@fuzdev/fuz_app 0.101.1 → 0.103.0

package/dist/auth/CLAUDE.md

@@ -171,7 +171,10 @@ Generic-only — no app vocabulary on the wire; per-kind shape is the
 consumer's `validate_data` pass-through callback on `CellActionDeps`.
 
 - `auth/cell_data_schema.ts` — `CellData` base (`z.looseObject` with
-  optional `kind` / `label` / `summary`); per-kind sub-API extends it.
+  optional `label` / `summary`); per-kind sub-API extends it. **`kind` is
+  not in `data`** — it is a top-level `cell.kind` column (peer to
+  `visibility` / `path`), the write-once capability/identity axis; a stray
+  `kind` inside `data` is rejected fail-loud (`ERROR_CELL_KIND_IN_DATA`).
 - `auth/cell_action_specs.ts` — `CellVisibility` enum, `CellPath` brand,
   `CellJson`, the six generic verb specs (`cell_create / get / update /
 delete / list / clone`), error reasons, and `all_cell_action_specs`
@@ -202,11 +205,17 @@ auth, ids)`: batched strict relation-read filter. Every relation read —
   reverse list verbs additionally cap the fetch by the wire `limit` so a
   heavily inbound-linked target can't force an unbounded scan.
 - `auth/cell_actions.ts` — `create_cell_actions(deps)`, the six generic
-  handlers. `cell_create` stamps `created_by`; `path` writes are
-  admin-only. `cell_update` gates `visibility` writes on `can_manage_cell`
-  (`ERROR_CELL_VISIBILITY_MANAGE_ONLY`). `cell_get` bundles
-  visibility-filtered `fields` + `items` (one over the cap for truncation
-  detection). `cell_clone` deep-walks viewable children only.
+  handlers. `cell_create` stamps `created_by` + writes the top-level `kind`
+  column; `path` writes are admin-only. `cell_update` gates `visibility`
+  writes on `can_manage_cell` (`ERROR_CELL_VISIBILITY_MANAGE_ONLY`) and
+  **never touches `kind`** (write-once at birth — not an update field).
+  `cell_get` bundles visibility-filtered `fields` + `items` (one over the cap
+  for truncation detection). `cell_clone` deep-walks viewable children only
+  (each clone inherits its source's `kind`). The optional `authorize_create`
+  dep (`CellCreateAuthorize` — wider `auth` + `{kind, data, scope_id}` input
+  than `validate_data`) gates create by capability; it runs after the
+  validator, before the insert, deny → `cell_not_found` 404 IDOR mask.
+  `None`/omitted = open create (the default; mirrors `validate_data`).
 - `auth/cell_grant_actions.ts` / `cell_field_actions.ts` /
   `cell_item_actions.ts` / `cell_audit_actions.ts` — the relation + ACL +
   audit handlers, exporting `to_grant_json` / `to_field_json` /
@@ -436,7 +445,7 @@ are excluded.
   records, regardless of outcome. Default
   `default_action_account_rate_limit` is 1200/15min per actor.
 
-### Admin actions — fourteen specs
+### Admin actions
 
 `create_admin_actions(deps, options?)` in `auth/admin_actions.ts`.
 
@@ -501,7 +510,7 @@ visibility — `target_account_id` is null (FK rejects missing ids), and the
 probed id is preserved under `metadata.attempted_account_id`. Every gated
 event additionally records `credential_type` in metadata (defense in depth).
 
-### Role-grant-offer actions — seven specs
+### Role-grant-offer actions
 
 `create_role_grant_offer_actions(deps, options?)` in
 `auth/role_grant_offer_actions.ts`.
@@ -525,19 +534,22 @@ event additionally records `credential_type` in metadata (defense in depth).
 - `role_grant_offer_list_action_spec` — input `{account_id?}`; output `{offers}`.
 - `role_grant_offer_history_action_spec` — input `{account_id?, limit?, offset?}`; output `{offers}`.
 - `role_grant_revoke_action_spec` — input `{actor_id, role_grant_id, reason?}`; output `{ok, revoked}`.
+- `role_grant_assign_action_spec` — admin-only immediate conferral (no consent step); input `{to_account_id, to_actor_id?, role, scope_id?}`; output `{ok, role_grant_id}`. Runs the same admin-grant-path gate as offer-create, resolves the target actor (named `to_actor_id` ∈ the account's active actors, else its sole active actor — multi-actor → `invalid_params`, actorless → 404), writes via the idempotent `query_create_role_grant` (`scope_kind` stays null), and emits a `role_grant_create` audit row. No WS notification in v1. Reasons: `ERROR_ROLE_NOT_WEB_GRANTABLE`, `ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH`.
 
