@fuzdev/fuz_app 0.7.1 → 0.8.0

package/dist/actions/action_rpc.d.ts

@@ -16,6 +16,7 @@ import type { RequestResponseActionSpec } from './action_spec.js';
 import { type RouteSpec } from '../http/route_spec.js';
 import { type RequestContext } from '../auth/request_context.js';
 import type { Db } from '../db/db.js';
+import { type JsonrpcRequestId } from '../http/jsonrpc.js';
 /**
  * Per-request context provided to RPC action handlers.
  *
@@ -26,6 +27,8 @@ import type { Db } from '../db/db.js';
 export interface ActionContext {
     /** The authenticated identity, or `null` for public routes. */
     auth: RequestContext | null;
+    /** The JSON-RPC request ID from the envelope. */
+    request_id: JsonrpcRequestId;
     /** Transaction-scoped for mutations, pool-level for reads. */
     db: Db;
     /** Always pool-level — for fire-and-forget effects that outlive the transaction. */

package/dist/actions/action_rpc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action_rpc.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/action_rpc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAoB,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAgC,KAAK,cAAc,EAAC,MAAM,4BAA4B,CAAC;AAC9F,OAAO,KAAK,EAAC,EAAE,EAAC,MAAM,aAAa,CAAC;AAWpC;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC7B,+DAA+D;IAC/D,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;IAC5B,8DAA8D;IAC9D,EAAE,EAAE,EAAE,CAAC;IACP,oFAAoF;IACpF,aAAa,EAAE,EAAE,CAAC;IAClB,2EAA2E;IAC3E,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,CACxD,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,aAAa,KACd,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,yBAAyB,CAAC;IAChC,OAAO,EAAE,aAAa,CAAC;CACvB;AAED,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACxC,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1B,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;CACZ;AA4CD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,mBAAmB,GAAI,SAAS,wBAAwB,KAAG,KAAK,CAAC,SAAS,CA6NtF,CAAC"}
+{"version":3,"file":"action_rpc.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/action_rpc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAoB,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAgC,KAAK,cAAc,EAAC,MAAM,4BAA4B,CAAC;AAE9F,OAAO,KAAK,EAAC,EAAE,EAAC,MAAM,aAAa,CAAC;AAEpC,OAAO,EAAkC,KAAK,gBAAgB,EAAC,MAAM,oBAAoB,CAAC;AAS1F;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC7B,+DAA+D;IAC/D,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;IAC5B,iDAAiD;IACjD,UAAU,EAAE,gBAAgB,CAAC;IAC7B,8DAA8D;IAC9D,EAAE,EAAE,EAAE,CAAC;IACP,oFAAoF;IACpF,aAAa,EAAE,EAAE,CAAC;IAClB,2EAA2E;IAC3E,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,CACxD,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,aAAa,KACd,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,yBAAyB,CAAC;IAChC,OAAO,EAAE,aAAa,CAAC;CACvB;AAED,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACxC,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1B,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;CACZ;AAkDD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,mBAAmB,GAAI,SAAS,wBAAwB,KAAG,KAAK,CAAC,SAAS,CAoOtF,CAAC"}

