js';
 /**
@@ -32,10 +33,10 @@ export const find_route_spec = (specs, method, path) => {
     });
 };
 /**
- * REST auth route suffixes still on the account/bootstrap surface after the
- * 2026-04-22 RPC migration. `find_auth_route` rejects any other suffix at
- * runtime — session/token CRUD, admin operations, and permit flows live on
- * the RPC surface and should be reached via `rpc_call`.
+ * REST auth route suffixes on the account/bootstrap surface — the only
+ * routes still REST. `find_auth_route` rejects any other suffix at runtime;
+ * session/token CRUD, admin operations, and role_grant flows live on the RPC
+ * surface and should be reached via `rpc_call`.
  */
 export const REST_AUTH_ROUTE_SUFFIXES = [
     '/login',
@@ -133,9 +134,9 @@ export const create_expired_test_cookie = async (keyring, session_options) => {
 const KNOWN_SAFE_ERROR_FIELDS = new Set([
     'error',
     'issues',
-    'required_role',
+    'required_roles',
+    'required_credential_types',
     'retry_after',
-    'credential_type',
     'has_references',
     'ok',
 ]);
@@ -172,16 +173,20 @@ export const check_error_response_fields = (body) => {
  * Assert that an error response contains no leaky field values.
  *
  * Checks both field names and string values for patterns indicating
- * stack traces, SQL, or internal paths.
+ * stack traces, SQL, or internal paths. Accepts `unknown` so callers
+ * pass response bodies / nested envelope fields directly without
+ * intermediate `as` casts; non-object bodies skip the field-name check.
  *
  * @param context - description for error messages
  */
 export const assert_no_error_info_leakage = (body, context) => {
     const body_str = JSON.stringify(body);
-    for (const pattern of LEAKY_FIELD_PATTERNS) {
-        // check field names (not values — 'error' legitimately contains error codes)
-        for (const key of Object.keys(body)) {
-            assert.ok(!key.toLowerCase().includes(pattern), `${context}: error response field '${key}' matches leaky pattern '${pattern}'`);
+    if (body !== null && typeof body === 'object' && !Array.isArray(body)) {
+        for (const pattern of LEAKY_FIELD_PATTERNS) {
+            // check field names (not values — 'error' legitimately contains error codes)
+            for (const key of Object.keys(body)) {
+                assert.ok(!key.toLowerCase().includes(pattern), `${context}: error response field '${key}' matches leaky pattern '${pattern}'`);
+            }
         }
     }
     // check for stack traces and file paths in values
@@ -250,17 +255,18 @@ export const assert_no_sensitive_fields_in_json = (body, blocklist, context) =>
  * - `keeper` — the test app's daemon token
  */
 export const pick_auth_headers = (spec, test_app, authed_account, admin_account) => {
-    switch (spec.auth.type) {
-        case 'none':
-            return { host: 'localhost', origin: 'http://localhost:5173' };
-        case 'authenticated':
-            return authed_account.create_session_headers();
-        case 'role':
-            if (spec.auth.role === ROLE_ADMIN) {
-                return admin_account.create_session_headers();
-            }
-            return test_app.create_session_headers();
-        case 'keeper':
-            return test_app.create_daemon_token_headers();
+    const { auth } = spec;
+    if (is_public_auth(auth)) {
+        return { host: 'localhost', origin: 'http://localhost:5173' };
+    }
+    if (auth.credential_types?.includes('daemon_token')) {
