@spfn/auth 0.2.0-beta.90 → 0.2.0-beta.91

package/README.md

@@ -856,6 +856,13 @@ HTTP status).
 - `createClientProofGuard(state)` — Hono middleware for mounting `requiresSession` operations
   on an SPFN server; tags admitted requests `clientType: 'mobile'` (the attestation slot
   proxy-guard reserved). hono is a type-only import here.
+- A refusal is **answered**, never thrown: `authenticate` / `optionalAuth` answer a request that
+  named this profile with the canonical envelope (`error.code` is one of the six codes, and the
+  body carries nothing else), and the guard and dev handler do the same. Handing the refusal to
+  the generic error handler instead would put the carrying error class's name in `error.code`
+  (`UnauthorizedError`) — a code no generated SDK can classify (#106). Errors raised **after**
+  admission (account status, application errors) are ordinary SPFN errors and keep the REST
+  envelope.
 - Replay ledger is module-local, NOT core's `NonceStore` — `checkAndSet` records on check,
   which would spend a nonce on a refused request; the contract requires spending only on
   admission.
@@ -904,6 +911,26 @@ app.use('*', createClientVersionMiddleware());
 Response header names are deliberately distinct from the request ones: a proxy that echoes a request
 header into the response would otherwise make the client's own version look like the server's.
 
+### When each operation became available (contract 0.6.1)
+
+Every operation in the exported bundle carries `since` — the contract version it first appeared in.
+`deprecatedIn` and `removedIn` are optional and absent today, because nothing has been deprecated.
+
+| Operation | `since` |
+|-----------|---------|
+| `auth.clientProof.handshake`, `echo.send`, `items.list` | 0.1.0 |
+| `auth.enroll.register`, `auth.enroll.login`, `auth.enroll.oauthNative`, `auth.keys.rotate` | 0.3.0 |
+| `auth.keys.list`, `auth.keys.revoke`, `auth.keys.revokeAll` | 0.4.1 |
+
+- **This is history, not policy.** The mobile contract's compatibility policy is `allOrNothing`: one
+  contract version passes or refuses the whole surface, so these three fields change no verdict here.
+  An app contract generated from SPFN routes decides `perOperation` and reads the same fields as an
+  input — the shape is shared so the two never diverge.
+- **A removal is mark, then wait, then remove.** `deprecatedIn` in one version with the operation
+  still served, `removedIn` in a later one. Nothing is removed in the version that deprecates it.
+- **A removed operation leaves the operations list**, so no entry carries `removedIn` today. It is
+  where the fact gets recorded when the first removal happens.
+
 ### Usage — dev surface (mobile integration target)
 
 The fastest path: run the packaged dev handler, which already serves the three contract

package/dist/{authenticate-CnccboAg.d.ts → authenticate-DlTGaBT8.d.ts}

@@ -1,5 +1,5 @@
 import * as _spfn_core_route from '@spfn/core/route';
-import { K as KeyAlgorithmType, d as KeyPlatformType, h as SocialProvider } from './types-CD95yudz.js';
+import { K as KeyAlgorithmType, h as KeyPlatformType, j as SocialProvider } from './types-DYyhze28.js';
 import * as _sinclair_typebox from '@sinclair/typebox';
 import { Static } from '@sinclair/typebox';
 import { Context } from 'hono';
@@ -879,7 +879,7 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
             id: number;
             name: string;
             displayName: string;
-            category: "custom" | "user" | "auth" | "rbac" | "system" | undefined;
+            category: "auth" | "custom" | "user" | "rbac" | "system" | undefined;
         }[];
         userId: number;
         publicId: string;
@@ -1179,8 +1179,8 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
     }, {}, {
         roles: {
             description: string | null;
-            id: number;
             name: string;
+            id: number;
             displayName: string;
             isBuiltin: boolean;
             isSystem: boolean;
@@ -1201,8 +1201,8 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
     }, {}, {
         role: {
             description: string | null;
-            id: number;
             name: string;
+            id: number;
             displayName: string;
             isBuiltin: boolean;
             isSystem: boolean;
@@ -1225,8 +1225,8 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
     }, {}, {
         role: {
             description: string | null;
-            id: number;
             name: string;
+            id: number;
             displayName: string;
             isBuiltin: boolean;
             isSystem: boolean;
@@ -1314,6 +1314,26 @@ declare function resolveAuthenticatedUser(userId: number): Promise<{
     role: string | null;
     locale: string;
 }>;
+/** What the profile path produced for one request. */
+type AuthProfileOutcome = {
+    kind: 'none';
+} | {
+    kind: 'authenticated';
+    auth: AuthContext;
+} | {
+    kind: 'refused';
+    response: Response;
+};
+/**
+ * The profile path from dispatch to answer — what `authenticate` and
+ * `optionalAuth` both run before their own Bearer code.
+ *
+ * `none` means the request named no profile and the caller continues on the
+ * Bearer path. A refusal comes back as a built response rather than a throw:
+ * the answer a proven call gets is the contract's own envelope, and an error
+ * handed to the generic error handler is classified by its class name instead.
+ */
+declare function runAuthProfile(c: Context): Promise<AuthProfileOutcome>;
 