package/dist/actions/action_rpc.js

@@ -15,9 +15,10 @@ import { z } from 'zod';
 import { DEV } from 'esm-env';
 import {} from '../http/route_spec.js';
 import { get_request_context, has_role } from '../auth/request_context.js';
+import { CREDENTIAL_TYPE_KEY } from '../hono_context.js';
 import { is_null_schema } from '../http/schema_helpers.js';
 import { JSONRPC_VERSION, JsonrpcRequest } from '../http/jsonrpc.js';
-import { jsonrpc_error_messages, jsonrpc_error_code_to_http_status, JSONRPC_ERROR_CODES, ThrownJsonrpcError, } from '../http/jsonrpc_errors.js';
+import { jsonrpc_error_messages, jsonrpc_error_code_to_http_status, JSONRPC_ERROR_CODES, } from '../http/jsonrpc_errors.js';
 /**
  * Format a JSON-RPC error response.
  *
@@ -35,9 +36,10 @@ const jsonrpc_error_response = (id, error) => ({
  *
  * @param auth - the action's auth requirement
  * @param request_context - the resolved identity (null if unauthenticated)
+ * @param credential_type - how the request was authenticated (session, api_token, daemon_token)
  * @returns an error json if auth fails, or null if authorized
  */
-const check_action_auth = (auth, request_context) => {
+const check_action_auth = (auth, request_context, credential_type) => {
     if (auth === 'public')
         return null;
     if (!request_context)
@@ -45,9 +47,12 @@ const check_action_auth = (auth, request_context) => {
     if (auth === 'authenticated')
         return null;
     if (auth === 'keeper') {
-        // keeper requires the keeper role
-        if (!has_role(request_context, 'keeper'))
+        // keeper requires daemon_token credential type AND the keeper role.
+        // API tokens and session cookies cannot access keeper actions even
+        // if the account has the keeper permit.
+        if (credential_type !== 'daemon_token' || !has_role(request_context, 'keeper')) {
             return jsonrpc_error_messages.forbidden();
+        }
         return null;
     }
     // role check
@@ -117,7 +122,8 @@ export const create_rpc_endpoint = (options) => {
         }
         // step 3: auth check
         const request_context = get_request_context(c);
-        const auth_error = check_action_auth(action.spec.auth, request_context);
+        const credential_type = c.get(CREDENTIAL_TYPE_KEY) ?? null;
+        const auth_error = check_action_auth(action.spec.auth, request_context, credential_type);
         if (auth_error) {
             const error = jsonrpc_error_response(id, auth_error);
             return c.json(error, jsonrpc_error_code_to_http_status(auth_error.code));
@@ -136,6 +142,7 @@ export const create_rpc_endpoint = (options) => {
         const execute = async (db) => {
             const action_context = {
                 auth: request_context,
+                request_id: id,
                 db,
                 background_db: route.background_db,
                 pending_effects: route.pending_effects,
@@ -160,11 +167,16 @@ export const create_rpc_endpoint = (options) => {
             return await execute(route.db);
         }
         catch (err) {
-            if (err instanceof ThrownJsonrpcError) {
-                const status = jsonrpc_error_code_to_http_status(err.code);
-                const error_json = { code: err.code, message: err.message };
-                if (err.data !== undefined)
-                    error_json.data = err.data;
+            // Duck-type check: Error with numeric `code` signals a JSON-RPC error.
+            // Avoids instanceof which fails when consumers throw their own ThrownJsonrpcError
+            // (structurally identical but different class identity, e.g. zzz's copy).
+            if (err instanceof Error && typeof err.code === 'number') {
+                const code = err.code;
+                const data = err.data;
+                const status = jsonrpc_error_code_to_http_status(code);
+                const error_json = { code, message: err.message };
+                if (data !== undefined)
+                    error_json.data = data;
                 return c.json(jsonrpc_error_response(id, error_json), status);
             }
             // generic error

package/dist/auth/bearer_auth.d.ts

@@ -17,6 +17,13 @@ import { type RateLimiter } from '../rate_limiter.js';
 /**
  * Create middleware that authenticates via bearer token.
  *
+ * Soft-fails for invalid, expired, or empty tokens — calls `next()` without
+ * setting a request context, letting downstream auth enforcement (per-action
+ * `check_action_auth` or `require_auth`) return a consistent JSON-RPC or
+ * route-level error. This avoids leaking token-specific diagnostics
+ * (`invalid_token`, `account_not_found`) that could aid enumeration attacks,
+ * and ensures public actions are not blocked by bad credentials.
+ *
  * Rejects bearer tokens when an `Origin` or `Referer` header is present —
  * browsers must use cookie auth to reduce attack surface.
  * Auth scheme matching is case-insensitive per RFC 7235.
@@ -24,6 +31,9 @@ import { type RateLimiter } from '../rate_limiter.js';
  * and sets it on the Hono context. Skips if a request context is already set
  * (e.g. by session middleware).
  *
+ * Rate limiting (429) is the only hard-fail — it's a throttling concern
+ * independent of auth identity.
+ *
  * @param deps - query dependencies (pool-level db for middleware)
  * @param ip_rate_limiter - per-IP rate limiter for bearer token attempts (null to disable)
  * @param log - the logger instance

package/dist/auth/bearer_auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bearer_auth.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/bearer_auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,MAAM,CAAC;AAC5C,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAKpD,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAA+B,KAAK,WAAW,EAAC,MAAM,oBAAoB,CAAC;AAOlF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,iBAAiB,WAAW,GAAG,IAAI,EACnC,KAAK,MAAM,KACT,iBAwEF,CAAC"}
+{"version":3,"file":"bearer_auth.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/bearer_auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,MAAM,CAAC;AAC5C,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAKpD,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAA+B,KAAK,WAAW,EAAC,MAAM,oBAAoB,CAAC;AAElF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,iBAAiB,WAAW,GAAG,IAAI,EACnC,KAAK,MAAM,KACT,iBAqFF,CAAC"}

