@fuzdev/fuz_app 0.103.0 → 0.105.0

package/dist/auth/cell_actions.js

@@ -39,16 +39,16 @@
  * @module
  */
 import { z } from 'zod';
-import { rpc_action, } from '../actions/action_rpc.js';
+import { rpc_action } from '../actions/action_rpc.js';
 import { jsonrpc_errors, dev_only } from '../http/jsonrpc_errors.js';
 import { is_pg_unique_violation } from '../db/pg_error.js';
 import { has_role } from './request_context.js';
 import { ROLE_ADMIN } from './role_schema.js';
-import { cell_create_action_spec, cell_get_action_spec, cell_update_action_spec, cell_delete_action_spec, cell_list_action_spec, cell_clone_action_spec, ERROR_CELL_NOT_FOUND, ERROR_CELL_PATH_ADMIN_ONLY, ERROR_CELL_PATH_TAKEN, ERROR_CELL_VISIBILITY_MANAGE_ONLY, ERROR_CELL_GET_REQUIRES_ID_OR_PATH, ERROR_CELL_KIND_IN_DATA, ERROR_CELL_KIND_EMPTY, ERROR_CELL_LIST_CREATED_BY_REQUIRES_AUTH, ERROR_CELL_LIST_SHARED_WITH_REQUIRES_AUTH, CELL_LIST_LIMIT_DEFAULT, CELL_RELATIONS_BUNDLE_LIMIT, } from './cell_action_specs.js';
-import { query_cell_create, query_cell_get, query_cell_get_by_path, query_cell_update, query_cell_delete, query_cell_list, query_cell_load_many, } from '../db/cell_queries.js';
-import { query_cell_grant_list_for_cell, query_cell_grants_for_caller_in_cells, } from '../db/cell_grant_queries.js';
+import { cell_create_action_spec, cell_get_action_spec, cell_update_action_spec, cell_delete_action_spec, cell_list_action_spec, cell_clone_action_spec, cell_moderate_action_spec, ERROR_CELL_NOT_FOUND, ERROR_CELL_PATH_ADMIN_ONLY, ERROR_CELL_PATH_TAKEN, ERROR_CELL_VISIBILITY_MANAGE_ONLY, ERROR_CELL_GET_REQUIRES_ID_OR_PATH, ERROR_CELL_KIND_IN_DATA, ERROR_CELL_KIND_EMPTY, ERROR_CELL_CREATE_FORBIDDEN, ERROR_CELL_MODERATE_FORBIDDEN, ERROR_CELL_NOT_A_CONTRIBUTION, ERROR_CELL_LIST_CREATED_BY_REQUIRES_AUTH, ERROR_CELL_LIST_SHARED_WITH_REQUIRES_AUTH, CELL_LIST_LIMIT_DEFAULT, CELL_RELATIONS_BUNDLE_LIMIT } from './cell_action_specs.js';
+import { query_cell_create, query_cell_get, query_cell_get_by_path, query_cell_update, query_cell_delete, query_cell_set_moderation, query_cell_list, query_cell_load_many } from '../db/cell_queries.js';
+import { query_cell_grant_list_for_cell, query_cell_grants_for_caller_in_cells } from '../db/cell_grant_queries.js';
 import { query_cell_field_list_for_source, query_cell_field_set } from '../db/cell_field_queries.js';
-import { query_cell_item_insert, query_cell_item_list_for_parent, } from '../db/cell_item_queries.js';
+import { query_cell_item_insert, query_cell_item_list_for_parent } from '../db/cell_item_queries.js';
 import { can_view_cell, can_edit_cell, can_manage_cell } from './cell_authorize.js';
 import { filter_visible_target_ids } from './cell_relation_visibility.js';
 import { to_grant_json } from './cell_grant_actions.js';
@@ -76,7 +76,7 @@ const path_taken_error = () => jsonrpc_errors.conflict('cell.path is already tak
 const reject_kind_in_data = (data) => {
     if (Object.hasOwn(data, 'kind')) {
         throw jsonrpc_errors.invalid_params('cell.data must not contain `kind` (it is a top-level field)', {
-            reason: ERROR_CELL_KIND_IN_DATA,
+            reason: ERROR_CELL_KIND_IN_DATA
         });
     }
 };
@@ -87,12 +87,15 @@ export const to_cell_json = (row) => ({
     kind: row.kind,
     visibility: row.visibility,
     refs: row.refs,
+    parent_id: row.parent_id,
+    root_id: row.root_id,
+    moderation: row.moderation,
     created_by: row.created_by,
     updated_by: row.updated_by,
     created_at: typeof row.created_at === 'string' ? row.created_at : row.created_at.toISOString(),
     updated_at: to_iso_nullable(row.updated_at),
     deleted_at: to_iso_nullable(row.deleted_at),
-    grant_count: row.grant_count,
+    grant_count: row.grant_count
 });
 /**
  * Emit a cell-mutation audit event with the standard `{cell_id, kind?,
@@ -108,8 +111,8 @@ const emit_cell_audit = (ctx, event_type, row, deps, auth) => {
         metadata: {
             cell_id: row.id,
             kind: row.kind ?? undefined,
-            path: row.path,
-        },
+            path: row.path
+        }
     });
 };
 /** Create the six generic cell RPC actions. */
@@ -141,7 +144,7 @@ export const create_cell_actions = (deps) => {