 declare module 'hono' {
     interface ContextVariableMap {
@@ -1380,4 +1400,4 @@ declare const authenticate: _spfn_core_route.NamedMiddleware<"auth">;
  */
 declare const optionalAuth: _spfn_core_route.NamedMiddleware<"optionalAuth">;
 
-export { requireEnabledProvider as $, type AuthSession as A, registerPublicKeyService as B, type ChangePasswordParams as C, rotateKeyService as D, revokeKeyService as E, listKeysService as F, revokeAllKeysService as G, KEY_FINGERPRINT_PREFIX_LENGTH as H, type IssueOneTimeTokenResult as I, type RegisterPublicKeyParams as J, type KeySummary as K, type LoginResult as L, type RotateKeyParams as M, type RevokeKeyParams as N, type OAuthStartResult as O, type PermissionConfig as P, type RevokeAllKeysParams as Q, type RoleConfig as R, type SendVerificationCodeResult as S, issueOneTimeTokenService as T, type UserProfile as U, type VerificationTargetType as V, verifyOneTimeTokenService as W, oauthStartService as X, oauthCallbackService as Y, buildOAuthErrorUrl as Z, isOAuthProviderEnabled as _, type RegisterResult as a, getEnabledOAuthProviders as a0, getGoogleAccessToken as a1, oauthUnlinkNotifyService as a2, type OAuthStartParams as a3, type OAuthCallbackParams as a4, type OAuthCallbackResult as a5, type UnlinkNotifyResult as a6, oauthNativeService as a7, type OAuthNativeParams as a8, selectAuthProfile as a9, resolveAuthenticatedUser as aa, type AuthProfileVerifier as ab, authenticate as ac, optionalAuth as ad, EmailSchema as ae, PhoneSchema as af, DeviceNameSchema as ag, PlatformSchema as ah, PasswordSchema as ai, TargetTypeSchema as aj, VerificationPurposeSchema as ak, type NormalizedIdentity as al, type OAuthTokens as am, type NativeVerifyOptions as an, type OAuthCodeExchangeOptions as ao, type UnlinkNotifyRequest as ap, type UnlinkNotification as aq, UnlinkNotifyRejection as ar, registerOAuthProvider as as, getOAuthProvider as at, getRegisteredProviders as au, type RotateKeyResult as b, type RevokeAllKeysResult as c, type OAuthNativeResult as d, type ProfileInfo as e, type VerificationPurpose as f, VERIFICATION_TARGET_TYPES as g, VERIFICATION_PURPOSES as h, PERMISSION_CATEGORIES as i, type PermissionCategory as j, type AuthInitOptions as k, type OAuthProvider as l, mainAuthRouter as m, type AuthContext as n, loginService as o, logoutService as p, changePasswordService as q, registerService as r, type RegisterParams as s, type LoginParams as t, type LogoutParams as u, sendVerificationCodeService as v, verifyCodeService as w, type SendVerificationCodeParams as x, type VerifyCodeParams as y, type VerifyCodeResult as z };
