@fuzdev/fuz_app 0.101.1 → 0.103.0

package/dist/auth/cell_actions.js

@@ -44,7 +44,7 @@ import { jsonrpc_errors, dev_only } from '../http/jsonrpc_errors.js';
 import { is_pg_unique_violation } from '../db/pg_error.js';
 import { has_role } from './request_context.js';
 import { ROLE_ADMIN } from './role_schema.js';
-import { cell_create_action_spec, cell_get_action_spec, cell_update_action_spec, cell_delete_action_spec, cell_list_action_spec, cell_clone_action_spec, ERROR_CELL_NOT_FOUND, ERROR_CELL_PATH_ADMIN_ONLY, ERROR_CELL_PATH_TAKEN, ERROR_CELL_VISIBILITY_MANAGE_ONLY, ERROR_CELL_GET_REQUIRES_ID_OR_PATH, ERROR_CELL_CLONE_KIND_MISMATCH, ERROR_CELL_LIST_CREATED_BY_REQUIRES_AUTH, ERROR_CELL_LIST_SHARED_WITH_REQUIRES_AUTH, CELL_LIST_LIMIT_DEFAULT, CELL_RELATIONS_BUNDLE_LIMIT, } from './cell_action_specs.js';
+import { cell_create_action_spec, cell_get_action_spec, cell_update_action_spec, cell_delete_action_spec, cell_list_action_spec, cell_clone_action_spec, ERROR_CELL_NOT_FOUND, ERROR_CELL_PATH_ADMIN_ONLY, ERROR_CELL_PATH_TAKEN, ERROR_CELL_VISIBILITY_MANAGE_ONLY, ERROR_CELL_GET_REQUIRES_ID_OR_PATH, ERROR_CELL_KIND_IN_DATA, ERROR_CELL_KIND_EMPTY, ERROR_CELL_LIST_CREATED_BY_REQUIRES_AUTH, ERROR_CELL_LIST_SHARED_WITH_REQUIRES_AUTH, CELL_LIST_LIMIT_DEFAULT, CELL_RELATIONS_BUNDLE_LIMIT, } from './cell_action_specs.js';
 import { query_cell_create, query_cell_get, query_cell_get_by_path, query_cell_update, query_cell_delete, query_cell_list, query_cell_load_many, } from '../db/cell_queries.js';
 import { query_cell_grant_list_for_cell, query_cell_grants_for_caller_in_cells, } from '../db/cell_grant_queries.js';
 import { query_cell_field_list_for_source, query_cell_field_set } from '../db/cell_field_queries.js';
@@ -66,10 +66,25 @@ const to_iso_nullable = (value) => {
  * write is unambiguously a path collision.
  */
 const path_taken_error = () => jsonrpc_errors.conflict('cell.path is already taken', { reason: ERROR_CELL_PATH_TAKEN });
+/**
+ * Reject a `kind` key supplied inside `data`. `kind` is the top-level
+ * `cell.kind` column (write-once capability axis), so a copy inside the
+ * loose `data` blob would be a second source of truth that silently
+ * diverges on update. Fail-loud `invalid_params` at every wire-`data`
+ * boundary (create / update / clone-patch).
+ */
+const reject_kind_in_data = (data) => {
+    if (Object.hasOwn(data, 'kind')) {
+        throw jsonrpc_errors.invalid_params('cell.data must not contain `kind` (it is a top-level field)', {
+            reason: ERROR_CELL_KIND_IN_DATA,
+        });
+    }
+};
 export const to_cell_json = (row) => ({
     id: row.id,
     path: row.path,
     data: row.data,
+    kind: row.kind,
     visibility: row.visibility,
     refs: row.refs,
     created_by: row.created_by,
@@ -92,14 +107,14 @@ const emit_cell_audit = (ctx, event_type, row, deps, auth) => {
         ip: ctx.client_ip,
         metadata: {
             cell_id: row.id,
-            kind: row.data.kind,
+            kind: row.kind ?? undefined,
             path: row.path,
         },
     });
 };
 /** Create the six generic cell RPC actions. */
 export const create_cell_actions = (deps) => {
-    const { validate_data } = deps;
+    const { validate_data, authorize_create } = deps;
     /**
      * Run the optional `validate_data` deps callback and convert any thrown
      * `ZodError` into the standard `invalid_params` JSON-RPC error so per-
@@ -129,9 +144,28 @@ export const create_cell_actions = (deps) => {
                 reason: ERROR_CELL_PATH_ADMIN_ONLY,
             });
         }
+        // `kind` is the top-level column — reject a stray copy inside `data`,
+        // and reject an empty `kind` (a tag tags nothing — `null` is the typeless
+        // state), so `kind` stays a clean `null | non-empty-string`. Both run
+        // after the path-admin gate so an unauthorized caller sees that first.
+        reject_kind_in_data(input.data);
+        if (input.kind === '') {
+            throw jsonrpc_errors.invalid_params('cell.kind must not be empty (use null for a typeless cell)', { reason: ERROR_CELL_KIND_EMPTY });
+        }
         // Per-kind shape validation (sub-API). Unknown kinds pass through;
         // known kinds with malformed payloads surface as invalid_params.
         const validated_data = validate_data_or_throw(input.data);
+        const kind = input.kind ?? null;
+        // Creation authorizer (opt-in): may this actor create this kind? Runs
+        // after shape validation, before the insert. Deny → 404 IDOR mask (the
+        // established cell-layer deny shape — a gated kind is indistinguishable
+        // from a missing resource). Receives the **raw** `input.data` (not the
+        // `validate_data`-normalized value) to match the Rust twin, so a
