@fuzdev/fuz_app 0.54.0 → 0.56.0

package/dist/testing/middleware.js

@@ -13,12 +13,12 @@ import { Hono } from 'hono';
 import { Logger } from '@fuzdev/fuz_util/log.js';
 import { create_bearer_auth_middleware } from '../auth/bearer_auth.js';
 import { query_validate_api_token } from '../auth/api_token_queries.js';
-import { query_account_by_id, query_actor_by_account } from '../auth/account_queries.js';
-import { query_permit_find_active_for_actor } from '../auth/permit_queries.js';
+import { query_account_by_id, query_actor_by_id, query_actors_by_account, } from '../auth/account_queries.js';
+import { query_role_grant_find_active_for_actor } from '../auth/role_grant_queries.js';
 import { create_proxy_middleware, get_client_ip } from '../http/proxy.js';
 import { verify_request_source, parse_allowed_origins } from '../http/origin.js';
 import { REQUEST_CONTEXT_KEY } from '../auth/request_context.js';
-import { AUTH_API_TOKEN_ID_KEY, CREDENTIAL_TYPE_KEY } from '../hono_context.js';
+import { ACCOUNT_ID_KEY, AUTH_API_TOKEN_ID_KEY, CREDENTIAL_TYPE_KEY, TEST_CONTEXT_PRESET_KEY, } from '../hono_context.js';
 import { ApiError } from '../http/error_schemas.js';
 // Mock the query modules so test cases can control return values.
 // vi.mock() is hoisted by vitest, so these run before any imports resolve.
@@ -27,10 +27,11 @@ vi.mock('../auth/api_token_queries.js', () => ({
 }));
 vi.mock('../auth/account_queries.js', () => ({
     query_account_by_id: vi.fn(),
-    query_actor_by_account: vi.fn(),
+    query_actor_by_id: vi.fn(),
+    query_actors_by_account: vi.fn(),
 }));
-vi.mock('../auth/permit_queries.js', () => ({
-    query_permit_find_active_for_actor: vi.fn(),
+vi.mock('../auth/role_grant_queries.js', () => ({
+    query_role_grant_find_active_for_actor: vi.fn(),
 }));
 /** Stub `QueryDeps` for bearer auth tests (no real DB needed). */
 const STUB_DEPS = { db: {} };
@@ -38,32 +39,48 @@ const STUB_DEPS = { db: {} };
  * Create mock dependencies for `create_bearer_auth_middleware`, configured per test case.
  *
  * Configures the module-level mocks for `query_validate_api_token`,
- * `query_account_by_id`, `query_actor_by_account`, and `query_permit_find_active_for_actor`
+ * `query_account_by_id`, `query_actor_by_id`, and `query_role_grant_find_active_for_actor`
  * so each test case controls return values independently.
  *
  * @returns mocks bundle with spy references
  * @mutates module-level `vi.mock` registrations for `api_token_queries`,
- *   `account_queries`, and `permit_queries` — each call resets and re-binds
+ *   `account_queries`, and `role_grant_queries` — each call resets and re-binds
  *   the four spies, so cases run in sequence without bleeding state.
  */
 export const create_bearer_auth_mocks = (tc) => {
     const mock_validate = vi.mocked(query_validate_api_token);
     const mock_find_by_id = vi.mocked(query_account_by_id);
-    const mock_find_by_account = vi.mocked(query_actor_by_account);
-    const mock_find_active_for_actor = vi.mocked(query_permit_find_active_for_actor);
+    const mock_find_actor_by_id = vi.mocked(query_actor_by_id);
+    const mock_find_actors_by_account = vi.mocked(query_actors_by_account);
+    const mock_find_active_for_actor = vi.mocked(query_role_grant_find_active_for_actor);
     mock_validate
         .mockReset()
         .mockImplementation(() => Promise.resolve(tc.mock_validate_result));
     mock_find_by_id
         .mockReset()
         .mockImplementation(() => Promise.resolve(tc.mock_find_by_id_result));
-    mock_find_by_account
+    mock_find_actor_by_id
         .mockReset()
-        .mockImplementation(() => Promise.resolve(tc.mock_find_by_account_result));
+        .mockImplementation(() => Promise.resolve(tc.mock_find_actor_by_id_result));
+    // `resolve_acting_actor` enumerates actors. Default: wrap the
+    // `mock_find_actor_by_id_result` in a single-element array so
+    // single-actor account scenarios resolve transparently; empty when
+    // the actor mock is undefined/null. Multi-actor scenarios should
+    // override this directly via `mockResolvedValue`.
+    mock_find_actors_by_account.mockReset().mockImplementation(() => {
+        const actor = tc.mock_find_actor_by_id_result;
+        return Promise.resolve(actor ? [actor] : []);
+    });
     mock_find_active_for_actor
         .mockReset()
-        .mockImplementation(() => Promise.resolve(tc.mock_permits_result ?? []));
-    return { mock_validate, mock_find_by_id, mock_find_by_account, mock_find_active_for_actor };
+        .mockImplementation(() => Promise.resolve(tc.mock_role_grants_result ?? []));
+    return {
+        mock_validate,
+        mock_find_by_id,
+        mock_find_actor_by_id,
+        mock_find_actors_by_account,
+        mock_find_active_for_actor,
+    };
 };
 /** Default client IP set by the proxy stub in test apps. */
 export const TEST_CLIENT_IP = '127.0.0.1';
@@ -77,11 +94,20 @@ export const create_bearer_auth_test_app = (tc, ip_rate_limiter = null) => {
     const mocks = create_bearer_auth_mocks(tc);
     const bearer_middleware = create_bearer_auth_middleware(STUB_DEPS, ip_rate_limiter, new Logger('test', { level: 'off' }));
     const app = new Hono();
-    // inject pre-existing request context if the test case specifies one
+    // inject pre-existing session identity if the test case specifies one.
+    // `pre_context` simulates the session middleware having authenticated
+    // the caller — sets `ACCOUNT_ID_KEY` (the account-grain identity bearer
+    // auth checks) and pre-populates `REQUEST_CONTEXT_KEY` as a test
+    // escape-hatch (production bearer middleware is account-only and never
+    // sets this key — see `auth/CLAUDE.md` Production-middleware invariant)
+    // so consumer expectations on the full context shape stay testable.