+export { type UnlinkNotifyResult as $, type AuthInitOptions as A, PasswordSchema as B, type ChangePasswordParams as C, DeviceNameSchema as D, EmailSchema as E, PhoneSchema as F, PlatformSchema as G, type RegisterParams as H, type IssueOneTimeTokenResult as I, type RegisterPublicKeyParams as J, type KeySummary as K, type LoginResult as L, type RevokeAllKeysParams as M, type NativeVerifyOptions as N, type OAuthStartResult as O, type PermissionConfig as P, type RevokeKeyParams as Q, type RoleConfig as R, type SendVerificationCodeResult as S, type RotateKeyParams as T, type UserProfile as U, VERIFICATION_PURPOSES as V, type SendVerificationCodeParams as W, TargetTypeSchema as X, type UnlinkNotification as Y, UnlinkNotifyRejection as Z, type UnlinkNotifyRequest as _, type RegisterResult as a, VerificationPurposeSchema as a0, type VerifyCodeParams as a1, type VerifyCodeResult as a2, authenticate as a3, buildOAuthErrorUrl as a4, changePasswordService as a5, getEnabledOAuthProviders as a6, getGoogleAccessToken as a7, getOAuthProvider as a8, getRegisteredProviders as a9, isOAuthProviderEnabled as aa, issueOneTimeTokenService as ab, listKeysService as ac, loginService as ad, logoutService as ae, oauthCallbackService as af, oauthNativeService as ag, oauthStartService as ah, oauthUnlinkNotifyService as ai, optionalAuth as aj, registerOAuthProvider as ak, registerPublicKeyService as al, registerService as am, requireEnabledProvider as an, resolveAuthenticatedUser as ao, revokeAllKeysService as ap, revokeKeyService as aq, rotateKeyService as ar, runAuthProfile as as, selectAuthProfile as at, sendVerificationCodeService as au, verifyCodeService as av, verifyOneTimeTokenService as aw, type RotateKeyResult as b, type RevokeAllKeysResult as c, type OAuthNativeResult as d, type ProfileInfo as e, type AuthSession as f, PERMISSION_CATEGORIES as g, type PermissionCategory as h, VERIFICATION_TARGET_TYPES as i, type VerificationPurpose as j, type VerificationTargetType as k, type OAuthProvider as l, mainAuthRouter as m, type AuthContext as n, type AuthProfileOutcome as o, type AuthProfileVerifier as p, KEY_FINGERPRINT_PREFIX_LENGTH as q, type LoginParams as r, type LogoutParams as s, type NormalizedIdentity as t, type OAuthCallbackParams as u, type OAuthCallbackResult as v, type OAuthCodeExchangeOptions as w, type OAuthNativeParams as x, type OAuthStartParams as y, type OAuthTokens as z };

package/dist/client-proof.d.ts

@@ -1,5 +1,7 @@
 import { KeyObject } from 'node:crypto';
-import { MiddlewareHandler } from 'hono';
+import { C as ClientProofRefusal } from './wire-version-CtzMKvBB.js';
+export { a as CLIENT_IDENTITY_HEADERS, b as CLIENT_KINDS, c as ClientIdentity, d as ClientKind, e as ClientProofErrorCode, S as SERVER_CONTRACT_HEADERS, f as applyServerContractHeaders, i as isAppKind, g as isContractVersionSupported, j as judgeClientIdentity, n as newHexId, r as readClientIdentity, s as serverContractHeaders } from './wire-version-CtzMKvBB.js';
+import { MiddlewareHandler, Context } from 'hono';
 
 /**
  * SPFN-CANON-JSON-1 — the canonical JSON form the mobile contract pins.
@@ -121,49 +123,6 @@ declare function signClientProof(input: ClientProofInput, privateKeyPkcs8DerBase
 /** Lowercase base16 SHA-256 of `bytes`. */
 declare function sha256Hex(bytes: Uint8Array): string;
 