+        return test_app.create_daemon_token_headers();
+    }
+    if (auth.roles?.length) {
+        if (auth.roles.includes(ROLE_ADMIN)) {
+            return admin_account.create_session_headers();
+        }
+        return test_app.create_session_headers();
     }
+    return authed_account.create_session_headers();
 };

package/dist/testing/middleware.d.ts

@@ -25,10 +25,10 @@ export interface BearerAuthTestOptions {
     mock_validate_result?: unknown;
     /** What `query_account_by_id()` returns. */
     mock_find_by_id_result?: unknown;
-    /** What `query_actor_by_account()` returns. */
-    mock_find_by_account_result?: unknown;
-    /** What `query_permit_find_active_for_actor()` returns. */
-    mock_permits_result?: unknown;
+    /** What `query_actor_by_id()` returns. */
+    mock_find_actor_by_id_result?: unknown;
+    /** What `query_role_grant_find_active_for_actor()` returns. */
+    mock_role_grants_result?: unknown;
     /** Expected HTTP status, or `'next'` if the middleware should call `next()`. */
     expected_status: number | 'next';
     /** Expected `error` field in JSON response body. */
@@ -40,11 +40,13 @@ export interface BearerAuthTestOptions {
 export interface BearerAuthTestCase extends BearerAuthTestOptions {
     /** Whether the request should reach token validation or be short-circuited. */
     validate_expectation: 'called' | 'not_called';
-    /** If true, assert `REQUEST_CONTEXT_KEY` and `CREDENTIAL_TYPE_KEY` were set to api_token values. */
-    assert_context_set?: boolean;
+    /** If true, assert `ACCOUNT_ID_KEY` was set and `CREDENTIAL_TYPE_KEY` is `'api_token'`. */
+    assert_account_set?: boolean;
+    /** Expected `ACCOUNT_ID_KEY` value when `assert_account_set` is true. */
+    expected_account_id?: string;
     /** If set, assert `AUTH_API_TOKEN_ID_KEY` was set to this value after a successful bearer auth. */
     expected_api_token_id?: string;
-    /** If true, assert the pre-existing session context and credential type are preserved. */
+    /** If true, assert the pre-existing session `ACCOUNT_ID_KEY` and credential type are preserved. */
     assert_context_preserved?: boolean;
     /** Optional callback for custom spy assertions on the mocks bundle. */
     assert_mocks?: (mocks: BearerAuthMocks) => void;
@@ -53,19 +55,20 @@ export interface BearerAuthTestCase extends BearerAuthTestOptions {
 export interface BearerAuthMocks {
     mock_validate: ReturnType<typeof vi.fn>;
     mock_find_by_id: ReturnType<typeof vi.fn>;
-    mock_find_by_account: ReturnType<typeof vi.fn>;
+    mock_find_actor_by_id: ReturnType<typeof vi.fn>;
+    mock_find_actors_by_account: ReturnType<typeof vi.fn>;
     mock_find_active_for_actor: ReturnType<typeof vi.fn>;
 }
 /**
  * Create mock dependencies for `create_bearer_auth_middleware`, configured per test case.
  *
  * Configures the module-level mocks for `query_validate_api_token`,
- * `query_account_by_id`, `query_actor_by_account`, and `query_permit_find_active_for_actor`
+ * `query_account_by_id`, `query_actor_by_id`, and `query_role_grant_find_active_for_actor`
  * so each test case controls return values independently.
  *
  * @returns mocks bundle with spy references
  * @mutates module-level `vi.mock` registrations for `api_token_queries`,
- *   `account_queries`, and `permit_queries` — each call resets and re-binds
+ *   `account_queries`, and `role_grant_queries` — each call resets and re-binds
  *   the four spies, so cases run in sequence without bleeding state.