     if (tc.pre_context) {
+        const pre_context = tc.pre_context;
         app.use('*', async (c, next) => {
-            c.set(REQUEST_CONTEXT_KEY, tc.pre_context);
+            c.set(ACCOUNT_ID_KEY, pre_context.account.id);
+            c.set(REQUEST_CONTEXT_KEY, pre_context);
             c.set(CREDENTIAL_TYPE_KEY, 'session');
+            c.set(TEST_CONTEXT_PRESET_KEY, true);
             await next();
         });
     }
@@ -91,19 +117,22 @@ export const create_bearer_auth_test_app = (tc, ip_rate_limiter = null) => {
         await next();
     });
     app.use('/api/*', bearer_middleware);
-    // route handler echoes full context state for assertions
+    // route handler echoes the account-grain identity the middleware writes
+    // (bearer auth sets `ACCOUNT_ID_KEY` + `CREDENTIAL_TYPE_KEY` +
+    // `AUTH_API_TOKEN_ID_KEY`; it never builds the full request context —
+    // that is the dispatcher's authorization phase). `request_context_set`
+    // is only true when a test pre-populates it via `pre_context`.
     app.get('/api/test', (c) => {
-        const ctx = c.get(REQUEST_CONTEXT_KEY);
+        const account_id = c.get(ACCOUNT_ID_KEY);
         const cred = c.get(CREDENTIAL_TYPE_KEY);
         const api_token_id = c.get(AUTH_API_TOKEN_ID_KEY);
+        const ctx = c.get(REQUEST_CONTEXT_KEY);
         return c.json({
             ok: true,
-            has_context: ctx != null,
+            account_id: account_id ?? null,
             credential_type: cred ?? null,
-            account_id: ctx?.account.id ?? null,
-            actor_id: ctx?.actor.id ?? null,
-            permit_count: ctx?.permits.length ?? 0,
             api_token_id: api_token_id ?? null,
+            request_context_set: ctx != null,
         });
     });
     return { app, mocks };
@@ -141,15 +170,18 @@ export const describe_bearer_auth_cases = (suite_name, cases, ip_rate_limiter =
                 else {
                     assert.ok(mocks.mock_validate.mock.calls.length > 0, 'validate should have been called');
                 }
-                if (tc.assert_context_set) {
-                    assert.strictEqual(body.has_context, true, 'REQUEST_CONTEXT_KEY should be set');
+                if (tc.assert_account_set) {
+                    assert.ok(body.account_id, 'ACCOUNT_ID_KEY should be set');
+                    if (tc.expected_account_id !== undefined) {
+                        assert.strictEqual(body.account_id, tc.expected_account_id, 'ACCOUNT_ID_KEY should match the validated api_token.account_id');
+                    }
                     assert.strictEqual(body.credential_type, 'api_token', 'CREDENTIAL_TYPE_KEY should be api_token');
                 }
                 if (tc.expected_api_token_id !== undefined) {
                     assert.strictEqual(body.api_token_id, tc.expected_api_token_id, 'AUTH_API_TOKEN_ID_KEY should match the validated api_token.id');
                 }
                 if (tc.assert_context_preserved) {
-                    assert.strictEqual(body.has_context, true, 'original context should be preserved');
+                    assert.ok(body.account_id, 'pre-existing account_id should be preserved');
                     assert.strictEqual(body.credential_type, 'session', 'credential type should remain session');
                 }
                 if (tc.assert_mocks) {
@@ -177,11 +209,13 @@ export const create_test_middleware_stack_app = (options) => {
     const allowed_origins_str = options?.allowed_origins ?? 'https://app.example.com';
     const mock_validate = vi.mocked(query_validate_api_token);
     const mock_find_by_id = vi.mocked(query_account_by_id);
-    const mock_find_by_account = vi.mocked(query_actor_by_account);
-    const mock_find_active_for_actor = vi.mocked(query_permit_find_active_for_actor);
+    const mock_find_actor_by_id = vi.mocked(query_actor_by_id);
+    const mock_find_actors_by_account = vi.mocked(query_actors_by_account);
+    const mock_find_active_for_actor = vi.mocked(query_role_grant_find_active_for_actor);
     mock_validate.mockReset().mockImplementation(() => Promise.resolve(undefined));
     mock_find_by_id.mockReset().mockImplementation(() => Promise.resolve(undefined));
-    mock_find_by_account.mockReset().mockImplementation(() => Promise.resolve(undefined));
+    mock_find_actor_by_id.mockReset().mockImplementation(() => Promise.resolve(undefined));
+    mock_find_actors_by_account.mockReset().mockImplementation(() => Promise.resolve([]));
     mock_find_active_for_actor.mockReset().mockImplementation(() => Promise.resolve([]));
     const get_connection_ip = typeof options?.connection_ip === 'function'
         ? options.connection_ip
@@ -197,14 +231,23 @@ export const create_test_middleware_stack_app = (options) => {
     app.use('*', proxy_mw);
     app.use('/api/*', origin_mw);
     app.use('/api/*', bearer_mw);
-    // echo route for assertions
+    // echo route for assertions — exposes the account-grain identity bearer
+    // auth writes (`ACCOUNT_ID_KEY`); the full request context is the
+    // dispatcher's authorization phase concern, not middleware.
     app.get(TEST_MIDDLEWARE_PATH, (c) => {
-        const ctx = c.get(REQUEST_CONTEXT_KEY);
+        const account_id = c.get(ACCOUNT_ID_KEY);
         return c.json({
             ok: true,
             client_ip: get_client_ip(c),
-            has_context: ctx != null,
+            account_id: account_id ?? null,
         });
     });
-    return { app, mock_validate, mock_find_by_id, mock_find_by_account, mock_find_active_for_actor };
+    return {
+        app,
+        mock_validate,
+        mock_find_by_id,
+        mock_find_actor_by_id,
+        mock_find_actors_by_account,
+        mock_find_active_for_actor,
+    };
 };