+        // consumer with a transforming validator can't diverge TS↔Rust.
+        if (authorize_create &&
+            !(await authorize_create(auth, { kind, data: input.data, scope_id: null }))) {
+            throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
+        }
         let row;
         try {
             row = await query_cell_create(ctx, {
@@ -141,6 +175,7 @@ export const create_cell_actions = (deps) => {
                 // extend `Json`. The DB column is JSONB; the cast trusts the
                 // schema-validated runtime shape.
                 data: validated_data,
+                kind,
                 visibility: input.visibility,
                 path: input.path ?? null,
                 created_by: auth.actor.id,
@@ -254,7 +289,11 @@ export const create_cell_actions = (deps) => {
         // Per-kind shape validation when `data` is supplied. Patch-only —
         // we don't validate the existing row's data on update (validation
         // is for incoming patches). `data` writes fully replace, so the
-        // patch IS the post-update state.
+        // patch IS the post-update state. A stray `kind` inside it is rejected
+        // (kind is the write-once top-level column — `cell_update` cannot
+        // change it, structurally: it is not even a field on `CellUpdateInput`).
+        if (input.data !== undefined)
+            reject_kind_in_data(input.data);
         const validated_data = input.data !== undefined ? validate_data_or_throw(input.data) : undefined;
         let updated;
         try {
@@ -312,23 +351,13 @@ export const create_cell_actions = (deps) => {
      * server-stamped provenance fields.
      */
     const clone_one_cell_row = async (ctx, source, auth, options) => {
+        // A patch is wire-supplied `data` — reject a stray `kind` (kind is the
+        // immutable top-level column; the clone inherits `source.kind`).
+        if (options.patch_data !== undefined)
+            reject_kind_in_data(options.patch_data);
         // Both `source.data` and `options.patch_data` are CellData (loose
         // objects). Patch-last shallow merge composes cleanly.
         const merged_data = options.patch_data !== undefined ? { ...source.data, ...options.patch_data } : source.data;
-        // Block cross-kind patches before per-kind shape validation: a
-        // kind-A → kind-B patch can pass `validate_data` coincidentally
-        // (loose shapes accept overlapping fields) and produce an
-        // incoherent result. Reject when the merged kind diverges from the
-        // source's kind. Both undefined or equal kinds pass through;
-        // one-sided undefined is permissive (caller patching unrelated
-        // fields on a typeless source).
-        if (source.data.kind !== undefined &&
-            merged_data.kind !== undefined &&
-            source.data.kind !== merged_data.kind) {
-            throw jsonrpc_errors.invalid_params('cell_clone cannot change kind via with_data_patch', {
-                reason: ERROR_CELL_CLONE_KIND_MISMATCH,
-            });
-        }
         // Per-kind shape validation runs on the merged result (sub-API).
         // Source rows are validated on their original create; the patch
         // could violate the kind shape (e.g., remove a required field).
@@ -336,6 +365,9 @@ export const create_cell_actions = (deps) => {
         return query_cell_create(ctx, {
             // Boundary cast (see `create_handler`).
             data: validated_data,
+            // Clone inherits the source's kind verbatim — kind is fixed at
+            // birth and a `with_data_patch` can't reach the column.
+            kind: source.kind,
             visibility: source.visibility,
             path: null, // admin-only paths cannot auto-clone
             created_by: auth.actor.id,
@@ -463,7 +495,7 @@ export const create_cell_actions = (deps) => {
         // — emit directly rather than threading it through `emit_cell_audit`.
         // `kind` is read from `source.data` (not the cloned row) so the
         // audit trail attributes the clone to the source's shape.
-        const source_kind = source.data.kind;
+        const source_kind = source.kind ?? undefined;
         const cloned_child_count = deep ? cloneable_items.length : 0;
         deps.audit.emit(ctx, {
             event_type: 'cell_clone',
@@ -505,7 +537,7 @@ export const create_cell_actions = (deps) => {
         const caller_actor_id = auth?.actor?.id ?? null;
         const rows = await query_cell_list(ctx, {
             ids: input.ids,
-            data_kind: input.data_kind,
+            kind: input.kind,
             visibility: input.visibility,
             ref: input.ref,
             created_by: input.created_by,

