@fuzdev/fuz_app 0.103.0 → 0.105.0

package/dist/auth/account_route_schema.js

@@ -15,46 +15,46 @@ import { z } from 'zod';
 import { ActorSummaryJson, RoleGrantSummaryJson, SessionAccountJson } from './account_schema.js';
 import { UsernameProvided } from '../primitive_schemas.js';
 import { Password, PasswordProvided } from './password.js';
-import { ERROR_AUTHENTICATION_REQUIRED, ERROR_INVALID_CREDENTIALS, ERROR_INVALID_JSON_BODY, ERROR_INVALID_REQUEST_BODY, } from '../http/error_schemas.js';
+import { ERROR_AUTHENTICATION_REQUIRED, ERROR_INVALID_CREDENTIALS, ERROR_INVALID_JSON_BODY, ERROR_INVALID_REQUEST_BODY } from '../http/error_schemas.js';
 /** Input for `GET /api/account/status`. No parameters — caller is the subject. */
 export const AccountStatusInput = z.null();
 /** Output for `GET /api/account/status`. */
 export const AccountStatusOutput = z.strictObject({
     account: SessionAccountJson,
     actor: ActorSummaryJson.nullable(),
-    role_grants: z.array(RoleGrantSummaryJson),
+    role_grants: z.array(RoleGrantSummaryJson)
 });
 /** Error body for `GET /api/account/status` on the unauthenticated path. */
 export const AccountStatusUnauthenticatedError = z.looseObject({
     error: z.literal(ERROR_AUTHENTICATION_REQUIRED),
-    bootstrap_available: z.boolean().optional(),
+    bootstrap_available: z.boolean().optional()
 });
 /** Input for `POST /login`. Accepts a username or email in the `username` field. */
 export const LoginInput = z.strictObject({
     username: UsernameProvided,
-    password: PasswordProvided,
+    password: PasswordProvided
 });
 /** Output for `POST /login`. Session cookie is the operative side effect. */
 export const LoginOutput = z.strictObject({
-    ok: z.literal(true),
+    ok: z.literal(true)
 });
 /** Input for `POST /logout`. Session identity flows through the cookie. */
 export const LogoutInput = z.null();
 /** Output for `POST /logout`. Includes the revoked account's username for UI redraw. */
 export const LogoutOutput = z.strictObject({
     ok: z.literal(true),
-    username: z.string(),
+    username: z.string()
 });
 /** Input for `POST /password`. `current_password` is minimally validated; `new_password` enforces the full policy. */
 export const PasswordChangeInput = z.strictObject({
     current_password: PasswordProvided,
-    new_password: Password,
+    new_password: Password
 });
 /** Output for `POST /password`. Counts are returned so the UI can summarize the revoke-all cascade. */
 export const PasswordChangeOutput = z.strictObject({
     ok: z.literal(true),
     sessions_revoked: z.number(),
-    tokens_revoked: z.number(),
+    tokens_revoked: z.number()
 });
 /** Default maximum sessions per account. */
 export const DEFAULT_MAX_SESSIONS = 5;
@@ -80,8 +80,8 @@ export const account_status_route_shape = {
     input: AccountStatusInput,
     output: AccountStatusOutput,
     errors: {
-        401: AccountStatusUnauthenticatedError,
-    },
+        401: AccountStatusUnauthenticatedError
+    }
 };
 /**
  * The four account route shapes (`/verify`, `/login`, `/logout`, `/password`)
@@ -100,7 +100,7 @@ export const create_account_route_shapes = (options) => [
         auth: { account: 'required', actor: 'none' },
         description: 'Session-validity probe for nginx auth_request (empty body, 200 or 401)',
         input: z.null(),
-        output: z.null(),
+        output: z.null()
     },
     {
         method: 'POST',
@@ -112,10 +112,10 @@ export const create_account_route_shapes = (options) => [
         rate_limit: 'both',
         errors: {
             400: z.looseObject({
-                error: z.enum([ERROR_INVALID_JSON_BODY, ERROR_INVALID_REQUEST_BODY]),
+                error: z.enum([ERROR_INVALID_JSON_BODY, ERROR_INVALID_REQUEST_BODY])
             }),
-            401: z.looseObject({ error: z.literal(ERROR_INVALID_CREDENTIALS) }),
-        },
+            401: z.looseObject({ error: z.literal(ERROR_INVALID_CREDENTIALS) })
+        }
     },
     {
         method: 'POST',
@@ -127,7 +127,7 @@ export const create_account_route_shapes = (options) => [
         auth: { account: 'required', actor: 'none', credential_types: ['session'] },
         description: 'Revoke current session and clear cookie',
         input: LogoutInput,
-        output: LogoutOutput,
+        output: LogoutOutput
     },
     {
         method: 'POST',
@@ -140,8 +140,8 @@ export const create_account_route_shapes = (options) => [
         rate_limit: options.login_account_rate_limited ? 'both' : 'ip',
         errors: {
             400: z.looseObject({
-                error: z.enum([ERROR_INVALID_JSON_BODY, ERROR_INVALID_REQUEST_BODY]),
-            }),
-        },
-    },
+                error: z.enum([ERROR_INVALID_JSON_BODY, ERROR_INVALID_REQUEST_BODY])
+            })
+        }
+    }
 ];