package/dist/testing/rpc_attack_surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc_attack_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_attack_surface.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAkB7B,OAAO,KAAK,EAA6C,cAAc,EAAC,MAAM,oBAAoB,CAAC;AAoBnG,uDAAuD;AACvD,MAAM,WAAW,uBAAuB;IACvC,+FAA+F;IAC/F,KAAK,EAAE,MAAM,cAAc,CAAC;IAC5B,yDAAyD;IACzD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACrB;AAodD;;;;;;;;;GASG;AACH,eAAO,MAAM,iCAAiC,GAAI,SAAS,uBAAuB,KAAG,IAOpF,CAAC"}
+{"version":3,"file":"rpc_attack_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_attack_surface.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAkB7B,OAAO,KAAK,EAA6C,cAAc,EAAC,MAAM,oBAAoB,CAAC;AAqBnG,uDAAuD;AACvD,MAAM,WAAW,uBAAuB;IACvC,+FAA+F;IAC/F,KAAK,EAAE,MAAM,cAAc,CAAC;IAC5B,yDAAyD;IACzD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACrB;AA0dD;;;;;;;;;GASG;AACH,eAAO,MAAM,iCAAiC,GAAI,SAAS,uBAAuB,KAAG,IAOpF,CAAC"}

package/dist/testing/rpc_attack_surface.js

@@ -13,18 +13,23 @@ import './assert_dev_env.js';
  * @module
  */
 import { test, assert, describe } from 'vitest';
+import { is_keeper_auth, is_public_auth, is_role_auth } from '../http/auth_shape.js';
 import { JSONRPC_ERROR_CODES } from '../http/jsonrpc_errors.js';
 import { create_auth_test_apps, create_test_app_from_specs, create_test_request_context, select_auth_app, } from './auth_apps.js';
 import { generate_input_test_cases } from './adversarial_input.js';
+import { generate_valid_body } from './schema_generators.js';
 import { ERROR_INVALID_JSON_BODY } from '../http/error_schemas.js';
 import { create_rpc_post_init, create_rpc_get_url, assert_jsonrpc_error_response, } from './rpc_helpers.js';
 // --- Helpers ---
 /** Filter RPC methods that require any form of authentication. */
-const filter_protected_rpc_methods = (endpoint) => endpoint.methods.filter((m) => m.auth.type !== 'none');
-/** Filter RPC methods that require a specific role. */
-const filter_role_rpc_methods = (endpoint) => endpoint.methods.filter((m) => m.auth.type === 'role');
-/** Filter RPC methods that require keeper auth (daemon_token + keeper role). */
-const filter_keeper_rpc_methods = (endpoint) => endpoint.methods.filter((m) => m.auth.type === 'keeper');
+const filter_protected_rpc_methods = (endpoint) => endpoint.methods.filter((m) => !is_public_auth(m.auth));
+/** Filter RPC methods that declare a role gate (`auth.roles?.length`). */
+const filter_role_rpc_methods = (endpoint) => endpoint.methods.filter((m) => is_role_auth(m.auth));
+/**
+ * Filter RPC methods that require daemon-token credentials. Today this
+ * is the keeper bucket; future credential gates will widen the filter.
+ */
+const filter_keeper_rpc_methods = (endpoint) => endpoint.methods.filter((m) => is_keeper_auth(m.auth));
 /** Find the `RpcAction` source spec for a surface method. */
 const find_rpc_action = (rpc_endpoint_specs, endpoint_path, method_name) => {
     const ep = rpc_endpoint_specs.find((e) => e.path === endpoint_path);
@@ -47,7 +52,7 @@ const find_rpc_action = (rpc_endpoint_specs, endpoint_path, method_name) => {
  */
 const describe_rpc_auth = (options) => {
     const { build, roles } = options;
-    const { surface, route_specs } = build();
+    const { surface, route_specs, rpc_endpoints: rpc_endpoint_specs } = build();
     if (surface.rpc_endpoints.length === 0)
         return;
     const apps = create_auth_test_apps(route_specs, roles);
@@ -71,13 +76,18 @@ const describe_rpc_auth = (options) => {
                 if (role_methods.length > 0) {
                     describe('wrong role → forbidden', () => {
                         for (const method of role_methods) {
-                            const wrong_roles = roles.filter((r) => r !== method.auth.role);
+                            const required_roles = method.auth.roles ?? [];
+                            const wrong_roles = roles.filter((r) => !required_roles.includes(r));
                             for (const wrong_role of wrong_roles) {
-                                test(`${method.name} (${wrong_role} instead of ${method.auth.role})`, async () => {
+                                test(`${method.name} (${wrong_role} instead of ${required_roles.join('|')})`, async () => {
                                     const app = apps.by_role.get(wrong_role);
                                     if (!app)
                                         throw new Error(`No test app for role '${wrong_role}'`);
-                                    const res = await app.request(endpoint.path, create_rpc_post_init(method.name));
+                                    // Send valid params so we trip the role gate (403), not input
+                                    // validation (400). Dispatcher ordering: 401 → 400 → 403.
+                                    const action = find_rpc_action(rpc_endpoint_specs, endpoint.path, method.name);
+                                    const params = action ? generate_valid_body(action.spec.input) : undefined;
+                                    const res = await app.request(endpoint.path, create_rpc_post_init(method.name, params));