package/dist/auth/cell_data_schema.d.ts

@@ -11,17 +11,19 @@
  * `auth/cell_actions.ts`.
  *
  * **Discipline**: a field joins `CellData` only when at least two
- * consumers in different domains read it generically. `kind` (editor
- * dispatch + sub-API registry), `label` (list/index rendering), and
- * `summary` (card subtitle + share-target description) meet this bar.
- * Future candidates require evidence of generic usage — otherwise they
- * stay per-kind.
+ * consumers in different domains read it generically. `label` (list/index
+ * rendering) and `summary` (card subtitle + share-target description) meet
+ * this bar. Future candidates require evidence of generic usage — otherwise
+ * they stay per-kind.
  *
- * **Visibility is not in here.** Access control is a peer of `cell_grant`,
- * not content metadata — `cell.visibility` lives as a top-level column on
- * `CellJson` and `CellRow` (the `CellVisibility` enum is defined in
- * `auth/cell_action_specs.ts` next to the wire fields that use it), and is
- * enforced by `can_view_cell` reading the column directly (no JSON dive).
+ * **`kind` is not in here, and is rejected if present.** Like `visibility`,
+ * a cell's `kind` is a top-level column (`cell.kind` on `CellJson` /
+ * `CellRow`), not content metadata — it is the capability / identity axis a
+ * creation authorizer gates on, write-once at birth. A stray `kind` key
+ * inside `data` is a fail-loud `ERROR_CELL_KIND_IN_DATA` at the create /
+ * update / clone-patch boundary (single source of truth). Access control
+ * (`cell.visibility`) is likewise a peer column, enforced by `can_view_cell`
+ * reading the column directly (no JSON dive).
  *
  * @module
  */
@@ -29,14 +31,10 @@ import { z } from 'zod';
 /**
  * Base cell-data shape. All fields optional; loose mode admits arbitrary
  * additional keys so apps can attach metadata or stage new kinds without
- * touching the wire schema.
- *
- * `kind` is optional because cells without a registered kind are valid —
- * admin-curated content, in-development types, or unknown shapes pass
- * through. Known kinds get richer validation via the per-kind sub-API.
+ * touching the wire schema. `kind` lives on the top-level `cell.kind`
+ * column, not here (see the module doc).
  */
 export declare const CellData: z.ZodObject<{
-    kind: z.ZodOptional<z.ZodString>;
     label: z.ZodOptional<z.ZodString>;
     summary: z.ZodOptional<z.ZodString>;
 }, z.core.$loose>;