         // + DB are clean.
         if (input.path !== undefined && input.path !== null && !has_role(auth, ROLE_ADMIN)) {
             throw jsonrpc_errors.forbidden('cell.path is admin-only', {
-                reason: ERROR_CELL_PATH_ADMIN_ONLY,
+                reason: ERROR_CELL_PATH_ADMIN_ONLY
             });
         }
         // `kind` is the top-level column — reject a stray copy inside `data`,
@@ -156,15 +159,75 @@ export const create_cell_actions = (deps) => {
         // known kinds with malformed payloads surface as invalid_params.
         const validated_data = validate_data_or_throw(input.data);
         const kind = input.kind ?? null;
-        // Creation authorizer (opt-in): may this actor create this kind? Runs
-        // after shape validation, before the insert. Deny → 404 IDOR mask (the
-        // established cell-layer deny shape — a gated kind is indistinguishable
-        // from a missing resource). Receives the **raw** `input.data` (not the
-        // `validate_data`-normalized value) to match the Rust twin, so a
-        // consumer with a transforming validator can't diverge TS↔Rust.
-        if (authorize_create &&
-            !(await authorize_create(auth, { kind, data: input.data, scope_id: null }))) {
-            throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
+        // Directory tree: resolve the governing `root_id` from the parent (and
+        // the root's `data` for the authorizer's policy read). Runs whether or
+        // not an authorizer is mounted — `root_id` is written regardless, and an
+        // unviewable parent 404-masks the attempt (the same IDOR mask the read
+        // path uses; never reveals a hidden container). A root creation
+        // (`parent_id` null/absent) has `root_id = null`. `root_data` is read
+        // **in-tx** (only when an authorizer is mounted), reusing the parent row
+        // when the parent *is* the root, else one read by `root_id` — so the
+        // authorizer stays pure + the read rides the handler's connection (no
+        // separate-handle deadlock on the single-connection PGlite).
+        const parent_id = input.parent_id ?? null;
+        let root_id = null;
+        let root_data = null;
+        if (parent_id !== null) {
+            const parent = await query_cell_get(ctx, parent_id);
+            if (!parent)
+                throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
+            const parent_grants = await query_cell_grant_list_for_cell(ctx, parent.id);
+            if (!can_view_cell(auth, parent, parent_grants)) {
+                throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
+            }
+            root_id = parent.root_id ?? parent.id;
+            if (authorize_create) {
+                root_data =
+                    root_id === parent.id
+                        ? parent.data
+                        : ((await query_cell_get(ctx, root_id))?.data ?? null);
+            }
+        }
+        // Parent-aware creation authorizer (opt-in). Runs after shape validation
+        // and after the parent-resolve (a hidden parent already 404-masked).
+        // `{allow: false}` for a *viewable* parent / a root creation is a 403
+        // `forbidden` (not the 404 mask); an `{allow: true}` verdict folds the
+        // moderation outcome. Receives the **raw** `input.data` (not the
+        // `validate_data`-normalized value) to match the Rust twin, so a consumer
+        // with a transforming validator can't diverge TS↔Rust. `scope_id` is
+        // `null` in v1. Without an authorizer, create is open: `moderation` stays
+        // null and the author's visibility holds.
+        let moderation = null;
+        let visibility = input.visibility;
+        if (authorize_create) {
+            const verdict = await authorize_create(auth, {
+                kind,
+                data: input.data,
+                parent_id,
+                root_id,
+                root_data,
+                scope_id: null
+            });
+            if (!verdict.allow) {
+                throw jsonrpc_errors.forbidden('cell creation is not permitted here', {