                                     assert.strictEqual(res.status, 403, `${method.name} should return 403`);
                                     const body = await res.json();
                                     assert_jsonrpc_error_response(body, JSONRPC_ERROR_CODES.forbidden);
@@ -87,8 +97,12 @@ const describe_rpc_auth = (options) => {
                     });
                     describe('authenticated without role → forbidden', () => {
                         for (const method of role_methods) {
-                            test(`${method.name} (${method.auth.role})`, async () => {
-                                const res = await apps.authed.request(endpoint.path, create_rpc_post_init(method.name));
+                            test(`${method.name} (${(method.auth.roles ?? []).join('|')})`, async () => {
+                                // Send valid params so we trip the role gate (403), not input
+                                // validation (400).
+                                const action = find_rpc_action(rpc_endpoint_specs, endpoint.path, method.name);
+                                const params = action ? generate_valid_body(action.spec.input) : undefined;
+                                const res = await apps.authed.request(endpoint.path, create_rpc_post_init(method.name, params));
                                 assert.strictEqual(res.status, 403, `${method.name} should return 403`);
                                 const body = await res.json();
                                 assert_jsonrpc_error_response(body, JSONRPC_ERROR_CODES.forbidden);
@@ -102,14 +116,16 @@ const describe_rpc_auth = (options) => {
                         const session_app = create_test_app_from_specs(route_specs, create_test_request_context('keeper'), 'session');
                         const api_token_app = create_test_app_from_specs(route_specs, create_test_request_context('keeper'), 'api_token');
                         for (const method of keeper_methods) {
+                            const action = find_rpc_action(rpc_endpoint_specs, endpoint.path, method.name);
+                            const valid_params = action ? generate_valid_body(action.spec.input) : undefined;
                             test(`${method.name} rejects session credential`, async () => {
-                                const res = await session_app.request(endpoint.path, create_rpc_post_init(method.name));
+                                const res = await session_app.request(endpoint.path, create_rpc_post_init(method.name, valid_params));
                                 assert.strictEqual(res.status, 403, `${method.name} should reject session credential`);
                                 const body = await res.json();
                                 assert_jsonrpc_error_response(body, JSONRPC_ERROR_CODES.forbidden);
                             });
                             test(`${method.name} rejects api_token credential`, async () => {
-                                const res = await api_token_app.request(endpoint.path, create_rpc_post_init(method.name));
+                                const res = await api_token_app.request(endpoint.path, create_rpc_post_init(method.name, valid_params));
                                 assert.strictEqual(res.status, 403, `${method.name} should reject api_token credential`);
                                 const body = await res.json();
                                 assert_jsonrpc_error_response(body, JSONRPC_ERROR_CODES.forbidden);
@@ -279,7 +295,7 @@ const describe_rpc_adversarial_envelopes = (options) => {
                         return;
                     // valid JSON but not an object — hits dispatcher's params validation
                     const res = await apps.public.request(`${endpoint.path}?method=${read_method.name}&id=test&params=42`);
-                    // should reject: either invalid_params (step 4) or auth error (step 3)
+                    // should reject: either invalid_params (validation) or auth error
                     assert.ok(res.status >= 400, `expected error status for non-object params, got ${res.status}`);
                     const body = await res.json();
                     assert_jsonrpc_error_response(body);
@@ -362,16 +378,16 @@ const describe_rpc_adversarial_params = (options) => {
 // --- Helpers (formatting) ---
 /** Format a `RouteAuth` as a human-readable label. */
 const format_auth = (auth) => {
-    switch (auth.type) {
-        case 'none':
-            return 'public';
-        case 'authenticated':
-            return 'authenticated';
-        case 'role':
-            return `role: ${auth.role}`;
-        case 'keeper':
-            return 'keeper';
-    }
+    if (is_public_auth(auth))
+        return 'public';
+    const parts = [];
+    parts.push(`account:${auth.account}`);
+    parts.push(`actor:${auth.actor}`);
+    if (auth.roles?.length)
+        parts.push(`roles:${auth.roles.join('|')}`);
+    if (auth.credential_types?.length)
+        parts.push(`creds:${auth.credential_types.join('|')}`);
+    return parts.join(' ');
 };
 // --- Public API ---
 /**