-/** The six wire codes. The SDKs classify by code, never HTTP status. */
-type ClientProofErrorCode = 'PROOF_INVALID' | 'PROOF_REPLAYED' | 'PROOF_EXPIRED' | 'SESSION_REVOKED' | 'PROFILE_REJECTED' | 'CONTRACT_UNSUPPORTED';
-/** 128 random bits as lowercase base16 — request ids and control tokens. */
-declare function newHexId(): string;
-declare class ClientProofRefusal {
-    readonly code: ClientProofErrorCode;
-    readonly message: string;
-    constructor(code: ClientProofErrorCode, message: string);
-    get httpStatus(): number;
-    /** The canonical bytes of `{"error":{"code":…,"message":…,"requestId":…}}`. */
-    envelopeBytes(requestId: string): Uint8Array;
-    /** Nothing request-derived reaches a log through this. */
-    toString(): string;
-    static unroutable(): ClientProofRefusal;
-    static malformedHeaders(): ClientProofRefusal;
-    static missingContentType(): ClientProofRefusal;
-    static bodyTooLarge(): ClientProofRefusal;
-    /**
-     * The body parsed but its bytes are not the canonical form of what it
-     * parsed to. Not PROOF_INVALID even though it is discovered next to the
-     * proof: the proof over these bytes verifies perfectly well, and an
-     * auth-family answer would tell the client to re-handshake and send the
-     * same non-canonical bytes again.
-     */
-    static bodyNotCanonical(): ClientProofRefusal;
-    static bodyNotTheDeclaredType(): ClientProofRefusal;
-    static sessionHeaderMisplaced(): ClientProofRefusal;
-    static unprocessable(): ClientProofRefusal;
-    /**
-     * A client that ships separately from the server said nothing about which
-     * contract it was built against. Without it the server cannot tell whether
-     * the two ends agree, and answering as though they do is what produces the
-     * undecodable body this check exists to replace.
-     */
-    static contractVersionMissing(): ClientProofRefusal;
-    static contractVersionUnsupported(): ClientProofRefusal;
-    static profileRejected(): ClientProofRefusal;
-    static sessionRevoked(): ClientProofRefusal;
-    static proofExpired(): ClientProofRefusal;
-    static proofReplayed(): ClientProofRefusal;
-    static proofInvalid(): ClientProofRefusal;
-}
-
 /** Millisecond clock. Injectable so expiry paths are testable without waiting. */
 interface ClientProofClock {
     nowMillis(): number;
@@ -452,6 +411,33 @@ interface ContractOperation {
     requestType: string;
     responseType: string;
     summary: string;
+    /**
+     * The contract version this operation first appeared in. Required, so an
+     * operation added later cannot ship without one: omitting it is a compile
+     * error rather than a hole a consumer discovers.
+     *
+     * It is history, not policy. This contract's compatibility policy is
+     * `allOrNothing` — one version passes or refuses the whole surface — so
+     * nothing here changes a verdict. It exists so a deprecation has somewhere
+     * to be recorded, and as the precedent an app contract's `perOperation`
+     * policy reads.
+     */
+    since: string;
+    /**
+     * The contract version that marked this operation deprecated, if one has.
+     * A deprecated operation is still served: the mark is the notice that opens
+     * the grace period before removal.
+     */
+    deprecatedIn?: string;
+    /**
+     * The contract version that removed this operation, if one has.
+     *
+     * A removed operation leaves this list, so nothing here carries the field
+     * today. When the first removal happens, `removedIn` is where the fact is
+     * recorded — how a removed operation stays visible after leaving the list
+     * is decided then, not invented in advance.
+     */
+    removedIn?: string;
 }
 declare const CONTRACT_OPERATIONS: readonly ContractOperation[];
 /**
@@ -563,87 +549,30 @@ interface ClientProofGuardOptions {
 declare function createClientProofGuard(state: ClientProofState, options?: ClientProofGuardOptions): MiddlewareHandler;
 