package/dist/auth/account_routes.d.ts

@@ -103,8 +103,8 @@ export interface AccountRouteOptions extends AuthSessionRouteOptions {
      * eagerly close affected WebSocket sockets for the account BEFORE
      * emitting the corresponding audit event. Mirrors the self-service
      * action surface (see `AccountActionOptions.connection_closer`). When
-     * absent, only the listener-based close (`transports_ws_auth_guard` on
-     * `audit.on_event_chain`) runs.
+     * absent, only the listener-based close (`transports_ws_auth_guard`
+     * registered via `audit.add_listener`) runs.
      */
     connection_closer?: ConnectionCloser | null;
     /**

package/dist/auth/account_routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,qBAAqB,CAAC;AA4BxD,OAAO,EAAkB,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAA+B,KAAK,WAAW,EAAC,MAAM,oBAAoB,CAAC;AAClF,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAChD,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,iCAAiC,CAAC;AAGtE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC,GAAI,UAAU,oBAAoB,KAAG,SA4EhF,CAAC;AAEH,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACpC,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,gBAAgB,CAAC,EAAE;QAAC,SAAS,EAAE,OAAO,CAAA;KAAC,CAAC;CACxC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAQ/C;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACvC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kFAAkF;IAClF,eAAe,EAAE,WAAW,GAAG,IAAI,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,uBAAuB;IACnE,4FAA4F;IAC5F,0BAA0B,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,2FAA2F;IAC3F,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC5C;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE;QAAC,SAAS,EAAE,OAAO,CAAA;KAAC,CAAC;CACxC;AAID;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,gBAAgB,EACtB,SAAS,mBAAmB,KAC1B,KAAK,CAAC,SAAS,CAwRjB,CAAC"}
+{"version":3,"file":"account_routes.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA4B1D,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAExE,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAGxE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC,GAAI,UAAU,oBAAoB,KAAG,SA4EhF,CAAC;AAEH,iDAAiD;AACjD,MAAM,WAAW,oBAAoB;IACpC,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,gBAAgB,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;CAC1C;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAQ/C;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACvC,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,kFAAkF;IAClF,eAAe,EAAE,WAAW,GAAG,IAAI,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,uBAAuB;IACnE,4FAA4F;IAC5F,0BAA0B,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,2FAA2F;IAC3F,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC5C;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;CAC1C;AAID;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,gBAAgB,EACtB,SAAS,mBAAmB,KAC1B,KAAK,CAAC,SAAS,CAwRjB,CAAC"}