package/dist/auth/cell_data_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_data_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_data_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ;;;;iBAInB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC"}
+{"version":3,"file":"cell_data_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_data_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB;;;;;GAKG;AACH,eAAO,MAAM,QAAQ;;;iBAGnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC"}

package/dist/auth/cell_data_schema.js

@@ -11,17 +11,19 @@
  * `auth/cell_actions.ts`.
  *
  * **Discipline**: a field joins `CellData` only when at least two
- * consumers in different domains read it generically. `kind` (editor
- * dispatch + sub-API registry), `label` (list/index rendering), and
- * `summary` (card subtitle + share-target description) meet this bar.
- * Future candidates require evidence of generic usage — otherwise they
- * stay per-kind.
+ * consumers in different domains read it generically. `label` (list/index
+ * rendering) and `summary` (card subtitle + share-target description) meet
+ * this bar. Future candidates require evidence of generic usage — otherwise
+ * they stay per-kind.
  *
- * **Visibility is not in here.** Access control is a peer of `cell_grant`,
- * not content metadata — `cell.visibility` lives as a top-level column on
- * `CellJson` and `CellRow` (the `CellVisibility` enum is defined in
- * `auth/cell_action_specs.ts` next to the wire fields that use it), and is
- * enforced by `can_view_cell` reading the column directly (no JSON dive).
+ * **`kind` is not in here, and is rejected if present.** Like `visibility`,
+ * a cell's `kind` is a top-level column (`cell.kind` on `CellJson` /
+ * `CellRow`), not content metadata — it is the capability / identity axis a
+ * creation authorizer gates on, write-once at birth. A stray `kind` key
+ * inside `data` is a fail-loud `ERROR_CELL_KIND_IN_DATA` at the create /
+ * update / clone-patch boundary (single source of truth). Access control
+ * (`cell.visibility`) is likewise a peer column, enforced by `can_view_cell`
+ * reading the column directly (no JSON dive).
  *
  * @module
  */
@@ -29,14 +31,10 @@ import { z } from 'zod';
 /**
  * Base cell-data shape. All fields optional; loose mode admits arbitrary
  * additional keys so apps can attach metadata or stage new kinds without
- * touching the wire schema.
- *
- * `kind` is optional because cells without a registered kind are valid —
- * admin-curated content, in-development types, or unknown shapes pass
- * through. Known kinds get richer validation via the per-kind sub-API.
+ * touching the wire schema. `kind` lives on the top-level `cell.kind`
+ * column, not here (see the module doc).
  */
 export const CellData = z.looseObject({
-    kind: z.string().optional(),
     label: z.string().optional(),
     summary: z.string().optional(),
 });