 /**
- * The header names each end announces itself under.
+ * One place turns a clientProofV1 refusal into a response.
  *
- * Separated from the logic that reads them so the contract bundle can name them
- * without importing the version comparison, which reads the bundle back. These
- * are declarations and depend on nothing.
+ * A proven call is answered by a generated SDK that classifies a failure by
+ * `error.code` alone and refuses a code it does not know. So a refusal must
+ * leave this server as the contract's own envelope — the canonical bytes of
+ * `{"error":{"code","message","requestId"}}` carrying one of the six refusal
+ * codes — and nothing else. Routing a refusal through the generic error
+ * handler instead puts the wrapper error class's name in `error.code`
+ * (`UnauthorizedError`), which no SDK can classify (#106).
  *
- * @module server/client-proof/wire-headers
- */
-/** What a client says about itself, one header each. */
-declare const CLIENT_IDENTITY_HEADERS: {
-    readonly kind: "x-spfn-client-kind";
-    readonly version: "x-spfn-client-version";
-    readonly contractVersion: "x-spfn-client-contract-version";
-};
-/**
- * What the server says about itself, on every response.
+ * Every refusal surface (the guard, the profile middleware) builds its answer
+ * here rather than assembling one of its own, so a code path added later
+ * cannot reintroduce a body that says something else.
  *
- * Distinct names from the request headers on purpose: a proxy that echoes a
- * request header into the response would otherwise make the client's own
- * version look like the server's.
- */
-declare const SERVER_CONTRACT_HEADERS: {
-    readonly version: "x-spfn-server-contract-version";
-    readonly supportedRange: "x-spfn-supported-contract-range";
-};
-/**
- * The client kinds the server distinguishes.
+ * hono is imported as types only, so this module adds no runtime dependency.
  *
- * `web` is separated from the two app kinds because it carries no contract
- * version: a browser bundle is deployed with the server that serves it, so
- * there is no second version to reconcile.
+ * @module server/client-proof/refusal-response
  */
-declare const CLIENT_KINDS: readonly ["web", "ios", "android"];
-type ClientKind = typeof CLIENT_KINDS[number];
-/** A kind that ships independently of the server, so its contract version matters. */
-declare function isAppKind(kind: ClientKind): boolean;
 
-/** What one request announced about the client that sent it. */
-interface ClientIdentity {
-    kind: ClientKind;
-    /** The client's own release — a store version, or a bundle build. */
-    version: string | null;
-    /** The contract version the client was generated from. Never set for `web`. */
-    contractVersion: string | null;
-}
 /**
- * Reads the identity headers, or null when the kind is absent or unrecognised.
- *
- * Null is not by itself a refusal — a request from something that predates
- * these headers reaches here too. `judgeClientIdentity` decides.
- */
-declare function readClientIdentity(headers: Headers): ClientIdentity | null;
-/**
- * Whether the server serves what the client was generated against.
- *
- * Under 0.x the minor carries breaking changes, so a supported client agrees on
- * major and minor. From 1.0.0 the major alone decides. This is the rule
- * `CONTRACT_SUPPORTED_RANGE` spells out; keeping it as a comparison rather than
- * parsing that string leaves one place to change when the line reaches 1.0.0.
- */
-declare function isContractVersionSupported(clientVersion: string): boolean;
-/**
- * The refusal a request's announced identity earns, or null to let it through.
- *
- * An app kind must state a contract version this server serves. A version it
- * does not serve, and the absence of one, are the same answer: the two ends do
- * not agree on what the contract is, which is what CONTRACT_UNSUPPORTED means.
- * The response carries the server's version and range, so the client can say
- * which way the gap runs.
- *
- * `web` is exempt from the contract check by construction, not by leniency.
- *
- * A request with no recognised kind passes. The check is on what a client says
- * about itself, and a caller that says nothing — a curl, a health probe, a
- * server-to-server call — is not a deployed client this rule is about.
+ * The canonical contract envelope for one refusal, with the server's contract
+ * announcement — a refused client needs the range most.
  */
-declare function judgeClientIdentity(identity: ClientIdentity | null): ClientProofRefusal | null;
-/** Writes the server's own announcement onto a response's headers. */
-declare function applyServerContractHeaders(headers: Headers): void;
-/** The same announcement as a plain object, for a response built from one. */
-declare function serverContractHeaders(): Record<string, string>;
+declare function clientProofRefusalResponse(c: Context, refusal: ClientProofRefusal): Response;
 