 Every input carries `acting?: ActingActor` (registry-time invariant 2).
 `role_grant_revoke` keys on **`actor_id`**, not `account_id` — role_grants
 are actor-scoped and deriving actor from account collapses under multi-actor
 accounts.
 
-`role_grant_offer_create` runs the **admin-grant-path gate first** (offered
+`role_grant_offer_create` runs the **admin-grantability gate first** (offered
 role's `RoleSpec.grant_paths` must include `'admin'`), then the
-`RoleGrantOfferCreateAuthorize` callback. Default: caller holds the offered
-role globally. Pre-built `authorize_admin_or_holder` admits any admin and
-otherwise falls back to the default — drop into `create_role_grant_offer_actions({authorize: authorize_admin_or_holder})`
-or `create_standard_rpc_actions` for "admins offer anything; users offer
-what they hold."
+`RoleGrantOfferCreateAuthorize` callback. **Default `default_authorize`: the
+caller must hold a _global_ `admin` grant** — conferral is admin-only, with no
+holder-propagation (holding the offered role confers no power to offer it). The
+global check (`has_scoped_role(_, ROLE_ADMIN, null)`) stops a scoped `admin`
+escalating into global authority over the offer surface. A consumer needing
+scope-aware delegation (e.g. a classroom teacher offering within their own
+scope) supplies a custom `authorize` callback.
 
 Error reasons (`as const` literals):
 
@@ -589,7 +601,7 @@ Options: `roles?: RoleSchemaResult` (drives admin-grant-path lookup),
 `default_ttl_ms?` (defaults to `ROLE_GRANT_OFFER_DEFAULT_TTL_MS` = 30 days),
 `authorize?: RoleGrantOfferCreateAuthorize`.
 
-### Account actions — seven self-service specs
+### Account actions — self-service
 
 `create_account_actions(deps, options?)` in `auth/account_actions.ts`.
 
@@ -625,8 +637,8 @@ arbitrary sockets.
 `create_standard_rpc_actions(deps, options)` in `auth/standard_rpc_actions.ts`
 spreads `create_admin_actions`, `create_role_grant_offer_actions`, and
 `create_account_actions` into a single `Array<RpcAction>` — the canonical
-fuz_app "standard" surface (28 actions: 14 admin + 7 role-grant-offer + 7
-account; the two app-settings methods are always wired). Frontend mirror is
+fuz_app "standard" surface (admin + role-grant-offer + account; the two
+app-settings methods are always wired). Frontend mirror is
 `all_standard_action_specs` in `auth/standard_action_specs.ts`.
 
 Option routing — `roles` is shared between admin + role-grant-offer;