package/dist/testing/rpc_helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAa7B,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,OAAO,EAIN,KAAK,gBAAgB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,2BAA2B,CAAC;AACzE,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,0BAA0B,CAAC;AACxD,OAAO,KAAK,EAAC,qBAAqB,EAAE,mBAAmB,EAAE,eAAe,EAAC,MAAM,oBAAoB,CAAC;AACpG,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAG9D;;;;;;;;GAQG;AACH,MAAM,MAAM,uBAAuB,GAChC,KAAK,CAAC,eAAe,CAAC,GACtB,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;AAEvD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,+BAA+B,GAC3C,eAAe,uBAAuB,EACtC,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,KAAK,CAAC,eAAe,CAuBvB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,GAChC,QAAQ,MAAM,EACd,SAAS,OAAO,EAChB,KAAI,MAAM,GAAG,MAAe,KAC1B,WAQF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAC9B,eAAe,MAAM,EACrB,QAAQ,MAAM,EACd,SAAS,OAAO,EAChB,KAAI,MAAM,GAAG,MAAe,KAC1B,MAMF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,OAAO,EACb,gBAAgB,gBAAgB,KAC9B,IAUF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,+BAA+B,GAAI,MAAM,OAAO,EAAE,gBAAgB,CAAC,CAAC,OAAO,KAAG,IAU1F,CAAC;AAIF;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAErF,2DAA2D;AAC3D,eAAO,MAAM,cAAc,GACzB,KAAK;IACL,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;CAC5E,KAAG,gBAEmB,CAAC;AAEzB,yEAAyE;AACzE,MAAM,MAAM,aAAa,GACtB;IAAC,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAC,GAC3C;IACA,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAC,CAAC;CACtD,CAAC;AAEL,gCAAgC;AAChC,MAAM,WAAW,WAAW;IAC3B,mEAAmE;IACnE,GAAG,EAAE;QAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAA;KAAC,CAAC;IACnF,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,wCAAwC;IACxC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACtB;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAClC;AAcD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,QAAQ,GAAU,MAAM,WAAW,KAAG,OAAO,CAAC,aAAa,CA0DvE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,KAChD,OAAO,CAAC,aAAa,CAAuD,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,CAAC,KAAK,SAAS,yBAAyB,IACrE;IAAC,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAA;CAAC,GAC5D;IAAC,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAC,CAAA;CAAC,CAAC;AAEvF,mFAAmF;AACnF,MAAM,MAAM,kBAAkB,CAAC,KAAK,SAAS,yBAAyB,IAAI,IAAI,CAC7E,WAAW,EACX,QAAQ,GAAG,QAAQ,CACnB,GAAG;IACH,2GAA2G;IAC3G,IAAI,EAAE,KAAK,CAAC;IACZ,0CAA0C;IAC1C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;CAChC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAAU,KAAK,SAAS,yBAAyB,EAC9E,MAAM,kBAAkB,CAAC,KAAK,CAAC,KAC7B,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAarC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GAAU,CAAC,EACrC,MAAM,WAAW,EACjB,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KACzB,OAAO,CAAC,CAAC,CAcX,CAAC;AAIF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC3B,eAAe,aAAa,CAAC,eAAe,CAAC,EAC7C,QAAQ,MAAM,KACZ;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAC,GAAG,SAOtC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC3B,eAAe,aAAa,CAAC,qBAAqB,CAAC,EACnD,QAAQ,MAAM,KACZ;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,mBAAmB,CAAA;CAAC,GAAG,SAOrD,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GACrC,eAAe,aAAa,CAAC,eAAe,CAAC,KAC3C,MAYF,CAAC"}
+{"version":3,"file":"rpc_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAa7B,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,OAAO,EAIN,KAAK,gBAAgB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,2BAA2B,CAAC;AACzE,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,0BAA0B,CAAC;AACxD,OAAO,KAAK,EAAC,qBAAqB,EAAE,mBAAmB,EAAE,eAAe,EAAC,MAAM,oBAAoB,CAAC;AACpG,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAG9D;;;;;;;;GAQG;AACH,MAAM,MAAM,uBAAuB,GAChC,KAAK,CAAC,eAAe,CAAC,GACtB,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;AAEvD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,+BAA+B,GAC3C,eAAe,uBAAuB,EACtC,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,KAAK,CAAC,eAAe,CAuBvB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,GAChC,QAAQ,MAAM,EACd,SAAS,OAAO,EAChB,KAAI,MAAM,GAAG,MAAe,KAC1B,WAQF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAC9B,eAAe,MAAM,EACrB,QAAQ,MAAM,EACd,SAAS,OAAO,EAChB,KAAI,MAAM,GAAG,MAAe,KAC1B,MAMF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,OAAO,EACb,gBAAgB,gBAAgB,KAC9B,IAUF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,+BAA+B,GAAI,MAAM,OAAO,EAAE,gBAAgB,CAAC,CAAC,OAAO,KAAG,IAW1F,CAAC;AAIF;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAErF,2DAA2D;AAC3D,eAAO,MAAM,cAAc,GACzB,KAAK;IACL,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;CAC5E,KAAG,gBAEmB,CAAC;AAEzB,yEAAyE;AACzE,MAAM,MAAM,aAAa,GACtB;IAAC,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAC,GAC3C;IACA,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAC,CAAC;CACtD,CAAC;AAEL,gCAAgC;AAChC,MAAM,WAAW,WAAW;IAC3B,mEAAmE;IACnE,GAAG,EAAE;QAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAA;KAAC,CAAC;IACnF,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,wCAAwC;IACxC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACtB;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAClC;AAcD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,QAAQ,GAAU,MAAM,WAAW,KAAG,OAAO,CAAC,aAAa,CA0DvE,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,IAAI,CAAC,WAAW,EAAE,yBAAyB,CAAC,KAChD,OAAO,CAAC,aAAa,CAAuD,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,CAAC,KAAK,SAAS,yBAAyB,IACrE;IAAC,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAA;CAAC,GAC5D;IAAC,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAC,CAAA;CAAC,CAAC;AAEvF,mFAAmF;AACnF,MAAM,MAAM,kBAAkB,CAAC,KAAK,SAAS,yBAAyB,IAAI,IAAI,CAC7E,WAAW,EACX,QAAQ,GAAG,QAAQ,CACnB,GAAG;IACH,2GAA2G;IAC3G,IAAI,EAAE,KAAK,CAAC;IACZ,0CAA0C;IAC1C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;CAChC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAAU,KAAK,SAAS,yBAAyB,EAC9E,MAAM,kBAAkB,CAAC,KAAK,CAAC,KAC7B,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAarC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GAAU,CAAC,EACrC,MAAM,WAAW,EACjB,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KACzB,OAAO,CAAC,CAAC,CAcX,CAAC;AAIF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC3B,eAAe,aAAa,CAAC,eAAe,CAAC,EAC7C,QAAQ,MAAM,KACZ;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAC,GAAG,SAOtC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC3B,eAAe,aAAa,CAAC,qBAAqB,CAAC,EACnD,QAAQ,MAAM,KACZ;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,mBAAmB,CAAA;CAAC,GAAG,SAOrD,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GACrC,eAAe,aAAa,CAAC,eAAe,CAAC,KAC3C,MAYF,CAAC"}