package/dist/auth/bearer_auth.js

@@ -15,10 +15,16 @@ import { CREDENTIAL_TYPE_KEY } from '../hono_context.js';
 import { query_validate_api_token } from './api_token_queries.js';
 import { get_client_ip } from '../http/proxy.js';
 import { rate_limit_exceeded_response } from '../rate_limiter.js';
-import { ERROR_BEARER_REJECTED_BROWSER, ERROR_INVALID_TOKEN, ERROR_ACCOUNT_NOT_FOUND, } from '../http/error_schemas.js';
 /**
  * Create middleware that authenticates via bearer token.
  *
+ * Soft-fails for invalid, expired, or empty tokens — calls `next()` without
+ * setting a request context, letting downstream auth enforcement (per-action
+ * `check_action_auth` or `require_auth`) return a consistent JSON-RPC or
+ * route-level error. This avoids leaking token-specific diagnostics
+ * (`invalid_token`, `account_not_found`) that could aid enumeration attacks,
+ * and ensures public actions are not blocked by bad credentials.
+ *
  * Rejects bearer tokens when an `Origin` or `Referer` header is present —
  * browsers must use cookie auth to reduce attack surface.
  * Auth scheme matching is case-insensitive per RFC 7235.
@@ -26,6 +32,9 @@ import { ERROR_BEARER_REJECTED_BROWSER, ERROR_INVALID_TOKEN, ERROR_ACCOUNT_NOT_F
  * and sets it on the Hono context. Skips if a request context is already set
  * (e.g. by session middleware).
  *
+ * Rate limiting (429) is the only hard-fail — it's a throttling concern
+ * independent of auth identity.
+ *
  * @param deps - query dependencies (pool-level db for middleware)
  * @param ip_rate_limiter - per-IP rate limiter for bearer token attempts (null to disable)
  * @param log - the logger instance
@@ -46,19 +55,24 @@ export const create_bearer_auth_middleware = (deps, ip_rate_limiter, log) => {
             await next();
             return;
         }
-        // Reject bearer tokens in browser context — defense-in-depth:
+        // Silently discard bearer tokens in browser context — defense-in-depth:
         // checks both Origin and Referer (not just Origin) because some browser
         // requests send only Referer. Uses `!== undefined` so that empty-string
         // headers (e.g. `Origin: ''`) are still treated as browser context.
+        // Discards rather than returning 403 so that the RPC dispatcher can still
+        // handle public actions or fall through to cookie auth.
         if (c.req.header('Origin') !== undefined || c.req.header('Referer') !== undefined) {
-            return c.json({ error: ERROR_BEARER_REJECTED_BROWSER }, 403);
+            log.debug('bearer auth rejected: browser context (Origin/Referer present)');
+            await next();
+            return;
         }
         const raw_token = auth_header.slice(7);
-        // Reject empty token body before any hashing or DB work.
+        // Empty token body — soft-fail (treat as "no credential").
         // (The Fetch API trims 'Bearer ' to 'Bearer' which skips this middleware entirely,
         // but raw HTTP clients may send 'Bearer ' with an empty token.)
         if (!raw_token) {
-            return c.json({ error: ERROR_INVALID_TOKEN }, 401);
+            await next();
+            return;
         }
         const ip = get_client_ip(c);
         // Per-IP rate limit: record before async DB work to close the TOCTOU
@@ -73,7 +87,11 @@ export const create_bearer_auth_middleware = (deps, ip_rate_limiter, log) => {
         }
         const api_token = await query_validate_api_token({ ...deps, log }, raw_token, ip, c.var.pending_effects);
         if (!api_token) {
-            return c.json({ error: ERROR_INVALID_TOKEN }, 401);
+            // Invalid or expired token — soft-fail. Rate limit counter stays
+            // incremented (recorded above), correctly penalizing bad attempts.
+            log.debug('bearer auth soft-fail: token not found or expired');
+            await next();
+            return;
         }
         // Valid token — reset rate limit counter
         if (ip_rate_limiter)
@@ -81,7 +99,11 @@ export const create_bearer_auth_middleware = (deps, ip_rate_limiter, log) => {
         // Build request context from the token's account
         const ctx = await build_request_context(deps, api_token.account_id);
         if (!ctx) {
-            return c.json({ error: ERROR_ACCOUNT_NOT_FOUND }, 401);
+            // Token exists but account/actor missing — soft-fail to avoid
+            // leaking account lifecycle information.
+            log.debug('bearer auth soft-fail: account or actor not found for token');
+            await next();
+            return;
         }
         c.set(REQUEST_CONTEXT_KEY, ctx);
         c.set(CREDENTIAL_TYPE_KEY, 'api_token');

package/dist/auth/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,4BAA4B,CAAC;AAG/D;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;IACtC,oFAAoF;IACpF,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;CAC3C;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CA+D/B,CAAC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,4BAA4B,CAAC;AAG/D;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;IACtC,oFAAoF;IACpF,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;CAC3C;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAmE/B,CAAC"}

package/dist/auth/middleware.js

@@ -47,7 +47,11 @@ export const create_auth_middleware_specs = async (deps, options) => {
             name: 'bearer_auth',
             path,
             handler: bearer_auth_middleware,
-            errors: { 401: ApiError, 403: ApiError, 429: RateLimitError },
+            // Bearer middleware soft-fails for invalid/expired tokens (calls next()
+            // without setting context). Only 429 is a hard-fail from this layer.
+            // Auth enforcement (401/403) happens downstream via check_action_auth
+            // or require_auth, producing consistent JSON-RPC or route-level errors.
+            errors: { 429: RateLimitError },
         },
     ];
     if (daemon_token_state) {