package/dist/auth/account_routes.js

@@ -23,11 +23,11 @@
  */
 import { clear_session_cookie, create_session_and_set_cookie } from './session_middleware.js';
 import { RoleGrantSummaryJson, to_session_account } from './account_schema.js';
-import { account_status_route_shape, create_account_route_shapes, DEFAULT_MAX_SESSIONS, } from './account_route_schema.js';
-import { hash_session_token, query_session_revoke_all_for_account, query_session_revoke_by_hash_unscoped, } from './session_queries.js';
-import { query_account_by_username_or_email, query_update_account_password, } from './account_queries.js';
+import { account_status_route_shape, create_account_route_shapes, DEFAULT_MAX_SESSIONS } from './account_route_schema.js';
+import { hash_session_token, query_session_revoke_all_for_account, query_session_revoke_by_hash_unscoped } from './session_queries.js';
+import { query_account_by_username_or_email, query_update_account_password } from './account_queries.js';
 import { query_revoke_all_api_tokens_for_account } from './api_token_queries.js';
-import { build_account_context, build_request_context, get_request_context, require_request_context, resolve_acting_actor, } from './request_context.js';
+import { build_account_context, build_request_context, get_request_context, require_request_context, resolve_acting_actor } from './request_context.js';
 import { ACCOUNT_ID_KEY, CREDENTIAL_TYPE_KEY } from '../hono_context.js';
 import { get_route_input } from '../http/route_spec.js';
 import { get_client_ip } from '../http/client_ip.js';
@@ -54,7 +54,7 @@ export const create_account_status_route_spec = (options) => ({
         if (!account_id) {
             return c.json({
                 error: ERROR_AUTHENTICATION_REQUIRED,
-                ...(options?.bootstrap_status?.available ? { bootstrap_available: true } : {}),
+                ...(options?.bootstrap_status?.available ? { bootstrap_available: true } : {})
             }, 401);
         }
         // Honor a pre-populated request context. The dispatcher's authorization
@@ -70,12 +70,12 @@ export const create_account_status_route_spec = (options) => ({
                 scope_id: p.scope_id,
                 created_at: p.created_at,
                 expires_at: p.expires_at,
-                granted_by: p.granted_by,
+                granted_by: p.granted_by
             }));
             return c.json({
                 account: to_session_account(existing.account),
                 actor: existing.actor ? { id: existing.actor.id, name: existing.actor.name } : null,
-                role_grants,
+                role_grants
             });
         }
         // Resolve actor + role_grants when the caller is unambiguous (single-actor
@@ -94,12 +94,12 @@ export const create_account_status_route_spec = (options) => ({
                     scope_id: p.scope_id,
                     created_at: p.created_at,
                     expires_at: p.expires_at,
-                    granted_by: p.granted_by,
+                    granted_by: p.granted_by
                 }));
                 return c.json({
                     account: to_session_account(ctx.account),
                     actor: { id: ctx.actor.id, name: ctx.actor.name },
-                    role_grants,
+                    role_grants
                 });
             }
         }
@@ -107,15 +107,15 @@ export const create_account_status_route_spec = (options) => ({
         if (!account_ctx) {
             return c.json({
                 error: ERROR_AUTHENTICATION_REQUIRED,
-                ...(options?.bootstrap_status?.available ? { bootstrap_available: true } : {}),
+                ...(options?.bootstrap_status?.available ? { bootstrap_available: true } : {})
             }, 401);
         }
         return c.json({
             account: to_session_account(account_ctx.account),
             actor: null,
-            role_grants: [],
+            role_grants: []
         });
-    },
+    }
 });
 /**
  * Default minimum wall-clock time (ms) for a login failure (401) response.
@@ -160,9 +160,9 @@ const login_fail_delay = (floor_ms, jitter_ms) => {
  */
 export const create_account_route_specs = (deps, options) => {
     const { keyring, password } = deps;
-    const { session_options, ip_rate_limiter, login_account_rate_limiter, max_sessions = DEFAULT_MAX_SESSIONS, login_fail_floor_ms = DEFAULT_LOGIN_FAIL_FLOOR_MS, login_fail_jitter_ms = DEFAULT_LOGIN_FAIL_JITTER_MS, connection_closer = null, bootstrap_status, } = options;
+    const { session_options, ip_rate_limiter, login_account_rate_limiter, max_sessions = DEFAULT_MAX_SESSIONS, login_fail_floor_ms = DEFAULT_LOGIN_FAIL_FLOOR_MS, login_fail_jitter_ms = DEFAULT_LOGIN_FAIL_JITTER_MS, connection_closer = null, bootstrap_status } = options;
     const [verify_shape, login_shape, logout_shape, password_shape] = create_account_route_shapes({
-        login_account_rate_limited: login_account_rate_limiter !== null,
+        login_account_rate_limited: login_account_rate_limiter !== null
     });
     return [
         // `/status` is bundled into the account family (relative path, prefixed
@@ -175,7 +175,7 @@ export const create_account_route_specs = (deps, options) => {
             handler: (c) => {
                 require_request_context(c);
                 return c.body(null, 200);
-            },
+            }
         },
         {
             ...login_shape,
@@ -222,7 +222,7 @@ export const create_account_route_specs = (deps, options) => {
                         event_type: 'login',
                         outcome: 'failure',
                         ip: get_client_ip(c),
-                        metadata: { username },
+                        metadata: { username }
                     });
                     await delay;
                     return c.json({ error: ERROR_INVALID_CREDENTIALS }, 401);
@@ -238,7 +238,7 @@ export const create_account_route_specs = (deps, options) => {
                         outcome: 'failure',
                         account_id: account.id,
                         ip: get_client_ip(c),
-                        metadata: { username },
+                        metadata: { username }
                     });
                     await delay;
                     return c.json({ error: ERROR_INVALID_CREDENTIALS }, 401);
@@ -254,15 +254,15 @@ export const create_account_route_specs = (deps, options) => {
                     c,
                     account_id: account.id,
                     session_options,
-                    max_sessions,
+                    max_sessions
                 });
                 deps.audit.emit(route, {
                     event_type: 'login',
                     account_id: account.id,
-                    ip: get_client_ip(c),
+                    ip: get_client_ip(c)
                 });
                 return c.json({ ok: true });
-            },
+            }
         },
         {
             ...logout_shape,
@@ -296,10 +296,10 @@ export const create_account_route_specs = (deps, options) => {
                 deps.audit.emit(route, {
                     event_type: 'logout',
                     account_id: ctx.account.id,
-                    ip: get_client_ip(c),
+                    ip: get_client_ip(c)
                 });
                 return c.json({ ok: true, username: ctx.account.username });
-            },
+            }
         },
         {
             ...password_shape,
@@ -334,7 +334,7 @@ export const create_account_route_specs = (deps, options) => {
                         outcome: 'failure',
                         account_id: ctx.account.id,
                         ip: get_client_ip(c),
-                        metadata: { credential_type },
+                        metadata: { credential_type }
                     });
                     return c.json({ error: ERROR_INVALID_CREDENTIALS }, 401);
                 }
@@ -379,7 +379,7 @@ export const create_account_route_specs = (deps, options) => {
                         outcome: 'failure',
                         account_id: ctx.account.id,
                         ip: get_client_ip(c),
-                        metadata: { reason: 'concurrent_change', credential_type },
+                        metadata: { reason: 'concurrent_change', credential_type }
                     });
                     return c.json({ error: ERROR_INVALID_CREDENTIALS }, 401);
                 }
@@ -411,10 +411,10 @@ export const create_account_route_specs = (deps, options) => {
                     event_type: 'password_change',
                     account_id: ctx.account.id,
                     ip: get_client_ip(c),
-                    metadata: { sessions_revoked, tokens_revoked, credential_type },
+                    metadata: { sessions_revoked, tokens_revoked, credential_type }
                 });
                 return c.json({ ok: true, sessions_revoked, tokens_revoked });
-            },
-        },
+            }
+        }
     ];
 };

