@fuzdev/fuz_app 0.7.1 → 0.9.0

package/dist/actions/action_codegen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action_codegen.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/action_codegen.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,eAAe,EAAE,gBAAgB,EAAC,MAAM,kBAAkB,CAAC;AAKxE;;GAEG;AACH,UAAU,UAAU;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,aAAa;;IACzB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAa;IAE1D;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAQrC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAI1C;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI;IAOrD;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI;IAgCtD;;;OAGG;IACH,KAAK,IAAI,MAAM;IAIf;;OAEG;IACH,WAAW,IAAI,OAAO;IAItB;;OAEG;IACH,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED;;;OAGG;IACH,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC;IAIxB;;OAEG;IACH,KAAK,IAAI,IAAI;CAqDb;AAED;;GAEG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,eAAe,EACrB,UAAU,UAAU,GAAG,SAAS,KAC9B,KAAK,CAAC,gBAAgB,CA4DxB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,eAAe,EACrB,OAAO,gBAAgB,EACvB,SAAS,aAAa,EACtB,aAAa,MAAM,KACjB,MAkBF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,eAAe,EACrB,UAAU,UAAU,GAAG,SAAS,EAChC,SAAS,aAAa,KACpB,MA+BF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa,GAAI,aAAa,MAAM,KAAG,MACU,CAAC"}
+{"version":3,"file":"action_codegen.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/action_codegen.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,eAAe,EAAE,gBAAgB,EAAC,MAAM,kBAAkB,CAAC;AAKxE;;GAEG;AACH,UAAU,UAAU;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,aAAa;;IACzB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAa;IAE1D;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAQrC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAI1C;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI;IAOrD;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI;IAgCtD;;;OAGG;IACH,KAAK,IAAI,MAAM;IAIf;;OAEG;IACH,WAAW,IAAI,OAAO;IAItB;;OAEG;IACH,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED;;;OAGG;IACH,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC;IAIxB;;OAEG;IACH,KAAK,IAAI,IAAI;CAqDb;AAED;;GAEG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,eAAe,EACrB,UAAU,UAAU,GAAG,SAAS,KAC9B,KAAK,CAAC,gBAAgB,CA4DxB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,eAAe,EACrB,OAAO,gBAAgB,EACvB,SAAS,aAAa,EACtB,aAAa,MAAM,KACjB,MAkBF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,eAAe,EACrB,UAAU,UAAU,GAAG,SAAS,EAChC,SAAS,aAAa,KACpB,MAyBF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,aAAa,GAAI,aAAa,MAAM,KAAG,MACU,CAAC"}

package/dist/actions/action_codegen.js

@@ -257,18 +257,13 @@ export const generate_phase_handlers = (spec, executor, imports) => {
     // Backend types file is in server/ subdirectory, so needs different relative paths
     const path_prefix = executor === 'frontend' ? './' : '../';
     imports.add_type(`${path_prefix}action_event.js`, 'ActionEvent');
-    // Add environment type import
-    const environment_type = executor === 'frontend' ? 'Frontend' : 'Backend';
-    const environment_module = executor === 'frontend' ? './frontend.svelte.js' : './backend.js';
-    imports.add_type(environment_module, environment_type);
     // Generate handler definitions for each phase
     const phase_handlers = phases
         .map((phase) => {
         // Pass imports to get_handler_return_type so it can add necessary imports
         const return_type = get_handler_return_type(spec, phase, imports, path_prefix);
-        // Use the new type parameter approach
         return `${phase}?: (
-			action_event: ActionEvent<'${method}', ${environment_type}, '${phase}', 'handling'>
+			action_event: ActionEvent<'${method}', '${phase}', 'handling'>
 		) => ${return_type}`;
     })
         .join(';\n\t\t');

package/dist/actions/action_rpc.d.ts

@@ -16,6 +16,7 @@ import type { RequestResponseActionSpec } from './action_spec.js';
 import { type RouteSpec } from '../http/route_spec.js';
 import { type RequestContext } from '../auth/request_context.js';
 import type { Db } from '../db/db.js';
+import { type JsonrpcRequestId } from '../http/jsonrpc.js';
 /**
  * Per-request context provided to RPC action handlers.
  *
@@ -26,6 +27,8 @@ import type { Db } from '../db/db.js';
 export interface ActionContext {
     /** The authenticated identity, or `null` for public routes. */
     auth: RequestContext | null;
+    /** The JSON-RPC request ID from the envelope. */
+    request_id: JsonrpcRequestId;
     /** Transaction-scoped for mutations, pool-level for reads. */
     db: Db;
     /** Always pool-level — for fire-and-forget effects that outlive the transaction. */

package/dist/actions/action_rpc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action_rpc.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/action_rpc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAoB,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAgC,KAAK,cAAc,EAAC,MAAM,4BAA4B,CAAC;AAC9F,OAAO,KAAK,EAAC,EAAE,EAAC,MAAM,aAAa,CAAC;AAWpC;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC7B,+DAA+D;IAC/D,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;IAC5B,8DAA8D;IAC9D,EAAE,EAAE,EAAE,CAAC;IACP,oFAAoF;IACpF,aAAa,EAAE,EAAE,CAAC;IAClB,2EAA2E;IAC3E,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,CACxD,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,aAAa,KACd,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,yBAAyB,CAAC;IAChC,OAAO,EAAE,aAAa,CAAC;CACvB;AAED,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACxC,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1B,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;CACZ;AA4CD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,mBAAmB,GAAI,SAAS,wBAAwB,KAAG,KAAK,CAAC,SAAS,CA6NtF,CAAC"}
+{"version":3,"file":"action_rpc.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/actions/action_rpc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAoB,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAgC,KAAK,cAAc,EAAC,MAAM,4BAA4B,CAAC;AAE9F,OAAO,KAAK,EAAC,EAAE,EAAC,MAAM,aAAa,CAAC;AAEpC,OAAO,EAAkC,KAAK,gBAAgB,EAAC,MAAM,oBAAoB,CAAC;AAS1F;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC7B,+DAA+D;IAC/D,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;IAC5B,iDAAiD;IACjD,UAAU,EAAE,gBAAgB,CAAC;IAC7B,8DAA8D;IAC9D,EAAE,EAAE,EAAE,CAAC;IACP,oFAAoF;IACpF,aAAa,EAAE,EAAE,CAAC;IAClB,2EAA2E;IAC3E,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAC;CACZ;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,CACxD,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,aAAa,KACd,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,yBAAyB,CAAC;IAChC,OAAO,EAAE,aAAa,CAAC;CACvB;AAED,yCAAyC;AACzC,MAAM,WAAW,wBAAwB;IACxC,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,4BAA4B;IAC5B,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1B,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;CACZ;AAkDD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,mBAAmB,GAAI,SAAS,wBAAwB,KAAG,KAAK,CAAC,SAAS,CAoOtF,CAAC"}