package/dist/auth/cell_action_specs.d.ts

@@ -58,12 +58,19 @@ export declare const ERROR_CELL_VISIBILITY_MANAGE_ONLY: "cell_visibility_manage_
 /** Error reason — input shape for `cell_get` lacked both `id` and `path`. */
 export declare const ERROR_CELL_GET_REQUIRES_ID_OR_PATH: "cell_get_requires_id_or_path";
 /**
- * Error reason — `cell_clone` `with_data_patch` would change `data.kind`.
- * Per-kind shape validation can pass coincidentally (e.g., one kind's
- * schema accepts most of another's fields), so we reject the cross-kind
- * patch explicitly to prevent incoherent clones.
+ * Error reason — a `kind` key was supplied inside `data`. `kind` is a
+ * top-level column (`cell.kind`), not content metadata; accepting it inside
+ * `data` would create two sources of truth. Rejected fail-loud at the
+ * create / update / clone-patch boundary so the column stays canonical.
  */
-export declare const ERROR_CELL_CLONE_KIND_MISMATCH: "cell_clone_kind_mismatch";
+export declare const ERROR_CELL_KIND_IN_DATA: "cell_kind_in_data";
+/**
+ * Error reason — `cell_create` was given an empty-string `kind`. `kind` is a
+ * non-empty capability tag or absent (`null` = typeless cell); `""` (a tag
+ * that tags nothing) is rejected fail-loud so `kind` stays a clean
+ * `null | non-empty-string` (twin of the Rust `ERROR_CELL_KIND_EMPTY`).
+ */
+export declare const ERROR_CELL_KIND_EMPTY: "cell_kind_empty";
 /**
  * Error reason — null-auth `cell_list` caller passed a `created_by`
  * filter. The filter is a soft account-id enumeration vector ("does
@@ -130,10 +137,10 @@ export declare const CellJson: z.ZodObject<{
     id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
     path: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "CellPath", "out">>;
     data: z.ZodObject<{
-        kind: z.ZodOptional<z.ZodString>;
         label: z.ZodOptional<z.ZodString>;
         summary: z.ZodOptional<z.ZodString>;
     }, z.core.$loose>;
+    kind: z.ZodNullable<z.ZodString>;
     visibility: z.ZodEnum<{
         private: "private";
         public: "public";
@@ -154,10 +161,10 @@ export type CellJson = z.infer<typeof CellJson>;
  */
 export declare const CellCreateInput: z.ZodObject<{
     data: z.ZodObject<{
-        kind: z.ZodOptional<z.ZodString>;
         label: z.ZodOptional<z.ZodString>;
         summary: z.ZodOptional<z.ZodString>;
     }, z.core.$loose>;
+    kind: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     visibility: z.ZodOptional<z.ZodEnum<{
         private: "private";
         public: "public";
@@ -171,10 +178,10 @@ export declare const CellCreateOutput: z.ZodObject<{
         id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
         path: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "CellPath", "out">>;
         data: z.ZodObject<{
-            kind: z.ZodOptional<z.ZodString>;
             label: z.ZodOptional<z.ZodString>;
             summary: z.ZodOptional<z.ZodString>;
         }, z.core.$loose>;
+        kind: z.ZodNullable<z.ZodString>;
         visibility: z.ZodEnum<{
             private: "private";
             public: "public";
@@ -215,10 +222,10 @@ export declare const CellGetOutput: z.ZodObject<{
         id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
         path: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "CellPath", "out">>;
         data: z.ZodObject<{
-            kind: z.ZodOptional<z.ZodString>;
             label: z.ZodOptional<z.ZodString>;
             summary: z.ZodOptional<z.ZodString>;
         }, z.core.$loose>;
+        kind: z.ZodNullable<z.ZodString>;
         visibility: z.ZodEnum<{
             private: "private";
             public: "public";
@@ -260,7 +267,6 @@ export type CellGetOutput = z.infer<typeof CellGetOutput>;
 export declare const CellUpdateInput: z.ZodObject<{
     cell_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
     data: z.ZodOptional<z.ZodObject<{
-        kind: z.ZodOptional<z.ZodString>;
         label: z.ZodOptional<z.ZodString>;
         summary: z.ZodOptional<z.ZodString>;
     }, z.core.$loose>>;
@@ -277,10 +283,10 @@ export declare const CellUpdateOutput: z.ZodObject<{
         id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
         path: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "CellPath", "out">>;
         data: z.ZodObject<{
-            kind: z.ZodOptional<z.ZodString>;
             label: z.ZodOptional<z.ZodString>;
             summary: z.ZodOptional<z.ZodString>;
         }, z.core.$loose>;
+        kind: z.ZodNullable<z.ZodString>;
         visibility: z.ZodEnum<{
             private: "private";
             public: "public";
@@ -319,7 +325,7 @@ export type CellDeleteOutput = z.infer<typeof CellDeleteOutput>;
  * `shared_with: 'me'` narrows to cells that admit the caller via a
  * `cell_grant` row (actor-shaped or role-shaped principal) AND that
  * the caller does not own. Authenticated only; combine with
- * `data_kind` / `path_prefix` etc. to scope further. Combining with
+ * `kind` / `path_prefix` etc. to scope further. Combining with
  * `created_by: <my-actor-id>` produces an empty result by definition
  * (owner is implicit, never appears as a grant principal); we don't
  * reject the combination at the schema layer because SQL emptiness is
@@ -327,7 +333,7 @@ export type CellDeleteOutput = z.infer<typeof CellDeleteOutput>;
  */
 export declare const CellListInput: z.ZodDefault<z.ZodObject<{
     ids: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>>;
-    data_kind: z.ZodOptional<z.ZodString>;