package/dist/auth/account_schema.d.ts

@@ -101,9 +101,20 @@ export declare const is_role_grant_active: (p: {
     revoked_at?: string | null;
     expires_at: string | null;
 }, now?: Date) => boolean;
+/**
+ * A session's storage key — the blake3 hash of its raw token, branded so a
+ * bare `string` can't stand in for one. `Blake3Hash` (`hash_schemas.ts`) is
+ * the shape; this is the meaning. Mint only via `hash_session_token`, or
+ * `SessionId.parse` at an external boundary.
+ *
+ * The raw token itself is never typed — it stays a `string` that exists only
+ * long enough to be hashed.
+ */
+export declare const SessionId: z.core.$ZodBranded<z.ZodString, "SessionId", "out">;
+export type SessionId = z.infer<typeof SessionId>;
 /** Server-side auth session, keyed by blake3 hash of session token. */
 export interface AuthSession {
-    id: string;
+    id: SessionId;
     account_id: Uuid;
     created_at: string;
     expires_at: string;
@@ -131,7 +142,7 @@ export declare const SessionAccountJson: z.ZodObject<{
 export type SessionAccountJson = z.infer<typeof SessionAccountJson>;
 /** Zod schema for `AuthSession` — id is the blake3 hash, safe for client. */
 export declare const AuthSessionJson: z.ZodObject<{
-    id: z.ZodString;
+    id: z.core.$ZodBranded<z.ZodString, "SessionId", "out">;
     account_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
     created_at: z.ZodString;
     expires_at: z.ZodString;