 /**
  * The version announcement, applied to every request rather than to the proven
@@ -674,4 +603,4 @@ declare const CLIENT_IDENTITY_CONTEXT_KEY = "clientIdentity";
  */
 declare function createClientVersionMiddleware(): MiddlewareHandler;
 
-export { ABSENT_BODY_SHA256, AUTH_SURFACE_OPERATIONS, type Admission, CLIENT_IDENTITY_CONTEXT_KEY, CLIENT_IDENTITY_HEADERS, CLIENT_KINDS, CLIENT_PROOF_CONTENT_TYPE, CLIENT_PROOF_HEADERS, CLIENT_PROOF_PROFILE, CONTRACT_OPERATIONS, CONTROL_PREFIX, CONTROL_TOKEN_HEADER, CanonicalJsonError, type CanonicalJsonErrorCode, type CanonicalObject, type CanonicalValue, type ClientIdentity, type ClientKind, type ClientProofClock, type ClientProofContext, type ClientProofCredentials, type ClientProofDevHandler, type ClientProofDevHandlerOptions, type ClientProofErrorCode, type ClientProofGuardOptions, type ClientProofInput, ClientProofRefusal, type ClientProofReplayStore, ClientProofState, type ClientProofStateOptions, type ClientProofStats, type ContractItem, type ContractOperation, ContractTypeError, DEFAULT_REPLAY_WINDOW_MILLIS, DEFAULT_SESSION_TTL_MILLIS, DEV_CATALOGUE, DEV_MAX_LIMIT, type EchoRequest, type HandshakeRequest, type ListItemsRequest, MemoryReplayLedger, MemoryReplayStore, PROOF_SIGNATURE_BYTES, PROOF_SIGNATURE_HEX_LENGTH, ProofInputError, RedisReplayStore, SERVER_CONTRACT_HEADERS, TestClock, admitClientProofRequest, applyServerContractHeaders, canonicalProofInput, configureClientProofReplayStore, createClientProofDevHandler, createClientProofGuard, createClientVersionMiddleware, decodeEchoRequest, decodeHandshakeRequest, decodeListItemsRequest, encodeCanonicalJson, encodeEchoResponse, encodeHandshakeResponse, encodeListItemsResponse, getClientProofReplayStore, isAppKind, isCanonicalBytes, isContractVersionSupported, isRequestContentType, judgeClientIdentity, newHexId, parseCanonicalJson, parseClientProofPublicKey, readClientIdentity, readCredentials, replayLedgerKey, serverContractHeaders, sha256Hex, signClientProof, systemClock, verifyClientProof };
+export { ABSENT_BODY_SHA256, AUTH_SURFACE_OPERATIONS, type Admission, CLIENT_IDENTITY_CONTEXT_KEY, CLIENT_PROOF_CONTENT_TYPE, CLIENT_PROOF_HEADERS, CLIENT_PROOF_PROFILE, CONTRACT_OPERATIONS, CONTROL_PREFIX, CONTROL_TOKEN_HEADER, CanonicalJsonError, type CanonicalJsonErrorCode, type CanonicalObject, type CanonicalValue, type ClientProofClock, type ClientProofContext, type ClientProofCredentials, type ClientProofDevHandler, type ClientProofDevHandlerOptions, type ClientProofGuardOptions, type ClientProofInput, ClientProofRefusal, type ClientProofReplayStore, ClientProofState, type ClientProofStateOptions, type ClientProofStats, type ContractItem, type ContractOperation, ContractTypeError, DEFAULT_REPLAY_WINDOW_MILLIS, DEFAULT_SESSION_TTL_MILLIS, DEV_CATALOGUE, DEV_MAX_LIMIT, type EchoRequest, type HandshakeRequest, type ListItemsRequest, MemoryReplayLedger, MemoryReplayStore, PROOF_SIGNATURE_BYTES, PROOF_SIGNATURE_HEX_LENGTH, ProofInputError, RedisReplayStore, TestClock, admitClientProofRequest, canonicalProofInput, clientProofRefusalResponse, configureClientProofReplayStore, createClientProofDevHandler, createClientProofGuard, createClientVersionMiddleware, decodeEchoRequest, decodeHandshakeRequest, decodeListItemsRequest, encodeCanonicalJson, encodeEchoResponse, encodeHandshakeResponse, encodeListItemsResponse, getClientProofReplayStore, isCanonicalBytes, isRequestContentType, parseCanonicalJson, parseClientProofPublicKey, readCredentials, replayLedgerKey, sha256Hex, signClientProof, systemClock, verifyClientProof };