package/dist/actions/action_rpc.js

@@ -15,9 +15,10 @@ import { z } from 'zod';
 import { DEV } from 'esm-env';
 import {} from '../http/route_spec.js';
 import { get_request_context, has_role } from '../auth/request_context.js';
+import { CREDENTIAL_TYPE_KEY } from '../hono_context.js';
 import { is_null_schema } from '../http/schema_helpers.js';
 import { JSONRPC_VERSION, JsonrpcRequest } from '../http/jsonrpc.js';
-import { jsonrpc_error_messages, jsonrpc_error_code_to_http_status, JSONRPC_ERROR_CODES, ThrownJsonrpcError, } from '../http/jsonrpc_errors.js';
+import { jsonrpc_error_messages, jsonrpc_error_code_to_http_status, JSONRPC_ERROR_CODES, } from '../http/jsonrpc_errors.js';
 /**
  * Format a JSON-RPC error response.
  *
@@ -35,9 +36,10 @@ const jsonrpc_error_response = (id, error) => ({
  *
  * @param auth - the action's auth requirement
  * @param request_context - the resolved identity (null if unauthenticated)
+ * @param credential_type - how the request was authenticated (session, api_token, daemon_token)
  * @returns an error json if auth fails, or null if authorized
  */
-const check_action_auth = (auth, request_context) => {
+const check_action_auth = (auth, request_context, credential_type) => {
     if (auth === 'public')
         return null;
     if (!request_context)
@@ -45,9 +47,12 @@ const check_action_auth = (auth, request_context) => {
     if (auth === 'authenticated')
         return null;
     if (auth === 'keeper') {
-        // keeper requires the keeper role
-        if (!has_role(request_context, 'keeper'))
+        // keeper requires daemon_token credential type AND the keeper role.
+        // API tokens and session cookies cannot access keeper actions even
+        // if the account has the keeper permit.
+        if (credential_type !== 'daemon_token' || !has_role(request_context, 'keeper')) {
             return jsonrpc_error_messages.forbidden();
+        }
         return null;
     }
     // role check
@@ -117,7 +122,8 @@ export const create_rpc_endpoint = (options) => {
         }
         // step 3: auth check
         const request_context = get_request_context(c);
-        const auth_error = check_action_auth(action.spec.auth, request_context);
+        const credential_type = c.get(CREDENTIAL_TYPE_KEY) ?? null;
+        const auth_error = check_action_auth(action.spec.auth, request_context, credential_type);
         if (auth_error) {
             const error = jsonrpc_error_response(id, auth_error);
             return c.json(error, jsonrpc_error_code_to_http_status(auth_error.code));
@@ -136,6 +142,7 @@ export const create_rpc_endpoint = (options) => {
         const execute = async (db) => {
             const action_context = {
                 auth: request_context,
+                request_id: id,
                 db,
                 background_db: route.background_db,
                 pending_effects: route.pending_effects,
@@ -160,11 +167,16 @@ export const create_rpc_endpoint = (options) => {
             return await execute(route.db);
         }
         catch (err) {
-            if (err instanceof ThrownJsonrpcError) {
-                const status = jsonrpc_error_code_to_http_status(err.code);
-                const error_json = { code: err.code, message: err.message };
-                if (err.data !== undefined)
-                    error_json.data = err.data;
+            // Duck-type check: Error with numeric `code` signals a JSON-RPC error.
+            // Avoids instanceof which fails when consumers throw their own ThrownJsonrpcError
+            // (structurally identical but different class identity, e.g. zzz's copy).
+            if (err instanceof Error && typeof err.code === 'number') {
+                const code = err.code;
+                const data = err.data;
+                const status = jsonrpc_error_code_to_http_status(code);
+                const error_json = { code, message: err.message };
+                if (data !== undefined)
+                    error_json.data = data;
                 return c.json(jsonrpc_error_response(id, error_json), status);
             }
             // generic error

package/dist/auth/bearer_auth.d.ts

@@ -17,6 +17,13 @@ import { type RateLimiter } from '../rate_limiter.js';
 /**
  * Create middleware that authenticates via bearer token.
  *
+ * Soft-fails for invalid, expired, or empty tokens — calls `next()` without
+ * setting a request context, letting downstream auth enforcement (per-action
+ * `check_action_auth` or `require_auth`) return a consistent JSON-RPC or
+ * route-level error. This avoids leaking token-specific diagnostics
+ * (`invalid_token`, `account_not_found`) that could aid enumeration attacks,
+ * and ensures public actions are not blocked by bad credentials.
+ *
  * Rejects bearer tokens when an `Origin` or `Referer` header is present —
  * browsers must use cookie auth to reduce attack surface.
  * Auth scheme matching is case-insensitive per RFC 7235.
@@ -24,6 +31,9 @@ import { type RateLimiter } from '../rate_limiter.js';
  * and sets it on the Hono context. Skips if a request context is already set
  * (e.g. by session middleware).
  *
+ * Rate limiting (429) is the only hard-fail — it's a throttling concern
+ * independent of auth identity.
+ *
  * @param deps - query dependencies (pool-level db for middleware)
  * @param ip_rate_limiter - per-IP rate limiter for bearer token attempts (null to disable)
  * @param log - the logger instance

package/dist/auth/bearer_auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bearer_auth.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/bearer_auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,MAAM,CAAC;AAC5C,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAKpD,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAA+B,KAAK,WAAW,EAAC,MAAM,oBAAoB,CAAC;AAOlF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,iBAAiB,WAAW,GAAG,IAAI,EACnC,KAAK,MAAM,KACT,iBAwEF,CAAC"}
+{"version":3,"file":"bearer_auth.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/bearer_auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,MAAM,CAAC;AAC5C,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAKpD,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAA+B,KAAK,WAAW,EAAC,MAAM,oBAAoB,CAAC;AAElF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,iBAAiB,WAAW,GAAG,IAAI,EACnC,KAAK,MAAM,KACT,iBAqFF,CAAC"}

package/dist/auth/bearer_auth.js

@@ -15,10 +15,16 @@ import { CREDENTIAL_TYPE_KEY } from '../hono_context.js';
 import { query_validate_api_token } from './api_token_queries.js';
 import { get_client_ip } from '../http/proxy.js';
 import { rate_limit_exceeded_response } from '../rate_limiter.js';
-import { ERROR_BEARER_REJECTED_BROWSER, ERROR_INVALID_TOKEN, ERROR_ACCOUNT_NOT_FOUND, } from '../http/error_schemas.js';
 /**
  * Create middleware that authenticates via bearer token.
  *
+ * Soft-fails for invalid, expired, or empty tokens — calls `next()` without
+ * setting a request context, letting downstream auth enforcement (per-action
+ * `check_action_auth` or `require_auth`) return a consistent JSON-RPC or
+ * route-level error. This avoids leaking token-specific diagnostics
+ * (`invalid_token`, `account_not_found`) that could aid enumeration attacks,
+ * and ensures public actions are not blocked by bad credentials.
+ *
  * Rejects bearer tokens when an `Origin` or `Referer` header is present —
  * browsers must use cookie auth to reduce attack surface.
  * Auth scheme matching is case-insensitive per RFC 7235.
@@ -26,6 +32,9 @@ import { ERROR_BEARER_REJECTED_BROWSER, ERROR_INVALID_TOKEN, ERROR_ACCOUNT_NOT_F
  * and sets it on the Hono context. Skips if a request context is already set
  * (e.g. by session middleware).
  *
+ * Rate limiting (429) is the only hard-fail — it's a throttling concern
+ * independent of auth identity.
+ *
  * @param deps - query dependencies (pool-level db for middleware)
  * @param ip_rate_limiter - per-IP rate limiter for bearer token attempts (null to disable)
  * @param log - the logger instance
@@ -46,19 +55,24 @@ export const create_bearer_auth_middleware = (deps, ip_rate_limiter, log) => {
             await next();
             return;
         }
-        // Reject bearer tokens in browser context — defense-in-depth:
+        // Silently discard bearer tokens in browser context — defense-in-depth:
         // checks both Origin and Referer (not just Origin) because some browser
         // requests send only Referer. Uses `!== undefined` so that empty-string
         // headers (e.g. `Origin: ''`) are still treated as browser context.
+        // Discards rather than returning 403 so that the RPC dispatcher can still
+        // handle public actions or fall through to cookie auth.
         if (c.req.header('Origin') !== undefined || c.req.header('Referer') !== undefined) {
-            return c.json({ error: ERROR_BEARER_REJECTED_BROWSER }, 403);
+            log.debug('bearer auth rejected: browser context (Origin/Referer present)');
+            await next();
+            return;
         }
         const raw_token = auth_header.slice(7);
-        // Reject empty token body before any hashing or DB work.
+        // Empty token body — soft-fail (treat as "no credential").
         // (The Fetch API trims 'Bearer ' to 'Bearer' which skips this middleware entirely,
         // but raw HTTP clients may send 'Bearer ' with an empty token.)
         if (!raw_token) {
-            return c.json({ error: ERROR_INVALID_TOKEN }, 401);
+            await next();
+            return;
         }
         const ip = get_client_ip(c);
         // Per-IP rate limit: record before async DB work to close the TOCTOU
@@ -73,7 +87,11 @@ export const create_bearer_auth_middleware = (deps, ip_rate_limiter, log) => {
         }
         const api_token = await query_validate_api_token({ ...deps, log }, raw_token, ip, c.var.pending_effects);
         if (!api_token) {
-            return c.json({ error: ERROR_INVALID_TOKEN }, 401);
+            // Invalid or expired token — soft-fail. Rate limit counter stays
+            // incremented (recorded above), correctly penalizing bad attempts.
+            log.debug('bearer auth soft-fail: token not found or expired');
+            await next();
+            return;
         }
         // Valid token — reset rate limit counter
         if (ip_rate_limiter)
@@ -81,7 +99,11 @@ export const create_bearer_auth_middleware = (deps, ip_rate_limiter, log) => {
         // Build request context from the token's account
         const ctx = await build_request_context(deps, api_token.account_id);
         if (!ctx) {
-            return c.json({ error: ERROR_ACCOUNT_NOT_FOUND }, 401);
+            // Token exists but account/actor missing — soft-fail to avoid
+            // leaking account lifecycle information.
+            log.debug('bearer auth soft-fail: account or actor not found for token');
+            await next();
+            return;
         }
         c.set(REQUEST_CONTEXT_KEY, ctx);
         c.set(CREDENTIAL_TYPE_KEY, 'api_token');