+                    reason: ERROR_CELL_CREATE_FORBIDDEN
+                });
+            }
+            // Moderation is a *contribution* concept — only stamp it for a create
+            // with a parent. A root / unparented create stays `moderation = null`
+            // at the author's visibility even under a mounted authorizer (there is
+            // no container to be moderated under).
+            if (parent_id !== null) {
+                if (verdict.moderation_required) {
+                    // Born pending: stays private until `cell_moderate` approves it.
+                    moderation = 'pending';
+                    visibility = 'private';
+                }
+                else {
+                    // Born approved + live immediately at the author's visibility.
+                    moderation = 'approved';
+                }
+            }
         }
         let row;
         try {
@@ -176,9 +239,12 @@ export const create_cell_actions = (deps) => {
                 // schema-validated runtime shape.
                 data: validated_data,
                 kind,
-                visibility: input.visibility,
+                visibility,
                 path: input.path ?? null,
-                created_by: auth.actor.id,
+                parent_id,
+                root_id,
+                moderation,
+                created_by: auth.actor.id
             });
         }
         catch (err) {
@@ -195,7 +261,7 @@ export const create_cell_actions = (deps) => {
         // bypass the wire schema get the same error shape.
         if (input.id === undefined && input.path === undefined) {
             throw jsonrpc_errors.invalid_params('cell_get requires id or path', {
-                reason: ERROR_CELL_GET_REQUIRES_ID_OR_PATH,
+                reason: ERROR_CELL_GET_REQUIRES_ID_OR_PATH
             });
         }
         const auth = ctx.auth;
@@ -214,11 +280,11 @@ export const create_cell_actions = (deps) => {
         const [grants, fields, items] = await Promise.all([
             auth ? query_cell_grant_list_for_cell(ctx, row.id) : Promise.resolve(null),
             query_cell_field_list_for_source(ctx, row.id, {
-                limit: CELL_RELATIONS_BUNDLE_LIMIT + 1,
+                limit: CELL_RELATIONS_BUNDLE_LIMIT + 1
             }),
             query_cell_item_list_for_parent(ctx, row.id, {
-                limit: CELL_RELATIONS_BUNDLE_LIMIT + 1,
-            }),
+                limit: CELL_RELATIONS_BUNDLE_LIMIT + 1
+            })
         ]);
         // 404 covers both "no such cell" and "exists but caller can't view"
         // — same response code so private-cell existence doesn't leak.
@@ -241,7 +307,7 @@ export const create_cell_actions = (deps) => {
         // id-sets. `*_truncated` still reflects the raw relation size.
         const visible_targets = await filter_visible_target_ids(ctx, auth, [
             ...fields_bundled.map((f) => f.target_id),
-            ...items_bundled.map((i) => i.child_id),
+            ...items_bundled.map((i) => i.child_id)
         ]);
         const fields_visible = fields_bundled.filter((f) => visible_targets.has(f.target_id));
         const items_visible = items_bundled.filter((i) => visible_targets.has(i.child_id));
@@ -252,7 +318,7 @@ export const create_cell_actions = (deps) => {
             items: items_visible.map(to_item_json),
             items_truncated,
             can_edit,
-            can_grant,
+            can_grant
         };
     };
     const update_handler = async (input, ctx) => {
@@ -262,7 +328,7 @@ export const create_cell_actions = (deps) => {
         // can't probe for cell existence by varying `path` shape.
         if (path_provided && !has_role(auth, ROLE_ADMIN)) {
             throw jsonrpc_errors.forbidden('cell.path is admin-only', {
-                reason: ERROR_CELL_PATH_ADMIN_ONLY,
+                reason: ERROR_CELL_PATH_ADMIN_ONLY
             });
         }
         const existing = await query_cell_get(ctx, input.cell_id);
@@ -283,7 +349,7 @@ export const create_cell_actions = (deps) => {
             input.visibility !== existing.visibility &&
             !can_manage_cell(auth, existing)) {