package/dist/testing/rpc_helpers.js

@@ -119,7 +119,9 @@ export const assert_jsonrpc_success_response = (body, output_schema) => {
     assert.ok(result.success, `not a valid JSON-RPC success response: ${JSON.stringify(body)}`);
     if (output_schema) {
         const output_result = output_schema.safeParse(result.data.result);
-        assert.ok(output_result.success, `JSON-RPC result does not match output schema: ${JSON.stringify(output_result.error?.issues)}`);
+        if (!output_result.success) {
+            assert.fail(`JSON-RPC result does not match output schema: ${JSON.stringify(output_result.error.issues)}`);
+        }
     }
 };
 /** Adapt a `Hono`-style app into an `RpcTestTransport`. */

package/dist/testing/rpc_round_trip.d.ts

@@ -27,7 +27,7 @@ export interface RpcRoundTripTestOptions {
     app_options?: SuiteAppOptions;
     /** Database factories to run tests against. Default: pglite only. */
     db_factories?: Array<DbFactory>;
-    /** Methods to skip, by name (e.g., `'tx_plan'`). */
+    /** Methods to skip, by name (e.g., `'zap_plan'`). */
     skip_methods?: Array<string>;
     /** Override generated params for specific methods (method name → params). */
     input_overrides?: Map<string, Record<string, unknown>>;

package/dist/testing/rpc_round_trip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAe7B,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAE9D,OAAO,EAEN,KAAK,eAAe,EAGpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAwB,KAAK,SAAS,EAAC,MAAM,SAAS,CAAC;AAM9D,OAAO,EAMN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAE1B,mDAAmD;AACnD,MAAM,WAAW,uBAAuB;IACvC,4CAA4C;IAC5C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,wDAAwD;IACxD,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE;;;;;;;;;;OAUG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC,iDAAiD;IACjD,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,qEAAqE;IACrE,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAChC,oDAAoD;IACpD,YAAY,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,6EAA6E;IAC7E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AA2BD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,6BAA6B,GAAI,SAAS,uBAAuB,KAAG,IA8IhF,CAAC"}
+{"version":3,"file":"rpc_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAe7B,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAE9D,OAAO,EAEN,KAAK,eAAe,EAGpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAwB,KAAK,SAAS,EAAC,MAAM,SAAS,CAAC;AAO9D,OAAO,EAMN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAE1B,mDAAmD;AACnD,MAAM,WAAW,uBAAuB;IACvC,4CAA4C;IAC5C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,wDAAwD;IACxD,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE;;;;;;;;;;OAUG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC,iDAAiD;IACjD,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,qEAAqE;IACrE,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAChC,qDAAqD;IACrD,YAAY,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,6EAA6E;IAC7E,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AA2BD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,6BAA6B,GAAI,SAAS,uBAAuB,KAAG,IA8IhF,CAAC"}

package/dist/testing/rpc_round_trip.js

@@ -16,25 +16,26 @@ import { create_pglite_factory } from './db.js';
 import { generate_valid_body } from './schema_generators.js';
 import { run_migrations } from '../db/migrate.js';
 import { AUTH_MIGRATION_NS } from '../auth/migrations.js';
+import { is_public_auth } from '../http/auth_shape.js';
 import { create_rpc_post_init, create_rpc_get_url, assert_jsonrpc_error_response, assert_jsonrpc_success_response, resolve_rpc_endpoints_for_setup, } from './rpc_helpers.js';
 /**
  * Pick auth headers matching an RPC method's auth requirement.
  */
 const pick_rpc_auth_headers = (method, test_app, authed_account, admin_account) => {
-    switch (method.auth.type) {
-        case 'none':
-            return { host: 'localhost', origin: 'http://localhost:5173' };
-        case 'authenticated':
-            return authed_account.create_session_headers();
-        case 'role':
-            if (method.auth.role === ROLE_ADMIN) {
-                return admin_account.create_session_headers();
-            }
-            // keeper role uses the bootstrapped account
-            return test_app.create_session_headers();
-        case 'keeper':
-            return test_app.create_daemon_token_headers();
+    const { auth } = method;
+    if (is_public_auth(auth)) {
+        return { host: 'localhost', origin: 'http://localhost:5173' };
     }
+    if (auth.credential_types?.includes('daemon_token')) {
+        return test_app.create_daemon_token_headers();
+    }
+    if (auth.roles?.length) {
+        if (auth.roles.includes(ROLE_ADMIN)) {
+            return admin_account.create_session_headers();
+        }
+        return test_app.create_session_headers();
+    }
+    return authed_account.create_session_headers();
 };
 /**
  * Run schema-driven round-trip validation for RPC endpoints.