package/dist/auth/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,4BAA4B,CAAC;AAG/D;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;IACtC,oFAAoF;IACpF,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;CAC3C;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CA+D/B,CAAC"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,oBAAoB,CAAC;AACpD,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,4BAA4B,CAAC;AAG/D;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;IACtC,oFAAoF;IACpF,sBAAsB,EAAE,WAAW,GAAG,IAAI,CAAC;CAC3C;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,OAAO,EACb,SAAS,qBAAqB,KAC5B,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAmE/B,CAAC"}

package/dist/auth/middleware.js

@@ -47,7 +47,11 @@ export const create_auth_middleware_specs = async (deps, options) => {
             name: 'bearer_auth',
             path,
             handler: bearer_auth_middleware,
-            errors: { 401: ApiError, 403: ApiError, 429: RateLimitError },
+            // Bearer middleware soft-fails for invalid/expired tokens (calls next()
+            // without setting context). Only 429 is a hard-fail from this layer.
+            // Auth enforcement (401/403) happens downstream via check_action_auth
+            // or require_auth, producing consistent JSON-RPC or route-level errors.
+            errors: { 429: RateLimitError },
         },
     ];
     if (daemon_token_state) {

package/dist/testing/adversarial_headers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adversarial_headers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_headers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAY7B,OAAO,KAAK,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAS3B,OAAO,EAGN,KAAK,0BAA0B,EAC/B,MAAM,iBAAiB,CAAC;AAIzB,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IAClC,qGAAqG;IACrG,oBAAoB,EAAE,QAAQ,GAAG,YAAY,CAAC;CAC9C;AAID;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,GAC7C,gBAAgB,MAAM,KACpB,KAAK,CAAC,qBAAqB,CAkE7B,CAAC;AAIF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qCAAqC,GACjD,YAAY,MAAM,EAClB,SAAS,0BAA0B,EACnC,gBAAgB,MAAM,EACtB,cAAc,KAAK,CAAC,qBAAqB,CAAC,KACxC,IAkCF,CAAC"}
+{"version":3,"file":"adversarial_headers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/adversarial_headers.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAY7B,OAAO,KAAK,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAG3B,OAAO,EAGN,KAAK,0BAA0B,EAC/B,MAAM,iBAAiB,CAAC;AAIzB,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IAClC,qGAAqG;IACrG,oBAAoB,EAAE,QAAQ,GAAG,YAAY,CAAC;CAC9C;AAID;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,GAC7C,gBAAgB,MAAM,KACpB,KAAK,CAAC,qBAAqB,CA+D7B,CAAC;AAIF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,qCAAqC,GACjD,YAAY,MAAM,EAClB,SAAS,0BAA0B,EACnC,gBAAgB,MAAM,EACtB,cAAc,KAAK,CAAC,qBAAqB,CAAC,KACxC,IAkCF,CAAC"}

package/dist/testing/adversarial_headers.js

@@ -8,7 +8,7 @@ import './assert_dev_env.js';
  * @module
  */
 import { test, assert, describe } from 'vitest';
-import { ApiError, ERROR_FORBIDDEN_ORIGIN, ERROR_FORBIDDEN_REFERER, ERROR_BEARER_REJECTED_BROWSER, ERROR_INVALID_TOKEN, } from '../http/error_schemas.js';
+import { ApiError, ERROR_FORBIDDEN_ORIGIN, ERROR_FORBIDDEN_REFERER } from '../http/error_schemas.js';
 import { create_test_middleware_stack_app, TEST_MIDDLEWARE_PATH, } from './middleware.js';
 // --- Standard adversarial header cases ---
 /**
@@ -29,13 +29,12 @@ export const create_standard_adversarial_cases = (allowed_origin) => [
         validate_expectation: 'not_called',
     },
     {
-        name: 'bearer token with allowed Origin is rejected as browser context',
+        name: 'bearer token with allowed Origin — bearer silently discarded (browser context)',
         headers: {
             Authorization: 'Bearer secret_fuz_token_test',
             Origin: allowed_origin,
         },
-        expected_status: 403,
-        expected_error: ERROR_BEARER_REJECTED_BROWSER,
+        expected_status: 200,
         validate_expectation: 'not_called',
     },
     {
@@ -55,12 +54,11 @@ export const create_standard_adversarial_cases = (allowed_origin) => [
         validate_expectation: 'not_called',
     },
     {
-        name: 'lowercase bearer scheme is recognized (case-insensitive per RFC 7235)',
+        name: 'lowercase bearer scheme is recognized (case-insensitive per RFC 7235), soft-fails',
         headers: {
             Authorization: 'bearer secret_fuz_token_test',
         },
-        expected_status: 401,
-        expected_error: ERROR_INVALID_TOKEN,
+        expected_status: 200,
         validate_expectation: 'called',
     },
     {
@@ -74,13 +72,12 @@ export const create_standard_adversarial_cases = (allowed_origin) => [
         validate_expectation: 'not_called',
     },
     {
-        name: 'bearer token with Referer from allowed origin is rejected as browser context (defense-in-depth)',
+        name: 'bearer token with Referer from allowed origin — bearer silently discarded (browser context)',
         headers: {
             Authorization: 'Bearer secret_fuz_token_test',
             Referer: `${allowed_origin}/page`,
         },
-        expected_status: 403,
-        expected_error: ERROR_BEARER_REJECTED_BROWSER,
+        expected_status: 200,
         validate_expectation: 'not_called',
     },
 ];

package/dist/testing/app_server.d.ts

@@ -144,6 +144,8 @@ export interface TestApp {
     create_session_headers: (extra?: Record<string, string>) => Record<string, string>;
     /** Build request headers with the bootstrapped Bearer token. */
     create_bearer_headers: (extra?: Record<string, string>) => Record<string, string>;
+    /** Build request headers with the daemon token (keeper auth). */
+    create_daemon_token_headers: (extra?: Record<string, string>) => Record<string, string>;
     /** Create an additional account with credentials. */
     create_account: (options?: {
         username?: string;