+    kind: z.ZodOptional<z.ZodString>;
     visibility: z.ZodOptional<z.ZodEnum<{
         private: "private";
         public: "public";
@@ -354,10 +360,10 @@ export declare const CellListOutput: z.ZodObject<{
         id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
         path: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "CellPath", "out">>;
         data: z.ZodObject<{
-            kind: z.ZodOptional<z.ZodString>;
             label: z.ZodOptional<z.ZodString>;
             summary: z.ZodOptional<z.ZodString>;
         }, z.core.$loose>;
+        kind: z.ZodNullable<z.ZodString>;
         visibility: z.ZodEnum<{
             private: "private";
             public: "public";
@@ -396,7 +402,6 @@ export declare const CellCloneInput: z.ZodObject<{
     source_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
     deep: z.ZodOptional<z.ZodBoolean>;
     with_data_patch: z.ZodOptional<z.ZodObject<{
-        kind: z.ZodOptional<z.ZodString>;
         label: z.ZodOptional<z.ZodString>;
         summary: z.ZodOptional<z.ZodString>;
     }, z.core.$loose>>;
@@ -408,10 +413,10 @@ export declare const CellCloneOutput: z.ZodObject<{
         id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
         path: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "CellPath", "out">>;
         data: z.ZodObject<{
-            kind: z.ZodOptional<z.ZodString>;
             label: z.ZodOptional<z.ZodString>;
             summary: z.ZodOptional<z.ZodString>;
         }, z.core.$loose>;
+        kind: z.ZodNullable<z.ZodString>;
         visibility: z.ZodEnum<{
             private: "private";
             public: "public";
@@ -437,10 +442,10 @@ export declare const cell_create_action_spec: {
     side_effects: true;
     input: z.ZodObject<{
         data: z.ZodObject<{
-            kind: z.ZodOptional<z.ZodString>;
             label: z.ZodOptional<z.ZodString>;
             summary: z.ZodOptional<z.ZodString>;
         }, z.core.$loose>;
+        kind: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         visibility: z.ZodOptional<z.ZodEnum<{
             private: "private";
             public: "public";
@@ -453,10 +458,10 @@ export declare const cell_create_action_spec: {
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
             path: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "CellPath", "out">>;
             data: z.ZodObject<{
-                kind: z.ZodOptional<z.ZodString>;
                 label: z.ZodOptional<z.ZodString>;
                 summary: z.ZodOptional<z.ZodString>;
             }, z.core.$loose>;
+            kind: z.ZodNullable<z.ZodString>;
             visibility: z.ZodEnum<{
                 private: "private";
                 public: "public";
@@ -493,10 +498,10 @@ export declare const cell_get_action_spec: {
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
             path: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "CellPath", "out">>;
             data: z.ZodObject<{
-                kind: z.ZodOptional<z.ZodString>;
                 label: z.ZodOptional<z.ZodString>;
                 summary: z.ZodOptional<z.ZodString>;
             }, z.core.$loose>;
+            kind: z.ZodNullable<z.ZodString>;
             visibility: z.ZodEnum<{
                 private: "private";
                 public: "public";
@@ -542,7 +547,6 @@ export declare const cell_update_action_spec: {
     input: z.ZodObject<{
         cell_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
         data: z.ZodOptional<z.ZodObject<{
-            kind: z.ZodOptional<z.ZodString>;
             label: z.ZodOptional<z.ZodString>;
             summary: z.ZodOptional<z.ZodString>;
         }, z.core.$loose>>;
@@ -558,10 +562,10 @@ export declare const cell_update_action_spec: {
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
             path: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "CellPath", "out">>;
             data: z.ZodObject<{
-                kind: z.ZodOptional<z.ZodString>;
                 label: z.ZodOptional<z.ZodString>;
                 summary: z.ZodOptional<z.ZodString>;
             }, z.core.$loose>;
+            kind: z.ZodNullable<z.ZodString>;
             visibility: z.ZodEnum<{
                 private: "private";
                 public: "public";
@@ -609,7 +613,7 @@ export declare const cell_list_action_spec: {
     side_effects: false;
     input: z.ZodDefault<z.ZodObject<{
         ids: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>>;
-        data_kind: z.ZodOptional<z.ZodString>;
+        kind: z.ZodOptional<z.ZodString>;
         visibility: z.ZodOptional<z.ZodEnum<{
             private: "private";
             public: "public";
@@ -635,10 +639,10 @@ export declare const cell_list_action_spec: {
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
             path: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "CellPath", "out">>;
             data: z.ZodObject<{
-                kind: z.ZodOptional<z.ZodString>;
                 label: z.ZodOptional<z.ZodString>;
                 summary: z.ZodOptional<z.ZodString>;
             }, z.core.$loose>;
+            kind: z.ZodNullable<z.ZodString>;
             visibility: z.ZodEnum<{
                 private: "private";
                 public: "public";
@@ -682,7 +686,6 @@ export declare const cell_clone_action_spec: {
         source_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
         deep: z.ZodOptional<z.ZodBoolean>;
         with_data_patch: z.ZodOptional<z.ZodObject<{