package/dist/testing/adversarial_headers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adversarial_headers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_headers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAY7B,OAAO,KAAK,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAS3B,OAAO,EAGN,KAAK,0BAA0B,EAC/B,MAAM,iBAAiB,CAAC;AAIzB,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IAClC,qGAAqG;IACrG,oBAAoB,EAAE,QAAQ,GAAG,YAAY,CAAC;CAC9C;AAID;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,GAC7C,gBAAgB,MAAM,KACpB,KAAK,CAAC,qBAAqB,CAkE7B,CAAC;AAIF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qCAAqC,GACjD,YAAY,MAAM,EAClB,SAAS,0BAA0B,EACnC,gBAAgB,MAAM,EACtB,cAAc,KAAK,CAAC,qBAAqB,CAAC,KACxC,IAkCF,CAAC"}
+{"version":3,"file":"adversarial_headers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_headers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAY7B,OAAO,KAAK,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAG3B,OAAO,EAGN,KAAK,0BAA0B,EAC/B,MAAM,iBAAiB,CAAC;AAIzB,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IAClC,qGAAqG;IACrG,oBAAoB,EAAE,QAAQ,GAAG,YAAY,CAAC;CAC9C;AAID;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,GAC7C,gBAAgB,MAAM,KACpB,KAAK,CAAC,qBAAqB,CA+D7B,CAAC;AAIF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qCAAqC,GACjD,YAAY,MAAM,EAClB,SAAS,0BAA0B,EACnC,gBAAgB,MAAM,EACtB,cAAc,KAAK,CAAC,qBAAqB,CAAC,KACxC,IAkCF,CAAC"}

package/dist/testing/adversarial_headers.js

@@ -8,7 +8,7 @@ import './assert_dev_env.js';
  * @module
  */
 import { test, assert, describe } from 'vitest';
-import { ApiError, ERROR_FORBIDDEN_ORIGIN, ERROR_FORBIDDEN_REFERER, ERROR_BEARER_REJECTED_BROWSER, ERROR_INVALID_TOKEN, } from '../http/error_schemas.js';
+import { ApiError, ERROR_FORBIDDEN_ORIGIN, ERROR_FORBIDDEN_REFERER } from '../http/error_schemas.js';
 import { create_test_middleware_stack_app, TEST_MIDDLEWARE_PATH, } from './middleware.js';
 // --- Standard adversarial header cases ---
 /**
@@ -29,13 +29,12 @@ export const create_standard_adversarial_cases = (allowed_origin) => [
         validate_expectation: 'not_called',
     },
     {
-        name: 'bearer token with allowed Origin is rejected as browser context',
+        name: 'bearer token with allowed Origin — bearer silently discarded (browser context)',
         headers: {
             Authorization: 'Bearer secret_fuz_token_test',
             Origin: allowed_origin,
         },
-        expected_status: 403,
-        expected_error: ERROR_BEARER_REJECTED_BROWSER,
+        expected_status: 200,
         validate_expectation: 'not_called',
     },
     {
@@ -55,12 +54,11 @@ export const create_standard_adversarial_cases = (allowed_origin) => [
         validate_expectation: 'not_called',
     },
     {
-        name: 'lowercase bearer scheme is recognized (case-insensitive per RFC 7235)',
+        name: 'lowercase bearer scheme is recognized (case-insensitive per RFC 7235), soft-fails',
         headers: {
             Authorization: 'bearer secret_fuz_token_test',
         },
-        expected_status: 401,
-        expected_error: ERROR_INVALID_TOKEN,
+        expected_status: 200,
         validate_expectation: 'called',
     },
     {
@@ -74,13 +72,12 @@ export const create_standard_adversarial_cases = (allowed_origin) => [
         validate_expectation: 'not_called',
     },
     {
-        name: 'bearer token with Referer from allowed origin is rejected as browser context (defense-in-depth)',
+        name: 'bearer token with Referer from allowed origin — bearer silently discarded (browser context)',
         headers: {
             Authorization: 'Bearer secret_fuz_token_test',
             Referer: `${allowed_origin}/page`,
         },
-        expected_status: 403,
-        expected_error: ERROR_BEARER_REJECTED_BROWSER,
+        expected_status: 200,
         validate_expectation: 'not_called',
     },
 ];

package/dist/testing/app_server.d.ts

@@ -144,6 +144,8 @@ export interface TestApp {
     create_session_headers: (extra?: Record<string, string>) => Record<string, string>;
     /** Build request headers with the bootstrapped Bearer token. */
     create_bearer_headers: (extra?: Record<string, string>) => Record<string, string>;
+    /** Build request headers with the daemon token (keeper auth). */
+    create_daemon_token_headers: (extra?: Record<string, string>) => Record<string, string>;
     /** Create an additional account with credentials. */
     create_account: (options?: {
         username?: string;