package/dist/testing/app_server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/app_server.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,MAAM,CAAC;AAK/B,OAAO,EAA2B,KAAK,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAE1E,OAAO,KAAK,EAAC,EAAE,EAAE,MAAM,EAAC,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,qBAAqB,CAAC;AAU1D,OAAO,EAA8B,KAAK,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAG3F,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAEN,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAC,UAAU,EAAE,cAAc,EAAC,MAAM,oBAAoB,CAAC;AACnE,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAKrD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,gBAIhC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AASjD;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC3C,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,GAClC,SAAS,2BAA2B,KAClC,OAAO,CAAC;IACV,OAAO,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACxC,KAAK,EAAE;QAAC,EAAE,EAAE,MAAM,CAAA;KAAC,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAyCA,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,UAAU;IAChD,gCAAgC;IAChC,OAAO,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACxC,uCAAuC;IACvC,KAAK,EAAE;QAAC,EAAE,EAAE,MAAM,CAAA;KAAC,CAAC;IACpB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,mDAAmD;IACnD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kGAAkG;IAClG,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yHAAyH;IACzH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAqBD,eAAO,MAAM,sBAAsB,GAClC,SAAS,oBAAoB,KAC3B,OAAO,CAAC,aAAa,CAsFvB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IACjE,yEAAyE;IACzE,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE,gHAAgH;IAChH,WAAW,CAAC,EAAE,OAAO,CACpB,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC,CAC5E,CAAC;CACF;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACxC,KAAK,EAAE;QAAC,EAAE,EAAE,MAAM,CAAA;KAAC,CAAC;IACpB,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,8DAA8D;IAC9D,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClF;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,kEAAkE;IAClE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,gEAAgE;IAChE,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClF,qDAAqD;IACrD,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE;QAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;KACtB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3B,8DAA8D;IAC9D,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,GAAU,SAAS,oBAAoB,KAAG,OAAO,CAAC,OAAO,CAgFpF,CAAC"}
+{"version":3,"file":"app_server.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/app_server.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,MAAM,CAAC;AAK/B,OAAO,EAA2B,KAAK,OAAO,EAAC,MAAM,oBAAoB,CAAC;AAE1E,OAAO,KAAK,EAAC,EAAE,EAAE,MAAM,EAAC,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,qBAAqB,CAAC;AAU1D,OAAO,EAA8B,KAAK,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAG3F,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAEN,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAC,UAAU,EAAE,cAAc,EAAC,MAAM,oBAAoB,CAAC;AACnE,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAUrD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,gBAIhC,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,QAAiB,CAAC;AASjD;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC3C,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,GAClC,SAAS,2BAA2B,KAClC,OAAO,CAAC;IACV,OAAO,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACxC,KAAK,EAAE;QAAC,EAAE,EAAE,MAAM,CAAA;KAAC,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACvB,CAyCA,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,UAAU;IAChD,gCAAgC;IAChC,OAAO,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACxC,uCAAuC;IACvC,KAAK,EAAE;QAAC,EAAE,EAAE,MAAM,CAAA;KAAC,CAAC;IACpB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACpC,mDAAmD;IACnD,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kGAAkG;IAClG,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yHAAyH;IACzH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACtB;AAqBD,eAAO,MAAM,sBAAsB,GAClC,SAAS,oBAAoB,KAC3B,OAAO,CAAC,aAAa,CAsFvB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IACjE,yEAAyE;IACzE,kBAAkB,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACpE,gHAAgH;IAChH,WAAW,CAAC,EAAE,OAAO,CACpB,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC,CAC5E,CAAC;CACF;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,OAAO,EAAE;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,CAAC;IACxC,KAAK,EAAE;QAAC,EAAE,EAAE,MAAM,CAAA;KAAC,CAAC;IACpB,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,8DAA8D;IAC9D,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClF;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACvB,GAAG,EAAE,IAAI,CAAC;IACV,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,cAAc,CAAC;IAC7B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,kEAAkE;IAClE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnF,gEAAgE;IAChE,qBAAqB,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClF,iEAAiE;IACjE,2BAA2B,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxF,qDAAqD;IACrD,cAAc,EAAE,CAAC,OAAO,CAAC,EAAE;QAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;KACtB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3B,8DAA8D;IAC9D,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,GAAU,SAAS,oBAAoB,KAAG,OAAO,CAAC,OAAO,CAkGpF,CAAC"}

package/dist/testing/app_server.js

@@ -12,6 +12,7 @@ import { create_session_cookie_value } from '../auth/session_cookie.js';
 import { run_migrations } from '../db/migrate.js';
 import { AUTH_MIGRATION_NS } from '../auth/migrations.js';
 import { create_app_server, } from '../server/app_server.js';
+import { generate_daemon_token, DAEMON_TOKEN_HEADER, } from '../auth/daemon_token.js';
 import { create_pglite_factory } from './db.js';
 /* eslint-disable @typescript-eslint/require-await */
 /**
@@ -172,6 +173,15 @@ export const create_test_app_server = async (options) => {
  */
 export const create_test_app = async (options) => {
     const test_server = await create_test_app_server(options);
+    // Daemon token state for keeper auth in tests.
+    // Uses a static token (no rotation) — sufficient for request-level testing.
+    const test_daemon_token = generate_daemon_token();
+    const daemon_token_state = {
+        current_token: test_daemon_token,
+        previous_token: null,
+        rotated_at: new Date(),
+        keeper_account_id: test_server.account.id,
+    };
     const result = await create_app_server({
         backend: test_server,
         session_options: options.session_options,
@@ -183,6 +193,7 @@ export const create_test_app = async (options) => {
         signup_account_rate_limiter: null,
         bearer_ip_rate_limiter: null,
         await_pending_effects: true,
+        daemon_token_state,
         ...options.app_options,
         create_route_specs: options.create_route_specs,
     });
@@ -200,6 +211,11 @@ export const create_test_app = async (options) => {
         authorization: `Bearer ${test_server.api_token}`,
         ...extra,
     });
+    const create_daemon_token_headers = (extra) => ({
+        host: 'localhost',
+        [DAEMON_TOKEN_HEADER]: test_daemon_token,
+        ...extra,
+    });
     let account_counter = 0;
     const create_account = async (account_options) => {
         account_counter++;
@@ -235,6 +251,7 @@ export const create_test_app = async (options) => {
         route_specs: surface_spec.route_specs,
         create_session_headers,
         create_bearer_headers,
+        create_daemon_token_headers,
         create_account,
         cleanup: () => test_server.cleanup(),
     };

package/dist/testing/data_exposure.js

@@ -291,6 +291,6 @@ const pick_auth_headers = (spec, test_app, authed_account, admin_account) => {
             // keeper role uses the bootstrapped account
             return test_app.create_session_headers();
         case 'keeper':
-            return test_app.create_bearer_headers();
+            return test_app.create_daemon_token_headers();
     }
 };

package/dist/testing/integration.d.ts

@@ -24,7 +24,7 @@ export interface StandardIntegrationTestOptions {
  *
  * Exercises login/logout, cookie attributes, session security, session
  * revocation, password change (incl. API token revocation), origin
- * verification, bearer auth (incl. browser context rejection on mutations),
+ * verification, bearer auth (incl. browser context discard on mutations),
  * token revocation, cross-account isolation, expired credential rejection,
  * signup invite edge cases, and response body validation.
  *

package/dist/testing/integration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAsB7B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAC,gBAAgB,EAAE,gBAAgB,EAAC,MAAM,yBAAyB,CAAC;AAChF,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAGrD,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,SAAS,CAAC;AAgBjB;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC9C,4CAA4C;IAC5C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,wDAAwD;IACxD,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,iDAAiD;IACjD,WAAW,CAAC,EAAE,OAAO,CACpB,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC,CAC5E,CAAC;IACF;;;OAGG;IACH,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;CAChC;AAeD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,mCAAmC,GAC/C,SAAS,8BAA8B,KACrC,IAk+CF,CAAC"}
+{"version":3,"file":"integration.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/integration.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAsB7B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAC,gBAAgB,EAAE,gBAAgB,EAAC,MAAM,yBAAyB,CAAC;AAChF,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAGrD,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,SAAS,CAAC;AAgBjB;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC9C,4CAA4C;IAC5C,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,wDAAwD;IACxD,kBAAkB,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,iDAAiD;IACjD,WAAW,CAAC,EAAE,OAAO,CACpB,IAAI,CAAC,gBAAgB,EAAE,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC,CAC5E,CAAC;IACF;;;OAGG;IACH,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;CAChC;AAeD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,mCAAmC,GAC/C,SAAS,8BAA8B,KACrC,IAo+CF,CAAC"}