             throw jsonrpc_errors.forbidden('cell.visibility is manage-tier only', {
-                reason: ERROR_CELL_VISIBILITY_MANAGE_ONLY,
+                reason: ERROR_CELL_VISIBILITY_MANAGE_ONLY
             });
         }
         // Per-kind shape validation when `data` is supplied. Patch-only —
@@ -302,7 +368,7 @@ export const create_cell_actions = (deps) => {
                 data: validated_data,
                 visibility: input.visibility,
                 path: path_provided ? (input.path ?? null) : undefined,
-                updated_by: auth.actor.id,
+                updated_by: auth.actor.id
             });
         }
         catch (err) {
@@ -338,6 +404,51 @@ export const create_cell_actions = (deps) => {
         emit_cell_audit(ctx, 'cell_delete', existing, deps, auth);
         return { ok: true, deleted: true };
     };
+    const moderate_handler = async (input, ctx) => {
+        const auth = ctx.auth;
+        const existing = await query_cell_get(ctx, input.cell_id);
+        // 404 covers miss + unviewable so a pending (private) contribution
+        // doesn't leak existence to a non-viewer.
+        if (!existing)
+            throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
+        const grants = await query_cell_grant_list_for_cell(ctx, existing.id);
+        if (!can_view_cell(auth, existing, grants)) {
+            throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
+        }
+        // Only a contribution (with a governing root) is moderatable.
+        if (existing.root_id === null) {
+            throw jsonrpc_errors.invalid_params('cell is not a contribution (no governing root to moderate under)', { reason: ERROR_CELL_NOT_A_CONTRIBUTION });
+        }
+        // Authority is over the governing ROOT (admin / root owner), not the
+        // contribution — the author manages the contribution and could otherwise
+        // self-approve. A viewable-but-unauthorized caller (incl. the author) → 403.
+        const root = await query_cell_get(ctx, existing.root_id);
+        if (!root)
+            throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
+        if (!can_manage_cell(auth, root)) {
+            throw jsonrpc_errors.forbidden('cell_moderate requires moderation authority over the governing root', { reason: ERROR_CELL_MODERATE_FORBIDDEN });
+        }
+        const approved = input.moderation === 'approved';
+        const updated = await query_cell_set_moderation(ctx, input.cell_id, input.moderation, {
+            set_visibility_public: approved,
+            updated_by: auth.actor.id
+        });
+        // Raced with a deleter between the authz check and the UPDATE.
+        if (!updated)
+            throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
+        deps.audit.emit(ctx, {
+            event_type: 'cell_moderate',
+            actor_id: auth.actor.id,
+            account_id: auth.account.id,
+            ip: ctx.client_ip,
+            metadata: {
+                cell_id: updated.id,
+                root_id: existing.root_id,
+                moderation: input.moderation
+            }
+        });
+        return { cell: to_cell_json(updated) };
+    };
     /**
      * Insert one cloned cell row owned by the caller.
      *
@@ -370,7 +481,7 @@ export const create_cell_actions = (deps) => {
             kind: source.kind,
             visibility: source.visibility,
             path: null, // admin-only paths cannot auto-clone
-            created_by: auth.actor.id,
+            created_by: auth.actor.id
         });
     };
     const clone_handler = async (input, ctx) => {
@@ -407,7 +518,7 @@ export const create_cell_actions = (deps) => {
             const child_ids = source_items.map((i) => i.child_id);
             const [child_rows, visible_children] = await Promise.all([
                 query_cell_load_many(ctx, child_ids),
-                filter_visible_target_ids(ctx, auth, child_ids),
+                filter_visible_target_ids(ctx, auth, child_ids)
             ]);
             const child_by_id = new Map(child_rows.map((r) => [r.id, r]));
             for (const item of source_items) {