-            kind: z.ZodOptional<z.ZodString>;
             label: z.ZodOptional<z.ZodString>;
             summary: z.ZodOptional<z.ZodString>;
         }, z.core.$loose>>;
@@ -693,10 +696,10 @@ export declare const cell_clone_action_spec: {
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
             path: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "CellPath", "out">>;
             data: z.ZodObject<{
-                kind: z.ZodOptional<z.ZodString>;
                 label: z.ZodOptional<z.ZodString>;
                 summary: z.ZodOptional<z.ZodString>;
             }, z.core.$loose>;
+            kind: z.ZodNullable<z.ZodString>;
             visibility: z.ZodEnum<{
                 private: "private";
                 public: "public";
@@ -732,10 +735,10 @@ export declare const all_cell_action_specs: readonly [{
     side_effects: true;
     input: z.ZodObject<{
         data: z.ZodObject<{
-            kind: z.ZodOptional<z.ZodString>;
             label: z.ZodOptional<z.ZodString>;
             summary: z.ZodOptional<z.ZodString>;
         }, z.core.$loose>;
+        kind: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         visibility: z.ZodOptional<z.ZodEnum<{
             private: "private";
             public: "public";
@@ -748,10 +751,10 @@ export declare const all_cell_action_specs: readonly [{
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
             path: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "CellPath", "out">>;
             data: z.ZodObject<{
-                kind: z.ZodOptional<z.ZodString>;
                 label: z.ZodOptional<z.ZodString>;
                 summary: z.ZodOptional<z.ZodString>;
             }, z.core.$loose>;
+            kind: z.ZodNullable<z.ZodString>;
             visibility: z.ZodEnum<{
                 private: "private";
                 public: "public";
@@ -787,10 +790,10 @@ export declare const all_cell_action_specs: readonly [{
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
             path: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "CellPath", "out">>;
             data: z.ZodObject<{
-                kind: z.ZodOptional<z.ZodString>;
                 label: z.ZodOptional<z.ZodString>;
                 summary: z.ZodOptional<z.ZodString>;
             }, z.core.$loose>;
+            kind: z.ZodNullable<z.ZodString>;
             visibility: z.ZodEnum<{
                 private: "private";
                 public: "public";
@@ -835,7 +838,6 @@ export declare const all_cell_action_specs: readonly [{
     input: z.ZodObject<{
         cell_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
         data: z.ZodOptional<z.ZodObject<{
-            kind: z.ZodOptional<z.ZodString>;
             label: z.ZodOptional<z.ZodString>;
             summary: z.ZodOptional<z.ZodString>;
         }, z.core.$loose>>;
@@ -851,10 +853,10 @@ export declare const all_cell_action_specs: readonly [{
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
             path: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "CellPath", "out">>;
             data: z.ZodObject<{
-                kind: z.ZodOptional<z.ZodString>;
                 label: z.ZodOptional<z.ZodString>;
                 summary: z.ZodOptional<z.ZodString>;
             }, z.core.$loose>;
+            kind: z.ZodNullable<z.ZodString>;
             visibility: z.ZodEnum<{
                 private: "private";
                 public: "public";
@@ -900,7 +902,7 @@ export declare const all_cell_action_specs: readonly [{
     side_effects: false;
     input: z.ZodDefault<z.ZodObject<{
         ids: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>>;
-        data_kind: z.ZodOptional<z.ZodString>;
+        kind: z.ZodOptional<z.ZodString>;
         visibility: z.ZodOptional<z.ZodEnum<{
             private: "private";
             public: "public";
@@ -926,10 +928,10 @@ export declare const all_cell_action_specs: readonly [{
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
             path: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "CellPath", "out">>;
             data: z.ZodObject<{
-                kind: z.ZodOptional<z.ZodString>;
                 label: z.ZodOptional<z.ZodString>;
                 summary: z.ZodOptional<z.ZodString>;
             }, z.core.$loose>;
+            kind: z.ZodNullable<z.ZodString>;
             visibility: z.ZodEnum<{
                 private: "private";
                 public: "public";
@@ -972,7 +974,6 @@ export declare const all_cell_action_specs: readonly [{
         source_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
         deep: z.ZodOptional<z.ZodBoolean>;
         with_data_patch: z.ZodOptional<z.ZodObject<{
-            kind: z.ZodOptional<z.ZodString>;
             label: z.ZodOptional<z.ZodString>;
             summary: z.ZodOptional<z.ZodString>;
         }, z.core.$loose>>;
@@ -983,10 +984,10 @@ export declare const all_cell_action_specs: readonly [{
             id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
             path: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "CellPath", "out">>;
             data: z.ZodObject<{
-                kind: z.ZodOptional<z.ZodString>;
                 label: z.ZodOptional<z.ZodString>;
                 summary: z.ZodOptional<z.ZodString>;
             }, z.core.$loose>;
+            kind: z.ZodNullable<z.ZodString>;
             visibility: z.ZodEnum<{
                 private: "private";
                 public: "public";