package/dist/testing/integration.js

@@ -38,7 +38,7 @@ const build_test_app_options = (options, db) => ({
  *
  * Exercises login/logout, cookie attributes, session security, session
  * revocation, password change (incl. API token revocation), origin
- * verification, bearer auth (incl. browser context rejection on mutations),
+ * verification, bearer auth (incl. browser context discard on mutations),
  * token revocation, cross-account isolation, expired credential rejection,
  * signup invite edge cases, and response body validation.
  *
@@ -525,17 +525,15 @@ export const describe_standard_integration_tests = (options) => {
                     headers: bearer_headers,
                 });
                 assert.strictEqual(ok_res.status, 200);
-                // With Origin — rejected (browser context)
+                // With Origin — bearer silently discarded (browser context), falls through to no auth
                 const res = await test_app.app.request(verify_route.path, {
                     headers: {
                         ...bearer_headers,
                         origin: 'http://localhost:5173',
                     },
                 });
-                assert.strictEqual(res.status, 403);
-                error_collector.record(test_app.route_specs, 'GET', verify_route.path, 403);
-                const body = await res.json();
-                assert.strictEqual(body.error, 'bearer_token_rejected_in_browser_context');
+                assert.strictEqual(res.status, 401);
+                error_collector.record(test_app.route_specs, 'GET', verify_route.path, 401);
             });
         });
         // --- 7. Token revocation ---
@@ -912,8 +910,8 @@ export const describe_standard_integration_tests = (options) => {
             });
         });
         // --- 12. Bearer token browser context on mutation routes ---
-        describe('bearer token browser context rejection on mutations', () => {
-            test('bearer token with Origin header rejected on POST logout', async () => {
+        describe('bearer token browser context silently discarded on mutations', () => {
+            test('bearer token with Origin header discarded on POST logout', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
                 const logout_route = find_auth_route(test_app.route_specs, '/logout', 'POST');
                 assert.ok(logout_route, 'Expected POST /logout route — ensure create_route_specs includes account routes');
@@ -924,12 +922,10 @@ export const describe_standard_integration_tests = (options) => {
                     method: 'POST',
                     headers: { ...bearer_headers, origin: 'http://localhost:5173' },
                 });
-                assert.strictEqual(res.status, 403, 'Bearer with Origin should be rejected on mutation');
-                const body = await res.json();
-                assert.strictEqual(body.error, 'bearer_token_rejected_in_browser_context');
-                error_collector.record(test_app.route_specs, 'POST', logout_route.path, 403);
+                assert.strictEqual(res.status, 401, 'Bearer with Origin should be discarded → unauthenticated');
+                error_collector.record(test_app.route_specs, 'POST', logout_route.path, 401);
             });
-            test('bearer token with Referer header rejected on POST password', async () => {
+            test('bearer token with Referer header discarded on POST password', async () => {
                 const test_app = await create_test_app(build_test_app_options(options, get_db()));
                 const password_route = find_auth_route(test_app.route_specs, '/password', 'POST');
                 assert.ok(password_route, 'Expected POST /password route — ensure create_route_specs includes account routes');
@@ -940,10 +936,8 @@ export const describe_standard_integration_tests = (options) => {
                     method: 'POST',
                     headers: { ...bearer_headers, referer: 'http://localhost:5173/admin' },
                 });
-                assert.strictEqual(res.status, 403, 'Bearer with Referer should be rejected on mutation');
-                const body = await res.json();
-                assert.strictEqual(body.error, 'bearer_token_rejected_in_browser_context');
-                error_collector.record(test_app.route_specs, 'POST', password_route.path, 403);
+                assert.strictEqual(res.status, 401, 'Bearer with Referer should be discarded → unauthenticated');
+                error_collector.record(test_app.route_specs, 'POST', password_route.path, 401);
             });
         });
         // --- 13. Password change revokes API tokens ---

package/dist/testing/round_trip.js

@@ -122,6 +122,6 @@ const pick_auth_headers = (spec, test_app, authed_account, admin_account) => {
             // Keeper role uses the bootstrapped account (which has keeper role)
             return test_app.create_session_headers();
         case 'keeper':
-            return test_app.create_bearer_headers();
+            return test_app.create_daemon_token_headers();
     }
 };

package/dist/testing/rpc_attack_surface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc_attack_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_attack_surface.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAkB7B,OAAO,KAAK,EAA6C,cAAc,EAAC,MAAM,oBAAoB,CAAC;AAenG,uDAAuD;AACvD,MAAM,WAAW,uBAAuB;IACvC,+FAA+F;IAC/F,KAAK,EAAE,MAAM,cAAc,CAAC;IAC5B,yDAAyD;IACzD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACrB;AAkaD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,GAAI,SAAS,uBAAuB,KAAG,IAOpF,CAAC"}
+{"version":3,"file":"rpc_attack_surface.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/testing/rpc_attack_surface.ts"],"names":[],"mappings":"AAAA,OAAO,qBAAqB,CAAC;AAkB7B,OAAO,KAAK,EAA6C,cAAc,EAAC,MAAM,oBAAoB,CAAC;AAoBnG,uDAAuD;AACvD,MAAM,WAAW,uBAAuB;IACvC,+FAA+F;IAC/F,KAAK,EAAE,MAAM,cAAc,CAAC;IAC5B,yDAAyD;IACzD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;CACrB;AAodD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,GAAI,SAAS,uBAAuB,KAAG,IAOpF,CAAC"}

package/dist/testing/rpc_attack_surface.js

@@ -14,7 +14,7 @@ import './assert_dev_env.js';
  */
 import { test, assert, describe } from 'vitest';
 import { JSONRPC_ERROR_CODES } from '../http/jsonrpc_errors.js';
-import { create_auth_test_apps, select_auth_app } from './auth_apps.js';
+import { create_auth_test_apps, create_test_app_from_specs, create_test_request_context, select_auth_app, } from './auth_apps.js';
 import { generate_input_test_cases } from './adversarial_input.js';
 import { ERROR_INVALID_JSON_BODY } from '../http/error_schemas.js';
 import { create_rpc_post_init, create_rpc_get_url, assert_jsonrpc_error_response, } from './rpc_helpers.js';
@@ -23,6 +23,8 @@ import { create_rpc_post_init, create_rpc_get_url, assert_jsonrpc_error_response
 const filter_protected_rpc_methods = (endpoint) => endpoint.methods.filter((m) => m.auth.type !== 'none');
 /** Filter RPC methods that require a specific role. */
 const filter_role_rpc_methods = (endpoint) => endpoint.methods.filter((m) => m.auth.type === 'role');
+/** Filter RPC methods that require keeper auth (daemon_token + keeper role). */
+const filter_keeper_rpc_methods = (endpoint) => endpoint.methods.filter((m) => m.auth.type === 'keeper');
 /** Find the `RpcAction` source spec for a surface method. */
 const find_rpc_action = (rpc_endpoint_specs, endpoint_path, method_name) => {
     const ep = rpc_endpoint_specs.find((e) => e.path === endpoint_path);
@@ -40,7 +42,7 @@ const find_rpc_action = (rpc_endpoint_specs, endpoint_path, method_name) => {
  * - unauthenticated → error code -32001 — every protected method
  * - wrong role → error code -32002 — every role method with non-matching roles
  * - authenticated without role → -32002 — every role method, no-role context
- * - keeper routes reject session credential → -32002
+ * - keeper rejects non-daemon credentials → -32002 — session and api_token rejected
  * - correct auth passes — every protected method, assert not 401/403
  */
 const describe_rpc_auth = (options) => {
@@ -94,9 +96,27 @@ const describe_rpc_auth = (options) => {
                         }
                     });
                 }
-                // NOTE: no "keeper rejects session credential" test for RPC — the RPC
-                // dispatcher's check_action_auth only checks role, not credential type.
-                // Credential type enforcement is a REST middleware concern (require_keeper).
+                const keeper_methods = filter_keeper_rpc_methods(endpoint);
+                if (keeper_methods.length > 0) {
+                    describe('keeper rejects non-daemon credentials', () => {
+                        const session_app = create_test_app_from_specs(route_specs, create_test_request_context('keeper'), 'session');
+                        const api_token_app = create_test_app_from_specs(route_specs, create_test_request_context('keeper'), 'api_token');
+                        for (const method of keeper_methods) {
+                            test(`${method.name} rejects session credential`, async () => {
+                                const res = await session_app.request(endpoint.path, create_rpc_post_init(method.name));
+                                assert.strictEqual(res.status, 403, `${method.name} should reject session credential`);
+                                const body = await res.json();
+                                assert_jsonrpc_error_response(body, JSONRPC_ERROR_CODES.forbidden);
+                            });
+                            test(`${method.name} rejects api_token credential`, async () => {
+                                const res = await api_token_app.request(endpoint.path, create_rpc_post_init(method.name));
+                                assert.strictEqual(res.status, 403, `${method.name} should reject api_token credential`);
+                                const body = await res.json();
+                                assert_jsonrpc_error_response(body, JSONRPC_ERROR_CODES.forbidden);
+                            });
+                        }
+                    });
+                }
                 describe('correct auth passes', () => {
                     for (const method of protected_methods) {
                         test(method.name, async () => {

package/dist/testing/rpc_round_trip.js

@@ -33,7 +33,7 @@ const pick_rpc_auth_headers = (method, test_app, authed_account, admin_account)
             // keeper role uses the bootstrapped account
             return test_app.create_session_headers();
         case 'keeper':
-            return test_app.create_bearer_headers();
+            return test_app.create_daemon_token_headers();
     }
 };
 /**