package/dist/auth/account_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AACtB,OAAO,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAE5C,OAAO,EAAC,QAAQ,EAAE,KAAK,EAAC,MAAM,yBAAyB,CAAC;AAIxD,mEAAmE;AACnE,MAAM,WAAW,OAAO;IACvB,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB;;;;OAIG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;OAKG;IACH,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,wFAAwF;AACxF,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,cAAc,EAAE,OAAO,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,4FAA4F;AAC5F,MAAM,WAAW,KAAK;IACrB,EAAE,EAAE,IAAI,CAAC;IACT,UAAU,EAAE,IAAI,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,8EAA8E;IAC9E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sEAAsE;IACtE,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,MAAM,CAAC;AAExD,wEAAwE;AACxE,MAAM,WAAW,SAAS;IACzB,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,IAAI,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,iGAAiG;IACjG,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,sHAAsH;IACtH,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,mGAAmG;IACnG,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;CAC7B;AAED,eAAO,MAAM,oBAAoB,GAChC,GAAG;IAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAC,EAC1D,MAAK,IAAiB,KACpB,OAA2E,CAAC;AAE/E,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACrB;AAED,6CAA6C;AAC7C,MAAM,WAAW,QAAQ;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,IAAI,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;CACnB;AAID,0EAA0E;AAC1E,eAAO,MAAM,kBAAkB;;;;;;kBAM7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,6EAA6E;AAC7E,eAAO,MAAM,eAAe;;;;;;kBAM1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB;;;;;;;;kBAQ7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,gFAAgF;AAChF,eAAO,MAAM,oBAAoB;;;;;;;;kBAQ/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB;;;kBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,iGAAiG;AACjG,eAAO,MAAM,gBAAgB;;;;;;;;;kBAU3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;kBASlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E,sGAAsG;AACtG,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAKhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E,MAAM,WAAW,kBAAkB;IAClC,QAAQ,EAAE,QAAQ,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,EAAE,IAAI,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,0GAA0G;IAC1G,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,OAAO,KAAG,cAMpD,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAAI,SAAS,OAAO,KAAG,gBAKlD,CAAC"}
+{"version":3,"file":"account_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAG9C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAI1D,mEAAmE;AACnE,MAAM,WAAW,OAAO;IACvB,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB;;;;OAIG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;OAKG;IACH,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,wFAAwF;AACxF,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,cAAc,EAAE,OAAO,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,4FAA4F;AAC5F,MAAM,WAAW,KAAK;IACrB,EAAE,EAAE,IAAI,CAAC;IACT,UAAU,EAAE,IAAI,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,8EAA8E;IAC9E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sEAAsE;IACtE,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED;;;;;GAKG;AACH,eAAO,MAAM,oCAAoC,MAAM,CAAC;AAExD,wEAAwE;AACxE,MAAM,WAAW,SAAS;IACzB,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,IAAI,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,iGAAiG;IACjG,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,sHAAsH;IACtH,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,mGAAmG;IACnG,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;CAC7B;AAED,eAAO,MAAM,oBAAoB,GAChC,GAAG;IAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAC5D,MAAK,IAAiB,KACpB,OAA2E,CAAC;AAE/E;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,qDAAgC,CAAC;AACvD,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAElD,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,SAAS,CAAC;IACd,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACrB;AAED,6CAA6C;AAC7C,MAAM,WAAW,QAAQ;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,IAAI,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;CACnB;AAID,0EAA0E;AAC1E,eAAO,MAAM,kBAAkB;;;;;;kBAM7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,6EAA6E;AAC7E,eAAO,MAAM,eAAe;;;;;;kBAM1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB;;;;;;;;kBAQ7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,gFAAgF;AAChF,eAAO,MAAM,oBAAoB;;;;;;;;kBAQ/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB;;;kBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,iGAAiG;AACjG,eAAO,MAAM,gBAAgB;;;;;;;;;kBAU3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;kBASlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E,sGAAsG;AACtG,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAKhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAI1E,MAAM,WAAW,kBAAkB;IAClC,QAAQ,EAAE,QAAQ,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,EAAE,IAAI,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,0GAA0G;IAC1G,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,OAAO,KAAG,cAMpD,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAAI,SAAS,OAAO,KAAG,gBAKlD,CAAC"}