package/dist/testing/sse_round_trip.d.ts

@@ -9,7 +9,7 @@ import { type DbFactory } from './db.js';
 import { type RpcEndpointsSuiteOption } from './rpc_helpers.js';
 /** Config for a single SSE route under test. */
 export interface SseRouteTestSpec {
-    /** Full HTTP path of the SSE endpoint (e.g., `'/api/tx/subscribe'`). */
+    /** Full HTTP path of the SSE endpoint (e.g., `'/api/zap/subscribe'`). */
     path: string;
     /**
      * Fire an event matching one of the declared `event_specs` that should
@@ -51,9 +51,8 @@ export interface SseRouteTestOptions {
     on_audit_event?: (event: AuditLogEvent) => void;
     /**
      * RPC endpoint specs — required so the close-on-revoke assertion can
-     * dispatch `account_session_revoke_all` via RPC (the former REST route
-     * `POST /api/account/sessions/revoke-all` was removed in the 2026-04-23
-     * migration). Hard-fails via `require_rpc_endpoint_path` on setup.
+     * dispatch `account_session_revoke_all` via RPC (there is no REST
+     * equivalent). Hard-fails via `require_rpc_endpoint_path` on setup.
      *
      * Accepts either an array (eager) or a factory
      * `(ctx: AppServerContext) => Array<RpcEndpointSpec>` — the factory form

package/dist/testing/sse_round_trip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sse_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/sse_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAmB7B,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAwB,KAAK,SAAS,EAAuB,MAAM,oBAAoB,CAAC;AAE/F,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAEN,KAAK,eAAe,EACpB,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAwB,KAAK,SAAS,EAAC,MAAM,SAAS,CAAC;AAE9D,OAAO,EAIN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAM1B,gDAAgD;AAChD,MAAM,WAAW,gBAAgB;IAChC,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,EAAE,CAAC,GAAG,EAAE;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,WAAW,CAAA;KAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E;;;OAGG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,8CAA8C;AAC9C,MAAM,WAAW,mBAAmB;IACnC,4CAA4C;IAC5C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,qDAAqD;IACrD,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,iDAAiD;IACjD,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,qEAAqE;IACrE,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAChC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;IAChD;;;;;;;;;;;;;OAaG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC,8BAA8B;IAC9B,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;CAChC;AAyHD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,mBAAmB,KAAG,IA2HvE,CAAC"}
+{"version":3,"file":"sse_round_trip.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/sse_round_trip.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAmB7B,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,yBAAyB,CAAC;AAC9D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAwB,KAAK,SAAS,EAAuB,MAAM,oBAAoB,CAAC;AAE/F,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAEN,KAAK,eAAe,EACpB,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAwB,KAAK,SAAS,EAAC,MAAM,SAAS,CAAC;AAE9D,OAAO,EAIN,KAAK,uBAAuB,EAC5B,MAAM,kBAAkB,CAAC;AAM1B,gDAAgD;AAChD,MAAM,WAAW,gBAAgB;IAChC,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,EAAE,CAAC,GAAG,EAAE;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,WAAW,CAAA;KAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E;;;OAGG;IACH,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,8CAA8C;AAC9C,MAAM,WAAW,mBAAmB;IACnC,4CAA4C;IAC5C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,qDAAqD;IACrD,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,iDAAiD;IACjD,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,qEAAqE;IACrE,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAChC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;IAChD;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE,uBAAuB,CAAC;IACvC,8BAA8B;IAC9B,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;CAChC;AAyHD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,mBAAmB,KAAG,IA2HvE,CAAC"}

package/dist/testing/sse_round_trip.js

@@ -229,18 +229,14 @@ export const describe_sse_route_tests = (options) => {
  * (keeper, other roles) uses the bootstrapped keeper account.
  */
 const pick_account_for_auth = (spec, test_app, authed_account, admin_account) => {
-    switch (spec.auth.type) {
-        case 'authenticated':
-            return authed_account;
-        case 'role':
-            if (spec.auth.role === ROLE_ADMIN)
-                return admin_account;
-            // keeper role — bootstrapped account is the keeper; model it as a TestAccount
-            return bootstrap_as_account(test_app);
-        case 'keeper':
-        case 'none':
-            return bootstrap_as_account(test_app);
+    const { auth } = spec;
+    if (auth.roles?.includes(ROLE_ADMIN))
+        return admin_account;
+    if (auth.account === 'required' && !auth.roles?.length && !auth.credential_types?.length) {
+        return authed_account;
     }
+    // keeper / other-role / public — bootstrapped account
+    return bootstrap_as_account(test_app);
 };
 /**
  * Treat the bootstrapped `TestApp` account as a `TestAccount` for revocation.

package/dist/testing/standard.d.ts

@@ -36,7 +36,7 @@ export interface StandardTestOptions {
     /**
      * RPC endpoint specs — required. The standard integration tests drive
      * `account_verify`, `account_session_*`, `account_token_*` through the
-     * RPC surface (and admin tests, when wired, drive permit grant/revoke
+     * RPC surface (and admin tests, when wired, drive role_grant grant/revoke
      * through it too).
      *
      * Accepts either an array (eager) or a factory