package/dist/ui/AdminOverview.svelte

@@ -67,20 +67,20 @@
 <!-- TODO: panels will be user-draggable/rearrangeable, hardcoded order for now -->
 <div class="overview">
 	<section>
-		<div class="panel_header">
+		<div class="panel-header">
 			<h3>accounts</h3>
 			<a href={resolve('/admin/accounts' as any)} class="text_50 font_size_sm">view all &rarr;</a>
 		</div>
 		{#if accounts.loading}
 			<p class="text_50">loading...</p>
 		{:else if accounts.error}
-			<p class="color_c">{accounts.error}</p>
+			<p class="color_c_50">{accounts.error}</p>
 		{:else}
-			<div class="baseline_row gap_xs">
+			<div class="baseline-row gap_xs">
 				<strong class="font_size_lg">{accounts.account_count}</strong>
 				<span class="text_50">accounts</span>
 			</div>
-			<div class="baseline_row gap_xs flex-wrap:wrap font_size_sm mt_xs">
+			<div class="baseline-row gap_xs flex-wrap:wrap font_size_sm mt_xs">
 				{#each role_counts as [role, count] (role)}
 					<span>{count} {role}</span>
 					<span class="text_50">&middot;</span>
@@ -88,7 +88,7 @@
 				<span>{unroled_count} unroled</span>
 			</div>
 			{#if accounts.accounts.length > 0}
-				<ul class="compact_list">
+				<ul class="compact-list">
 					{#each accounts.accounts.slice(0, 6) as entry (entry)}
 						<li>
 							<strong>{entry.account.username}</strong>
@@ -109,25 +109,25 @@
 	</section>
 
 	<section>
-		<div class="panel_header">
+		<div class="panel-header">
 			<h3>sessions</h3>
 			<a href={resolve('/admin/sessions' as any)} class="text_50 font_size_sm">view all &rarr;</a>
 		</div>
 		{#if sessions.loading}
 			<p class="text_50">loading...</p>
 		{:else if sessions.error}
-			<p class="color_c">{sessions.error}</p>
+			<p class="color_c_50">{sessions.error}</p>
 		{:else}
-			<div class="baseline_row gap_xs">
+			<div class="baseline-row gap_xs">
 				<strong class="font_size_lg">{sessions.active_count}</strong>
 				<span class="text_50">active</span>
 			</div>
-			<div class="baseline_row gap_xs">
+			<div class="baseline-row gap_xs">
 				<strong class="font_size_lg">{unique_users}</strong>
 				<span class="text_50">unique users</span>
 			</div>
 			{#if most_recent}
-				<div class="baseline_row gap_xs font_size_sm mt_sm">
+				<div class="baseline-row gap_xs font_size_sm mt_sm">
 					<span class="text_50">last active:</span>
 					<strong>{most_recent.username}</strong>
 					<span class="text_50" title={format_datetime_local(most_recent.last_seen_at)}
@@ -139,16 +139,16 @@
 	</section>
 
 	<section>
-		<div class="panel_header">
+		<div class="panel-header">
 			<h3>invites</h3>
 			<a href={resolve('/admin/invites' as any)} class="text_50 font_size_sm">view all &rarr;</a>
 		</div>
 		{#if invites.loading}
 			<p class="text_50">loading...</p>
 		{:else if invites.error}
-			<p class="color_c">{invites.error}</p>
+			<p class="color_c_50">{invites.error}</p>
 		{:else}
-			<div class="baseline_row gap_sm">
+			<div class="baseline-row gap_sm">
 				<span class="text_50">public signup</span>
 				{#if app_settings.settings?.open_signup}
 					<span class="chip color_b">open</span>
@@ -156,7 +156,7 @@
 					<span class="chip">closed</span>
 				{/if}
 			</div>
-			<div class="baseline_row gap_xs">
+			<div class="baseline-row gap_xs">
 				<strong class="font_size_lg">{invites.unclaimed_count}</strong>
 				<span class="text_50">unclaimed</span>
 				<span class="text_50">/</span>
@@ -164,7 +164,7 @@
 				<span class="text_50">total</span>
 			</div>
 			{#if invites.invites.length > 0}
-				<ul class="compact_list">
+				<ul class="compact-list">
 					{#each invites.invites.slice(0, 4) as invite (invite.id)}
 						<li>
 							<span>{invite.email || invite.username || '—'}</span>
@@ -184,18 +184,18 @@
 	</section>
 
 	<section>
-		<div class="panel_header">
+		<div class="panel-header">
 			<h3>recent activity</h3>
 			<a href={resolve('/admin/audit-log' as any)} class="text_50 font_size_sm">view all &rarr;</a>
 		</div>
 		{#if audit_log.loading}
 			<p class="text_50">loading...</p>
 		{:else if audit_log.error}
-			<p class="color_c">{audit_log.error}</p>
+			<p class="color_c_50">{audit_log.error}</p>
 		{:else if recent_events.length === 0}
 			<p class="text_50">no events</p>
 		{:else}
-			<ul class="compact_list">
+			<ul class="compact-list">
 				{#each recent_events as event (event.id)}
 					<li>
 						<span class="text_50 font_size_sm" title={format_datetime_local(event.created_at)}
@@ -212,27 +212,27 @@
 	</section>
 
 	<section>
-		<div class="panel_header">
+		<div class="panel-header">
 			<h3>security</h3>
 			<a href={resolve('/admin/audit-log' as any)} class="text_50 font_size_sm">audit log &rarr;</a>
 		</div>
 		{#if audit_log.loading}
 			<p class="text_50">loading...</p>
 		{:else if audit_log.error}
-			<p class="color_c">{audit_log.error}</p>
+			<p class="color_c_50">{audit_log.error}</p>
 		{:else}
-			<div class="baseline_row gap_xs">
-				<strong class="font_size_lg" class:color_c={failed_logins.length > 0}>
+			<div class="baseline-row gap_xs">
+				<strong class="font_size_lg" class:color_c_50={failed_logins.length > 0}>
 					{failed_logins.length}
 				</strong>
 				<span class="text_50">failed logins</span>
 			</div>
-			<div class="baseline_row gap_xs">
+			<div class="baseline-row gap_xs">
 				<strong class="font_size_lg">{permit_changes.length}</strong>
 				<span class="text_50">permit changes</span>
 			</div>
 			{#if permit_changes.length > 0}
-				<ul class="compact_list">
+				<ul class="compact-list">
 					{#each permit_changes.slice(0, 4) as event (event.id)}
 						<li class="font_size_sm">
 							<span class="text_50" title={format_datetime_local(event.created_at)}
@@ -250,15 +250,15 @@
 	</section>
 
 	<section>
-		<div class="panel_header">
+		<div class="panel-header">
 			<h3>system</h3>
 		</div>
 		{#if app_settings.loading}
 			<p class="text_50">loading...</p>
 		{:else if app_settings.error}
-			<p class="color_c">{app_settings.error}</p>
+			<p class="color_c_50">{app_settings.error}</p>
 		{:else}
-			<div class="baseline_row gap_sm">
+			<div class="baseline-row gap_sm">
 				<span class="text_50">public signup</span>
 				{#if app_settings.settings?.open_signup}
 					<span class="chip color_b">open</span>
@@ -267,7 +267,7 @@
 				{/if}
 			</div>
 			{#if app_settings.settings?.updated_at}
-				<div class="baseline_row gap_xs font_size_sm mt_xs">
+				<div class="baseline-row gap_xs font_size_sm mt_xs">
 					<span class="text_50">last changed:</span>
 					<span title={format_datetime_local(app_settings.settings.updated_at)}>
 						{format_relative_time(app_settings.settings.updated_at)}
@@ -280,7 +280,7 @@
 			{/if}
 		{/if}
 		{#if auth_state.account}
-			<div class="baseline_row gap_sm">
+			<div class="baseline-row gap_sm">
 				<span class="text_50">logged in as</span>
 				<strong>{auth_state.account.username}</strong>
 			</div>
@@ -310,25 +310,25 @@
 		gap: var(--space_lg);
 	}
 
-	.panel_header {
+	.panel-header {
 		display: flex;
 		justify-content: space-between;
 		align-items: baseline;
 		margin-bottom: var(--space_md);
 	}
 
-	.baseline_row {
+	.baseline-row {
 		display: flex;
 		align-items: baseline;
 	}
 
-	.compact_list {
+	.compact-list {
 		list-style: none;
 		padding: 0;
 		margin: var(--space_sm) 0 0;
 	}
 