package/dist/auth/account_schema.js

@@ -18,6 +18,7 @@
  */
 import { z } from 'zod';
 import { Uuid } from '@fuzdev/fuz_util/id.ts';
+import { Blake3Hash } from '@fuzdev/fuz_util/hash_schemas.ts';
 import { Username, Email } from '../primitive_schemas.js';
 /**
  * Maximum length of the optional free-form `revoked_reason` attached to a
@@ -27,6 +28,16 @@ import { Username, Email } from '../primitive_schemas.js';
  */
 export const ROLE_GRANT_REVOKED_REASON_LENGTH_MAX = 500;
 export const is_role_grant_active = (p, now = new Date()) => !p.revoked_at && (!p.expires_at || new Date(p.expires_at) > now);
+/**
+ * A session's storage key — the blake3 hash of its raw token, branded so a
+ * bare `string` can't stand in for one. `Blake3Hash` (`hash_schemas.ts`) is
+ * the shape; this is the meaning. Mint only via `hash_session_token`, or
+ * `SessionId.parse` at an external boundary.
+ *
+ * The raw token itself is never typed — it stays a `string` that exists only
+ * long enough to be hashed.
+ */
+export const SessionId = Blake3Hash.brand('SessionId');
 // Client-safe Zod schemas — for route output validation and ActionSpec outputs.
 /** Zod schema for `SessionAccount` — account without sensitive fields. */
 export const SessionAccountJson = z.strictObject({
@@ -34,15 +45,15 @@ export const SessionAccountJson = z.strictObject({
     username: Username,
     email: Email.nullable(),
     email_verified: z.boolean(),
-    created_at: z.string(),
+    created_at: z.string()
 });
 /** Zod schema for `AuthSession` — id is the blake3 hash, safe for client. */
 export const AuthSessionJson = z.strictObject({
-    id: z.string(),
+    id: SessionId,
     account_id: Uuid,
     created_at: z.string(),
     expires_at: z.string(),
-    last_seen_at: z.string(),
+    last_seen_at: z.string()
 });
 /** Zod schema for client-safe API token listing (excludes `token_hash`). */
 export const ClientApiTokenJson = z.strictObject({
@@ -52,7 +63,7 @@ export const ClientApiTokenJson = z.strictObject({
     expires_at: z.string().nullable(),
     last_used_at: z.string().nullable(),
     last_used_ip: z.string().nullable(),
-    created_at: z.string(),
+    created_at: z.string()
 });
 /** Zod schema for the role_grant summary returned in admin account listings. */
 export const RoleGrantSummaryJson = z.strictObject({
@@ -62,12 +73,12 @@ export const RoleGrantSummaryJson = z.strictObject({
     scope_id: Uuid.nullable(),
     created_at: z.string(),
     expires_at: z.string().nullable(),
-    granted_by: Uuid.nullable(),
+    granted_by: Uuid.nullable()
 });
 /** Zod schema for the actor summary returned in admin account listings. */
 export const ActorSummaryJson = z.strictObject({
     id: Uuid,
-    name: z.string(),
+    name: z.string()
 });
 /** Zod schema for admin-facing account data — extends `SessionAccountJson` with audit fields. */
 export const AdminAccountJson = SessionAccountJson.extend({
@@ -79,7 +90,7 @@ export const AdminAccountJson = SessionAccountJson.extend({
      * is requested with `include_deleted`) and offer reactivation via
      * `account_undelete`. Active listings always carry `null` here.
      */
-    deleted_at: z.string().nullable(),
+    deleted_at: z.string().nullable()
 });
 /**
  * Zod schema for a pending role_grant offer surfaced in admin account listings.
@@ -102,14 +113,14 @@ export const PendingOfferSummaryJson = z.strictObject({
     from_actor_id: Uuid,
     from_username: z.string(),
     created_at: z.string(),
-    expires_at: z.string(),
+    expires_at: z.string()
 });
 /** Zod schema for an admin account listing entry (account + actor + role_grants + pending offers). */
 export const AdminAccountEntryJson = z.strictObject({
     account: AdminAccountJson,
     actor: ActorSummaryJson.nullable(),
     role_grants: z.array(RoleGrantSummaryJson),
-    pending_offers: z.array(PendingOfferSummaryJson),
+    pending_offers: z.array(PendingOfferSummaryJson)
 });
 /**
  * Convert an `Account` to a `SessionAccount` by stripping sensitive fields.
@@ -122,7 +133,7 @@ export const to_session_account = (account) => ({
     username: account.username,
     email: account.email,
     email_verified: account.email_verified,
-    created_at: account.created_at,
+    created_at: account.created_at
 });
 /**
  * Convert an `Account` to an `AdminAccountJson` for admin listings.
@@ -134,5 +145,5 @@ export const to_admin_account = (account) => ({
     ...to_session_account(account),
     updated_at: account.updated_at,
     updated_by: account.updated_by,
-    deleted_at: account.deleted_at,
+    deleted_at: account.deleted_at
 });

package/dist/auth/actor_lookup_action_specs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actor_lookup_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/actor_lookup_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAKtB;;;GAGG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC,iEAAiE;AACjE,eAAO,MAAM,oBAAoB;;;;kBAI/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,eAAO,MAAM,gBAAgB;;kBAU3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,eAAO,MAAM,iBAAiB;;;;;;kBAE5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;CAaA,CAAC;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;EAAsC,CAAC"}
+{"version":3,"file":"actor_lookup_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/actor_lookup_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;GAGG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC,iEAAiE;AACjE,eAAO,MAAM,oBAAoB;;;;kBAI/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,eAAO,MAAM,gBAAgB;;kBAU3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,eAAO,MAAM,iBAAiB;;;;;;kBAE5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;CAaA,CAAC;AAEtC;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;EAAsC,CAAC"}