@@ -427,7 +538,7 @@ export const create_cell_actions = (deps) => {
         // in that single transaction and rolls back together on any
         // failure. No nested `ctx.db.transaction(...)` here.
         const cloned_root = await clone_one_cell_row(ctx, source, auth, {
-            patch_data: input.with_data_patch,
+            patch_data: input.with_data_patch
         });
         // Copy outgoing fields shallowly: the clone points at the same
         // targets the source did (fields are JSON references, not
@@ -448,7 +559,7 @@ export const create_cell_actions = (deps) => {
             await query_cell_field_set(ctx, {
                 source_id: cloned_root.id,
                 name: f.name,
-                target_id: f.target_id,
+                target_id: f.target_id
             });
         }
         if (deep) {
@@ -464,7 +575,7 @@ export const create_cell_actions = (deps) => {
                 await query_cell_item_insert(ctx, {
                     parent_id: cloned_root.id,
                     position: item.position,
-                    child_id: cloned_child.id,
+                    child_id: cloned_child.id
                 });
             }
         }
@@ -487,7 +598,7 @@ export const create_cell_actions = (deps) => {
                 await query_cell_item_insert(ctx, {
                     parent_id: cloned_root.id,
                     position: item.position,
-                    child_id: item.child_id,
+                    child_id: item.child_id
                 });
             }
         }
@@ -507,8 +618,8 @@ export const create_cell_actions = (deps) => {
                 new_id: cloned_root.id,
                 deep,
                 item_count: cloned_child_count,
-                ...(source_kind !== undefined ? { kind: source_kind } : {}),
-            },
+                ...(source_kind !== undefined ? { kind: source_kind } : {})
+            }
         });
         return { cell: to_cell_json(cloned_root) };
     };
@@ -518,14 +629,14 @@ export const create_cell_actions = (deps) => {
         // ("does account X have any public cells?") — require auth to use it.
         if (auth === null && input.created_by !== undefined) {
             throw jsonrpc_errors.invalid_params('cell_list created_by requires authentication', {
-                reason: ERROR_CELL_LIST_CREATED_BY_REQUIRES_AUTH,
+                reason: ERROR_CELL_LIST_CREATED_BY_REQUIRES_AUTH
             });
         }
         // `shared_with: 'me'` resolves to the caller's actor + role_grants;
         // no auth means no caller, no admit path.
         if (auth === null && input.shared_with !== undefined) {
             throw jsonrpc_errors.invalid_params('cell_list shared_with requires authentication', {
-                reason: ERROR_CELL_LIST_SHARED_WITH_REQUIRES_AUTH,
+                reason: ERROR_CELL_LIST_SHARED_WITH_REQUIRES_AUTH
             });
         }
         // Project the active role_grant set into parallel arrays for the
@@ -542,6 +653,8 @@ export const create_cell_actions = (deps) => {
             ref: input.ref,
             created_by: input.created_by,
             path_prefix: input.path_prefix,
+            root_id: input.root_id,
+            moderation: input.moderation,
             viewer_actor_id: caller_actor_id,
             viewer_is_admin: auth ? has_role(auth, ROLE_ADMIN) : false,
             caller_actor_id,
@@ -553,7 +666,7 @@ export const create_cell_actions = (deps) => {
             // Apply the default cap when caller omits `limit`. Without this
             // the SQL `LIMIT NULL` returns every matching row.
             limit: input.limit ?? CELL_LIST_LIMIT_DEFAULT,
-            offset: input.offset,
+            offset: input.offset
         });
         let cell_grants;
         if (input.shared_with === 'me' && rows.length > 0 && caller_actor_id !== null) {
@@ -572,5 +685,6 @@ export const create_cell_actions = (deps) => {
         rpc_action(cell_delete_action_spec, delete_handler),
         rpc_action(cell_list_action_spec, list_handler),
         rpc_action(cell_clone_action_spec, clone_handler),
+        rpc_action(cell_moderate_action_spec, moderate_handler)
     ];
 };