package/dist/auth/role_grant_offer_action_specs.d.ts

@@ -1,6 +1,7 @@
 /**
  * Role grant offer RPC action specs — declarative contract for the
- * consentful-role-grants surface (offer lifecycle + admin revoke).
+ * consentful-role-grants surface (offer lifecycle + admin revoke + the
+ * immediate admin-only `role_grant_assign`).
  *
  * Import this module for the specs, Input/Output schemas, `ERROR_ROLE_GRANT_OFFER_*`
  * reason constants, and the `all_role_grant_offer_action_specs` registry.
@@ -209,6 +210,27 @@ export declare const RoleGrantRevokeOutput: z.ZodObject<{
     revoked: z.ZodLiteral<true>;
 }, z.core.$strict>;
 export type RoleGrantRevokeOutput = z.infer<typeof RoleGrantRevokeOutput>;
+/**
+ * Input for `role_grant_assign` — the immediate admin-only conferral path, the
+ * consent-free sibling of `role_grant_offer_create`. An admin assigns a
+ * role_grant straight onto the target actor; there is no offer for a grantee to
+ * accept. No `message` (no offer to carry it on) and no `scope_kind` (`scope_id`
+ * alone is the v1 scope discriminator — the grant row's `scope_kind` stays null).
+ */
+export declare const RoleGrantAssignInput: z.ZodObject<{
+    to_account_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
+    to_actor_id: z.ZodOptional<z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>>;
+    role: z.ZodString;
+    scope_id: z.ZodOptional<z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>>;
+    acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
+}, z.core.$strict>;
+export type RoleGrantAssignInput = z.infer<typeof RoleGrantAssignInput>;
+/** Output for `role_grant_assign`. */
+export declare const RoleGrantAssignOutput: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    role_grant_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
+}, z.core.$strict>;
+export type RoleGrantAssignOutput = z.infer<typeof RoleGrantAssignOutput>;
 /**
  * `rate_limit: 'account'` throttles offer-spam at the authenticated
  * grantor and bounds the account-existence oracle on `to_account_id` —
@@ -447,10 +469,41 @@ export declare const role_grant_revoke_action_spec: {
     error_reasons: ("role_not_web_grantable" | "role_grant_not_found")[];
     rate_limit: "account";
 };
+/**
+ * `rate_limit: 'account'` bounds admin-side burn of `role_grant_assign` — the
+ * action is admin-gated and audit-trailed, but the per-account cap matches
+ * `role_grant_revoke` so a single admin script can't churn grants in a loop.
+ */
+export declare const role_grant_assign_action_spec: {
+    method: string;
+    kind: "request_response";
+    initiator: "frontend";
+    auth: {
+        account: "required";
+        actor: "required";
+        roles: string[];
+    };
+    side_effects: true;
+    input: z.ZodObject<{
+        to_account_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
+        to_actor_id: z.ZodOptional<z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>>;
+        role: z.ZodString;
+        scope_id: z.ZodOptional<z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>>;
+        acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
+    }, z.core.$strict>;
+    output: z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+        role_grant_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
+    }, z.core.$strict>;
+    async: true;
+    description: string;
+    error_reasons: ("role_not_web_grantable" | "role_grant_offer_actor_account_mismatch")[];
+    rate_limit: "account";
+};
 /**
  * All role-grant-offer action specs — a codegen-ready registry. Consumers spread
- * this into their own action-spec array to include offer lifecycle + revoke
- * methods in a typed client surface.
+ * this into their own action-spec array to include offer lifecycle + revoke +
+ * assign methods in a typed client surface.
  */
 export declare const all_role_grant_offer_action_specs: Array<RequestResponseActionSpec>;
 //# sourceMappingURL=role_grant_offer_action_specs.d.ts.map