package/dist/testing/app_server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/app_server.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,MAAM,CAAC;AAK/B,OAAO,EAA2B,KAAK,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAE1E,OAAO,KAAK,EAAC,EAAE,EAAE,MAAM,EAAC,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,qBAAqB,CAAC;AAU1D,OAAO,EAA8B,KAAK,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAG3F,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAEN,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAC,UAAU,EAAE,cAAc,EAAC,MAAM,oBAAoB,CAAC;AACnE,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAKrD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,gBAIhC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AASjD;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC3C,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,GAClC,SAAS,2BAA2B,KAClC,OAAO,CAAC;IACV,OAAO,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACxC,KAAK,EAAE;QAAC,EAAE,EAAE,MAAM,CAAA;KAAC,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAyCA,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,UAAU;IAChD,gCAAgC;IAChC,OAAO,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACxC,uCAAuC;IACvC,KAAK,EAAE;QAAC,EAAE,EAAE,MAAM,CAAA;KAAC,CAAC;IACpB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,mDAAmD;IACnD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kGAAkG;IAClG,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yHAAyH;IACzH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAqBD,eAAO,MAAM,sBAAsB,GAClC,SAAS,oBAAoB,KAC3B,OAAO,CAAC,aAAa,CAsFvB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IACjE,yEAAyE;IACzE,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE,gHAAgH;IAChH,WAAW,CAAC,EAAE,OAAO,CACpB,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC,CAC5E,CAAC;CACF;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACxC,KAAK,EAAE;QAAC,EAAE,EAAE,MAAM,CAAA;KAAC,CAAC;IACpB,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,8DAA8D;IAC9D,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClF;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,kEAAkE;IAClE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,gEAAgE;IAChE,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClF,qDAAqD;IACrD,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE;QAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;KACtB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3B,8DAA8D;IAC9D,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,GAAU,SAAS,oBAAoB,KAAG,OAAO,CAAC,OAAO,CAgFpF,CAAC"}
+{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/app_server.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,MAAM,CAAC;AAK/B,OAAO,EAA2B,KAAK,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAE1E,OAAO,KAAK,EAAC,EAAE,EAAE,MAAM,EAAC,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,qBAAqB,CAAC;AAU1D,OAAO,EAA8B,KAAK,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAG3F,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAEN,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAC,UAAU,EAAE,cAAc,EAAC,MAAM,oBAAoB,CAAC;AACnE,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAUrD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,gBAIhC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AASjD;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC3C,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,GAClC,SAAS,2BAA2B,KAClC,OAAO,CAAC;IACV,OAAO,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACxC,KAAK,EAAE;QAAC,EAAE,EAAE,MAAM,CAAA;KAAC,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAyCA,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,UAAU;IAChD,gCAAgC;IAChC,OAAO,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACxC,uCAAuC;IACvC,KAAK,EAAE;QAAC,EAAE,EAAE,MAAM,CAAA;KAAC,CAAC;IACpB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,mDAAmD;IACnD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kGAAkG;IAClG,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yHAAyH;IACzH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAqBD,eAAO,MAAM,sBAAsB,GAClC,SAAS,oBAAoB,KAC3B,OAAO,CAAC,aAAa,CAsFvB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IACjE,yEAAyE;IACzE,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE,gHAAgH;IAChH,WAAW,CAAC,EAAE,OAAO,CACpB,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC,CAC5E,CAAC;CACF;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACxC,KAAK,EAAE;QAAC,EAAE,EAAE,MAAM,CAAA;KAAC,CAAC;IACpB,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,8DAA8D;IAC9D,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClF;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,kEAAkE;IAClE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,gEAAgE;IAChE,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClF,iEAAiE;IACjE,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxF,qDAAqD;IACrD,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE;QAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;KACtB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3B,8DAA8D;IAC9D,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,GAAU,SAAS,oBAAoB,KAAG,OAAO,CAAC,OAAO,CAkGpF,CAAC"}

package/dist/testing/app_server.js

@@ -12,6 +12,7 @@ import { create_session_cookie_value } from '../auth/session_cookie.js';
 import { run_migrations } from '../db/migrate.js';
 import { AUTH_MIGRATION_NS } from '../auth/migrations.js';
 import { create_app_server, } from '../server/app_server.js';
+import { generate_daemon_token, DAEMON_TOKEN_HEADER, } from '../auth/daemon_token.js';
 import { create_pglite_factory } from './db.js';
 /* eslint-disable @typescript-eslint/require-await */
 /**
@@ -172,6 +173,15 @@ export const create_test_app_server = async (options) => {
  */
 export const create_test_app = async (options) => {
     const test_server = await create_test_app_server(options);
+    // Daemon token state for keeper auth in tests.
+    // Uses a static token (no rotation) — sufficient for request-level testing.
+    const test_daemon_token = generate_daemon_token();
+    const daemon_token_state = {
+        current_token: test_daemon_token,
+        previous_token: null,
+        rotated_at: new Date(),
+        keeper_account_id: test_server.account.id,
+    };
     const result = await create_app_server({
         backend: test_server,
         session_options: options.session_options,
@@ -183,6 +193,7 @@ export const create_test_app = async (options) => {
         signup_account_rate_limiter: null,
         bearer_ip_rate_limiter: null,
         await_pending_effects: true,
+        daemon_token_state,
         ...options.app_options,
         create_route_specs: options.create_route_specs,
     });
@@ -200,6 +211,11 @@ export const create_test_app = async (options) => {
         authorization: `Bearer ${test_server.api_token}`,
         ...extra,
     });
+    const create_daemon_token_headers = (extra) => ({
+        host: 'localhost',
+        [DAEMON_TOKEN_HEADER]: test_daemon_token,
+        ...extra,
+    });
     let account_counter = 0;
     const create_account = async (account_options) => {
         account_counter++;
@@ -235,6 +251,7 @@ export const create_test_app = async (options) => {
         route_specs: surface_spec.route_specs,
         create_session_headers,
         create_bearer_headers,
+        create_daemon_token_headers,
         create_account,
         cleanup: () => test_server.cleanup(),
     };