package/dist/client-proof.js

@@ -512,6 +512,18 @@ var ClientProofRefusal = class _ClientProofRefusal {
   static profileRejected() {
     return new _ClientProofRefusal("PROFILE_REJECTED", "the named auth profile is not on this contract's allowlist");
   }
+  /**
+   * A request that names a profile and presents Bearer credentials as well.
+   * The profile named is a real one, so this is not a shape the two ends
+   * disagree about: the request asked to be authenticated two ways at once
+   * and the profile it named is the one refused.
+   */
+  static credentialsMixed() {
+    return new _ClientProofRefusal(
+      "PROFILE_REJECTED",
+      "an auth profile and Bearer credentials must not be mixed in one request"
+    );
+  }
   // ---- auth: a new session might clear it (rule 1) -------------------------
   static sessionRevoked() {
     return new _ClientProofRefusal("SESSION_REVOKED", "the key or session was revoked");
@@ -932,7 +944,8 @@ var CONTRACT_OPERATIONS = [
     requiresSession: false,
     requestType: "HandshakeRequest",
     responseType: "HandshakeResponse",
-    summary: "Presents a client proof and opens a session."
+    summary: "Presents a client proof and opens a session.",
+    since: "0.1.0"
   },
   {
     id: "echo.send",
@@ -942,7 +955,8 @@ var CONTRACT_OPERATIONS = [
     requiresSession: true,
     requestType: "EchoRequest",
     responseType: "EchoResponse",
-    summary: "Authenticated round trip used as the smallest real vertical slice."
+    summary: "Authenticated round trip used as the smallest real vertical slice.",
+    since: "0.1.0"
   },
   {
     id: "items.list",
@@ -952,7 +966,8 @@ var CONTRACT_OPERATIONS = [
     requiresSession: true,
     requestType: "ListItemsRequest",
     responseType: "ListItemsResponse",
-    summary: "Authenticated paged read covering optional fields and arrays."
+    summary: "Authenticated paged read covering optional fields and arrays.",
+    since: "0.1.0"
   }
 ];
 var AUTH_SURFACE_OPERATIONS = [
@@ -964,7 +979,8 @@ var AUTH_SURFACE_OPERATIONS = [
     requiresSession: false,
     requestType: "RegisterRequest",
     responseType: "RegisterResponse",
-    summary: "Registers an account with a verification token and enrolls the client-generated public key."
+    summary: "Registers an account with a verification token and enrolls the client-generated public key.",
+    since: "0.3.0"
   },
   {
     id: "auth.enroll.login",
@@ -974,7 +990,8 @@ var AUTH_SURFACE_OPERATIONS = [
     requiresSession: false,
     requestType: "LoginRequest",
     responseType: "LoginResponse",
-    summary: "Authenticates with password credentials and enrolls a fresh client-generated public key."
+    summary: "Authenticates with password credentials and enrolls a fresh client-generated public key.",
+    since: "0.3.0"
   },
   {
     id: "auth.enroll.oauthNative",
@@ -984,7 +1001,8 @@ var AUTH_SURFACE_OPERATIONS = [
     requiresSession: false,
     requestType: "OauthNativeRequest",
     responseType: "OauthNativeResponse",
-    summary: "Verifies a native/web social id_token server-side and enrolls the client-generated public key."
+    summary: "Verifies a native/web social id_token server-side and enrolls the client-generated public key.",
+    since: "0.3.0"
   },
   {
     id: "auth.keys.rotate",
@@ -994,7 +1012,8 @@ var AUTH_SURFACE_OPERATIONS = [
     requiresSession: false,
     requestType: "RotateKeyRequest",
     responseType: "RotateKeyResponse",
-    summary: "Replaces the authenticated key with a new client-generated public key before its TTL runs out."
+    summary: "Replaces the authenticated key with a new client-generated public key before its TTL runs out.",
+    since: "0.3.0"
   },
   {
     id: "auth.keys.list",
@@ -1004,7 +1023,8 @@ var AUTH_SURFACE_OPERATIONS = [
     requiresSession: false,
     requestType: "ListKeysRequest",
     responseType: "ListKeysResponse",
-    summary: "Lists the keys registered to the caller, one per device that can sign for them."
+    summary: "Lists the keys registered to the caller, one per device that can sign for them.",
+    since: "0.4.1"
   },
   {
     id: "auth.keys.revoke",
@@ -1014,7 +1034,8 @@ var AUTH_SURFACE_OPERATIONS = [
     requiresSession: false,
     requestType: "RevokeKeyRequest",
     responseType: "RevokeKeyResponse",
-    summary: "Revokes one of the caller's keys, signing that device out."
+    summary: "Revokes one of the caller's keys, signing that device out.",
+    since: "0.4.1"
   },
   {
     id: "auth.keys.revokeAll",
@@ -1024,7 +1045,8 @@ var AUTH_SURFACE_OPERATIONS = [
     requiresSession: false,
     requestType: "RevokeAllKeysRequest",
     responseType: "RevokeAllKeysResponse",
-    summary: "Revokes every key the caller has, sparing the calling device unless asked otherwise."
+    summary: "Revokes every key the caller has, sparing the calling device unless asked otherwise.",
+    since: "0.4.1"
   }
 ];
 var ContractTypeError = class extends Error {
@@ -1285,9 +1307,9 @@ function isAppKind(kind) {
 }
 