package/dist/auth/role_grant_offer_action_specs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_grant_offer_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_grant_offer_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAGtB,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,2BAA2B,CAAC;AAUzE,oEAAoE;AACpE,eAAO,MAAM,kCAAkC,EAAG,8BAAuC,CAAC;AAC1F,kEAAkE;AAClE,eAAO,MAAM,+BAA+B,EAAG,2BAAoC,CAAC;AACpF,sDAAsD;AACtD,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAClF,wGAAwG;AACxG,eAAO,MAAM,gCAAgC,EAAG,4BAAqC,CAAC;AACtF,uIAAuI;AACvI,eAAO,MAAM,yCAAyC,EACrD,qCAA8C,CAAC;AAChD,gKAAgK;AAChK,eAAO,MAAM,qCAAqC,EAAG,iCAA0C,CAAC;AAChG,6FAA6F;AAC7F,eAAO,MAAM,qCAAqC,EAAG,iCAA0C,CAAC;AAChG,wHAAwH;AACxH,eAAO,MAAM,6CAA6C,EACzD,yCAAkD,CAAC;AAIpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;kBAoBpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,2CAA2C;AAC3C,eAAO,MAAM,yBAAyB;;;kBAGpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;;kBAQrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;kBAGrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,uGAAuG;AACvG,eAAO,MAAM,uBAAuB;;;mBAOvB,CAAC;AACd,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;;;kBAQ/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;mBAa1B,CAAC;AACd,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;kBAErC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;kBAIrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,0EAA0E;AAC1E,eAAO,MAAM,sBAAsB;;kBAAwC,CAAC;AAC5E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,0CAA0C;AAC1C,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;kBAAwD,CAAC;AAC9F,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,6CAA6C;AAC7C,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;kBAAwD,CAAC;AACjG,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEtF,sCAAsC;AACtC,eAAO,MAAM,qBAAqB;;;kBAGhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkBX,CAAC;AAEtC,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiBX,CAAC;AAEtC,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;CAWZ,CAAC;AAEtC,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;CAWZ,CAAC;AAEtC,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWT,CAAC;AAEtC,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWZ,CAAC;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;CAaL,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAAE,KAAK,CAAC,yBAAyB,CAQ9E,CAAC"}
+{"version":3,"file":"role_grant_offer_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_grant_offer_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAGtB,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,2BAA2B,CAAC;AAUzE,oEAAoE;AACpE,eAAO,MAAM,kCAAkC,EAAG,8BAAuC,CAAC;AAC1F,kEAAkE;AAClE,eAAO,MAAM,+BAA+B,EAAG,2BAAoC,CAAC;AACpF,sDAAsD;AACtD,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAClF,wGAAwG;AACxG,eAAO,MAAM,gCAAgC,EAAG,4BAAqC,CAAC;AACtF,uIAAuI;AACvI,eAAO,MAAM,yCAAyC,EACrD,qCAA8C,CAAC;AAChD,gKAAgK;AAChK,eAAO,MAAM,qCAAqC,EAAG,iCAA0C,CAAC;AAChG,6FAA6F;AAC7F,eAAO,MAAM,qCAAqC,EAAG,iCAA0C,CAAC;AAChG,wHAAwH;AACxH,eAAO,MAAM,6CAA6C,EACzD,yCAAkD,CAAC;AAIpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;kBAoBpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,2CAA2C;AAC3C,eAAO,MAAM,yBAAyB;;;kBAGpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;;kBAQrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;kBAGrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,uGAAuG;AACvG,eAAO,MAAM,uBAAuB;;;mBAOvB,CAAC;AACd,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;;;kBAQ/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;mBAa1B,CAAC;AACd,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;kBAErC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,4CAA4C;AAC5C,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;kBAIrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEpF,0EAA0E;AAC1E,eAAO,MAAM,sBAAsB;;kBAAwC,CAAC;AAC5E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,0CAA0C;AAC1C,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;kBAAwD,CAAC;AAC9F,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,6CAA6C;AAC7C,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;kBAAwD,CAAC;AACjG,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEtF,sCAAsC;AACtC,eAAO,MAAM,qBAAqB;;;kBAGhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;;;;kBAa/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,sCAAsC;AACtC,eAAO,MAAM,qBAAqB;;;kBAGhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkBX,CAAC;AAEtC,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiBX,CAAC;AAEtC,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;CAWZ,CAAC;AAEtC,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;CAWZ,CAAC;AAEtC,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWT,CAAC;AAEtC,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWZ,CAAC;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;CAaL,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;CAaL,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAAE,KAAK,CAAC,yBAAyB,CAS9E,CAAC"}