  */
 export declare const create_bearer_auth_mocks: (tc: BearerAuthTestOptions) => BearerAuthMocks;
@@ -105,7 +108,8 @@ export interface TestMiddlewareStackApp {
     app: Hono;
     mock_validate: ReturnType<typeof vi.fn>;
     mock_find_by_id: ReturnType<typeof vi.fn>;
-    mock_find_by_account: ReturnType<typeof vi.fn>;
+    mock_find_actor_by_id: ReturnType<typeof vi.fn>;
+    mock_find_actors_by_account: ReturnType<typeof vi.fn>;
     mock_find_active_for_actor: ReturnType<typeof vi.fn>;
 }
 /**

package/dist/testing/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;GAQG;AAEH,OAAO,EAAC,EAAE,EAAyB,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAC,IAAI,EAAC,MAAM,MAAM,CAAC;AAC1B,OAAO,KAAK,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAU3B,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAsB,KAAK,cAAc,EAAC,MAAM,4BAA4B,CAAC;AAqBpF,gEAAgE;AAChE,MAAM,WAAW,qBAAqB;IACrC,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,oEAAoE;IACpE,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,4CAA4C;IAC5C,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,+CAA+C;IAC/C,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,2DAA2D;IAC3D,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,gFAAgF;IAChF,eAAe,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;CAClC;AAED,gEAAgE;AAChE,MAAM,WAAW,kBAAmB,SAAQ,qBAAqB;IAChE,+EAA+E;IAC/E,oBAAoB,EAAE,QAAQ,GAAG,YAAY,CAAC;IAC9C,oGAAoG;IACpG,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,mGAAmG;IACnG,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,0FAA0F;IAC1F,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,uEAAuE;IACvE,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;CAChD;AAID,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC/B,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,eAAe,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1C,oBAAoB,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/C,0BAA0B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACrD;AAKD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,GAAI,IAAI,qBAAqB,KAAG,eAoBpE,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,cAAc,cAAc,CAAC;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GACvC,IAAI,qBAAqB,EACzB,kBAAiB,WAAW,GAAG,IAAW,KACxC;IAAC,GAAG,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CA6CpC,CAAC;AAIF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,GACtC,YAAY,MAAM,EAClB,OAAO,KAAK,CAAC,kBAAkB,CAAC,EAChC,kBAAiB,WAAW,GAAG,IAAW,KACxC,IAkEF,CAAC;AAIF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAEhD,sDAAsD;AACtD,MAAM,WAAW,0BAA0B;IAC1C,iDAAiD;IACjD,eAAe,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IACpD,oDAAoD;IACpD,eAAe,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CACrC;AAED,yDAAyD;AACzD,MAAM,WAAW,sBAAsB;IACtC,GAAG,EAAE,IAAI,CAAC;IACV,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,eAAe,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1C,oBAAoB,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/C,0BAA0B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACrD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC,GAC5C,UAAU,0BAA0B,KAClC,sBAiDF,CAAC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;GAQG;AAEH,OAAO,EAAC,EAAE,EAAyB,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAC,IAAI,EAAC,MAAM,MAAM,CAAC;AAC1B,OAAO,KAAK,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAc3B,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAsB,KAAK,cAAc,EAAC,MAAM,4BAA4B,CAAC;AA2BpF,gEAAgE;AAChE,MAAM,WAAW,qBAAqB;IACrC,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,oEAAoE;IACpE,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,4CAA4C;IAC5C,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,0CAA0C;IAC1C,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,+DAA+D;IAC/D,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,gFAAgF;IAChF,eAAe,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;CAClC;AAED,gEAAgE;AAChE,MAAM,WAAW,kBAAmB,SAAQ,qBAAqB;IAChE,+EAA+E;IAC/E,oBAAoB,EAAE,QAAQ,GAAG,YAAY,CAAC;IAC9C,2FAA2F;IAC3F,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,yEAAyE;IACzE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mGAAmG;IACnG,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mGAAmG;IACnG,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,uEAAuE;IACvE,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;CAChD;AAID,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC/B,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,eAAe,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1C,qBAAqB,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,2BAA2B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,0BAA0B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACrD;AAKD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,GAAI,IAAI,qBAAqB,KAAG,eAoCpE,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,cAAc,cAAc,CAAC;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GACvC,IAAI,qBAAqB,EACzB,kBAAiB,WAAW,GAAG,IAAW,KACxC;IAAC,GAAG,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAyDpC,CAAC;AAIF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,GACtC,YAAY,MAAM,EAClB,OAAO,KAAK,CAAC,kBAAkB,CAAC,EAChC,kBAAiB,WAAW,GAAG,IAAW,KACxC,IAyEF,CAAC;AAIF,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAEhD,sDAAsD;AACtD,MAAM,WAAW,0BAA0B;IAC1C,iDAAiD;IACjD,eAAe,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChC,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IACpD,oDAAoD;IACpD,eAAe,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CACrC;AAED,yDAAyD;AACzD,MAAM,WAAW,sBAAsB;IACtC,GAAG,EAAE,IAAI,CAAC;IACV,aAAa,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACxC,eAAe,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1C,qBAAqB,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,2BAA2B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,0BAA0B,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACrD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gCAAgC,GAC5C,UAAU,0BAA0B,KAClC,sBA4DF,CAAC"}