package/dist/testing/data_exposure.js

@@ -291,6 +291,6 @@ const pick_auth_headers = (spec, test_app, authed_account, admin_account) => {
             // keeper role uses the bootstrapped account
             return test_app.create_session_headers();
         case 'keeper':
-            return test_app.create_bearer_headers();
+            return test_app.create_daemon_token_headers();
     }
 };

package/dist/testing/integration.d.ts

@@ -24,7 +24,7 @@ export interface StandardIntegrationTestOptions {
  *
  * Exercises login/logout, cookie attributes, session security, session
  * revocation, password change (incl. API token revocation), origin
- * verification, bearer auth (incl. browser context rejection on mutations),
+ * verification, bearer auth (incl. browser context discard on mutations),
  * token revocation, cross-account isolation, expired credential rejection,
  * signup invite edge cases, and response body validation.
  *

package/dist/testing/integration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAsB7B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAC,gBAAgB,EAAE,gBAAgB,EAAC,MAAM,yBAAyB,CAAC;AAChF,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAGrD,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,SAAS,CAAC;AAgBjB;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC9C,4CAA4C;IAC5C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,wDAAwD;IACxD,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,iDAAiD;IACjD,WAAW,CAAC,EAAE,OAAO,CACpB,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC,CAC5E,CAAC;IACF;;;OAGG;IACH,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;CAChC;AAeD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,mCAAmC,GAC/C,SAAS,8BAA8B,KACrC,IAk+CF,CAAC"}
+{"version":3,"file":"integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAsB7B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAC,gBAAgB,EAAE,gBAAgB,EAAC,MAAM,yBAAyB,CAAC;AAChF,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAGrD,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,SAAS,CAAC;AAgBjB;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC9C,4CAA4C;IAC5C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,wDAAwD;IACxD,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,iDAAiD;IACjD,WAAW,CAAC,EAAE,OAAO,CACpB,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC,CAC5E,CAAC;IACF;;;OAGG;IACH,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;CAChC;AAeD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,mCAAmC,GAC/C,SAAS,8BAA8B,KACrC,IAo+CF,CAAC"}

package/dist/testing/integration.js

@@ -38,7 +38,7 @@ const build_test_app_options = (options, db) => ({
  *
  * Exercises login/logout, cookie attributes, session security, session
  * revocation, password change (incl. API token revocation), origin
- * verification, bearer auth (incl. browser context rejection on mutations),
+ * verification, bearer auth (incl. browser context discard on mutations),
  * token revocation, cross-account isolation, expired credential rejection,
  * signup invite edge cases, and response body validation.
  *
@@ -525,17 +525,15 @@ export const describe_standard_integration_tests = (options) => {
                     headers: bearer_headers,
                 });
                 assert.strictEqual(ok_res.status, 200);
-                // With Origin — rejected (browser context)
+                // With Origin — bearer silently discarded (browser context), falls through to no auth
                 const res = await test_app.app.request(verify_route.path, {
                     headers: {
                         ...bearer_headers,
                         origin: 'http://localhost:5173',
                     },
                 });
-                assert.strictEqual(res.status, 403);
-                error_collector.record(test_app.route_specs, 'GET', verify_route.path, 403);
-                const body = await res.json();
-                assert.strictEqual(body.error, 'bearer_token_rejected_in_browser_context');
+                assert.strictEqual(res.status, 401);
+                error_collector.record(test_app.route_specs, 'GET', verify_route.path, 401);
             });
         });
         // --- 7. Token revocation ---
@@ -912,8 +910,8 @@ export const describe_standard_integration_tests = (options) => {
             });
         });
         // --- 12. Bearer token browser context on mutation routes ---
-        describe('bearer token browser context rejection on mutations', () => {
-            test('bearer token with Origin header rejected on POST logout', async () => {
+        describe('bearer token browser context silently discarded on mutations', () => {
+            test('bearer token with Origin header discarded on POST logout', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
                 const logout_route = find_auth_route(test_app.route_specs, '/logout', 'POST');
                 assert.ok(logout_route, 'Expected POST /logout route — ensure create_route_specs includes account routes');
@@ -924,12 +922,10 @@ export const describe_standard_integration_tests = (options) => {
                     method: 'POST',
                     headers: { ...bearer_headers, origin: 'http://localhost:5173' },
                 });
-                assert.strictEqual(res.status, 403, 'Bearer with Origin should be rejected on mutation');
-                const body = await res.json();
-                assert.strictEqual(body.error, 'bearer_token_rejected_in_browser_context');
-                error_collector.record(test_app.route_specs, 'POST', logout_route.path, 403);
+                assert.strictEqual(res.status, 401, 'Bearer with Origin should be discarded → unauthenticated');
+                error_collector.record(test_app.route_specs, 'POST', logout_route.path, 401);
             });
-            test('bearer token with Referer header rejected on POST password', async () => {
+            test('bearer token with Referer header discarded on POST password', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
                 const password_route = find_auth_route(test_app.route_specs, '/password', 'POST');
                 assert.ok(password_route, 'Expected POST /password route — ensure create_route_specs includes account routes');
@@ -940,10 +936,8 @@ export const describe_standard_integration_tests = (options) => {
                     method: 'POST',
                     headers: { ...bearer_headers, referer: 'http://localhost:5173/admin' },
                 });
-                assert.strictEqual(res.status, 403, 'Bearer with Referer should be rejected on mutation');
-                const body = await res.json();
-                assert.strictEqual(body.error, 'bearer_token_rejected_in_browser_context');
-                error_collector.record(test_app.route_specs, 'POST', password_route.path, 403);
+                assert.strictEqual(res.status, 401, 'Bearer with Referer should be discarded → unauthenticated');
+                error_collector.record(test_app.route_specs, 'POST', password_route.path, 401);
             });
         });
         // --- 13. Password change revokes API tokens ---