-	.compact_list li {
+	.compact-list li {
 		display: flex;
 		align-items: baseline;
 		gap: var(--space_xs);

package/dist/ui/BootstrapForm.svelte

@@ -1,4 +1,6 @@
 <script lang="ts">
+	import {goto} from '$app/navigation';
+	import {resolve} from '$app/paths';
 	import PendingButton from '@fuzdev/fuz_ui/PendingButton.svelte';
 	import {autofocus} from '@fuzdev/fuz_ui/autofocus.svelte.js';
 
@@ -7,6 +9,12 @@
 	import {auth_state_context} from './auth_state.svelte.js';
 	import {FormState} from './form_state.svelte.js';
 
+	const {
+		redirect_on_bootstrap = resolve('/'),
+	}: {
+		redirect_on_bootstrap?: string;
+	} = $props();
+
 	const auth_state = auth_state_context.get();
 	const form_state = new FormState();
 
@@ -35,7 +43,11 @@
 			else if (!passwords_match) form_state.focus('password_confirm');
 			return;
 		}
-		await auth_state.bootstrap(token.trim(), username.trim(), password);
+		const success = await auth_state.bootstrap(token.trim(), username.trim(), password);
+		if (success) {
+			form_state.reset();
+			await goto(redirect_on_bootstrap);
+		}
 	};
 </script>
 

package/dist/ui/BootstrapForm.svelte.d.ts

@@ -1,4 +1,7 @@
-declare const BootstrapForm: import("svelte").Component<Record<string, never>, {}, "">;
+type $$ComponentProps = {
+    redirect_on_bootstrap?: string;
+};
+declare const BootstrapForm: import("svelte").Component<$$ComponentProps, {}, "">;
 type BootstrapForm = ReturnType<typeof BootstrapForm>;
 export default BootstrapForm;
 //# sourceMappingURL=BootstrapForm.svelte.d.ts.map

package/dist/ui/BootstrapForm.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BootstrapForm.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/BootstrapForm.svelte"],"names":[],"mappings":"AAqGA,QAAA,MAAM,aAAa,2DAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}
+{"version":3,"file":"BootstrapForm.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/BootstrapForm.svelte"],"names":[],"mappings":"AAaC,KAAK,gBAAgB,GAAI;IACxB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAqGH,QAAA,MAAM,aAAa,sDAAwC,CAAC;AAC5D,KAAK,aAAa,GAAG,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC;AACtD,eAAe,aAAa,CAAC"}

package/dist/ui/ColumnLayout.svelte

@@ -15,29 +15,29 @@
 	} = $props();
 </script>
 
-<div class="column_layout {class_name}" style:--column_width={column_width} {...rest}>
-	<aside class="column_fixed unstyled">
+<div class="column-layout {class_name}" style:--column_width={column_width} {...rest}>
+	<aside class="column-fixed unstyled">
 		{@render aside()}
 	</aside>
-	<div class="column_fluid">
+	<div class="column-fluid">
 		{@render children()}
 	</div>
 </div>
 
 <style>
-	.column_layout {
+	.column-layout {
 		display: flex;
 		height: 100%;
 	}
 
-	.column_fixed {
+	.column-fixed {
 		width: var(--column_width, 280px);
 		min-width: var(--column_width, 280px);
 		height: 100%;
 		overflow: auto;
 	}
 
-	.column_fluid {
+	.column-fluid {
 		flex: 1;
 		height: 100%;
 		min-width: 0;

package/dist/ui/Datatable.svelte

@@ -78,16 +78,16 @@
 	aria-rowcount={rows.length + 1}
 >
 	<!-- sticky header -->
-	<div class="datatable_header" role="row" aria-rowindex={1}>
+	<div class="datatable-header" role="row" aria-rowindex={1}>
 		{#each columns as column, i (column.key)}
-			<div class="datatable_header_cell" role="columnheader">
+			<div class="datatable-header-cell" role="columnheader">
 				{#if header}
 					{@render header(column)}
 				{:else}
 					{column.label}
 				{/if}
 				<div
-					class="datatable_resize_handle"
+					class="datatable-resize-handle"
 					role="separator"
 					onpointerdown={(e) => handle_resize_start(e, i)}
 					onpointermove={handle_resize_move}
@@ -98,7 +98,7 @@
 	</div>
 
 	{#if rows.length === 0}
-		<div class="datatable_empty">
+		<div class="datatable-empty">
 			{#if empty}
 				{@render empty()}
 			{:else}
@@ -107,9 +107,9 @@
 		</div>
 	{:else}
 		{#each rows as row, i (row[row_key] ?? i)}
-			<div class="datatable_row" role="row" aria-rowindex={i + 2}>
+			<div class="datatable-row" role="row" aria-rowindex={i + 2}>
 				{#each columns as column (column.key)}
-					<div class="datatable_cell" role="gridcell">
+					<div class="datatable-cell" role="gridcell">
 						{#if cell}
 							{@render cell(column, row, row[column.key])}
 						{:else if column.format}
@@ -131,7 +131,7 @@
 		overflow: auto;
 	}
 
-	.datatable_header {
+	.datatable-header {
 		display: grid;
 		grid-column: 1 / -1;
 		grid-template-columns: subgrid;
@@ -142,7 +142,7 @@
 		border-bottom: var(--border_width, 1px) solid var(--border_color);
 	}
 
-	.datatable_header_cell {
+	.datatable-header-cell {
 		position: relative;
 		display: flex;
 		align-items: center;
@@ -150,7 +150,7 @@
 		font-weight: 600;
 	}
 
-	.datatable_resize_handle {
+	.datatable-resize-handle {
 		position: absolute;
 		top: 0;
 		right: 0;
@@ -159,11 +159,11 @@
 		cursor: col-resize;
 	}
 
-	.datatable_resize_handle:hover {
-		background: var(--color_a_5);
+	.datatable-resize-handle:hover {
+		background: var(--color_a_10);
 	}
 
-	.datatable_row {
+	.datatable-row {
 		display: grid;
 		grid-column: 1 / -1;
 		grid-template-columns: subgrid;
@@ -172,13 +172,13 @@
 		border-bottom: var(--border_width, 1px) solid var(--border_color);
 	}
 
-	.datatable_cell {
+	.datatable-cell {
 		padding: var(--space_xs);
 		min-width: 0; /* override grid auto minimum to respect column widths */
 		overflow-wrap: break-word;
 	}
 
-	.datatable_empty {
+	.datatable-empty {
 		grid-column: 1 / -1;
 		padding: var(--space_lg);
 	}

package/dist/ui/LoginForm.svelte

@@ -9,7 +9,7 @@
 
 	const {
 		username_label = 'username or email',
-		redirect_on_login = resolve('/account' as any),
+		redirect_on_login = resolve('/'),
 	}: {
 		username_label?: string;
 		redirect_on_login?: string;

package/dist/ui/OpenSignupToggle.svelte

@@ -6,7 +6,7 @@
 	void app_settings.fetch();
 </script>
 
-<div class="open_signup_toggle">
+<div class="open-signup-toggle">
 	{#if app_settings.loading}
 		<p class="text_50">loading settings...</p>
 	{:else if app_settings.settings}

package/dist/ui/SignupForm.svelte

@@ -10,7 +10,7 @@
 	import {FormState} from './form_state.svelte.js';
 
 	const {
-		redirect_on_signup = resolve('/account' as any),
+		redirect_on_signup = resolve('/'),
 	}: {
 		redirect_on_signup?: string;
 	} = $props();

package/dist/ui/SurfaceExplorer.svelte

@@ -4,11 +4,7 @@
 	import type {AppSurface, AppSurfaceRoute, AppSurfaceDiagnostic} from '../http/surface.js';
 	import {surface_auth_summary, format_route_key} from '../http/surface_query.js';
 