package/dist/auth/cell_audit_action_specs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_audit_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_audit_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAMtB;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;kBAO7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,2EAA2E;AAC3E,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD,eAAO,MAAM,kBAAkB;;;kBAG7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;kBAE9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWH,CAAC;AAEtC,+DAA+D;AAC/D,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAAyC,CAAC"}
+{"version":3,"file":"cell_audit_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_audit_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;kBAO7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,2EAA2E;AAC3E,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD,eAAO,MAAM,kBAAkB;;;kBAG7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;kBAE9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWH,CAAC;AAEtC,+DAA+D;AAC/D,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAAyC,CAAC"}

package/dist/auth/cell_audit_action_specs.js

@@ -44,16 +44,16 @@ export const CellAuditEventJson = z.strictObject({
     event_type: z.string(),
     outcome: z.enum(['success', 'failure']),
     actor_id: Uuid.nullable(),
-    created_at: z.string(),
+    created_at: z.string()
 });
 /** Page size for `cell_audit_list`. Single page at MVP; no cursor wire. */
 export const CELL_AUDIT_LIST_DEFAULT_LIMIT = 50;
 export const CellAuditListInput = z.strictObject({
     cell_id: Uuid.meta({ description: 'Cell whose audit trail to fetch.' }),
-    acting: ActingActor,
+    acting: ActingActor
 });
 export const CellAuditListOutput = z.strictObject({
-    events: z.array(CellAuditEventJson),
+    events: z.array(CellAuditEventJson)
 });
 export const cell_audit_list_action_spec = {
     method: 'cell_audit_list',
@@ -64,7 +64,7 @@ export const cell_audit_list_action_spec = {
     input: CellAuditListInput,
     output: CellAuditListOutput,
     async: true,
-    description: 'List the most-recent audit events referencing the cell on any of `cell_id`, `source_id`, `parent_id`, `child_id`, `target_id`, or `new_id` metadata keys. Manage-tier only (admin / owner) — the timeline reveals who touched the cell, so viewers and editors get the IDOR-mask 404. 404 on miss or unauthorized — same shape as `cell_get` so private-cell existence does not leak.',
+    description: 'List the most-recent audit events referencing the cell on any of `cell_id`, `source_id`, `parent_id`, `child_id`, `target_id`, or `new_id` metadata keys. Manage-tier only (admin / owner) — the timeline reveals who touched the cell, so viewers and editors get the IDOR-mask 404. 404 on miss or unauthorized — same shape as `cell_get` so private-cell existence does not leak.'
 };
 /** Registry export to compose into `all_cell_action_specs`. */
 export const all_cell_audit_action_specs = [cell_audit_list_action_spec];

package/dist/auth/cell_audit_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_audit_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_audit_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAsC,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAgC7F,eAAO,MAAM,yBAAyB,QAAO,KAAK,CAAC,SAAS,CA0B3D,CAAC"}
+{"version":3,"file":"cell_audit_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_audit_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAuC,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAgC/F,eAAO,MAAM,yBAAyB,QAAO,KAAK,CAAC,SAAS,CA0B3D,CAAC"}

package/dist/auth/cell_audit_actions.js

@@ -15,7 +15,7 @@
  */
 import { rpc_action } from '../actions/action_rpc.js';
 import { jsonrpc_errors } from '../http/jsonrpc_errors.js';
-import { cell_audit_list_action_spec, CELL_AUDIT_LIST_DEFAULT_LIMIT, } from './cell_audit_action_specs.js';
+import { cell_audit_list_action_spec, CELL_AUDIT_LIST_DEFAULT_LIMIT } from './cell_audit_action_specs.js';
 import { ERROR_CELL_NOT_FOUND } from './cell_action_specs.js';
 import { query_cell_get } from '../db/cell_queries.js';
 import { query_audit_log_list_by_cell } from '../db/cell_audit_queries.js';
@@ -32,7 +32,7 @@ const to_cell_audit_event_json = (row) => ({
     event_type: row.event_type,
     outcome: row.outcome,
     actor_id: row.actor_id,
-    created_at: typeof row.created_at === 'string' ? row.created_at : row.created_at.toISOString(),
+    created_at: typeof row.created_at === 'string' ? row.created_at : row.created_at.toISOString()
 });
 export const create_cell_audit_actions = () => {
     const handler = async (input, ctx) => {
@@ -51,7 +51,7 @@ export const create_cell_audit_actions = () => {
             throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
         }
         const rows = await query_audit_log_list_by_cell(ctx, cell.id, {
-            limit: CELL_AUDIT_LIST_DEFAULT_LIMIT,
+            limit: CELL_AUDIT_LIST_DEFAULT_LIMIT
         });
         return { events: rows.map(to_cell_audit_event_json) };
     };

package/dist/auth/cell_audit_events.d.ts

@@ -20,7 +20,7 @@ import type { z } from 'zod';
 /**
  * Cell-layer `event_type → metadata schema` map for `extra_events`.
  *
- * Covers the six generic cell verbs' mutation events plus the grant /
+ * Covers the seven generic cell verbs' mutation events plus the grant /
  * field / item relation events. Read-only verbs (`cell_get`, `cell_list`,
  * `cell_*_list`, `cell_audit_list`) emit nothing and are absent here.
  */

package/dist/auth/cell_audit_events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_audit_events.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_audit_events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAiB3B;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAYjE,CAAC"}
+{"version":3,"file":"cell_audit_events.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_audit_events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAqB7B;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAajE,CAAC"}