package/dist/auth/cell_action_specs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAMtB,OAAO,EAEN,6BAA6B,EAC7B,6BAA6B,EAC7B,2BAA2B,EAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEN,0BAA0B,EAC1B,6BAA6B,EAC7B,2BAA2B,EAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEN,4BAA4B,EAC5B,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAE1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAEN,2BAA2B,EAC3B,MAAM,8BAA8B,CAAC;AAGtC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,cAAc;;;EAAgC,CAAC;AAC5D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAO5D,OAAO,EAAC,6BAA6B,EAAE,6BAA6B,EAAE,2BAA2B,EAAC,CAAC;AACnG,OAAO,EAAC,0BAA0B,EAAE,6BAA6B,EAAE,2BAA2B,EAAC,CAAC;AAChG,OAAO,EACN,4BAA4B,EAC5B,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,GAC1B,CAAC;AACF,OAAO,EAAC,2BAA2B,EAAC,CAAC;AAIrC,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,EAAG,gBAAyB,CAAC;AAE9D,yEAAyE;AACzE,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,EAAG,iBAA0B,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,EAAG,6BAAsC,CAAC;AAExF,6EAA6E;AAC7E,eAAO,MAAM,kCAAkC,EAAG,8BAAuC,CAAC;AAE1F;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAElF;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,EACpD,oCAA6C,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,EACrD,qCAA8C,CAAC;AAIhD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,oDAAgE,CAAC;AACtF,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;kBAkBnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAIhD;;;;GAIG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;kBAa1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;kBAAmC,CAAC;AACjE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAIhE;;;;;GAKG;AACH,eAAO,MAAM,YAAY;;;;kBAQtB,CAAC;AACJ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAI1D;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;kBAQ1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;kBAAmC,CAAC;AACjE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAIhE,eAAO,MAAM,eAAe;;;kBAG1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,gBAAgB;;;kBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAIhE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;mBA2Bb,CAAC;AACd,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAGzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAI5D;;;;;;GAMG;AACH,eAAO,MAAM,cAAc;;;;;;;;;kBAezB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;kBAAmC,CAAC;AAChE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAI9D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYC,CAAC;AAEtC,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYI,CAAC;AAEtC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWC,CAAC;AAEtC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;CAUC,CAAC;AAEtC,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYG,CAAC;AAEtC,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYE,CAAC;AAEtC;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWxB,CAAC"}
+{"version":3,"file":"cell_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAMtB,OAAO,EAEN,6BAA6B,EAC7B,6BAA6B,EAC7B,2BAA2B,EAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEN,0BAA0B,EAC1B,6BAA6B,EAC7B,2BAA2B,EAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEN,4BAA4B,EAC5B,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAE1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAEN,2BAA2B,EAC3B,MAAM,8BAA8B,CAAC;AAGtC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,cAAc;;;EAAgC,CAAC;AAC5D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAO5D,OAAO,EAAC,6BAA6B,EAAE,6BAA6B,EAAE,2BAA2B,EAAC,CAAC;AACnG,OAAO,EAAC,0BAA0B,EAAE,6BAA6B,EAAE,2BAA2B,EAAC,CAAC;AAChG,OAAO,EACN,4BAA4B,EAC5B,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,GAC1B,CAAC;AACF,OAAO,EAAC,2BAA2B,EAAC,CAAC;AAIrC,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,EAAG,gBAAyB,CAAC;AAE9D,yEAAyE;AACzE,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,EAAG,iBAA0B,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,EAAG,6BAAsC,CAAC;AAExF,6EAA6E;AAC7E,eAAO,MAAM,kCAAkC,EAAG,8BAAuC,CAAC;AAE1F;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAG,mBAA4B,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAG,iBAA0B,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,EACpD,oCAA6C,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,EACrD,qCAA8C,CAAC;AAIhD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,oDAAgE,CAAC;AACtF,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;kBAsBnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAIhD;;;;GAIG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;kBAiB1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;kBAAmC,CAAC;AACjE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAIhE;;;;;GAKG;AACH,eAAO,MAAM,YAAY;;;;kBAQtB,CAAC;AACJ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAI1D;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;kBAQ1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;kBAAmC,CAAC;AACjE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAIhE,eAAO,MAAM,eAAe;;;kBAG1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,gBAAgB;;;kBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAIhE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;mBA8Bb,CAAC;AACd,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAGzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAI5D;;;;;;GAMG;AACH,eAAO,MAAM,cAAc;;;;;;;;kBAezB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;kBAAmC,CAAC;AAChE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAI9D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYC,CAAC;AAEtC,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYI,CAAC;AAEtC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWC,CAAC;AAEtC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;CAUC,CAAC;AAEtC,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYG,CAAC;AAEtC,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYE,CAAC;AAEtC;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWxB,CAAC"}