-	interface Props {
-		surface: AppSurface;
-	}
-
-	const {surface}: Props = $props();
+	const {surface}: {surface: AppSurface} = $props();
 
 	const auth_types = ['all', 'none', 'authenticated', 'role', 'keeper'] as const;
 

package/dist/ui/SurfaceExplorer.svelte.d.ts

@@ -1,8 +1,8 @@
 import type { AppSurface } from '../http/surface.js';
-interface Props {
+type $$ComponentProps = {
     surface: AppSurface;
-}
-declare const SurfaceExplorer: import("svelte").Component<Props, {}, "">;
+};
+declare const SurfaceExplorer: import("svelte").Component<$$ComponentProps, {}, "">;
 type SurfaceExplorer = ReturnType<typeof SurfaceExplorer>;
 export default SurfaceExplorer;
 //# sourceMappingURL=SurfaceExplorer.svelte.d.ts.map

package/dist/ui/SurfaceExplorer.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SurfaceExplorer.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/SurfaceExplorer.svelte"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAC,UAAU,EAAwC,MAAM,oBAAoB,CAAC;AAIzF,UAAU,KAAK;IACd,OAAO,EAAE,UAAU,CAAC;CACpB;AAuRF,QAAA,MAAM,eAAe,2CAAwC,CAAC;AAC9D,KAAK,eAAe,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;AAC1D,eAAe,eAAe,CAAC"}
+{"version":3,"file":"SurfaceExplorer.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/SurfaceExplorer.svelte"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAC,UAAU,EAAwC,MAAM,oBAAoB,CAAC;AAGzF,KAAK,gBAAgB,GAAI;IAAC,OAAO,EAAE,UAAU,CAAA;CAAC,CAAC;AAsRhD,QAAA,MAAM,eAAe,sDAAwC,CAAC;AAC9D,KAAK,eAAe,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC;AAC1D,eAAe,eAAe,CAAC"}

package/dist/ui/auth_state.svelte.d.ts

@@ -32,6 +32,15 @@
  * @module
  */
 import { type Permit, type SessionAccount } from '../auth/account_schema.js';
+/**
+ * Svelte context for `AuthState`.
+ * Use `auth_state_context.set(state)` in the provider and `auth_state_context.get()` to access.
+ */
+export declare const auth_state_context: {
+    get: (error_message?: string) => AuthState;
+    get_maybe: () => AuthState | undefined;
+    set: (value: AuthState) => AuthState;
+};
 export declare class AuthState {
     verifying: boolean;
     verified: boolean;
@@ -73,13 +82,4 @@ export declare class AuthState {
      */
     logout(): Promise<void>;
 }
-/**
- * Svelte context for `AuthState`.
- * Use `auth_state_context.set(state)` in the provider and `auth_state_context.get()` to access.
- */
-export declare const auth_state_context: {
-    get: (error_message?: string) => AuthState;
-    get_maybe: () => AuthState | undefined;
-    set: (value: AuthState) => AuthState;
-};
 //# sourceMappingURL=auth_state.svelte.d.ts.map

package/dist/ui/auth_state.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/auth_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAMH,OAAO,EAAC,KAAK,MAAM,EAAoB,KAAK,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAE7F,qBAAa,SAAS;IACrB,SAAS,UAAqB;IAC9B,QAAQ,UAAqB;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC/C,OAAO,EAAE,cAAc,GAAG,IAAI,CAAoB;IAClD,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAkB;IACxC,QAAQ,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,CAEpC;IACF,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAoD;IAEjF,gEAAgE;IAChE,eAAe,UAAqB;IAEpC;;;;;;OAMG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IA4BpC;;;;OAIG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAwCjE;;;;OAIG;IACG,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiCpF;;;;OAIG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA4ClF;;OAEG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAU7B;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;CAA8B,CAAC"}
+{"version":3,"file":"auth_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/auth_state.svelte.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAKH,OAAO,EAAC,KAAK,MAAM,EAAoB,KAAK,cAAc,EAAC,MAAM,2BAA2B,CAAC;AAE7F;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;CAA8B,CAAC;AAE9D,qBAAa,SAAS;IACrB,SAAS,UAAqB;IAC9B,QAAQ,UAAqB;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAoB;IAC/C,OAAO,EAAE,cAAc,GAAG,IAAI,CAAoB;IAClD,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAkB;IACxC,QAAQ,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,CAEpC;IACF,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAoD;IAEjF,gEAAgE;IAChE,eAAe,UAAqB;IAEpC;;;;;;OAMG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IA4BpC;;;;OAIG;IACG,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAwCjE;;;;OAIG;IACG,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiCpF;;;;OAIG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA4ClF;;OAEG;IACG,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAU7B"}

package/dist/ui/auth_state.svelte.js

@@ -34,6 +34,11 @@
 import { create_context } from '@fuzdev/fuz_ui/context_helpers.js';
 import { ui_fetch } from './ui_fetch.js';
 import { is_permit_active } from '../auth/account_schema.js';
+/**
+ * Svelte context for `AuthState`.
+ * Use `auth_state_context.set(state)` in the provider and `auth_state_context.get()` to access.
+ */
+export const auth_state_context = create_context();
 export class AuthState {
     verifying = $state.raw(false);
     verified = $state.raw(false);
@@ -231,8 +236,3 @@ export class AuthState {
         this.permits = [];
     }
 }
-/**
- * Svelte context for `AuthState`.
- * Use `auth_state_context.set(state)` in the provider and `auth_state_context.get()` to access.
- */
-export const auth_state_context = create_context();

package/dist/ui/sidebar_state.svelte.d.ts

@@ -1,3 +1,8 @@
+export declare const sidebar_state_context: {
+    get: (error_message?: string) => () => SidebarState;
+    get_maybe: () => (() => SidebarState) | undefined;
+    set: (value: () => SidebarState) => () => SidebarState;
+};
 /**
  * Options for configuring a `SidebarState`.
  *
@@ -22,9 +27,4 @@ export declare class SidebarState {
      */
     activate(): () => void;
 }
-export declare const sidebar_state_context: {
-    get: (error_message?: string) => () => SidebarState;
-    get_maybe: () => (() => SidebarState) | undefined;
-    set: (value: () => SidebarState) => () => SidebarState;
-};
 //# sourceMappingURL=sidebar_state.svelte.d.ts.map

package/dist/ui/sidebar_state.svelte.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sidebar_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/sidebar_state.svelte.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IACnC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC;CACxB;AAED,qBAAa,YAAY;;IAKxB,IAAI,OAAO,IAAI,OAAO,CAErB;IAED,IAAI,OAAO,CAAC,KAAK,EAAE,OAAO,EAEzB;IAED,IAAI,YAAY,IAAI,OAAO,CAG1B;IAED,IAAI,YAAY,CAAC,KAAK,EAAE,OAAO,EAE9B;gBAEW,OAAO,CAAC,EAAE,mBAAmB;IAIzC,cAAc,CAAC,KAAK,GAAE,OAA4B,GAAG,IAAI;IAIzD;;;OAGG;IACH,QAAQ,IAAI,MAAM,IAAI;CAQtB;AAED,eAAO,MAAM,qBAAqB;2CAAwB,YAAY;4BAAZ,YAAY;uBAAZ,YAAY,WAAZ,YAAY;CAAG,CAAC"}
+{"version":3,"file":"sidebar_state.svelte.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/ui/sidebar_state.svelte.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,qBAAqB;2CAAwB,YAAY;4BAAZ,YAAY;uBAAZ,YAAY,WAAZ,YAAY;CAAG,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IACnC,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC;CACxB;AAED,qBAAa,YAAY;;IAKxB,IAAI,OAAO,IAAI,OAAO,CAErB;IAED,IAAI,OAAO,CAAC,KAAK,EAAE,OAAO,EAEzB;IAED,IAAI,YAAY,IAAI,OAAO,CAG1B;IAED,IAAI,YAAY,CAAC,KAAK,EAAE,OAAO,EAE9B;gBAEW,OAAO,CAAC,EAAE,mBAAmB;IAIzC,cAAc,CAAC,KAAK,GAAE,OAA4B,GAAG,IAAI;IAIzD;;;OAGG;IACH,QAAQ,IAAI,MAAM,IAAI;CAQtB"}

package/dist/ui/sidebar_state.svelte.js

@@ -1,4 +1,5 @@
 import { create_context } from '@fuzdev/fuz_ui/context_helpers.js';
+export const sidebar_state_context = create_context();
 export class SidebarState {
     #get_enabled;
     #enabled = $state.raw(true);
@@ -36,4 +37,3 @@ export class SidebarState {
         };
     }
 }
-export const sidebar_state_context = create_context();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.7.1",
+  "version": "0.9.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",
@@ -46,7 +46,7 @@
     "@fuzdev/fuz_code": "^0.45.1",
     "@fuzdev/fuz_css": "^0.58.0",
     "@fuzdev/fuz_ui": "^0.191.2",
-    "@fuzdev/fuz_util": "^0.55.0",
+    "@fuzdev/fuz_util": "^0.56.0",
     "@fuzdev/gro": "^0.197.3",
     "@jridgewell/trace-mapping": "^0.3.31",
     "@node-rs/argon2": "^2.0.2",