package/dist/auth/cell_audit_events.js

@@ -16,14 +16,14 @@
  *
  * @module
  */
-import { CellAuditMetadata, CellCloneAuditMetadata } from './cell_audit_metadata.js';
-import { CellGrantCreateAuditMetadata, CellGrantRevokeAuditMetadata, } from './cell_grant_audit_metadata.js';
-import { CellFieldSetAuditMetadata, CellFieldDeleteAuditMetadata, } from './cell_field_audit_metadata.js';
-import { CellItemInsertAuditMetadata, CellItemMoveAuditMetadata, CellItemDeleteAuditMetadata, } from './cell_item_audit_metadata.js';
+import { CellAuditMetadata, CellCloneAuditMetadata, CellModerateAuditMetadata } from './cell_audit_metadata.js';
+import { CellGrantCreateAuditMetadata, CellGrantRevokeAuditMetadata } from './cell_grant_audit_metadata.js';
+import { CellFieldSetAuditMetadata, CellFieldDeleteAuditMetadata } from './cell_field_audit_metadata.js';
+import { CellItemInsertAuditMetadata, CellItemMoveAuditMetadata, CellItemDeleteAuditMetadata } from './cell_item_audit_metadata.js';
 /**
  * Cell-layer `event_type → metadata schema` map for `extra_events`.
  *
- * Covers the six generic cell verbs' mutation events plus the grant /
+ * Covers the seven generic cell verbs' mutation events plus the grant /
  * field / item relation events. Read-only verbs (`cell_get`, `cell_list`,
  * `cell_*_list`, `cell_audit_list`) emit nothing and are absent here.
  */
@@ -32,11 +32,12 @@ export const cell_audit_events = {
     cell_update: CellAuditMetadata,
     cell_delete: CellAuditMetadata,
     cell_clone: CellCloneAuditMetadata,
+    cell_moderate: CellModerateAuditMetadata,
     cell_grant_create: CellGrantCreateAuditMetadata,
     cell_grant_revoke: CellGrantRevokeAuditMetadata,
     cell_field_set: CellFieldSetAuditMetadata,
     cell_field_delete: CellFieldDeleteAuditMetadata,
     cell_item_insert: CellItemInsertAuditMetadata,
     cell_item_move: CellItemMoveAuditMetadata,
-    cell_item_delete: CellItemDeleteAuditMetadata,
+    cell_item_delete: CellItemDeleteAuditMetadata
 };

package/dist/auth/cell_audit_metadata.d.ts

@@ -45,4 +45,19 @@ export declare const CellCloneAuditMetadata: z.ZodObject<{
     kind: z.ZodOptional<z.ZodString>;
 }, z.core.$loose>;
 export type CellCloneAuditMetadata = z.infer<typeof CellCloneAuditMetadata>;
+/**
+ * Metadata envelope for `cell_moderate`. `cell_id` is the moderated
+ * contribution; `root_id` is its governing root (the container whose
+ * moderation authority gated the call); `moderation` is the terminal decision
+ * applied (`'approved'` | `'rejected'`).
+ */
+export declare const CellModerateAuditMetadata: z.ZodObject<{
+    cell_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
+    root_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
+    moderation: z.ZodEnum<{
+        rejected: "rejected";
+        approved: "approved";
+    }>;
+}, z.core.$loose>;
+export type CellModerateAuditMetadata = z.infer<typeof CellModerateAuditMetadata>;
 //# sourceMappingURL=cell_audit_metadata.d.ts.map

package/dist/auth/cell_audit_metadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_audit_metadata.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_audit_metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAGtB;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB;;;;;;iBAMjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}
+{"version":3,"file":"cell_audit_metadata.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_audit_metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB;;;;;;iBAMjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}

package/dist/auth/cell_audit_metadata.js

@@ -21,7 +21,7 @@ import { Uuid } from '@fuzdev/fuz_util/id.ts';
 export const CellAuditMetadata = z.looseObject({
     cell_id: Uuid,
     kind: z.string().optional(),
-    path: z.string().nullable().optional(),
+    path: z.string().nullable().optional()
 });
 /**
  * Metadata envelope for `cell_clone`.
@@ -42,5 +42,16 @@ export const CellCloneAuditMetadata = z.looseObject({
     new_id: Uuid,
     deep: z.boolean(),
     item_count: z.number().int().nonnegative(),
-    kind: z.string().optional(),
+    kind: z.string().optional()
+});
+/**
+ * Metadata envelope for `cell_moderate`. `cell_id` is the moderated
+ * contribution; `root_id` is its governing root (the container whose
+ * moderation authority gated the call); `moderation` is the terminal decision
+ * applied (`'approved'` | `'rejected'`).
+ */
+export const CellModerateAuditMetadata = z.looseObject({
+    cell_id: Uuid,
+    root_id: Uuid,
+    moderation: z.enum(['approved', 'rejected'])
 });