package/dist/testing/stubs.d.ts

@@ -3,11 +3,13 @@ import type { z } from 'zod';
 import type { SessionOptions } from '../auth/session_cookie.js';
 import type { MiddlewareSpec } from '../http/middleware_spec.js';
 import type { AppDeps } from '../auth/deps.js';
+import type { AuditEmitter } from '../auth/audit_emitter.js';
 import type { AppServerContext } from '../server/app_server.js';
 import { Db } from '../db/db.js';
 import { type RouteSpec } from '../http/route_spec.js';
 import { type AppSurfaceSpec, type RpcEndpointSpec } from '../http/surface.js';
 import type { EventSpec } from '../realtime/sse.js';
+import { type AuditLogSse } from '../realtime/sse_auth_guard.js';
 /**
  * Create a Proxy that throws descriptive errors on any property access or method call.
  *
@@ -51,6 +53,29 @@ export declare const create_stub_db: () => Db;
 export declare const stub_handler: () => Response;
 /** Stub middleware that passes through. */
 export declare const stub_mw: (_c: any, next: any) => Promise<void>;
+/**
+ * Build a no-op `AuditEmitter` for tests that don't assert on audit fan-out.
+ *
+ * `emit` / `emit_role_grant_target` are no-ops; `emit_pool` resolves
+ * immediately; `notify` is a no-op; `on_event_chain` is a frozen empty
+ * array — pushing onto it throws at runtime, so a test that wires a
+ * listener fails loudly instead of silently never firing. Tests asserting
+ * on real audit-row persistence (or on listener fan-out) build a real
+ * emitter via `create_audit_emitter` against a stub or real DB —
+ * `create_test_app` already does this on the test backend.
+ */
+export declare const create_test_audit_emitter: () => AuditEmitter;
+/**
+ * Build a no-op `AuditLogSse` for tests that wire `audit_sse` into the
+ * surface helper but don't assert on SSE fan-out or subscriber state.
+ *
+ * `subscribe` returns a no-op cleanup; `on_audit_event` is a no-op; the
+ * `registry` is a fresh `SubscriberRegistry` instance (call sites that
+ * inspect `.size` or call `.close_*` see a real registry, so writes are
+ * isolated per test). Tests that need real SSE plumbing build it via
+ * `create_audit_log_sse` against `create_test_app`.
+ */
+export declare const create_stub_audit_sse: () => AuditLogSse;
 /** Stub `AppDeps` for auth surface tests — throws on any method access. */
 export declare const stub_app_deps: AppDeps;
 /**

package/dist/testing/stubs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stubs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/stubs.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAa7B,OAAO,KAAK,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAE3B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,4BAA4B,CAAC;AAE/D,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,iBAAiB,CAAC;AAC7C,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAC,EAAE,EAAC,MAAM,aAAa,CAAC;AAC/B,OAAO,EAAqB,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAGzE,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,oBAAoB,CAAC;AAKlD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,GAAG,GAAG,EAAE,OAAO,MAAM,KAAG,CAqBtD,CAAC;AAET;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,GAAG,GAAG,EAAE,QAAQ,MAAM,EAAE,YAAY,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,CAOxF,CAAC;AAET,iEAAiE;AACjE,eAAO,MAAM,IAAI,EAAE,GAAkC,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,QAAO,EAI/B,CAAC;AAEJ,gDAAgD;AAChD,eAAO,MAAM,YAAY,QAAO,QAAgC,CAAC;AAEjE,2CAA2C;AAC3C,eAAO,MAAM,OAAO,GAAU,IAAI,GAAG,EAAE,MAAM,GAAG,KAAG,OAAO,CAAC,IAAI,CAAW,CAAC;AAI3E,2EAA2E;AAC3E,eAAO,MAAM,aAAa,EAAE,OAS3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,QAAO,OAStC,CAAC;AAEH,2FAA2F;AAC3F,eAAO,MAAM,0BAA0B,GAAI,UAAU;IACpD,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAC/B,KAAG,KAAK,CAAC,cAAc,CAqBvB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,GAC1C,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,gBAqBF,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,+BAA+B;IAC/C,6DAA6D;IAC7D,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,qFAAqF;IACrF,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7F,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/E,0DAA0D;IAC1D,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,cA2CF,CAAC"}
+{"version":3,"file":"stubs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/stubs.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAa7B,OAAO,KAAK,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAE3B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,4BAA4B,CAAC;AAE/D,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,iBAAiB,CAAC;AAC7C,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,0BAA0B,CAAC;AAE3D,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAC,EAAE,EAAC,MAAM,aAAa,CAAC;AAC/B,OAAO,EAAqB,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAGzE,OAAO,EAEN,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAC,SAAS,EAAkB,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAA8B,KAAK,WAAW,EAAC,MAAM,+BAA+B,CAAC;AAM5F;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,GAAG,GAAG,EAAE,OAAO,MAAM,KAAG,CAqBtD,CAAC;AAET;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,GAAG,GAAG,EAAE,QAAQ,MAAM,EAAE,YAAY,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,CAOxF,CAAC;AAET,iEAAiE;AACjE,eAAO,MAAM,IAAI,EAAE,GAAkC,CAAC;AAEtD;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,QAAO,EAI/B,CAAC;AAEJ,gDAAgD;AAChD,eAAO,MAAM,YAAY,QAAO,QAAgC,CAAC;AAEjE,2CAA2C;AAC3C,eAAO,MAAM,OAAO,GAAU,IAAI,GAAG,EAAE,MAAM,GAAG,KAAG,OAAO,CAAC,IAAI,CAAW,CAAC;AAI3E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,QAAO,YAM3C,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,QAAO,WAUxC,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,aAAa,EAAE,OAS3B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,QAAO,OAStC,CAAC;AAEH,2FAA2F;AAC3F,eAAO,MAAM,0BAA0B,GAAI,UAAU;IACpD,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAC/B,KAAG,KAAK,CAAC,cAAc,CAqBvB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,GAC1C,iBAAiB,cAAc,CAAC,MAAM,CAAC,KACrC,gBAqBF,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,+BAA+B;IAC/C,6DAA6D;IAC7D,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,qFAAqF;IACrF,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7F,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/E,0DAA0D;IAC1D,sBAAsB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,cA2CF,CAAC"}