package/dist/auth/role_grant_offer_action_specs.js

@@ -1,6 +1,7 @@
 /**
  * Role grant offer RPC action specs — declarative contract for the
- * consentful-role-grants surface (offer lifecycle + admin revoke).
+ * consentful-role-grants surface (offer lifecycle + admin revoke + the
+ * immediate admin-only `role_grant_assign`).
  *
  * Import this module for the specs, Input/Output schemas, `ERROR_ROLE_GRANT_OFFER_*`
  * reason constants, and the `all_role_grant_offer_action_specs` registry.
@@ -156,6 +157,31 @@ export const RoleGrantRevokeOutput = z.strictObject({
     ok: z.literal(true),
     revoked: z.literal(true),
 });
+/**
+ * Input for `role_grant_assign` — the immediate admin-only conferral path, the
+ * consent-free sibling of `role_grant_offer_create`. An admin assigns a
+ * role_grant straight onto the target actor; there is no offer for a grantee to
+ * accept. No `message` (no offer to carry it on) and no `scope_kind` (`scope_id`
+ * alone is the v1 scope discriminator — the grant row's `scope_kind` stays null).
+ */
+export const RoleGrantAssignInput = z.strictObject({
+    to_account_id: Uuid.meta({ description: 'Account id of the grantee.' }),
+    to_actor_id: Uuid.nullish().meta({
+        description: "Optional actor-grain target on the grantee account. When set, must belong to `to_account_id`. Omit to resolve the account's sole active actor — a multi-actor account must name one.",
+    }),
+    role: RoleName.meta({
+        description: "Role to assign. Must be admin-grantable (its `grant_paths` includes `'admin'`).",
+    }),
+    scope_id: Uuid.nullish().meta({
+        description: 'Scope id for resource-scoped grants. `null` for a global role_grant.',
+    }),
+    acting: ActingActor,
+});
+/** Output for `role_grant_assign`. */
+export const RoleGrantAssignOutput = z.strictObject({
+    ok: z.literal(true),
+    role_grant_id: Uuid,
+});
 // -- Action specs -----------------------------------------------------------
 /**
  * `rate_limit: 'account'` throttles offer-spam at the authenticated
@@ -267,10 +293,28 @@ export const role_grant_revoke_action_spec = {
     error_reasons: [ERROR_ROLE_GRANT_NOT_FOUND, ERROR_ROLE_NOT_WEB_GRANTABLE],
     rate_limit: 'account',
 };
+/**
+ * `rate_limit: 'account'` bounds admin-side burn of `role_grant_assign` — the
+ * action is admin-gated and audit-trailed, but the per-account cap matches
+ * `role_grant_revoke` so a single admin script can't churn grants in a loop.
+ */
+export const role_grant_assign_action_spec = {
+    method: 'role_grant_assign',
+    kind: 'request_response',
+    initiator: 'frontend',
+    auth: { account: 'required', actor: 'required', roles: ['admin'] },
+    side_effects: true,
+    input: RoleGrantAssignInput,
+    output: RoleGrantAssignOutput,
+    async: true,
+    description: "Immediately assign a role_grant to a target account — admin-only, no consent step (the capability-unlock UX). The role's `grant_paths` must include `'admin'`. Idempotent: re-assigning an active grant returns it. Emits a role_grant_create audit event.",
+    error_reasons: [ERROR_ROLE_NOT_WEB_GRANTABLE, ERROR_ROLE_GRANT_OFFER_ACTOR_ACCOUNT_MISMATCH],
+    rate_limit: 'account',
+};
 /**
  * All role-grant-offer action specs — a codegen-ready registry. Consumers spread
- * this into their own action-spec array to include offer lifecycle + revoke
- * methods in a typed client surface.
+ * this into their own action-spec array to include offer lifecycle + revoke +
+ * assign methods in a typed client surface.
  */
 export const all_role_grant_offer_action_specs = [
     role_grant_offer_create_action_spec,
@@ -280,4 +324,5 @@ export const all_role_grant_offer_action_specs = [
     role_grant_offer_list_action_spec,
     role_grant_offer_history_action_spec,
     role_grant_revoke_action_spec,
+    role_grant_assign_action_spec,
 ];