package/dist/auth/actor_lookup_action_specs.js

@@ -58,7 +58,7 @@ export const ACTOR_LOOKUP_IDS_MAX = 50;
 export const ActorLookupEntryJson = z.strictObject({
     id: Uuid,
     username: z.string(),
-    display_name: z.string().optional(),
+    display_name: z.string().optional()
 });
 export const ActorLookupInput = z.strictObject({
     ids: z
@@ -66,11 +66,11 @@ export const ActorLookupInput = z.strictObject({
         .min(1)
         .max(ACTOR_LOOKUP_IDS_MAX)
         .meta({
-        description: `Actor ids to resolve. Capped at ${ACTOR_LOOKUP_IDS_MAX}; unknown ids are silently absent from the response.`,
-    }),
+        description: `Actor ids to resolve. Capped at ${ACTOR_LOOKUP_IDS_MAX}; unknown ids are silently absent from the response.`
+    })
 });
 export const ActorLookupOutput = z.strictObject({
-    actors: z.array(ActorLookupEntryJson),
+    actors: z.array(ActorLookupEntryJson)
 });
 export const actor_lookup_action_spec = {
     method: 'actor_lookup',
@@ -82,7 +82,7 @@ export const actor_lookup_action_spec = {
     output: ActorLookupOutput,
     async: true,
     rate_limit: 'account',
-    description: `Batched id → (username, display_name) resolver, keyed by actor id. Powers the labels arc for surfaces that stamp an actor id (e.g. cell owners, grant grantors). Authenticated + per-account rate-limited to bound batched username enumeration. Cap ${ACTOR_LOOKUP_IDS_MAX}; unknown ids absent from response.`,
+    description: `Batched id → (username, display_name) resolver, keyed by actor id. Powers the labels arc for surfaces that stamp an actor id (e.g. cell owners, grant grantors). Authenticated + per-account rate-limited to bound batched username enumeration. Cap ${ACTOR_LOOKUP_IDS_MAX}; unknown ids absent from response.`
 };
 /**
  * All actor_lookup action specs — independent opt-in registry. Consumers

package/dist/auth/actor_lookup_actions.d.ts

@@ -11,9 +11,11 @@
  *
  * @module
  */
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import { type RpcAction } from '../actions/action_rpc.js';
-import type { RouteFactoryDeps } from './deps.js';
 /** Dependencies for `create_actor_lookup_actions`. */
-export type ActorLookupActionDeps = Pick<RouteFactoryDeps, 'log'>;
+export interface ActorLookupActionDeps {
+    log: Logger;
+}
 export declare const create_actor_lookup_actions: (_deps: ActorLookupActionDeps) => Array<RpcAction>;
 //# sourceMappingURL=actor_lookup_actions.d.ts.map

package/dist/auth/actor_lookup_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actor_lookup_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/actor_lookup_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAiC,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAExF,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAShD,sDAAsD;AACtD,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;AAElE,eAAO,MAAM,2BAA2B,GAAI,OAAO,qBAAqB,KAAG,KAAK,CAAC,SAAS,CAkBzF,CAAC"}
+{"version":3,"file":"actor_lookup_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/actor_lookup_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEtD,OAAO,EAAkC,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAU1F,sDAAsD;AACtD,MAAM,WAAW,qBAAqB;IACrC,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,eAAO,MAAM,2BAA2B,GAAI,OAAO,qBAAqB,KAAG,KAAK,CAAC,SAAS,CAkBzF,CAAC"}

package/dist/auth/actor_lookup_actions.js

@@ -13,7 +13,7 @@
  */
 import { rpc_action } from '../actions/action_rpc.js';
 import { query_actors_by_ids } from './actor_lookup_queries.js';
-import { actor_lookup_action_spec, } from './actor_lookup_action_specs.js';
+import { actor_lookup_action_spec } from './actor_lookup_action_specs.js';
 export const create_actor_lookup_actions = (_deps) => {
     const handler = async (input, ctx) => {
         const rows = await query_actors_by_ids(ctx, input.ids);
@@ -23,9 +23,9 @@ export const create_actor_lookup_actions = (_deps) => {
                 return {
                     id: row.id,
                     username: row.username,
-                    ...(display_name ? { display_name } : {}),
+                    ...(display_name ? { display_name } : {})
                 };
-            }),
+            })
         };
     };
     return [rpc_action(actor_lookup_action_spec, handler)];

package/dist/auth/actor_lookup_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actor_lookup_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/actor_lookup_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAEjD,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,qBAAqB,CAAC;AAEnD,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,KAAK,aAAa,CAAC,IAAI,CAAC,KACtB,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAS/B,CAAC"}
+{"version":3,"file":"actor_lookup_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/actor_lookup_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,KAAK,aAAa,CAAC,IAAI,CAAC,KACtB,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAS/B,CAAC"}

package/dist/auth/actor_search_action_specs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actor_search_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/actor_search_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAMtB;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC,gDAAgD;AAChD,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAAG,6BAAsC,CAAC;AAExF,eAAO,MAAM,gBAAgB;;;;kBAyB3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,eAAO,MAAM,iBAAiB;;;;;;kBAE5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;CAcA,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;EAAsC,CAAC"}
+{"version":3,"file":"actor_search_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/actor_search_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC,gDAAgD;AAChD,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAAG,6BAAsC,CAAC;AAExF,eAAO,MAAM,gBAAgB;;;;kBAyB3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,eAAO,MAAM,iBAAiB;;;;;;kBAE5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;CAcA,CAAC;AAEtC;;;;GAIG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;EAAsC,CAAC"}