package/dist/auth/cell_action_specs.js

@@ -64,12 +64,19 @@ export const ERROR_CELL_VISIBILITY_MANAGE_ONLY = 'cell_visibility_manage_only';
 /** Error reason — input shape for `cell_get` lacked both `id` and `path`. */
 export const ERROR_CELL_GET_REQUIRES_ID_OR_PATH = 'cell_get_requires_id_or_path';
 /**
- * Error reason — `cell_clone` `with_data_patch` would change `data.kind`.
- * Per-kind shape validation can pass coincidentally (e.g., one kind's
- * schema accepts most of another's fields), so we reject the cross-kind
- * patch explicitly to prevent incoherent clones.
+ * Error reason — a `kind` key was supplied inside `data`. `kind` is a
+ * top-level column (`cell.kind`), not content metadata; accepting it inside
+ * `data` would create two sources of truth. Rejected fail-loud at the
+ * create / update / clone-patch boundary so the column stays canonical.
  */
-export const ERROR_CELL_CLONE_KIND_MISMATCH = 'cell_clone_kind_mismatch';
+export const ERROR_CELL_KIND_IN_DATA = 'cell_kind_in_data';
+/**
+ * Error reason — `cell_create` was given an empty-string `kind`. `kind` is a
+ * non-empty capability tag or absent (`null` = typeless cell); `""` (a tag
+ * that tags nothing) is rejected fail-loud so `kind` stays a clean
+ * `null | non-empty-string` (twin of the Rust `ERROR_CELL_KIND_EMPTY`).
+ */
+export const ERROR_CELL_KIND_EMPTY = 'cell_kind_empty';
 /**
  * Error reason — null-auth `cell_list` caller passed a `created_by`
  * filter. The filter is a soft account-id enumeration vector ("does
@@ -136,6 +143,9 @@ export const CellJson = z.strictObject({
     id: Uuid,
     path: CellPath.nullable(),
     data: CellData,
+    kind: z.string().nullable().meta({
+        description: 'Capability / identity tag — a write-once top-level column (peer to `visibility` / `path`), not a field inside `data`. `null` for a typeless cell. The discriminator a creation authorizer gates on; fixed at birth.',
+    }),
     visibility: CellVisibility.meta({
         description: "Access-control tag. `'public'` admits everyone (including unauthenticated visitors); `'private'` (default) admits admin / owner / `cell_grant`-admitted callers. Top-level column, not inside `data`.",
     }),
@@ -157,7 +167,10 @@ export const CellJson = z.strictObject({
  */
 export const CellCreateInput = z.strictObject({
     data: CellData.meta({
-        description: 'Cell data. Base fields (kind / label / summary) typed; extras loose. Per-kind shape is sub-API.',
+        description: 'Cell content. Base fields (label / summary) typed; extras loose. A `kind` key here is rejected (`ERROR_CELL_KIND_IN_DATA`) — kind is the top-level field. Per-kind shape is sub-API.',
+    }),
+    kind: z.string().nullish().meta({
+        description: 'Capability / identity tag, written to the top-level `cell.kind` column (not `data`). Write-once — fixed at birth, not updatable. Non-empty when present (an empty string is rejected `ERROR_CELL_KIND_EMPTY`); omit / null for a typeless cell. A creation authorizer (if mounted) gates on this.',
     }),
     visibility: CellVisibility.optional().meta({
         description: "Access-control tag. Top-level column (not in `data`). Default `'private'` when omitted.",
@@ -245,7 +258,7 @@ export const CellDeleteOutput = z.strictObject({
  * `shared_with: 'me'` narrows to cells that admit the caller via a
  * `cell_grant` row (actor-shaped or role-shaped principal) AND that
  * the caller does not own. Authenticated only; combine with
- * `data_kind` / `path_prefix` etc. to scope further. Combining with
+ * `kind` / `path_prefix` etc. to scope further. Combining with
  * `created_by: <my-actor-id>` produces an empty result by definition
  * (owner is implicit, never appears as a grant principal); we don't
  * reject the combination at the schema layer because SQL emptiness is
@@ -258,7 +271,9 @@ export const CellListInput = z
         .max(CELL_LIST_LIMIT_MAX)
         .optional()
         .meta({ description: 'Batch-fetch by id. Visibility predicate still applies.' }),
-    data_kind: z.string().min(1).optional().meta({ description: 'Match `data.kind = ?`.' }),
+    kind: z.string().optional().meta({
+        description: 'Match `cell.kind = ?`. An empty string matches nothing — no cell carries an empty kind.',
+    }),
     visibility: CellVisibility.optional().meta({
         description: "Match `cell.visibility = ?`. The SQL-side auth-narrow already filters to public-or-admitted; this is an additional narrowing filter (e.g. `visibility: 'public'` on the discovery feed so authed callers don't see their own private entries mixed in).",
     }),