package/dist/testing/round_trip.js

@@ -122,6 +122,6 @@ const pick_auth_headers = (spec, test_app, authed_account, admin_account) => {
             // Keeper role uses the bootstrapped account (which has keeper role)
             return test_app.create_session_headers();
         case 'keeper':
-            return test_app.create_bearer_headers();
+            return test_app.create_daemon_token_headers();
     }
 };

package/dist/testing/rpc_attack_surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc_attack_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_attack_surface.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAkB7B,OAAO,KAAK,EAA6C,cAAc,EAAC,MAAM,oBAAoB,CAAC;AAenG,uDAAuD;AACvD,MAAM,WAAW,uBAAuB;IACvC,+FAA+F;IAC/F,KAAK,EAAE,MAAM,cAAc,CAAC;IAC5B,yDAAyD;IACzD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACrB;AAkaD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,GAAI,SAAS,uBAAuB,KAAG,IAOpF,CAAC"}
+{"version":3,"file":"rpc_attack_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_attack_surface.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAkB7B,OAAO,KAAK,EAA6C,cAAc,EAAC,MAAM,oBAAoB,CAAC;AAoBnG,uDAAuD;AACvD,MAAM,WAAW,uBAAuB;IACvC,+FAA+F;IAC/F,KAAK,EAAE,MAAM,cAAc,CAAC;IAC5B,yDAAyD;IACzD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACrB;AAodD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,GAAI,SAAS,uBAAuB,KAAG,IAOpF,CAAC"}

package/dist/testing/rpc_attack_surface.js

@@ -14,7 +14,7 @@ import './assert_dev_env.js';
  */
 import { test, assert, describe } from 'vitest';
 import { JSONRPC_ERROR_CODES } from '../http/jsonrpc_errors.js';
-import { create_auth_test_apps, select_auth_app } from './auth_apps.js';
+import { create_auth_test_apps, create_test_app_from_specs, create_test_request_context, select_auth_app, } from './auth_apps.js';
 import { generate_input_test_cases } from './adversarial_input.js';
 import { ERROR_INVALID_JSON_BODY } from '../http/error_schemas.js';
 import { create_rpc_post_init, create_rpc_get_url, assert_jsonrpc_error_response, } from './rpc_helpers.js';
@@ -23,6 +23,8 @@ import { create_rpc_post_init, create_rpc_get_url, assert_jsonrpc_error_response
 const filter_protected_rpc_methods = (endpoint) => endpoint.methods.filter((m) => m.auth.type !== 'none');
 /** Filter RPC methods that require a specific role. */
 const filter_role_rpc_methods = (endpoint) => endpoint.methods.filter((m) => m.auth.type === 'role');
+/** Filter RPC methods that require keeper auth (daemon_token + keeper role). */
+const filter_keeper_rpc_methods = (endpoint) => endpoint.methods.filter((m) => m.auth.type === 'keeper');
 /** Find the `RpcAction` source spec for a surface method. */
 const find_rpc_action = (rpc_endpoint_specs, endpoint_path, method_name) => {
     const ep = rpc_endpoint_specs.find((e) => e.path === endpoint_path);
@@ -40,7 +42,7 @@ const find_rpc_action = (rpc_endpoint_specs, endpoint_path, method_name) => {
  * - unauthenticated → error code -32001 — every protected method
  * - wrong role → error code -32002 — every role method with non-matching roles
  * - authenticated without role → -32002 — every role method, no-role context
- * - keeper routes reject session credential → -32002
+ * - keeper rejects non-daemon credentials → -32002 — session and api_token rejected
  * - correct auth passes — every protected method, assert not 401/403
  */
 const describe_rpc_auth = (options) => {
@@ -94,9 +96,27 @@ const describe_rpc_auth = (options) => {
                         }
                     });
                 }
-                // NOTE: no "keeper rejects session credential" test for RPC — the RPC
-                // dispatcher's check_action_auth only checks role, not credential type.
-                // Credential type enforcement is a REST middleware concern (require_keeper).
+                const keeper_methods = filter_keeper_rpc_methods(endpoint);
+                if (keeper_methods.length > 0) {
+                    describe('keeper rejects non-daemon credentials', () => {
+                        const session_app = create_test_app_from_specs(route_specs, create_test_request_context('keeper'), 'session');
+                        const api_token_app = create_test_app_from_specs(route_specs, create_test_request_context('keeper'), 'api_token');
+                        for (const method of keeper_methods) {
+                            test(`${method.name} rejects session credential`, async () => {
+                                const res = await session_app.request(endpoint.path, create_rpc_post_init(method.name));
+                                assert.strictEqual(res.status, 403, `${method.name} should reject session credential`);
+                                const body = await res.json();
+                                assert_jsonrpc_error_response(body, JSONRPC_ERROR_CODES.forbidden);
+                            });
+                            test(`${method.name} rejects api_token credential`, async () => {
+                                const res = await api_token_app.request(endpoint.path, create_rpc_post_init(method.name));
+                                assert.strictEqual(res.status, 403, `${method.name} should reject api_token credential`);
+                                const body = await res.json();
+                                assert_jsonrpc_error_response(body, JSONRPC_ERROR_CODES.forbidden);
+                            });
+                        }
+                    });
+                }
                 describe('correct auth passes', () => {
                     for (const method of protected_methods) {
                         test(method.name, async () => {