package/dist/auth/role_grant_offer_actions.d.ts

@@ -1,8 +1,9 @@
 /**
  * Role grant offer RPC action handlers — the consentful-role-grants action surface.
  *
- * Seven actions: six offer-lifecycle methods (create / accept / decline /
- * retract / list / history) plus `role_grant_revoke` (admin-only). All mount
+ * Eight actions: six offer-lifecycle methods (create / accept / decline /
+ * retract / list / history) plus `role_grant_revoke` and `role_grant_assign`
+ * (both admin-only). All mount
  * on a consumer's JSON-RPC endpoint via `create_rpc_endpoint`. The action
  * specs themselves live in `auth/role_grant_offer_action_specs.ts`. Mutations
  * declare `side_effects: true` so the RPC dispatcher wraps the handler in
@@ -23,6 +24,10 @@
  *   dispatcher rejects non-admin callers before the handler runs.
  *   The admin-grant-path gate prevents revoking keeper / daemon-scoped
  *   roles via this surface. Keys on `actor_id` to survive multi-actor accounts.
+ * - `role_grant_assign` — spec-level `auth: {role: 'admin'}`; the immediate
+ *   consent-free conferral path. The admin-grant-path gate prevents assigning
+ *   keeper / daemon-scoped roles via this surface. No holder-propagation — only
+ *   admins confer (see participation-gates.md Decision 7).
  *
  * Audit events are emitted in-transaction by the query layer (atomic with
  * the role_grant write on accept/revoke) or by the handler via the bound
@@ -76,23 +81,8 @@ export interface RoleGrantOfferActionOptions {
     authorize?: RoleGrantOfferCreateAuthorize;
 }
 /**
- * Authorization callback that admits any admin and otherwise falls back to
- * the symmetric default (caller must hold the offered role globally).
- *
- * The admin-grant-path filter in `create_handler` runs **before** the
- * `authorize` callback, so this never sees roles whose `grant_paths`
- * omits `'admin'`. Drop into
- * `create_role_grant_offer_actions({authorize: authorize_admin_or_holder})`
- * (or any factory that forwards `authorize`, e.g. `create_standard_rpc_actions`)
- * for the common "admins offer anything; users offer what they hold"
- * pattern. Scope-aware policies (e.g. classroom_teacher offering
- * classroom_student in their own scope) wrap this and short-circuit `true`
- * before delegating.
- */
-export declare const authorize_admin_or_holder: RoleGrantOfferCreateAuthorize;
-/**
- * Create the seven role-grant-offer RPC actions (six offer-lifecycle methods
- * plus `role_grant_revoke`).
+ * Create the eight role-grant-offer RPC actions (six offer-lifecycle methods
+ * plus `role_grant_revoke` and the immediate `role_grant_assign`).
  *
  * @param deps - `RouteFactoryDeps` (`log`, `audit`, …) plus optional `notification_sender` for WS fan-out — when absent, WS fan-out is silently skipped (DB-only side effects still happen). Consumers wiring `BackendWebsocketTransport` assign its instance directly (the transport's `send_to_account` signature accepts the broader `JsonrpcMessageFromServerToClient`, which is contravariantly compatible)
  * @param options - role schema, default TTL, authorization override

package/dist/auth/role_grant_offer_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role_grant_offer_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_grant_offer_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAGN,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAIN,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC;AA0B1B,OAAO,EAA4C,KAAK,cAAc,EAAC,MAAM,sBAAsB,CAAC;AACpG,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAEhD,OAAO,EAON,KAAK,kBAAkB,EACvB,MAAM,qCAAqC,CAAC;AAiC7C;;;;;;;;GAQG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAC3C,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAC,EACrE,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,EACnC,GAAG,EAAE,aAAa,KACd,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,0FAA0F;IAC1F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,6BAA6B,CAAC;CAC1C;AA6BD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,EAAE,6BAavC,CAAC;AAIF;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,GAC3C,MAAM,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG;IAC/C,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAChD,EACD,UAAS,2BAAgC,KACvC,KAAK,CAAC,SAAS,CAodjB,CAAC"}
+{"version":3,"file":"role_grant_offer_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/role_grant_offer_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAIH,OAAO,EAGN,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAIN,KAAK,gBAAgB,EACrB,MAAM,kBAAkB,CAAC;AA2B1B,OAAO,EAA4C,KAAK,cAAc,EAAC,MAAM,sBAAsB,CAAC;AACpG,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAEhD,OAAO,EAON,KAAK,kBAAkB,EACvB,MAAM,qCAAqC,CAAC;AAoC7C;;;;;;;;GAQG;AACH,MAAM,MAAM,6BAA6B,GAAG,CAC3C,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAC,EACrE,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,EACnC,GAAG,EAAE,aAAa,KACd,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,qDAAqD;AACrD,MAAM,WAAW,2BAA2B;IAC3C;;;;;OAKG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,0FAA0F;IAC1F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,6BAA6B,CAAC;CAC1C;AAgCD;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,GAC3C,MAAM,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG;IAC/C,mBAAmB,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAChD,EACD,UAAS,2BAAgC,KACvC,KAAK,CAAC,SAAS,CAkiBjB,CAAC"}