package/dist/auth/actor_search_action_specs.js

@@ -100,10 +100,10 @@ export const ActorSearchInput = z.strictObject({
         .min(1)
         .max(ACTOR_SEARCH_QUERY_LENGTH_MAX)
         .meta({
-        description: `Case-insensitive prefix match against \`actor.name\`. Length 1–${ACTOR_SEARCH_QUERY_LENGTH_MAX}.`,
+        description: `Case-insensitive prefix match against \`actor.name\`. Length 1–${ACTOR_SEARCH_QUERY_LENGTH_MAX}.`
     }),
     scope_ids: z.array(Uuid).optional().meta({
-        description: 'Restrict results to actors holding a role_grant on any of these scopes. Required (non-empty) for non-admin callers; admin callers may omit or pass empty for unbounded search. Caller is responsible for pre-filtering against their own authority — the SQL filter does not enforce it.',
+        description: 'Restrict results to actors holding a role_grant on any of these scopes. Required (non-empty) for non-admin callers; admin callers may omit or pass empty for unbounded search. Caller is responsible for pre-filtering against their own authority — the SQL filter does not enforce it.'
     }),
     limit: z
         .number()
@@ -112,11 +112,11 @@ export const ActorSearchInput = z.strictObject({
         .max(ACTOR_SEARCH_LIMIT_MAX)
         .optional()
         .meta({
-        description: `Maximum rows to return. Defaults to ${ACTOR_SEARCH_LIMIT_DEFAULT}, hard cap ${ACTOR_SEARCH_LIMIT_MAX}.`,
-    }),
+        description: `Maximum rows to return. Defaults to ${ACTOR_SEARCH_LIMIT_DEFAULT}, hard cap ${ACTOR_SEARCH_LIMIT_MAX}.`
+    })
 });
 export const ActorSearchOutput = z.strictObject({
-    actors: z.array(ActorLookupEntryJson),
+    actors: z.array(ActorLookupEntryJson)
 });
 export const actor_search_action_spec = {
     method: 'actor_search',
@@ -129,7 +129,7 @@ export const actor_search_action_spec = {
     async: true,
     rate_limit: 'account',
     error_reasons: [ERROR_ACTOR_SEARCH_SCOPE_REQUIRED],
-    description: `Case-insensitive prefix search over actor.name, returning {id, username, display_name?} rows. Authenticated + per-account rate-limited; non-admin callers must pass at least one scope_id. Default limit ${ACTOR_SEARCH_LIMIT_DEFAULT}, hard cap ${ACTOR_SEARCH_LIMIT_MAX}.`,
+    description: `Case-insensitive prefix search over actor.name, returning {id, username, display_name?} rows. Authenticated + per-account rate-limited; non-admin callers must pass at least one scope_id. Default limit ${ACTOR_SEARCH_LIMIT_DEFAULT}, hard cap ${ACTOR_SEARCH_LIMIT_MAX}.`
 };
 /**
  * All actor_search action specs — independent opt-in registry. Like

package/dist/auth/actor_search_actions.d.ts

@@ -23,9 +23,11 @@
  *
  * @module
  */
+import type { Logger } from '@fuzdev/fuz_util/log.ts';
 import { type RpcAction } from '../actions/action_rpc.js';
-import type { RouteFactoryDeps } from './deps.js';
 /** Dependencies for `create_actor_search_actions`. */
-export type ActorSearchActionDeps = Pick<RouteFactoryDeps, 'log'>;
+export interface ActorSearchActionDeps {
+    log: Logger;
+}
 export declare const create_actor_search_actions: (_deps: ActorSearchActionDeps) => Array<RpcAction>;
 //# sourceMappingURL=actor_search_actions.d.ts.map

package/dist/auth/actor_search_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actor_search_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/actor_search_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EAAqC,KAAK,SAAS,EAAC,MAAM,0BAA0B,CAAC;AAE5F,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAahD,sDAAsD;AACtD,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;AAElE,eAAO,MAAM,2BAA2B,GAAI,OAAO,qBAAqB,KAAG,KAAK,CAAC,SAAS,CAiCzF,CAAC"}
+{"version":3,"file":"actor_search_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/actor_search_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGtD,OAAO,EAAsC,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAc9F,sDAAsD;AACtD,MAAM,WAAW,qBAAqB;IACrC,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,eAAO,MAAM,2BAA2B,GAAI,OAAO,qBAAqB,KAAG,KAAK,CAAC,SAAS,CAiCzF,CAAC"}