 // src/server/client-proof/contract-bundle.ts
-var CONTRACT_VERSION = "0.6.0";
+var CONTRACT_VERSION = "0.8.0";
 var CONTRACT_MAJOR = 0;
-var CONTRACT_SUPPORTED_RANGE = ">=0.6.0 <0.7.0";
+var CONTRACT_SUPPORTED_RANGE = ">=0.8.0 <0.9.0";
 function required(name, type) {
   return { name, type, optional: false };
 }
@@ -1697,6 +1719,16 @@ function toArrayBuffer(bytes) {
   return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
 }
 
+// src/server/client-proof/refusal-response.ts
+function clientProofRefusalResponse(c, refusal) {
+  const bytes = refusal.envelopeBytes(newHexId());
+  const buffer = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
+  return c.newResponse(buffer, refusal.httpStatus, {
+    "content-type": "application/json",
+    ...serverContractHeaders()
+  });
+}
+
 // src/server/client-proof/guard.ts
 function createClientProofGuard(state, options = {}) {
   return async (c, next) => {
@@ -1711,12 +1743,7 @@ function createClientProofGuard(state, options = {}) {
     });
     if (!admission.admitted) {
       state.recordRefusal();
-      const bytes = admission.refusal.envelopeBytes(newHexId());
-      const buffer = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
-      return c.newResponse(buffer, admission.refusal.httpStatus, {
-        "content-type": "application/json",
-        ...serverContractHeaders()
-      });
+      return clientProofRefusalResponse(c, admission.refusal);
     }
     c.set("clientType", "mobile");
     c.set("clientProof", {
@@ -1782,6 +1809,7 @@ export {
   admitClientProofRequest,
   applyServerContractHeaders,
   canonicalProofInput,
+  clientProofRefusalResponse,
   configureClientProofReplayStore,
   createClientProofDevHandler,
   createClientProofGuard,