package/dist/auth/cell_authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_authorize.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAW,KAAK,cAAc,EAAC,MAAM,sBAAsB,CAAC;AAInE,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,6BAA6B,CAAC;AA+D9D;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,aAAa,GACzB,MAAM,cAAc,GAAG,IAAI,EAC3B,MAAM,OAAO,EACb,QAAQ,aAAa,CAAC,YAAY,CAAC,GAAG,IAAI,KACxC,OAMF,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,aAAa,GACzB,MAAM,cAAc,GAAG,IAAI,EAC3B,MAAM,OAAO,EACb,QAAQ,aAAa,CAAC,YAAY,CAAC,GAAG,IAAI,KACxC,OAUF,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,eAAe,GAAI,MAAM,cAAc,GAAG,IAAI,EAAE,MAAM,OAAO,KAAG,OAI5E,CAAC"}
+{"version":3,"file":"cell_authorize.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_authorize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAY,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAIrE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AA+DhE;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,aAAa,GACzB,MAAM,cAAc,GAAG,IAAI,EAC3B,MAAM,OAAO,EACb,QAAQ,aAAa,CAAC,YAAY,CAAC,GAAG,IAAI,KACxC,OAMF,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,aAAa,GACzB,MAAM,cAAc,GAAG,IAAI,EAC3B,MAAM,OAAO,EACb,QAAQ,aAAa,CAAC,YAAY,CAAC,GAAG,IAAI,KACxC,OAUF,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,eAAe,GAAI,MAAM,cAAc,GAAG,IAAI,EAAE,MAAM,OAAO,KAAG,OAI5E,CAAC"}

package/dist/auth/cell_data_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_data_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_data_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB;;;;;GAKG;AACH,eAAO,MAAM,QAAQ;;;iBAGnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC"}
+{"version":3,"file":"cell_data_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_data_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;GAKG;AACH,eAAO,MAAM,QAAQ;;;iBAGnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC"}

package/dist/auth/cell_data_schema.js

@@ -36,5 +36,5 @@ import { z } from 'zod';
  */
 export const CellData = z.looseObject({
     label: z.string().optional(),
-    summary: z.string().optional(),
+    summary: z.string().optional()
 });

package/dist/auth/cell_field_action_specs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_field_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_field_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAQtB,gFAAgF;AAChF,eAAO,MAAM,+CAA+C,EAC3D,2CAAoD,CAAC;AAItD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,QAA2B,CAAC;AAC9D,eAAO,MAAM,aAAa,yDAAiE,CAAC;AAC5F,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,2EAA2E;AAC3E,eAAO,MAAM,SAAS;;;;;kBAKpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAIlD;;;GAGG;AACH,eAAO,MAAM,iBAAiB;;;;;kBAO5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,kBAAkB;;;;;;;kBAAqC,CAAC;AACrE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAIpE;;;GAGG;AACH,eAAO,MAAM,oBAAoB;;;;kBAI/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,eAAO,MAAM,qBAAqB;;;kBAGhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB;;;;;;kBAoB5B,CAAC;AACJ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,eAAO,MAAM,mBAAmB;;;;;;;kBAE9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAItE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAEtC,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;CAWL,CAAC;AAEtC,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYH,CAAC;AAEtC,2EAA2E;AAC3E,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI9B,CAAC"}
+{"version":3,"file":"cell_field_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_field_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,gFAAgF;AAChF,eAAO,MAAM,+CAA+C,EAC3D,2CAAoD,CAAC;AAItD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,QAA2B,CAAC;AAC9D,eAAO,MAAM,aAAa,yDAAiE,CAAC;AAC5F,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,2EAA2E;AAC3E,eAAO,MAAM,SAAS;;;;;kBAKpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAIlD;;;GAGG;AACH,eAAO,MAAM,iBAAiB;;;;;kBAO5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,kBAAkB;;;;;;;kBAAuC,CAAC;AACvE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAIpE;;;GAGG;AACH,eAAO,MAAM,oBAAoB;;;;kBAI/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,eAAO,MAAM,qBAAqB;;;kBAGhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB;;;;;;kBAoB5B,CAAC;AACJ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,eAAO,MAAM,mBAAmB;;;;;;;kBAE9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAItE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;CAWF,CAAC;AAEtC,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;CAWL,CAAC;AAEtC,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYH,CAAC;AAEtC,2EAA2E;AAC3E,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI9B,CAAC"}