package/dist/testing/rpc_round_trip.js

@@ -33,7 +33,7 @@ const pick_rpc_auth_headers = (method, test_app, authed_account, admin_account)
             // keeper role uses the bootstrapped account
             return test_app.create_session_headers();
         case 'keeper':
-            return test_app.create_bearer_headers();
+            return test_app.create_daemon_token_headers();
     }
 };
 /**

package/dist/ui/BootstrapForm.svelte

@@ -1,4 +1,6 @@
 <script lang="ts">
+	import {goto} from '$app/navigation';
+	import {resolve} from '$app/paths';
 	import PendingButton from '@fuzdev/fuz_ui/PendingButton.svelte';
 	import {autofocus} from '@fuzdev/fuz_ui/autofocus.svelte.js';
 
@@ -7,6 +9,12 @@
 	import {auth_state_context} from './auth_state.svelte.js';
 	import {FormState} from './form_state.svelte.js';
 
+	const {
+		redirect_on_bootstrap = resolve('/'),
+	}: {
+		redirect_on_bootstrap?: string;
+	} = $props();
+
 	const auth_state = auth_state_context.get();
 	const form_state = new FormState();
 
@@ -35,7 +43,11 @@
 			else if (!passwords_match) form_state.focus('password_confirm');
 			return;
 		}
-		await auth_state.bootstrap(token.trim(), username.trim(), password);
+		const success = await auth_state.bootstrap(token.trim(), username.trim(), password);
+		if (success) {
+			form_state.reset();
+			await goto(redirect_on_bootstrap);
+		}
 	};
 </script>
 

package/dist/ui/BootstrapForm.svelte.d.ts

@@ -1,4 +1,7 @@
-declare const BootstrapForm: import("svelte").Component<Record<string, never>, {}, "">;
+type $$ComponentProps = {
+    redirect_on_bootstrap?: string;
+};
+declare const BootstrapForm: import("svelte").Component<$$ComponentProps, {}, "">;
 type BootstrapForm = ReturnType<typeof BootstrapForm>;
 export default BootstrapForm;
 //# sourceMappingURL=BootstrapForm.svelte.d.ts.map

package/dist/ui/BootstrapForm.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BootstrapForm.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/BootstrapForm.svelte"],"names":[],"mappings":"AAqGA,QAAA,MAAM,aAAa,2DAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}
+{"version":3,"file":"BootstrapForm.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/BootstrapForm.svelte"],"names":[],"mappings":"AAaC,KAAK,gBAAgB,GAAI;IACxB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAqGH,QAAA,MAAM,aAAa,sDAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}

package/dist/ui/LoginForm.svelte

@@ -9,7 +9,7 @@
 
 	const {
 		username_label = 'username or email',
-		redirect_on_login = resolve('/account' as any),
+		redirect_on_login = resolve('/'),
 	}: {
 		username_label?: string;
 		redirect_on_login?: string;

package/dist/ui/SignupForm.svelte

@@ -10,7 +10,7 @@
 	import {FormState} from './form_state.svelte.js';
 
 	const {
-		redirect_on_signup = resolve('/account' as any),
+		redirect_on_signup = resolve('/'),
 	}: {
 		redirect_on_signup?: string;
 	} = $props();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.7.1",
+  "version": "0.8.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",