package/dist/auth/cell_actions.d.ts

@@ -39,10 +39,34 @@
  * @module
  */
 import { type RpcAction } from '../actions/action_rpc.js';
+import { type RequestActorContext } from './request_context.js';
 import type { RouteFactoryDeps } from './deps.js';
+import type { Uuid } from '@fuzdev/fuz_util/id.ts';
 import { type CellJson } from './cell_action_specs.js';
 import { type CellRow } from '../db/cell_queries.js';
 import type { CellData } from './cell_data_schema.js';
+/**
+ * Input to a `CellCreateAuthorize` callback — the TS twin of the Rust
+ * `CellCreateAuthorizeInput`.
+ */
+export interface CellCreateAuthorizeInput {
+    /** The cell's `kind` (the top-level `cell.kind` value); `null` for a typeless cell. */
+    kind: string | null;
+    /** The cell `data` (kind-free — a `kind` key is rejected upstream). For richer M3-era policies (e.g. content pre-screen). */
+    data: CellData;
+    /** Target scope — designed-in for M2 space-scoping; **always `null` in v1** (cells carry no scope column). */
+    scope_id: Uuid | null;
+}
+/**
+ * Opt-in creation authorizer — the TS twin of the Rust `CellCreateAuthorize`
+ * trait. Answers "may *this actor* create *this kind* of cell?". Runs in
+ * `cell_create` after `validate_data`, before the insert; returning `false`
+ * surfaces as the existing `cell_not_found` 404 (IDOR mask), so a denied
+ * caller can't distinguish a gated kind from a missing resource. Omitted =
+ * today's open create (all consumers untouched). Async-capable (DB / policy
+ * calls) — the create handler is already async with `auth` in hand.
+ */
+export type CellCreateAuthorize = (auth: RequestActorContext, input: CellCreateAuthorizeInput) => boolean | Promise<boolean>;
 /**
  * Dependencies for `create_cell_actions`.
  *
@@ -53,9 +77,13 @@ import type { CellData } from './cell_data_schema.js';
  * `invalid_params` JSON-RPC error so per-kind validation failures
  * surface to clients with code -32602 (not -32603 / internal). When
  * omitted, payloads pass through as-is.
+ *
+ * `authorize_create` is the optional creation-gate hook (see
+ * `CellCreateAuthorize`). When omitted, create is open (today's behavior).
  */
 export type CellActionDeps = Pick<RouteFactoryDeps, 'log' | 'audit'> & {
     validate_data?: (data: CellData) => CellData;
+    authorize_create?: CellCreateAuthorize;
 };
 export declare const to_cell_json: (row: CellRow) => CellJson;
 /** Create the six generic cell RPC actions. */

package/dist/auth/cell_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAIH,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,0BAA0B,CAAC;AAKlC,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAGhD,OAAO,EA6BN,KAAK,QAAQ,EAEb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAQN,KAAK,OAAO,EACZ,MAAM,uBAAuB,CAAC;AAkB/B,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,uBAAuB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG;IACtE,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC;CAC7C,CAAC;AAgBF,eAAO,MAAM,YAAY,GAAI,KAAK,OAAO,KAAG,QAY1C,CAAC;AA2BH,+CAA+C;AAC/C,eAAO,MAAM,mBAAmB,GAAI,MAAM,cAAc,KAAG,KAAK,CAAC,SAAS,CA6ezE,CAAC"}
+{"version":3,"file":"cell_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAIH,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAW,KAAK,mBAAmB,EAAC,MAAM,sBAAsB,CAAC;AAExE,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAEhD,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAEjD,OAAO,EA8BN,KAAK,QAAQ,EAEb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAQN,KAAK,OAAO,EACZ,MAAM,uBAAuB,CAAC;AAkB/B,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,uBAAuB,CAAC;AAEpD;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACxC,uFAAuF;IACvF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,6HAA6H;IAC7H,IAAI,EAAE,QAAQ,CAAC;IACf,8GAA8G;IAC9G,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG,CACjC,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE,wBAAwB,KAC3B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG;IACtE,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC;IAC7C,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;CACvC,CAAC;AAkCF,eAAO,MAAM,YAAY,GAAI,KAAK,OAAO,KAAG,QAa1C,CAAC;AA2BH,+CAA+C;AAC/C,eAAO,MAAM,mBAAmB,GAAI,MAAM,cAAc,KAAG,KAAK,CAAC,SAAS,CA+fzE,CAAC"}